FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

Section 1 introduces essential malware analysis techniques, covering static, behavioral, and code analysis to understand malware interactions and inner workings. Students will set up a flexible lab environment, using Windows and REMnux virtual machines, to conduct these analyses effectively and with instructor guidance.

Section two dives into assembly-level analysis of Windows executables, teaching key x86 and x64 concepts for malware analysis using tools like Ghidra. Students will learn to interpret disassembled code, follow control flow, and identify common malware characteristics, such as command and control, through hands-on exercises.

Section 3 covers the analysis of malicious documents and scripts, teaching techniques for examining PDFs, VBA macros in Office files, RTF documents, and deobfuscating JavaScript. Students will learn to identify threats, extract indicators of compromise (IOCs), and understand shellcode capabilities within these file types.

Section 4 delves into advanced techniques for malware analysis, focusing on unpacking, deobfuscating, and analyzing multi-technology malware, including .NET and "fileless" threats. Students will learn to identify packers, handle code injection methods, and examine obfuscated JavaScript, PowerShell, and shellcode.

Section 5 covers anti-analysis techniques used by malware authors, teaching students to identify and bypass evasion tactics, unpack malware employing process hollowing, and handle code misdirection. This section integrates and expands previous techniques, with hands-on exercises to reinforce skills in analyzing resistant malware.

Section 6 consolidates malware analysis skills through a capture-the-flag tournament, offering practical challenges with real-world malware. This hands-on experience reinforces key techniques in static and dynamic analysis, unpacking, and examining self-defending malware.