English | MP4 | AVC 1280×720 | AAC 44KHz 2ch | 5.5 Hours | 3.81 GB
Tools and Techniques for Windows Malware Analysis
The aim of this course is to cover the essentials techniques and tools for reverse engineering and malware analysis. As the title suggests, we will cover only the Windows environment in this class, since it is by far the most used and abused. We try to provide a complete picture for the starting reverse engineer but in the same time relevant for the more advanced analysts.
There are always multiple ways to do a task. We will insist more on “Why?”s instead of “How?”s since we consider that it’s more important to understand WHAT we’re trying to achieve and WHY.
There are no pre-requisites for this class other that a Windows virtual machine and the will to learn. All the tools discussed here are freely available online. Analyses are demonstrated on a Windows 8.1 virtual machine.
Don’t worry! Neither professional programming experience nor assembly language knowledge are required to benefit from the course. If you know these already, it would be helpful when we’ll look at identifying encryption algorithms and bypass anti-virtualisation checks. The concepts will be explained clearly and additional resources will be recommended.
Some programming experience will definitely be beneficial, however, the focus will be mostly on understanding the technique, the tools and their most useful features. When needed, source code written in C or Python will be provided.
To get the most out of this course, we recommended to try all the exercises and assignments that follow the lectures and whenever a concept or idea is not fully explained or clearly understood, either reach out with questions on the Q&A section or consult online resources.
What you’ll learn
- How to build a virtual environment for malware analysis
- How to identify and bypass anti-virtualisation techniques
- How to confidently use debuggers and disassemblers
- Be able to analyse processes and perform low-level API monitoring
- How to monitor changes to the Registry and the file system
- Learn how to intercept and investigate network traffic
- Execute samples inside a sandbox, extract and analyse artefacts
- Become comfortable with tools for static analysis
- How to identify packers automatically and manually
Table of Contents
Introduction
1 Introduction
Building a virtual environment
2 Setup
3 Setup Practice
4 Hardening – VM Detection
5 Hardening – VM Detection Practice
6 Anti-VM and Anti-Debug
7 Anti-VM and Anti-Debug Practice 1
8 Anti-VM and Anti-Debug Practice 2
9 Anti-VM and Anti-Debug Practice 3
10 Anti-VM and Anti-Debug Practice 4
Analysis Tools
11 Monitor Process Activity
12 Monitor API Calls Practice 3
13 Monitor Registry and File System
14 Monitor Registry and File System Practice 1
15 Monitor Registry and File System Practice 2
16 Monitor Network Activity
17 Monitor Network Activity Practice 1
18 Monitor Network Activity Practice 2
19 Monitor Network Activity Practice 3
20 Monitor Process Activity Practice 1
21 Monitor Network Activity Practice 4
22 Sandboxing
23 Sandboxing Practice 1
24 Sandboxing Practice 2
25 Static Analysis
26 Static Analysis Practice 1
27 Static Analysis Practice 2
28 Monitor Process Activity Practice 2
29 Monitor Process Activity Practice 3
30 Monitor Process Activity Practice 4
31 Monitor API Calls
32 Monitor API Calls Practice 1
33 Monitor API Calls Practice 2
Next steps
34 Next steps
Resolve the captcha to access the links!