Malicious Documents Analysis

Course Description

This course provides a rapid introduction to the file formats, tools, and methodologies used to perform malware analysis on malicious documents using a practical hands-on approach. Students will learn to pinpoint and analyze the most suspicious document components and how to extract host and network-based indicators from them. This course includes demonstrations and hands-on labs that contain real malware.

Learning Objectives

After completing this course, learners should be able to:

• Dissect and analyze malicious document formats
• Extract network and host-based indicators
• Extract noteworthy components that require further isolated analysis
• Detect suspicious patterns and common exploitation techniques
• Utilize modern analysis tools including Offvis and 010 editor
• Create and automate custom tools for your specific organization

Who should attend

Malware researchers, software developers, information security professionals, incident responders, computer security researchers, corporate investigators and others who need to understand how malware operates and the processes involved in performing malware analysis.

Prerequisites

General knowledge of computer and operating system fundamentals. Exposure to programming fundamentals is recommended.

Delivery method

In-classroom instructor-led training available globally; virtual instructor-led training available in North American Time Zones (Pacific to Eastern).

Duration

• 2 days (in-person delivery)
• 3 or 4 days (virtual delivery)

What to bring

Students are required to bring their own laptop that meets the following specs:

• VMware Workstation Pro 12.5 or newer (installed with the ability to run a VM)
• At least 30 GB of free HDD space