Defensive ResearchIntermediate~7 months

Malware Analysis

Analyze malicious software through static and dynamic analysis techniques to understand behavior and impact.

10 Topics

Key concepts

3 Levels

Beginner to Advanced

4 Tools

Curated for this track

8 Questions

Test yourself

Start learningTake the quizAll tracks

About this track

Take the sample apart and find out what it really does.

Malware analysis answers the questions an incident responder cannot answer from logs alone: what did this binary do, what did it talk to, and how do we detect the next one? It sits at the intersection of reverse engineering and threat intelligence.

The track moves from static triage — strings, imports, PE structure — into dynamic detonation in an instrumented sandbox, and then into the behavioural analysis that produces durable detection logic. You will write YARA rules against real sample families rather than toy examples.

Everything here assumes a properly isolated lab. Building that lab safely is the first module for a reason.

Key topics

10 topics grouped into three modules, in the order you should meet them.

  1. 01

    Static triage

    4 topics
    • 1.

      Static Analysis

      Reading the sample without running it — strings, imports, entropy, and packing indicators.

    • 2.

      Dynamic Analysis

      Detonating in an instrumented environment and watching what it touches.

    • 3.

      Behavioral Analysis

      Moving from individual API calls to the intent behind them.

    • 4.

      Sandboxing

      Building isolation that the sample cannot detect and cannot escape.

  2. 02

    Dynamic analysis

    4 topics
    • 5.

      PE File Analysis

      Headers, sections, and the import table as a map of the binary's capabilities.

    • 6.

      Ransomware Analysis

      Key handling, encryption routines, and whether recovery is realistically possible.

    • 7.

      Rootkit Detection

      Hooking, driver abuse, and finding what is actively hiding itself from you.

    • 8.

      Threat Intelligence

      Turning a single sample into attribution, campaign context, and shareable indicators.

  3. 03

    Intelligence & detection

    2 topics
    • 9.

      YARA Rules

      Pattern logic that generalises across a family instead of matching one build.

    • 10.

      Malware Families

      Knowing the major lineages so a new sample has somewhere to sit.

What you'll be able to do

  • Triage an unknown binary statically and decide whether it warrants deeper analysis
  • Detonate a sample safely and capture its full behavioural footprint
  • Write YARA rules that catch a family rather than a single hash
  • Produce indicators and a written analysis that a SOC can operationalise