FO R E NS IC S

Hands On

Six Days

Laptop Required

6 1 0
36 CPEs

FOR610: Reverse-Engineering Malware:

Malware Analysis Tools & Techniques
The exercises and
This popular malware analysis course helps forensic investigators,
examples
are very good
incident responders, security engineers and IT administrators
and useful to get a better
acquire practical skills for examining malicious programs that
understanding of code
target and infect Windows systems. Knowing how to understand
analysis.
Definitely one
capabilities of malware is critical to an organizations ability to
of
the
best
courses Ive
derive the threat intelligence it needs to respond to information
attended on this topic.
security incidents and fortify defenses. The course builds a strong
-Thor Olsen,
foundation for analyzing malicious software using a variety of
Norwegian Police Security Services
system and network monitoring utilities, a disassembler, a debugger
and other tools useful for turning malware inside-out.

The course begins by covering fundamental aspects of malware analysis. You will learn
how to set up an inexpensive and flexible laboratory to understand the inner workings of
malicious software and uncover characteristics of real-world malware samples. Then you
will learn to examine the specimens behavioral patterns and code. The course continues
by discussing essential x86 assembly language concepts. You will examine malicious code
to understand its key components and execution flow. Additionally, you will learn to
identify common malware characteristics by looking at suspicious Windows API patterns
employed by bots, rootkits, keyloggers, downloaders, and other types of malware.
This course will teach you how to handle self-defending malware, learning to bypass the
protection offered by packers, and other anti-analysis methods.
This class gave me
In addition, given the frequent use of browser malware for
essential tools that I can
targeting systems, you will learn practical approaches to analyzing
immediately apply to
malicious browser scripts and deobfuscating JavaScript and
protect my organization.
-Don Lopez, Valley National Bank
VBScript to understand the nature of the attack.
You will also learn how to analyze malicious documents that take the form of Microsoft
Office and Adobe PDF files. Such documents act as a common infection vector and may
need to be examined when dealing with large-scale infections as well as targeted attacks.
The course also explores memory forensics approaches to examining malicious software,
especially useful if it exhibits rootkit characteristics.
The course culminates with a series of capture-the-flag challenges designed to reinforce
the techniques learned in class and to provide additional opportunities for learning
practical malware analysis skills in a fun setting.
Hands-on workshop exercises are a critical aspect
of this course and allow you to apply malware
analysis techniques by examining malware in a
lab that you control. When performing the
exercises, you will study the supplied
specimens behavioral patterns and
examine key portions of their code.
To support these activities, you will
receive pre-built Windows and
Linux virtual machines that
include tools for examining and
interacting with malware.
To register, visit sans.org
or call 301-654-SANS (7267)

GIAC Cert: GREM

Who Should Attend

P rofessionals with responsibilities in the areas of
incident response, forensic investigation, Windows
security, and system administration
Professionals who deal with incidents involving
malware and would like to learn how to
understand key aspects of malicious programs
Individuals who attended the course have
experimented with aspects of malware analysis
prior to the course and were looking to formalize
and expand their malware forensics expertise

You Will Be Able To

B uild an isolated laboratory environment for
analyzing code and behavior of malicious programs
Employ network and system-monitoring tools
to examine how malware interacts with the
file system, the registry, the network and other
processes on Microsoft Windows
Uncover and analyze malicious JavaScript, VB Script
and ActionScript components of web pages, which
are often used as part of drive-by attacks
Control some aspect of the malicious programs
behavior through network traffic interception and
code patching
Use a disassembler and a debugger to examine
inner workings of malicious Windows executables
Bypass a variety of defensive mechanisms designed
by malware authors to misdirect, confuse and
otherwise slow down the analyst
Recognize and understand common assembly-level
patterns in malicious code, such as DLL injection
Assess the threat associated with malicious
documents, such as PDF and Microsoft Office files
in the context of targeted attacks
Derive Indicators of Compromise (IOCs) from
malicious executables to contain and recover from
the incident
Utilize practical memory forensics techniques to
examine capabilities of rootkits

digital-forensics.sans.org

giac.org

sans.edu

For schedules, course updates, prerequisites, special notes,

or laptop requirements, visit sans.org/courses

Course Day Descriptions

610.1 
Hands On: Malware

FOR610 Training Formats

Analysis Fundamentals

Section one lays the groundwork for malware analysis by presenting the key tools and techniques useful
for examining malicious programs. You will learn how to save time by exploring Windows malware in
two phases. Behavioral analysis focuses on the programs interactions with its environment, such as the
registry, the network, and the file system. Code analysis focuses on the specimens code and makes use
of a disassembler and debugger tools such as IDA Pro and OllyDbg. You will learn how to set up a flexible laboratory to perform such analysis in a controlled manner, and you will set up such a lab on your
laptop using the supplied windows and Linux (REMnux) virtual machines. You will then learn how to use
the key analysis tools by examining a malware sample in your lab with guidance from the instructor
to reinforce the concepts discussed throughout the day.
Topics: Assembling a Toolkit for Effective Malware Analysis; Examining Static Properties of Suspicious Programs; Performing Behavioral
Analysis of Malicious Windows Executables; Performing Static and Dynamic Code Analysis of Malicious Windows Executables;
Contributing Insights to the Organizations Larger Incident Response Effort

610.2 
Hands On: Malicious

Code Analysis

Section two focuses on examining malicious Windows executables at the assembly level. You will discover approaches for studying inner workings of a specimen by looking at it through a disassembler and,
at times, with the help of a debugger. The section begins with an overview of key code-reversing concepts and presents a primer on essential x86 Intel assembly concepts, such as instructions, function calls,
variables, and jumps. You will also learn how to examine common assembly constructs, such as functions,
loops, and conditional statements. The remaining part of the section discusses how malware implements
common characteristics, such as keylogging and DLL injection, at the assembly level. You will learn how to
recognize such characteristics in suspicious Windows executable files.
Topics: Core Concepts for Analyzing Malware at the Code Level; x86 Intel Assembly Language Primer for Malware Analysts; Identifying Key
x86 Assembly Logic Structures with a Disassembler; Patterns of Common Malware Characteristics at the Windows API Level (DLL
Injection, Function Hooking, Keylogging, Communicating over HTTP, etc.)

610.3 
Hands On: In-Depth

Malware Analysis

(subject to change)

Live Training
sans.org/security-training/by-location/all

OnSite
sans.org/onsite

vLive
sans.org/vlive

Simulcast
sans.org/simulcast

OnDemand
sans.org/ondemand

SelStudy

Section three builds upon the approaches to behavioral and code analysis introduced earlier in the
sans.org/selfstudy
course, exploring techniques for uncovering additional aspects of the functionality of malicious programs.
You will learn about packers and the techniques that may help analysts bypass their defenses. Additionally,
you will understand how to redirect network traffic in the lab to better interact with malware to understand its capabilities. You will also learn how to examine malicious websites and deobfuscate browser
scripts, which often play a pivotal role in malware attacks.
Topics: Recognizing Packed Malware; Automated Malware Unpacking Tools and Approaches; Manual Unpacking of Using OllyDbg, Process
Dumping Tools and Imports-Rebuilding Utilities; Intercepting Network Connections in the Malware Lab; Interacting with Malicious
Websites to Examine their Nature; Deobfuscating Browser Scripts Using Debuggers and Runtime Interpreters; JavaScript Analysis Complications

610.4 
Hands On: Self-Defending

Malware

Section four focuses on the techniques malware authors commonly employ to protect malicious software from being examined, often with the help of
packers. You will learn how to recognize and bypass anti-analysis measures, such as tool detection, string obfuscation, unusual jumps, breakpoint detection
and so on. We will also discuss the role that shellcode plays in the context of malware analysis and will learn how to examine this aspect of attacks. As
with the other topics covered throughout the course, you will be able to experiment with such techniques during hands-on exercises.
Topics: Bypassing Anti-Analysis Defenses; Recovering Concealed Malicious Code and Data; Unpacking More Sophisticated Packers to Locate the Original Entry Point (OEP); Identifying and Disabling Methods
Employed by Malware to Detect Analysts Tools; Analyzing Shellcode to Assist with the Examination of Malicious Documents and other Artifacts

610.5 
Hands On: Malicious

Documents and Memory Forensics

Section five starts by exploring common patterns of assembly instructions often used to gain initial access to the victims computer. Next, we will learn
how to analyze malicious Microsoft Office documents, covering tools such as OfficeMalScanner and exploring steps for analyzing malicious PDF documents
with practical tools and techniques. Another major topic covered in this section is the reversing of malicious Windows executables using memory forensics
techniques. We will explore this topic with the help of tools such as the Volatility Framework and associated plug-ins. The discussion of memory forensics
will bring us deeper into the world of user and kernel-mode rootkits and allow us to use context of the infection to analyze malware more efficiently.
Topics: Analyzing Malicious Microsoft Office (Word, Excel, PowerPoint) Documents; Analyzing Malicious Adobe PDF Documents; Analyzing Memory to Assess Malware Characteristics and Reconstruct Infection
Artifacts; Using Memory Forensics to Analyze Rootkit Infections

610.6 
Hands On: Malware

Reverse-Engineering Tournament

Section six assigns students to the role of a malware reverse engineer working as a member of an incident response and malware analysis team. Students
are presented with a variety of hands-on challenges involving real-world malware in the context of a fun tournament. These challenges further a students ability to respond to typical malware-reversing tasks in an instructor-led lab environment and offer additional learning opportunities. Moreover, the
challenges are designed to reinforce skills covered in the first five sections of the course, making use of the hugely popular SANS NetWars tournament
platform. By applying the techniques learned earlier in the course, students solidify their knowledge and can shore up skill areas where they feel they need
additional practice. The students who score the highest in the malware reverse-engineering challenge will be awarded the coveted SANS Digital Forensics
Lethal Forensicator coin. Game on!
Topics: Behavioral Malware Analysis; Dynamic Malware Analysis (Using a Debugger); Static Malware Analysis (Using a Disassembler); JavaScript Deobfuscation; PDF Document Analysis; Office Document
Analysis; Memory Analysis

To register, visit sans.org

or call 301-654-SANS (7267)

For schedules, course updates, prerequisites, special notes,

or laptop requirements, visit sans.org/courses