My Skill Lab
CybersecurityAdvanced

Malware Analysis Basics

Static and dynamic analysis in a safe sandbox.

Taught by Nisha Poudel · SOC Lead

What you'll learn

  • Build an isolated analysis lab with snapshots, simulated internet and safe sample-handling habits
  • Triage an unknown file using hashes, file type, strings and reputation lookups in under fifteen minutes
  • Read a PE header to infer capability from imports, sections, entropy and packing
  • Run a sample in a sandbox and capture process, registry, file and network behaviour
  • Map observed behaviour to MITRE ATT&CK techniques and persistence mechanisms
  • Write and test YARA rules and publish a clear IOC report for other defenders

About this course

Malware analysis is the skill that turns a suspicious file into a clear answer: what does it do, how do we detect it, and how do we stop it? This course is for SOC analysts, incident responders and security engineers who want to move beyond antivirus verdicts and analyse samples themselves. You will build an isolated malware analysis lab with REMnux and FLARE VM, triage files with hashes, strings and PE header inspection, detonate samples in a sandbox while watching processes, registry and network activity, and map the behaviour you see to MITRE ATT&CK. You will then write YARA rules that catch the family, not just the file, and report indicators of compromise in a format other defenders can use. You should be comfortable with Windows internals at a basic level, the Linux command line and some Python. No reverse-engineering or assembly experience is required.

Course content

7 lessons
  1. 1Building a Safe Analysis LabIsolate your lab with virtual machines, snapshots and a fake internet before you touch a single sample.Preview
  2. 2Triage: Hashes, Strings and File TypesAnswer the first questions fast: what is this file, has anyone seen it, and what does it contain?
  3. 3PE Basics: Headers, Imports and PackingRead the Portable Executable format to infer what a Windows binary can do before it runs.
  4. 4Dynamic Analysis in a SandboxDetonate the sample and record every process, file, registry key and network connection it touches.
  5. 5Behavioural Indicators and PersistenceRecognise how malware survives reboots and how to describe what you saw using MITRE ATT&CK.
  6. 6Writing YARA RulesTurn the strings and structures you found into rules that detect the whole family, not just one file.
  7. 7Reporting IOCs and Sharing FindingsWrite the analysis report and IOC package that lets responders, detection engineers and peers act immediately.