FOR610A: Introduction to Malware Analysis: Hands-on and Technical

  • Online
12 CPEs

FOR610A: Introduction to Malware Analysis: Hands-on and Technical supercharges your incident response and forensics skills by learning key malware analysis tools and techniques. This practical, hands-on course builds upon your existing network, system and infoSec skills and teach you how to turn Windows and related malware inside out.

What You Will Learn

FOR610A: Introduction to Malware Analysis: Hands-On and Technical supercharges your incident response and forensics skills by teaching you key malware analysis tools and techniques. This practical, hands-on course builds on your existing network, system, and InfoSec skills and shows you how to turn Windows and related malware inside out.

In this course you'll learn how to:

  • Build an isolated, controlled laboratory environment for analyzing malware
  • Use network and system-monitoring tools to examine how malware interacts with the file system, registry, network, and other processes in a Windows environment
  • Examine the most relevant aspects of malicious code dynamically with the help of a debugger
  • Unpack malware to bypass attacker's code defenses
  • Deobfuscate JavaScript to understand attacks that involve malicious scripts
  • Derive Indicators of Compromise (IOCs) from malicious executables to detect the presence of malware in the enterprise

Syllabus (12 CPEs)

  • Overview

    This course section explains how to examine Windows malware in several phases. Static properties analysis will explore meta data and other file attributes to perform triage. Behavioral analysis will focus on the malicious program's interactions with its environment. Code analysis will focus on the specimen's inner workings and make use of debuggers. You will learn how to set up and use a flexible laboratory to perform such an analysis in a controlled manner, becoming familiar with the Windows and Linux (REMnux) Virtual Machines supplied as part of the course. You will then learn how to begin examining malware in your lab, with guidance and explanations from the instructor to reinforce the concepts discussed throughout the day.

    • Assembling a Toolkit for Effective Malware Analysis
    • Examining Static Properties of Suspicious Programs
    • Performing Behavioral Analysis of Malicious Windows Executables
    • Performing Dynamic Code Analysis of Malicious Windows Executables
    • Contributing Insights to the Organization's Larger Incident Response Effort
  • Overview

    This section builds on the approaches to behavioral and code analysis introduced in the first section of the course so that you can start learning how to analyze packed Windows executables and obfuscated JavaScript scripts. You'll experiment with essential techniques for unpacking malware. Though the real-world packer you'll explore in class will be relatively straightforward, the approaches you'll learn will set a foundation for handling even more complex packers. Additionally, you will learn how to examine malicious websites and deobfuscate browser scripts, which can play a pivotal role in malware attacks.

    • Recognizing Packed Malware
    • Unpacking Malware Using a Debugger, Process Dumping Tools, and Imports-Rebuilding Utilities
    • Interacting with Malicious Websites to Examine Their Nature
    • Deobfuscating JavaScript Scripts Using Debuggers and Runtime Interpreters

Laptop Requirements

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

This is common sense, but we will say it anyway: Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS can't responsible for your system or data.


  • CPU: 64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class. Important - Please Read: a 64-bit system processor is mandatory.
  • It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machines will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
  • Note: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VT". Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it before class!
  • 16 GB (Gigabytes) of RAM or higher is mandatory for this class Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.
  • USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. Therefore, a Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.
  • 200 Gigabytes of Free Space on your System Hard Drive. Free Space on Hard Drive is critical to host the VMs we distribute.
  • Local Administrator access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • Wi-Fi 802.11 capability is mandatory. You'll need to connect to an in-class Wi-Fi network when participating in this course at a life event. Without working Wi-Fi, you'll be unable to participating in important aspects of the course.


  • Host Operating System: Your system must be running either Windows 10 Pro, Linux or macOS 10.14 or later that also can install and run VMware virtualization products described below.
  • It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
  • Those who use a Linux host must also be able to access exFAT partitions using the appropriate kernel or FUSE modules.
  • Download and install 7-Zip (for Windows Hosts) or Keka (macOS). Without these extraction tools, you'll be unable to extract large archives we'll supply to you in class.


  • Download and install VMware Workstation 15.5 Pro, VMware Fusion 11.5 Pro or higher versions before class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.
  • You must get the versions of the products that have "Pro" in their name. The free non-Pro versions of these products (e.g., VMware Workstation Player) are not sufficient for this course because they do not support snapshot functionality, which we will need to use.
  • Other virtualization software, such as VirtualBox and Hyper-V, are not appropriate because of compatibility and troubleshooting problems you might encounter during class.
  • VMware Workstation Pro on Windows 10 is not compatible with Windows 10 Credential Guard and Device Guard technologies. Please disable these capabilities for the duration of the class, if they're enabled on your system, by following instructions from VMware.

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

Register for FOR610A

  • In Person

Training events and topical summits feature presentations and courses in classrooms around the world.

Learn more
  • Live Online

Live, interactive sessions with SANS instructors over the course of one or more weeks, at times convenient to students worldwide.

Learn more
  • OnDemand

Study and prepare for GIAC Certification with four months of online access to SANS OnDemand courses. Includes labs and exercises, and SME support.

Learn more