Abstract

This class is planned and organized to introduce attendees to reverse engineering and malware analysis foundations. During this course, we will provide students with recommended tools, concepts and techniques to retrieve key information from a binary, understand and correlate such information, and start the analysis based on relevant facts and artifacts.

We will take an overview about PE format and highlight associated concepts that will be used to perform basic static analysis, whose demonstrations are executed in real time, and that will be essential later in the course. Class attendees will learn how to analyze non-binary objects, and how to configure a sandbox for their own purpose. Students will learn how to configure their own Yara rules for threat hunting and malware detection as well as they will receive a quick refresh about Assembly calling conventions and common APIs that are observed in the most malicious binaries. Critical concepts about code injection and hooking, which are techniques used for most malicious binaries these days, will be taught and quickly demonstrated.

In the second part of the training, which is composed by completly real-time and practical sections of the course, we show how to use a world-class product for disassembly and also how to use local and remote debuggers. Afterwards, we present WinDbg and instrumentation techniques, followed by a deep dive on unpacking techniques of different binaries, tricks and techniques to repair demage artifacts after the unpacking or extraction. Finally, students will be introduced to first techniques on malware analysis.

This class will focus on binaries running on x86/x64 Windows.

Who Should Attend

This class is designed for professionals who want to start the malware analysis and reverse engineering career, and also that are currently working as analysts, incident responders and threat hunters.

Key Learning Objectives

Students attending this class will:

  • Learn effective and practical approaches to triage and gathering important information from a malware.
  • Understand key concepts that are essential for reverse engineering and malware analysis.
  • Learn how to build effective Yara rules.
  • Learn how to configure a sandbox in an efficient way.
  • Master well-known techniques of unpacking binaries.
  • Learn how to handle non-binary artifacts.
  • Learn how to use disassemblers and debuggers.
  • Learn how to start a malware analysis procedure.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Students should be comfortable in running commands on operating system such Windows and Linux.
  • Knowledge on threat hunting and incident response could be useful, but it is not a requirement.
  • Having previous knowledge in any programming language could be useful, but it is not a requirement.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • One virtual machine running Ubuntu 22.04+ or REMnux.
  • One virtual machine running Windows 11 x64.
  • One virtual machine running Windows 7.
  • Malwoverview installed on both virtual machines, including all necessary APIs already configured.
  • Visual Studio Code installed on both Windows virtual machines.
  • Visual Studio and SDK installed on both Windows machines.
  • Recent versions IDA Pro or IDA Free, or even equivalent.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class is:

  • Introduction and Lab Setup
  • Sandbox
  • PE Format Overview
  • Yara
  • Basic Binary Analysis
  • Non-Binary Analysis
  • Calling Conventions and Common APIs
  • Code Injection and Hooking
  • Windows Security
  • Disassembling
  • Local and Remote Debugging
  • WinDbg
  • Instrumentation and Coverage
  • Unpacking
  • Introduction to Malware Analysis

Note: Topics can be added, merged or removed without prior notice!