This course provides a rapid introduction to the file formats, tools, and methodologies used to perform malware analysis on malicious documents using a practical hands-on approach. Students will learn to pinpoint and analyze the most suspicious document components and how to extract host and network-based indicators from them. This course includes demonstrations and hands-on labs that contain real malware.
After completing this course, learners should be able to:
- Dissect and analyze malicious document formats
- Extract network and host-based indicators
- Extract noteworthy components that require further isolated analysis
- Detect suspicious patterns and common exploitation techniques
- Utilize modern analysis tools including Offvis and 010 editor
- Create and automate custom tools for your specific organization
Who should attend
Malware researchers, software developers, information security professionals, incident responders, computer security researchers, corporate investigators and others who need to understand how malware operates and the processes involved in performing malware analysis.
General knowledge of computer and operating system fundamentals. Exposure to programming fundamentals is recommended.
In-classroom instructor-led training
- 2 days (in-person delivery)
- 3 or 4 days (virtual delivery)
What to bring
Students are required to bring their own laptop that meets the following specs:
- VMware Workstation Pro 12.5 or newer (installed with the ability to run a VM)
- At least 30 GB of free HDD space