You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 
hasherezade 85894f0d5a [module1][lesson3] Fixed wording (Issue #21) 1 year ago
exercises Update README.md 2 years ago
slides [module1][lesson3] Fixed wording (Issue #21) 1 year ago
README.md Update README.md 1 year ago

README.md

malware_training_vol1

Materials for Windows Malware Analysis training (volume 1)

🚧 WARNING: work in progress! More material will be added gradually.

Content

The goal of this training it to build understanding of various common techniques used by malware. It contains elements of programming as well as reverse engineering, and introduction to some Windows internals concepts.

It also showcases how various tools (including my own) can be used to achieve particular analysis goals.

Target audience

This material would fit best to people who already have technical knowledge from surrounding areas: basics of programming and reverse engineering - yet, who want to enter into the field of Windows malware analysis.

License

Creative Commons BY License

This material is published under the Creative Commons BY License, which means:

This license lets others distribute, remix, adapt, and build upon your work, even commercially, as long as they credit you for the original creation.

Noticed an error?

If you noticed any error in this material, please report it in the Issues

Need help in a task?

If you need help in any of the exercises, or have additional questions, you can share it in discussions

Covered topics vs planned

Module 1

Slides Exercises Topic
compilation
PE
Process
WoW64
shellcode
code injection
/ / PE loaders

Module 2

Slides Exercises Topic
Malware missions & tactics (intro)
hooking
persistence
UAC bypass
Banking trojans
RATs
Ransomware
Lateral movements

Module 3

Slides Exercises Topic
Evasion and self-defence (intro)
/ Fingerprinting
String obfuscation
Imports obfuscation
Flow obfuscation
Malware antihooking
Review of approaches to deobfuscation
Kernel-mode malware components