Malware Analysis
An introduction to malware analysis — what it is, why it matters, who does it, and what the discipline looks like from the inside. The foundation before touching a single tool.
Malware Analysis — Part 0: What Is Malware Analysis?
An introduction to malware analysis — what it is, why it matters, who does it, and what the discipline looks like from the inside. The foundation before touching a single tool.
Malware Analysis — Part 1: Building the Lab
Build a professional-grade malware analysis lab on Windows 11 Pro using Hyper-V and pfSense. Covers network architecture, virtual switches, VM layout, snapshot strategy, and safe file transfer between host and VM.
Malware Analysis — Part 2: Setting Up the Windows Analysis VM with FLARE-VM
Install and configure the Windows malware analysis VM using FLARE-VM — Mandiant's open source Windows environment purpose-built for malware analysis and reverse engineering. Every tool explained.
Malware Analysis — Part 3: Setting Up REMnux and INetSim
Install and configure REMnux — the Linux-based malware analysis distribution — and set up INetSim to simulate internet services for controlled malware network analysis. Every built-in tool explained.
Malware Analysis — Part 4: Safe Sample Acquisition, Triage, and Permissions
How to safely obtain malware samples, verify file integrity with hashes, use VirusTotal correctly, configure Windows permissions to prevent accidental execution, and perform initial triage before touching a sample.
Malware Analysis — Part 5: Static Analysis Part 1 — File Identification and PE Structure
A deep dive into static analysis — examining malware without executing it. Covers the Windows PE file format in detail, what headers and sections reveal, entropy analysis, packer detection, and reading import tables like a story.
Malware Analysis — Part 6: Static Analysis Part 2 — Strings, YARA, and IOC Extraction
The second half of static analysis — extracting strings from obfuscated binaries with FLOSS, writing YARA rules to detect malware families, using capa for capability mapping, and extracting every indicator of compromise before touching dynamic analysis.
Malware Analysis — Part 7: Dynamic Analysis Part 1 — Behavioral Monitoring
Dynamic analysis in depth — setting up the monitoring stack, using Process Monitor, Process Explorer, Autoruns, and TCPView to capture every filesystem, registry, process, and network action the malware takes. Includes filtering strategies for making sense of millions of events.
Malware Analysis — Part 8: Dynamic Analysis Part 2 — Network Traffic and Sandboxes
Network traffic analysis during malware execution — capturing and reading PCAPs with Wireshark, understanding C2 communication patterns, extracting artifacts from network captures, and using automated sandboxes effectively.