FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

GIAC Reverse Engineering Malware (GREM)
GIAC Reverse Engineering Malware (GREM)
  • In Person (6 days)
  • Online
36 CPEs
Learn to turn malware inside out! This popular course explores malware analysis tools and techniques in depth. FOR610 training has helped forensic investigators, incident responders, security engineers, and IT administrators acquire the practical skills to examine malicious programs that target and infect Windows systems.

What You Will Learn

Learn to turn malware inside out! This popular reversing course explores malware analysis tools and techniques in depth. FOR610 training has helped forensic investigators, incident responders, security engineers, and threat analysts acquire the practical skills to examine malicious programs that target and infect Windows systems.

Understanding the capabilities of malware is critical to your ability to derive threat intelligence, respond to cybersecurity incidents, and fortify enterprise defenses. This course builds a strong foundation for reverse-engineering malicious software using a variety of system and network monitoring utilities, a disassembler, a debugger, and many other freely available tools.

The course begins malware analysis essentials that let you go beyond the findings of automated analysis tools. You will learn how to set up a flexible laboratory to examine the inner workings of malicious software, and how to use the lab to uncover characteristics of real-world malware samples. You will also learn how to redirect and intercept network traffic in the lab to derive additional insights and indicators of compromise. You will also start mastering dynamic code analysis techniques with the help of a debugger.

The course continues by discussing essential assembly language concepts relevant to reverse engineering. You will learn to examine malicious code with the help of a disassembler and a decompiler to understand key capabilities and execution flow. In addition, you will learn to identify common malware characteristics by looking at suspicious Windows API patterns employed by malicious programs.

Next, you will dive the analysis of malicious Microsoft Office, RTF, and PDF document files, which are often used as part of the attack chain in mainstream and targeted attacks. You'll learn how to examine macros and other threats that such documents might pose. The course will also teach you how to deobfuscate malicious scripts in the form of JavaScript and PowerShell scripts. You'll also learn how to examine shellcode.

Malware is often obfuscated to hinder analysis efforts, so the course will equip you with the skills to unpack malicious Windows executables. You will learn how to dump such programs from memory or otherwise bypass the packer's protection with the help of a debugger and additional specialized tools. You will also learn how to examine malware that performs code injection and API hooking to to conceal its presence on the system or interfere with information flow.

FOR610 malware analysis training also teaches how to handle malicious software that attempts to safeguard itself from analysis. You will learn how to recognize and bypass common self-defensive measures, including "fileless" techniques, sandbox evasion, flow misdirection, debugger detection, and other anti-analysis measures.

The course culminates with a series of Capture-the-Flag challenges designed to reinforce the techniques learned in class and provide additional opportunities to learn practical, hands-on malware analysis skills in a fun setting.

Hands-on lab exercises are a critical aspect of this course. They enable you to apply malware analysis techniques by examining malicious software in a controlled and systemic manner. When performing the exercises, you will study the supplied specimens behavioral patterns and examine key portions of their code. To support these activities, you will receive pre-built Windows and Linux virtual machines that include tools for examining and interacting with malware.

In summary, FOR610 malware analysis training will teach you how to:

  • Build an isolated, controlled laboratory environment for analyzing the code and behavior of malicious programs
  • Employ network and system-monitoring tools to examine how malware interacts with the file system, registry, network, and other processes in a Windows environment
  • Analyze malicious, often obfuscated JavaScript and PowerShell scripts that are often used as part of attack chains
  • Control relevant aspects of the malicious program's behavior through network traffic interception and code patching to perform effective malware analysis
  • Use a disassembler and a debugger to examine the inner workings of malicious Windows executables
  • Bypass a variety of packers and other defensive mechanisms designed by malware authors to misdirect, confuse, and otherwise slow down the analyst
  • Recognize and understand common assembly-level patterns in malicious code, such as code injection, C2 interactions, dropper and downloader techniques, and anti-analysis measures
  • Assess the threat associated with malicious documents, such as PDF and Microsoft Office files
  • Derive Indicators of Compromise (IOCs) from malicious executables to strengthen incident response and threat intelligence efforts.
  • Analyze .NET malware, which is often obfuscated and attempts to evade detection by using reflective code loading

Why Choose Our Course

The malware analysis process taught in FOR610 helps incident responders and other security professionals assess the severity and repercussions of a situation that involves malicious software so that they can plan recovery steps. Forensics investigators also learn about the key characteristics of malware discovered during the examination, including how to establish Indicators of Compromise and obtain other threat intelligence details for analyzing, scoping, and containing the incident.

What threat does the malicious or suspicious program pose? What do its mechanics reveal about the adversary's goals and capabilities? How effective are the company's security controls against such infections? What security measures can strengthen the organization's infrastructure from future attacks of this nature? This course teaches the skills necessary to answer these and other questions critical to an organization's ability to handle malware threats and related incidents.

Business Takeaways

  • Empower your internal teams to perform analysis in-house to lower the need for external expertise.
  • Expand your teams analysis capabilities to offer more value to your internal or external stakeholders.
  • Increase the efficiency of your analysis tasks, so you can provide valuable insights faster.
  • Minimize the scope and cost of the potential intrusion by responding to security incidents more quickly.

What You Will Receive

When attending FOR610, you will receive an electronic toolkit packed with helpful malware analysis tools. You will use them to perform exercises in class, and you can also use them later to interrogate suspicious files when you return to your job. The tools have been preinstalled and configured for your convenience into two virtual machines that you will receive in the course toolkit:

  • A Windows REM Workstation virtual machine with preinstalled analysis tools, along with the corresponding Microsoft Windows license.
  • A REMnux virtual machine set up to run the lightweight Linux distribution used by many malware analysts world-wide.

The toolkit also includes many real-world malware samples that you will examine during the course when performing hands-on lab exercises, as well as MP3 audio files of the complete course lectures.

You will also receive electronic training materials with detailed explanations and illustrations of the concepts, tools, and techniques covered in the course. The materials include an electronic workbook that provides detailed, step-by-step instructions for all the hands-on lab exercises performed in the course to facilitate the learning experience.

Syllabus (36 CPEs)

Download PDF
  • Overview

    Section 1 lays the groundwork for malware analysis by presenting the key tools and techniques useful for examining malicious programs. You will learn how to save time by exploring Windows malware in several phases. Static properties analysis examines meta data and other file attributes to perform triage and determine the next course of action. Behavioral analysis focuses on the program's nteractions with its environment, such as the registry, file system, and network. Code analysis focuses on the specimen's inner workings and makes use of debugging tools such as x64bg. You will learn how to set up and use a flexible laboratory to perform such an analysis in a controlled manner, becoming familiar with the supplied Windows and Linux (REMnux) virtual machines. You will then learn how to begin examining malware in your lab - with guidance and explanations from the instructor to reinforce the concepts discussed throughout the day.

    Topics
    • Assembling a toolkit for effective malware analysis
    • Examining static properties of suspicious programs
    • Performing behavioral analysis of malicious Windows executables; Performing dynamic code analysis of malicious Windows executables
    • Exploring network interactions of malware in a lab for additional characteristics
  • Overview

    Section two focuses on statically examining malicious Windows executables at the assembly level. You will discover approaches for studying inner workings of a specimen by looking at it through a disassembler and, at times, with the help of a decompiler. You will use Ghidra for hands-on exercises in this section. The section begins with an informally overview of key code-reversing concepts and presents a experimented with aspects of primer on essential x86 Intel assembly concepts, such as malware analysis and are looking to instructions, function calls, variables, and jumps. You will formalize and expand their expertise also learn how to examine common assembly constructs, in this area such as functions, loops, and conditional statements. The material will then build on this foundation and expand practitioners looking to expand understanding to incorporate 64-bit malware.

    Throughout the discussion, you will learn to recognize common characteristics at a code level, including HTTP command and control, artifact extraction, and command execution.

    Topics
    • Understanding core x86 assembly concepts for malicious code analysis
    • Identifying key assembly constructs with a disassembler
    • Following program control flow to understand decision points
    • Recognizing common malware characteristics at the Windows API level
    • Extending assembly knowledge to include x64 code analysis
  • Overview

    Section 3 focuses on examining malicious documents and scripts, which adversaries can use to directly perform malicious actions on the infected system and launch attacks that lead to the installation of malicious executables. The section begins by explaining how to examine PDF files to understand the threat they might pose to the organization. It continues with a look at examining VBA macros delivered to victims in Microsoft Office documents. You will learn how to handle macros that are straightforward and those that are more sophisticated, so you can understand their capabilities and derive indicators of compromise (IOCs). Next, you will learn how to examine suspicious RTF files, which can embed risky artifacts and execute malicious code by exploiting vulnerabilities. This section will also demonstrate the techniques for examining suspicious websites, understanding shellcode capabilities, and deobfuscating JavaScript scripts. 

    Topics
    • Malicious PDF file analysis
    • The analysis of suspicious websites
    • VBA macros in Microsoft Office documents
    • Examining malicious RTF files
    • Understanding shellcode
    • Deobfuscating malicious JavaScript scripts
  • Overview

    Section 4 builds on the approaches to behavioral and code analysis introduced earlier in the course, exploring techniques for uncovering additional aspects of the functionality of malicious programs. The section begins discussing practical methods for deobfuscating JavaScript, which you might encounter in malicious documents, suspicious websites, and other forms of attacks. Next, you'll learn how to handle packed malware. You will explore ways to identify packers and strip away their protection with the help of a debugger and other utilities. You will also examine a malware sample that employs multiple technologies to conceal its true nature, including the use of registry, obfuscated JavaScript and PowerShell scripts, and shellcode. You will also learn how to analyze malware created using the .NET Framework, including ways of decompiling, debugging, and deobuscating such code. Finally, you will learn how malware perform code injection to evade detection and interfere with how programs perceive their environment.

    Topics

    • Recognizing packed Windows malware
    • Getting started with unpacking
    • Using debuggers for dumping packed malware from memory
    • Analyzing multi-technology and "fileless" malware
    • Analyzing .NET malware
    • Code injection techniques

  • Overview

    Section 5 takes a close look at the techniques that malware authors commonly use to protect malicious software from being analyzed. You will learn how to recognize and bypass anti-analysis measures designed to slow you down or misdirect you. In the process, you will gain more experience performing static and dynamic analysis of malware that is able to unpack or inject itself into other processes. You will also expand your understanding of how malware authors safeguard the data that they embed inside malicious executables. As with the other topics covered throughout the course, you will be able to experiment with such techniques during hands-on exercises. This section brings together and expands on many of the tools and techniques covered earlier in the course.

    Topics
    • How malware detects debuggers and protects embedded data
    • Unpacking malicious software that employs process hollowing
    • Bypassing the attempts by malware to detect and evade analysis tools
    • Handling code misdirection techniques, including SEH and TLS callbacks
    • Unpacking malicious executables by anticipating the packer's actions

  • Overview

    Section 6 allows you to internalize, practice, and expand the many aspects of malware analysis you learned in the earlier sections of the course. You will be presented with a variety of hands-on challenges involving real-world malware in the context of a fun tournament. You will be given access to a capture-the-flag (CTF) system that will present to you practical challenges, which you'll need to address by examining malware in your lab. The system will offer guidance when you need it, so you can cater this game experience to your own skillset and needs. The tournament will help you consolidate your knowledge and shore up skill areas where you might need additional practice.

    Topics
    • Malware analysis fundamentals
    • Reversing malicious code using static and dynamic techniques
    • Analyzing malicious documents
    • In-depth malware analysis, including unpacking
    • Examining self-defending malware

GIAC Reverse Engineering Malware

The GIAC Reverse Engineering Malware (GREM) certification is designed for technologists who protect the organization from malicious code. GREM-certified technologists possess the knowledge and skills to reverse-engineer malicious software (malware) that targets common platforms, such as Microsoft Windows and web browsers. These individuals know how to examine inner-workings of malware in the context of forensic investigations, incident response, and Windows system administration. Become more valuable to your employer and/or customers by highlighting your cutting-edge malware analysis skills through the GREM certification.

  • Malware Analysis Using Malware Code and Behavioral Analysis Fundamentals
  • Windows Assembly Code Concepts for Reverse Engineering and Common Windows Malware Characteristics in Assembly
  • In-Depth Analysis of Malicious Executables and Self-Defending Malware
  • Analysis of Malicious Document Files, .NET programs, and Protected Executables
More Certification Details

Prerequisites

FOR610 attendees should:

  • Have a computer system that matches the stated laptop requirements; some software needs to be installed before students come to class.
  • Be familiar with using Windows and Linux operating environments and be able to troubleshoot general OS connectivity and setup issues.
  • Be familiar with VMware and be able to import and configure virtual machines.
  • Have a general idea about core programming concepts such as variables, loops, and functions in order to quickly grasp the relevant concepts in this area; however, no programming experience is necessary.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

MANDATORY FOR610 SYSTEM HARDWARE REQUIREMENTS
  • CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
  • CRITICAL: Apple systems using the M1/M2 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
  • 16GB of RAM or more is required.
  • 200GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
MANDATORY FOR610 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS
  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
  • Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
  • Download and install VMware Workstation Pro 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. This course requires a "Pro" version of VMware software. The "Player" versions are not sufficient.
  • On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
  • Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org

Author Statement

"I'm amazed how much information a skilled analyst can derive from the malicious files that find their way onto infected systems. Knowing how to reverse-engineer malware allows you to determine the severity of the intrusion, the context of the attack, the intent of the adversary, the containment steps, and numerous other details that help the organization handle the incident. The FOR610 course is the on-ramp for professionals who wish to acquire such malware analysis, building upon the expertise they already have, to learn how to examine malicious software using a variety of practical techniques."

- Lenny Zeltser

"To combat adversaries effectively, you must understand the tools they are using against you. This course teaches the critical skills necessary to systematically reverse engineer code and understand its functionality, dependencies, and limitations. Attackers often go to great lengths to produce unique, robust malware to achieve their objectives. Organizations must have an equally skilled malware analysis capability to dissect that code and learn from it to mitigate future attacks."

- Anuj Soni

Reviews

I'd recommend FOR610 to anyone in cyber security who is looking to get deeper into malware analysis.
Richard E.
IBM
I learned a great amount of valuable information in FOR610, including what areas I need to master for my job. The CTF lab was a wake up call regarding how much I don't know, so thank you!
Urban M.
CNF Technologies
This course has helped me to improve my knowledge of malware techniques, to understand how to better protect assets, and how to successfully complete the eradication steps.
Eric B.
Nestle

    Register for FOR610

    Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.

    Loading...