Windows Malware Analysis for Hedgehog...

Description

This course teaches more than just reverse engineering because as a malware analyst you need a variety of other skills. You will learn how to classify samples into malware types, how to identify malware families and how to determine file verdicts like clean, malicious, potentially unwanted programs, junk, grayware, or corrupt. Additionally, you will learn how malware persists, how to identify malicious autostart entries and clean infected systems.

The course aims to dispel common myths such as “trojan in a detection name means the file is a trojan horse” or “antivirus detection names are a malware classification”.

As a malware analyst with experience working at an antivirus company since 2015, I have trained many beginners in the field. I understand the usual pitfalls and the concepts that you need to grasp to become proficient. I focus on building strong foundations that make you flexible in the face of new malware advancements, rather than providing shortcuts with step-by-step recipes.

I will teach you how to differentiate between different types of files, including installers, wrappers, packed files, non-packed files, hybrid, and native compiled files. You will learn which tools to apply in which situations and how to analyse samples efficiently. To do that I give you example approaches that work for most situations.

This course is ideal for you if you already have some IT background, such as hobby or professional programmers, computer enthusiasts, administrators, computer science students, or gamers with an interest in the inner workings of software or IT security.

If you have a strong interest in the topic but lack the necessary IT background, I recommend that you learn programming first. Please refer to the course requirements for more information.

Tools

All the tools and web services that we use during the course are free:

Ghidra
x64dbg
VirtualBox
SysInternals Suite
PortexAnalyzer CLI and GUI
VirusTotal (without account)
Speakeasy by Mandiant
API Monitor
CyberChef
EXIFTool
Meld
VBinDiff
AnalyzePESig
DnSpy
C# Online Compiler programwiz
TriD
Detect-it-Easy
ReNamer
7zip
Notepad++
HxD
Malpedia
lnk_parser

Requirements

You should have a strong understanding of at least one programming language, such as Python, C, C++, Java, or C#. This is a crucial requirement for the course, not only because we create small scripts during the course but because reverse engineering needs an understanding of software as foundation. The specific language does not matter, as you cannot learn every language you may encounter during analysis anyways. The concepts of programming must be clear, though.

If you are not there yet, you should not buy this course and start learning C instead. C is great because it is low-level and will integrate well with x86 assembly language.

Additionally, you must be able to read (not write) x86 assembly to understand everything in the course. Without assembly you will only be able to understand two-thirds of the content. So if you consider starting this course right away and learning assembly alongside it, that should work fine.

During this course we look at samples that use the following execution environments:

x86, x64 assembly
.NET
Batch
PowerShell
Nullsoft scripts

However, you do not need to learn all of these languages. Because an analyst encounters new languages all the time, your skillset is rather in using the available documentation, manuals and help provided for those environments and languages. I also show you during the course how to use the documentation for ,e.g., PowerShell.

Out of scope

Malware analysis is a broad field, so there are inevitably topics that I will not teach during this course because they would rather require their own course. Some of these topics are: assembly language, programming, how computers work, URL and website analysis, networks, analysis of malware for other platforms than Windows, mobile malware, IoT malware.
Who this course is for:

ideal for people with some IT experience or IT enthusiasts who are beginners in malware analysis and reverse engineering
entry-level or aspiring malware analysts
computer science graduates
software developers
SOC analysts
hobby programmers

Requirements

You know how to program in at least one language (e.g. Python, C, C#, Java, …)
You are able to read x86 assembly

Last Updated 10/2023

Files (258)

[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/5. Lab Triage 2 Whole file examination.mp4142.54 MiB
TutsNode.org.txt63 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/2.1 Portable Executable Format-Basics.pdf118.24 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/10.1 Safety rules.pdf70.66 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/10. Safety rules summary.html8.15 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/4. Download links and documentation.html2.98 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/2. Download links.html951 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/2. Download links.html1.57 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/3. PortexAnalyzer and DnSpy download.html1.03 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/5. Installing the bindiff and certificate tools.html944 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/10. Debugging basics with x64dbg/2. Download links and bookmarks.html872 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/3. Tools and links.html589 B
[TGx]Downloaded from torrentgalaxy.to .txt585 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/6. Tools and links.html515 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/5. Malware Persistence and Disinfection Basics/3. Links.html501 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/9. Ghidra basics/2. Download link for Ghidra.html315 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/11. Safety rules quiz.html167 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/8. Portable Executable metadata exercise.html171 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/10. SteamHide FinalMalware.exe analysis.html171 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/11. Triage Quiz.html167 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/13. Wrappers and installers quiz.html167 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/5. Malware Persistence and Disinfection Basics/7. Malware Persistence and Disinfection Quiz.html167 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/9. Portable Executable Quiz.html167 B
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/10. Debugging basics with x64dbg/10. x64dbg Quiz.html167 B
.pad/0265.12 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/9. Lab Installers 1 Layer 1 Unpacking Nullsoft.mp4138.35 MiB
.pad/1664.71 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/10. Lab Poison 1 Speakeasy API logging.mp4130.33 MiB
.pad/2683.03 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/12. Lab Injector DLL Unpacking via VirtualAlloc.mp4127.74 MiB
.pad/3271.21 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/5. Malware Persistence and Disinfection Basics/4. Lab Services.mp4127.62 MiB
.pad/4384.95 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/11. Ransomware analysis with Ghidra and x64dbg/6. Lab Legion ransomware 5 Understanding the encryption.mp4127.48 MiB
.pad/5532.8 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/5. Malware Persistence and Disinfection Basics/5. Lab Disinfection 1 Autoruns - Run, IFEO.mp4126.16 MiB
.pad/6858.64 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/5. Lab Wrapped files 2 Obtaining the script with ACLs.mp4124.08 MiB
.pad/7946.07 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/6. Lab Winupack 1 packing, fix disassembly in x32dbg.mp4121.27 MiB
.pad/8752.36 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/5. Malware Persistence and Disinfection Basics/6. Lab Disinfection 2 RunOnce, Active Setup, Scheduled Tasks, LNKs.mp4113.5 MiB
.pad/9516.15 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/9. Lab report writing 3 Malware decryption with CyberChef.mp4108.69 MiB
.pad/10322.04 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/12. Lab Installers 4 Triage of multiple files.mp4106.15 MiB
.pad/11866.07 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/11. Ransomware analysis with Ghidra and x64dbg/7. Lab Legion ransomware 6 Patching with x32dbg.mp4105.02 MiB
.pad/121006.56 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/4. Lab Wapped files 1 Triage of a wrapped file.mp4103 MiB
.pad/131023.25 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/3. Lab Triage 1 Determine file types of unknown samples.mp4102.95 MiB
.pad/1446.12 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/11. Ransomware analysis with Ghidra and x64dbg/8. Lab Legion ransomware 7 Ransomware monitoring and file decryption test.mp4102.43 MiB
.pad/15584.39 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/4. Lab PE 1 MS DOS stub, COFF file header, timestamps and REPRO builds.mp4102.33 MiB
.pad/16686.72 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/7. Lab Winupack 2 Find OEP via tracing, dump and fix imports.mp4100.3 MiB
.pad/17719.84 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/9. Lab diffing3 Force strict signature verification.mp498.18 MiB
.pad/18839.41 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/5. Lab PE 2 Optional header and section table.mp494.69 MiB
.pad/19312.97 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/10. Debugging basics with x64dbg/8. Lab ASLR 1 Rebasing and DllCharacteristics in the Optional Header.mp494.43 MiB
.pad/20585.06 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/9. Ghidra basics/5. Lab Ghidra 2 Windows in the codebrowser part 1.mp493.62 MiB
.pad/21388.11 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/9. Ghidra basics/7. Lab finding main 1 MinGW and VisualStudio C++ applications.mp492.83 MiB
.pad/22172.61 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/13. Lab .NET 3 Code search in DnSpy.mp492.58 MiB
.pad/23427.72 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/10. Debugging basics with x64dbg/5. Lab x64dbg 3 Software breakpoints.mp489.11 MiB
.pad/24907.26 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/11. Lab Poison 2 Unpacking via RtlDecompressBuffer.mp488.07 MiB
.pad/25952.77 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/11. Ransomware analysis with Ghidra and x64dbg/4. Lab Legion ransomware 3 Date check markup.mp487.57 MiB
.pad/26439.92 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/9. Ghidra basics/8. Lab finding main 2 A more difficult application.mp485.94 MiB
.pad/2758.18 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/2. File analysis verdicts.mp485.63 MiB
.pad/28375.57 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/6. Lab diffing 1 Binary diffing with vbindiff and meld.mp485.62 MiB
.pad/29389.45 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/10. Debugging basics with x64dbg/7. Lab x64dbg 5 Memory breakpoints.mp483.71 MiB
.pad/30295.39 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/10. Debugging basics with x64dbg/9. Lab ASLR 2 Hex to Bin Conversion, Bitmasks and Disabling Exploit Protection.mp483.41 MiB
.pad/31607.91 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/11. Ransomware analysis with Ghidra and x64dbg/2. Lab Legion ransomware 1 Triage.mp483.34 MiB
.pad/32674.05 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/10. Lab Exercise solution.mp480.59 MiB
.pad/33418.46 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/11. Ransomware analysis with Ghidra and x64dbg/3. Lab Legion ransomware 2 Finding main.mp479.43 MiB
.pad/34583.39 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/6. Lab PE 3 Resources, icons, debug path, imports.mp478.39 MiB
.pad/35620.34 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/8. Lab report writing 2 ICC profile extraction with exiftool.mp477.2 MiB
.pad/36814.95 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/11. Lab Installers 3 Extract 7zip SFX configuration.mp476.1 MiB
.pad/37925.05 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/7. Lab report writing 1 Main analysis of a downloader.mp475.7 MiB
.pad/38304.93 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/7. Lab PE 4 Anomalies and visualization.mp475.22 MiB
.pad/39803.3 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/7. Lab diffing 2 Identify certificate manipulation.mp474.89 MiB
.pad/40111.58 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/7. Lab Wrapped files 4 Obtaining the script with APIMonitor.mp474.86 MiB
.pad/41140.11 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/11. Ransomware analysis with Ghidra and x64dbg/5. Lab Legion ransomware 4 Finding the encryption function.mp474.25 MiB
.pad/42771.16 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/10. Lab Installers 2 Layer 2 Extract 7zip SFX files.mp473.7 MiB
.pad/43302.72 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/10. Debugging basics with x64dbg/3. Lab x64dbg 1 CPU view windows.mp472.35 MiB
.pad/44670.25 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/9. Network, snapshots and first sample execution.mp470.6 MiB
.pad/45404.69 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/10. Debugging basics with x64dbg/4. Lab x64dbg 2 Navigation.mp469.4 MiB
.pad/46616.54 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/9. Ghidra basics/6. Lab Ghidra 3 Windows in the codebrowser part 2.mp468.46 MiB
.pad/47553.88 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/9. Lab Triage 4 Final analysis.mp468.28 MiB
.pad/48739.29 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/3. Installing VirtualBox Windows 10 VM.mp464.11 MiB
.pad/49908.26 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/12. Lab .NET 2 Running the file, DnSpy basics.mp462.6 MiB
.pad/50408.02 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/5. Enabling hidden files view and removing Windows Defender.mp457.61 MiB
.pad/51396.53 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/8. Sample handling Prevent execution via ACLs (Windows host only).mp454.67 MiB
.pad/52338.95 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/11. Lab .NET 1 .NET basics and triage.mp453.89 MiB
.pad/53111.5 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/5. Installing Python 3 and Speakeasy.mp453.34 MiB
.pad/54676.9 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/5. Malware Persistence and Disinfection Basics/2. The Windows Registry.mp453.04 MiB
.pad/55978.43 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/6. Lab Wrapped files 3 Wrapped file payload analysis.mp451.17 MiB
.pad/56849.88 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/10. Debugging basics with x64dbg/6. Lab x64dbg 4 Hardware breakpoints.mp451.14 MiB
.pad/57877.11 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/7. Deciphering antivirus detection names for malware.mp449.69 MiB
.pad/58316.98 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/8. Lab Winupack 3 Find OEP via hardware breakpoint on stack.mp449.06 MiB
.pad/59962.11 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/1. Malware Analysis Lab.mp446.4 MiB
.pad/60614.39 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/9. Ghidra basics/4. Lab Ghidra 1 New project, file import and autoanalysis.mp445.17 MiB
.pad/61847.53 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/7. Sample handling Shared folder setup.mp444.19 MiB
.pad/62825.28 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/3. Clean vs malicious—approaches for clean file analysis.mp444.14 MiB
.pad/63878 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/1. What is triage.mp443.16 MiB
.pad/64857.84 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/10. Compilation and Interpretation.mp439.82 MiB
.pad/65187.19 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/10. Mapping detection names to file verdicts.mp439.09 MiB
.pad/66927.41 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/4. What is a file type.mp437.8 MiB
.pad/67205.46 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/2. Portable Executable format basics.mp437.51 MiB
.pad/68496.87 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/2. Malware Classification.mp436.7 MiB
.pad/69305.45 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/1. Introduction to Malware Analysis/1. Introduction.mp435.77 MiB
.pad/70234.54 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/8. Lab Triage 3 VirusTotal autoscans and first research.mp435.37 MiB
.pad/71649.67 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/9. One generic unpacking approach.mp435.2 MiB
.pad/72821.39 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/2. Unpacking methods.mp432.54 MiB
.pad/73473.92 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/1. How packers work.mp432.27 MiB
.pad/74750.41 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/1. Writing analysis reports.mp430.78 MiB
.pad/75220.63 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/10. Debugging basics with x64dbg/1. x64dbg introduction.mp429.41 MiB
.pad/76601.54 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/5. Malware Persistence and Disinfection Basics/1. Auto Start Extensibility Points (ASEPs).mp428.39 MiB
.pad/77624.2 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/4. Installing VirtualBox Guest Additions.mp427.71 MiB
.pad/78296.57 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/3. Unpacking stub types and how they work.mp427.06 MiB
.pad/79964.67 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/2. Wrapped files.mp427 MiB
.pad/801022.78 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/6. Antivirus detection names and formats for malware.mp426.19 MiB
.pad/81827.35 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/9. Ghidra basics/3. Lab preparation Installing Ghidra.mp425.44 MiB
.pad/82575.76 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/1. Introduction to Portable Executable files.mp424.65 MiB
.pad/83354.9 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/3. Malware types by propagation.mp423.08 MiB
.pad/84937.81 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/4. Malware types by payload behavior.mp421.21 MiB
.pad/85806.14 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/2. Malware lab setup/6. Sample handling Course samples and password protected archives.mp421.21 MiB
.pad/86806.81 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/8. Installers.mp419.99 MiB
.pad/8711.73 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/3.1 Malware Types by Propagation.pdf19.91 MiB
.pad/8891.5 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/1. Analysis types.mp419.36 MiB
.pad/89660.24 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/5. Malware Persistence and Disinfection Basics/2.1 Registry - 2023-05-28 06.06.16.pdf17.53 MiB
.pad/90481.66 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/3.1 Determine Clean vs Malicious - 2023-09-10 05.44.08.pdf17.51 MiB
.pad/91506.14 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/1. Finding the malware developer's code.mp417.09 MiB
.pad/92930.01 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/2.1 Unpacking Methods - 2023-09-11 05.39.15.pdf16.77 MiB
.pad/93234.69 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/9.1 Unpacking Approach - 2023-09-11 06.08.21.pdf16.67 MiB
.pad/94334.53 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/2.1 Analysis Verdicts - 2023-04-15 07.28.26.pdf14.88 MiB
.pad/95125.64 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/6.1 AV Detection Names - 2023-08-28 10.43.52.pdf14.53 MiB
.pad/96478 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/4. Tools for binary diffing and finding hidden certificate data.mp413.76 MiB
.pad/97245.57 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/10.1 Compilers and interpreters - 2023-04-26 07.49.42.pdf13.44 MiB
.pad/98576.64 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/2.1 Malware Classification.pdf10.68 MiB
.pad/99328.7 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/8. How signature verification works.mp410.31 MiB
.pad/100702.47 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/9. Ghidra basics/1. Ghidra introduction.mp49.23 MiB
.pad/101789.23 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/5. Malware family identification.mp48.68 MiB
.pad/102329.92 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/1.1 Analysis Reports.pdf7.56 MiB
.pad/103450.36 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/4.1 Malware Types by Behavior.pdf7.36 MiB
.pad/104655.85 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/8. Malware classification and analysis reports/5.1 Malware Families - 2023-09-09 11.26.32.pdf6.85 MiB
.pad/105151.69 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/1.1 Packers - 2023-09-11 05.43.00.pdf6.73 MiB
.pad/106272.44 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/11. Ransomware analysis with Ghidra and x64dbg/1. Legion ransomware intro.mp46.62 MiB
.pad/107394 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/2.1 Wrappers - 2023-09-03 07.51.53.pdf5.99 MiB
.pad/10811.36 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/8.1 Installers - 2023-09-03 08.13.53.pdf5.81 MiB
.pad/109193.99 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/3. Triage and file type basics/1.1 Triage - 2023-04-15 06.22.51.pdf5.71 MiB
.pad/110292.93 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/12. Packers and unpacking methods/3.1 Unpacking Stubs - 2023-09-10 05.45.54.pdf5.02 MiB
.pad/1111002.15 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/5. Malware Persistence and Disinfection Basics/1.1 ASEPs - 2023-05-06 11.26.44.pdf4.87 MiB
.pad/112136 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/7. File analysis verdicts/1.1 Analysis Types.pdf4.54 MiB
.pad/113474.34 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/1. Introduction to Malware Analysis/2. Analysis process.mp44.02 MiB
.pad/1141003.65 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/4. Wrapped files and installers/1.1 Finding the Dev's code - 2023-08-31 05.39.23.pdf3.74 MiB
.pad/115263.11 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/1. Introduction to Malware Analysis/2.1 Analysis Process.pdf2.79 MiB
.pad/116217.55 KiB
[TutsNode.org] - Windows Malware Analysis for Hedgehogs - Beginner Training/6. Portable Executable format and .NET/1.1 PE Basics - 2023-09-05 05.41.30.pdf2.66 MiB

Windows Malware Analysis for Hedgehogs - Beginner Training

Continue browsing

Description

Files (258)