Malware Analysis Fundamentals (Intermediate)

This course covers static analysis (examining a file without running it) and dynamic analysis (reading behavior out of sandbox and monitoring reports), building the judgment for which technique fits which situation. It follows NIST SP 800-83 Rev. 1 and works in the tools analysts actually reach for — disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen. Dynamic analysis is taught through explanation and example reports alone; no lab, sandbox, or live sample is required. A thread on sample sensitivity, data handling, and structured reporting runs the length of the course.

The course closes by tying it together: participants track a single sample from first triage through a written report modeled on the CISA Malware Analysis Report (MAR) format — the structure most analysts already have to produce — built to read cleanly for both a technical and a leadership audience.

What You Will Learn

• Static analysis: triage, string and metadata extraction, YARA, basic disassembly
• Read dynamic analysis output (sandboxing, monitoring, network simulation) and recognize evasive behavior from example reports
• Capture network IOCs and correlate them with threat intel and MITRE ATT&CK
• Reach for FLARE-VM, REMnux, and CISA Malware Next-Gen where each is appropriate, as against public multi-scanners
• Write a CISA-MAR-style report that serves both technical and leadership readers
• Track a single sample from first triage through to final report in a worked example

Course Outline

Module 1

Foundations & Isolated Analysis Environments

Module 2

Static Analysis Fundamentals

Module 3

Static Analysis: Disassembly & Code-Level Review

Module 4

Dynamic Analysis Fundamentals — via example reports, no lab

Module 5

Network & Behavioral Analysis

Module 6

Toolkits & Federal Analysis Platforms

Module 7

Reporting, MARs & Best Practices

Module 8

Capstone Analysis Exercise & Program Development