Malware Analysis Fundamentals
Learn how analysts safely triage a suspicious file: build an isolated environment, run static and dynamic analysis, extract indicators of compromise, write a YARA rule and report a verdict. All samples in this course are fictional simulated outputs; no real malware is used.
- Level
- Intermediate
- Study time
- 8 hours
- Lessons
- 5
- Practice labs
- 5
- Assessments
- 2
- Format
- Self-paced, online
What you will learn
By the end of this course you will be able to:
- Describe the controls of a safe, isolated malware analysis environment
- Triage a sample statically: hashes, strings, imports, sections and signs of packing
- Interpret a sandbox report to identify process, file, registry and network behaviour
- Extract and defang indicators of compromise from analyst data
- Review a YARA rule for false-positive and coverage problems
- Produce a verdict, IOC list and containment recommendation
Before you start
Digital Forensics & Incident Response (or equivalent); networking and Windows basics; ability to read command-line output.
Tools you will use
Course outline
5 lessons in 2 modules.
Module 1: Safe setup and static analysis
- Building a safe analysis environment
- Static analysis: hashes, strings and PE headers
Module 2: Behaviour, indicators and reporting
- Dynamic analysis and behaviour observation
- Indicators of compromise and YARA rules
- Writing the analysis report
Practice labs and assessments
Labs run in the browser as simulations. They never touch a real system.
5 practice labs
- Static triage artifact Beginner, 30 min
- Sandbox behaviour report analysis Intermediate, 35 min
- Analysis workstation console Intermediate, 35 min
- IOC extraction and YARA rule review Intermediate, 40 min
- Verdict, IOCs and containment Advanced, 50 min, final lab
2 assessments
- Malware analysis knowledge check
- Malware analysis final quiz
The pass mark is 70%. You can retake an assessment.
Take Malware Analysis Fundamentals
Request access and your instructor will set up your account.