FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

This popular course explores malware analysis tools and techniques in depth. FOR610 training has helped forensic investigators, incident responders, security engineers, and IT administrators acquire the practical skills to examine malicious programs that target and infect Windows systems. Understanding the capabilities of malware is critical to an organization's ability to derive threat intelligence, respond to information security incidents, and fortify defenses. This course builds a strong foundation for reverse-engineering malicious software using a variety of system and network monitoring utilities, a disassembler, a debugger, and other tools useful for turning malware inside-out.

The course begins by covering fundamental aspects of malware analysis. You will learn how to set up an inexpensive and flexible laboratory to examine the inner workings of malicious software, and how to use the lab to uncover characteristics of real-world malware samples. Then you will learn to examine the specimens' behavioral patterns and code. The course continues by discussing essential x86 assembly language concepts. You will examine malicious code to understand its key components and execution flow. In addition, you will learn to identify common malware characteristics by looking at suspicious Windows API patterns employed by bots, rootkits, keyloggers, downloaders, and other types of malware.

You will also learn how to handle self-defending malware, bypassing the protection offered by packers, and other anti-analysis methods. In addition, given the frequent use of browser malware for targeting systems, you will learn practical approaches to analyzing malicious browser scripts, deobfuscating JavaScript and VBScript to understand the nature of the attack.

You will learn how to analyze malicious documents that take the form of Microsoft Office and Adobe PDF files. Such documents act as a common infection vector and may need to be examined when dealing with large-scale infections as well as targeted attacks. The course also explores memory forensics approaches to examining malicious software, especially useful if the software exhibits rootkit characteristics.

The course culminates with a series of capture-the-flag style challenges designed to reinforce the techniques learned in class and provide additional opportunities to learn practical, hands-on malware analysis skills in a fun setting.

Hands-on workshop exercises are a critical aspect of this course and allow you to apply malware analysis techniques by examining malware in a lab that you control. When performing the exercises, you will study the supplied specimens' behavioral patterns and examine key portions of their code. To support these activities, you will receive pre-built Windows and Linux virtual machines that include tools for examining and interacting with malware.

You Will Learn How To:

  • Build an isolated, controlled laboratory environment for analyzing the code and behavior of malicious programs.
  • Employ network and system-monitoring tools to examine how malware interacts with the file system, registry, network, and other processes in a Windows environment.
  • Uncover and analyze malicious JavaScript and VBScript components of web pages, which are often used by exploit kits for drive-by attacks.
  • Control relevant aspects of the malicious program's behavior through network traffic interception and code patching to perform effective malware analysis.
  • Use a disassembler and a debugger to examine the inner workings of malicious Windows executables.
  • Bypass a variety of packers and other defensive mechanisms designed by malware authors to misdirect, confuse, and otherwise slow down the analyst.
  • Recognize and understand common assembly-level patterns in malicious code, such as DLL injection and anti-analysis measures.
  • Assess the threat associated with malicious documents, such as PDF and Microsoft Office files, in the context of targeted attacks.
  • Derive Indicators of Compromise from malicious executables to perform incident response triage.
  • Utilize practical memory forensics techniques to examine the capabilities of rootkits and other malicious program types.

Course Syllabus
Course Contents
  FOR610.1: Malware Analysis Fundamentals
Overview

Section one lays the groundwork for malware analysis by presenting the key tools and techniques useful for examining malicious programs. You will learn how to save time by exploring Windows malware in two phases. Behavioral analysis focuses on the program's interactions with its environment, such as the registry, network, and file system. Code analysis focuses on the specimen's code and makes use of a disassembler and debugger tools such as IDA Pro and OllyDbg. You will learn how to set up a flexible laboratory to perform such an analysis in a controlled manner, as well as how to set up such a lab on your laptop using the supplied windows and Linux (REMnux) virtual machines. You will then learn how to use the key analysis tools by examining a malware sample in your lab - with guidance and explanations from the instructor - to reinforce the concepts discussed throughout the day.

CPE/CMU Credits: 6

Topics
  • Assembling a toolkit for effective malware analysis
  • Examining static properties of suspicious programs
  • Performing behavioral analysis of malicious Windows executables
  • Performing static and dynamic code analysis of malicious Windows executables
  • Contributing insights to the organization's larger incident response effort

 
  FOR610.2: Malicious Code Analysis
Overview

Section two focuses on examining malicious Windows executables at the assembly level. You will discover approaches for studying the inner workings of a specimen by looking at it through a disassembler and, at times, with the help of a debugger. The section begins with an overview of key code-reversing concepts and presents a primer on essential x86 Intel assembly concepts, such as instructions, function calls, variables and jumps. You will also learn how to examine common assembly constructs such as functions, loops, and conditional statements. The remaining part of the section discusses how malware implements common characteristics, such as keylogging and DLL injection, at the assembly level. You will learn how to recognize such characteristics in suspicious Windows executable files.

CPE/CMU Credits: 6

Topics
  • Core concepts for analyzing malware at the code level
  • x86 Intel assembly language primer for malware analysts
  • Identifying key x86 assembly logic structures with a disassembler
  • Patterns of common malware characteristics at the Windows API level (DLL injection, function hooking, keylogging, communicating over HTTP, etc.)

 
  FOR610.3: In-Depth Malware Analysis
Overview

Section three builds upon the approaches to behavioral and code analysis introduced earlier in the course, exploring techniques for uncovering additional aspects of the functionality of malicious programs. You will learn about packers and the techniques that may help analysts bypass their defenses. Additionally, you will understand how to redirect network traffic in the lab to better interact with malware to understand its capabilities. You will also learn how to examine malicious websites and deobfuscate browser scripts, which often play a pivotal role in malware attacks.

CPE/CMU Credits: 6

Topics
  • Recognizing packed malware
  • Automated malware unpacking tools and approaches
  • Manual unpacking of malware using OllyDbg, process dumping tools and imports-rebuilding utilities
  • Intercepting network connections in the malware lab
  • Interacting with malicious websites to examine their nature
  • Deobfuscating browser scripts using debuggers and runtime interpreters
  • JavaScript analysis complications

 
  FOR610.4: Self-Defending Malware
Overview

Section four focuses on the techniques that malware authors commonly employ to protect malicious software from being examined, often with the help of packers. You will learn how to recognize and bypass anti-analysis measures such as tool detection, string obfuscation, unusual jumps, breakpoint detection, and so on. We will also discuss the role that shellcode plays in the context of malware analysis and learn how to examine this aspect of attacks. As with the other topics covered throughout the course, you will be able to experiment with such techniques during hands-on exercises.

CPE/CMU Credits: 6

Topics
  • Bypassing anti-analysis defenses
  • Recovering concealed malicious code and data
  • Unpacking more sophisticated packers to locate the Original Entry Point
  • Identifying and disabling methods employed by malware to detect analysts' tools
  • Analyzing shellcode to assist with the examination of malicious documents and other artifacts

 
  FOR610.5: Malicious Documents and Memory Forensics
Overview

Section five starts by exploring common patterns of assembly instructions often used to gain initial access to the victim's computer. Next, we will learn how to analyze malicious Microsoft Office documents, covering tools such as OfficeMalScanner and exploring steps to examine malicious PDF documents with practical tools and techniques. Another major topic covered in this section is the reversing of malicious Windows executables using memory forensics techniques. We will explore this topic with the help of tools such the Volatility Framework and associated plug-ins. The discussion of memory forensics will bring us deeper into the world of user and kernel-mode rootkits and allow us to use the context of the infection to analyze malware more efficiently.

CPE/CMU Credits: 6

Topics
  • Analyzing malicious Microsoft Office (Word, Excel, PowerPoint) documents
  • Analyzing malicious Adobe PDF documents
  • Analyzing memory to assess malware characteristics and reconstruct infection artifacts
  • Using memory forensics to analyze rootkit infections

 
  FOR610.6: Malware Analysis Tournament
Overview

Section six assigns students to the role of a malware analyst working as a member of an incident response or forensics team. Students are presented with a variety of hands-on challenges involving real-world malware in the context of a fun tournament. These challenges further a student's ability to respond to typical malware analysis tasks in an instructor-led lab environment and offer additional learning opportunities. Moreover, the challenges are designed to reinforce skills covered in the first five sections of the course, making use of the hugely popular SANS NetWars tournament platform. By applying the techniques learned earlier in the course, students consolidate their knowledge and shore up skill areas where they feel they need additional practice.

CPE/CMU Credits: 6

Topics
  • Behavioral malware analysis
  • Dynamic malware analysis (using a debugger)
  • Static malware analysis (using a disassembler)
  • JavaScript deobfuscation
  • PDF document analysis
  • Office document analysis
  • Memory analysis

The students who score the highest in the malware analysis challenge will be awarded the coveted SANS' Digital Forensics Lethal Forensicator coin. Game on!

 
Additional Information
 
  Laptop Required

Important! Bring your own system configured according to these instructions!

A properly configured laptop is required to participate in this course. Prior to the start of class, you must install virtualization software and meet minimum hardware requirements as described below. If you do not carefully read and follow these instructions, you will leave the class unsatisfied, because you will not be able to participate in hands on-exercises that are essential to this course.

The following are minimal requirements for your laptop:

  • Intel-compatible 2 GHz dual-core CPU (a faster processor is recommended)
  • 8 GB RAM (more memory is recommended)
  • 60 GB of available disk space (more space is recommended)
  • USB port 2.0 or higher
  • Ethernet network interface card (NIC) or built-in Ethernet network port

Note that your laptop needs to have both wireless and wired network capabilities. You also should have the ability to have local administrative rights on the system you will be using during class.

In addition, you will need to have the ability to extract large compressed files. Unzipping utilities built into the operating system might struggle with this. For this reason, please download and install the free 7zip tool.

The Need for VMware Virtualization

Please download and install VMware Workstation 10 or higher or VMware Fusion 6 or higher prior to class. If you do not own a licensed copy of VMware Workstation or Fusion, you can obtain a free 30-day trial copy from VMware. VMware will e-mail you a time-limited serial number when you register for the trial at their web site. Please note that VMware Player is not sufficient for the class because it does not support snapshot functionality, which we will want to use. Also, VirtualBox is not appropriate because of compatibility and troubleshooting problems you might encounter during class.

You will be asked to take multiple snapshots of virtual machines during the course. Experience has shown that students with limited free disk space are more likely to experience snapshot and other VMware performance problems. Please test your ability to run a virtual machine, create snapshot, and restore a snapshot in a timely manner (creating a snapshot should take less than 2 minutes). Some disk encryption software interferes with VMware's ability to create snapshots in a timely fashion.

Using Your System for Malware Analysis

Hands-on exercises will involve operating with malicious code. Although VMware will provide you with reasonable isolation, we do not recommend using your day-to-day production system as your laboratory machine. We expect you to exercise due caution when handling malicious code.

Additional Tools You Will Receive

We will provide you with additional tools for completing hands-on exercises, including a pre-built Linux virtual machine (a version of REMnux). You will also receive a pre-built Windows virtual machine (REM Workstation) along with a corresponding license. Hardware requirements outlined above are meant to ensure that you have sufficient memory and disk space available to simultaneously run the virtual machines.

Final Checklist

Review the following checklist to make sure that your laptop is prepared for the course:

  • Your laptop meets hardware requirements outlined in this note, including an Ethernet card and sufficient processor, memory, and disk space.
  • VMware Workstation 10 or higher or VMware Fusion or higher is installed and operational with a valid license.
  • The VMware license will not expire before the class (if using a trial copy).

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

 
  Who Should Attend

This course acts as a practical and concise on-ramp into the world of malware analysis. It is useful both for individuals looking to enter this exciting field, as well as for those who seek to formalize and expand their skills in this area. Attendees who found this course especially useful often had responsibilities in the areas of incident response, forensic investigation, information security, and system administration. Course participants have included:

  • Individuals who have dealt with incidents involving malware and wanted to learn how to understand key aspects of malicious programs.
  • Technologists who have informally experimented with aspects of malware analysis prior to the course and were looking to formalize and expand their expertise in this area.
  • Forensic investigators and IT practitioners looking to expand their skillsets and learn how to play a pivotal role in the incident response process.

The course begins by covering malware analysis at an introductory level, then quickly progresses to discussing tools and techniques of intermediate complexity. Neither programming experience nor knowledge of assembly is required to benefit from the course. However, you should have a general idea about core programming concepts such as variables, loops, and functions. The course spends some time discussing essential aspects of x86 assembly language, allowing malware analysts to navigate through malicious executables using a debugger and a disassembler.

 
  Prerequisites
  • Attendees should have a computer system that matches the stated laptop requirements. Some software needs to be installed before students come to class.
  • Attendees should be familiar with using Windows and Linux operating environments and be able to troubleshoot general connectivity and setup issues.
  • Students should be familiar with VMware Workstation and be able to create and configure virtual machines.
  • Attendees should have a high-level understanding of key programming concepts such as variables, loops, and functions; however, no programming experience is necessary.

 
  Why Take This Course?

Why Choose Our Course?

The malware analysis process taught in this course helps incident responders assess the severity and repercussions of a situation that involves malicious software so that they can plan recovery steps. Forensics investigators also learn about the key characteristics of malware discovered during the examination, including how to establish Indicators of Compromise for scoping and containing the incident.

What threat does the malicious program pose? What do its mechanics reveal about the adversary's goals and capabilities? What security measures can strengthen the organization's infrastructure from future attacks of this nature? This course teaches the skills necessary to answer these and other questions critical to the organization's ability to handle malware threats and related incidents.

 
  What You Will Receive

When attending this course, you will receive a USB key-based toolkit, packed with practical malware analysis tools. You will use them to perform exercises in class, and then you will be able to use them when examining malicious software when you get back to your job. The tools have been preinstalled and configured for your convenience into two virtual machines that you will receive in the course toolkit:

  • Windows REM Workstation virtual machine, along with a Windows 8.1 license needed to activate the system and take advantage of the preinstalled tools.
  • REMnux virtual machine, set up to run the lightweight Linux distribution used by many malware analysts world-wide.

You will also receive many real-world malware samples that you will examine during the course when performing hands-on lab exercises.

 
  Press & Reviews

Quotes from Former Students

Here are just some of the comments shared with us by course attendees:

  • "Highly valuable content, greatly increased my understanding of malware and techniques to reverse engineer." - Kenneth Miltenberger, U.S. Coast Guard
  • "I thought I knew reversing. This class taught me so much more and provided easy understandings of complex reversing tasks." -David Werden, NGIS
  • "It is an excellent course for those who want hands-on experience understanding an under-the-hood view of malware and how it works." - Ryan Denniston, DoD
  • "Lenny has an incredible ability to make highly technical concepts seem easy." - Anonymous
  • "High valuable content that has immediately boosted my skills. The day 6 CTF was awesome." - Rafe Pilling, Dell Secureworks
  • "Blown away again. FOR610 is intense, challenging, relevant and will take you to the next level!" - Matthew B., BlueCross BlueShield of Louisiana
  • "The best SANS course I've ever attended, and it was easy to say that, great structure of knowledge, great teaching skills, great function." - Karel Nykles, CESNET, z. s. p. o.
  • "Like all SANS courses, it exposes you to everything you need to know in the subject. It lays a foundation for you to keep learning and building the skills taught in class. Nothing could make you an expert in a topic in a week, but this class can take you from zero to a good working knowledge, so you can teach yourself to be an expert." - Dave Lassalle, SANS FOR610 attendee
  • "I learned a variety of tools and techniques for malware analysis in a relatively short time, I am a better forensic analyst and I can better protect my organization." - David Bernal, ALSTOM

See more comments here about this malware analysis course.

Course Reviews

"The SANS Institute is currently the leader in the commercial IR and computer forensic training market. They have a large number of quality courses." - Luttgens, Jason; Pepe, Matthew; Mandia, Kevin. Incident Response & Computer Forensics, Third Edition - July 2014

For additional feedback regarding the course, please see:

 

Additional Resources

Authors of this course created the following cheat sheets to summarize some of the concepts and tools useful for malware analysis:

You can also get a sense for malware analysis approaches explored in this course by looking at the following resources:

This course is a part of SANS' comprehensive Digital Forensics and Incident Response (DFIR) curriculum. Learn more about our DFIR courses and free resources.

*CPE/CMU credits not offered for the SelfStudy delivery method

Online options available. Train from any location.
Type
Topic
Course
/ Location
/ Instructor
Date
Register

Training Event
Malware Jan 16, 2015 -
Jan 21, 2015
 

Training Event
Malware
SANS Dubai 2015
Dubai, United Arab Emirates
Jan 31, 2015 -
Feb 5, 2015
 

Training Event
Malware Feb 23, 2015 -
Feb 28, 2015
 

Training Event
Malware
SANS Secure Singapore 2015
Singapore, Singapore
Mar 9, 2015 -
Mar 21, 2015
 

Training Event
Malware
SANS 2015
Orlando, FL
Apr 11, 2015 -
Apr 18, 2015
 

Training Event
Malware
SANS Canberra 2015
Canberra, Australia
Jun 29, 2015 -
Jul 11, 2015
 

Training Event
Malware
SANS London in the Summer
London, United Kingdom
Jul 13, 2015 -
Jul 18, 2015
 

Summit
Malware Jul 7, 2015 -
Jul 14, 2015
 

Community SANS
Malware
Staff
Nov 30, 2015 -
Dec 5, 2015
 

vLive
Malware
Online
Staff
Jul 14, 2015 -
Aug 20, 2015
 

vLive
Malware
Online
Staff
Nov 10, 2015 -
Dec 17, 2015
 

OnDemand
Malware
Online
Anytime  

SelfStudy
Malware
Online
Anytime  

Onsite
All OnSite Course of Your Choice Your Choice  

*Course contents may vary depending upon location, see specific event description for details.