GIAC Reverse Engineering Malware

Before running a sample, you can learn a lot from its file. You identify file types, hashes and strings, read the structure of Windows executables, spot packing, and decide what question to ask next.

• File identification, hashing and reputation lookups
• Strings, encoding and what they hint at
• Windows executable format: headers, sections and imports
• Entropy and signs of packing
• Writing and using YARA rules
• Turning static findings into a hypothesis

You build A static analysis note for three samples, each with a hypothesis and a YARA rule.

Watching a sample run shows what it does to a system and to a network. You monitor file, registry, process and network activity, simulate the services it expects, and pull out its main functions without reading code.

• Monitoring files, registry and processes during execution
• Simulating network services the sample expects
• Capturing and reading its network traffic
• Comparing system state before and after
• Identifying persistence and configuration
• Recording indicators from behavior

You build A behavioral report on one sample, with a table of host and network indicators.

Reading code is the skill that separates classification from understanding. You learn the parts of x86 and x64 assembly an analyst uses most, how the stack and calling conventions work, and how compilers turn familiar code into jumps and loops.

• Registers, memory and common instructions
• The stack, function prologues and epilogues
• Calling conventions and passing arguments
• Conditional jumps, loops and switch statements
• Recognizing compiler patterns
• Reading 32-bit and 64-bit code side by side

You build An annotated disassembly of a small program with each function and branch explained.

Static and dynamic work belong together. You pair a disassembler with a debugger, set breakpoints on the right functions, follow data through a sample and rename what you learn until the code reads like a story.

• Working in a disassembler: navigation and annotation
• Debugger basics: breakpoints, stepping and memory views
• Following data from input to use
• Identifying and renaming functions and variables
• Combining debugger and disassembler findings
• Patching and emulation to reach hidden code

You build A fully annotated analysis of one sample’s main routine with a flow diagram.

Malware must ask Windows for most of what it wants, and the requests give it away. You learn the frequently called functions for files, registry, networking, processes and cryptography, and what each combination means.

• File and registry API patterns
• Network and internet API patterns
• Process and thread API patterns
• Cryptographic API usage and encoded data
• Persistence-related API calls
• Resolving APIs at runtime and spotting dynamic loading

You build An API pattern reference table for ten common malware behaviors, each with a sample from the lab.

Injection lets malware run inside a trusted process. You study the common injection and hollowing methods at the code level, recognize them in disassembly and in behavior, and see what each leaves for a defender.

• Why malware injects into other processes
• Classic injection call sequences
• Process hollowing step by step
• Reflective loading and in-memory execution
• Recognizing injection in a debugger
• Detection and forensic traces of injection

You build An analysis of an injecting sample that identifies the method, the target and the artifacts it leaves.

Packers hide the real code until runtime. You find where a sample unpacks itself, dump it from memory, rebuild the structures needed to analyze it, and verify the result against the original’s behavior.

• How packers and crypters work
• Finding the original entry point
• Dumping a process from memory
• Rebuilding imports and headers
• Handling multi-layer unpacking
• Verifying that the repaired file behaves like the original

You build An unpacked, repaired executable from a packed sample, with the steps to repeat it.

Authors expect to be analyzed and plan for it. You recognize checks for debuggers and virtual machines, obfuscated control flow and strings, detection of security tools and deceptive execution paths, and work around each.

• Anti-debugging techniques and how to pass them
• Virtual machine and sandbox detection
• String and control-flow obfuscation
• Detecting analysis and security tools
• Misdirection: decoy code and false paths
• Documenting anti-analysis as an indicator

You build A list of anti-analysis checks found in two samples, with the method used to bypass each.

Much of today’s malware is not an executable. You analyze JavaScript and PowerShell scripts, untangle obfuscation, examine malicious PDFs and office documents, and trace the chain from document to final payload.

• Deobfuscating JavaScript
• Analyzing PowerShell and its encoded commands
• PDF structure and malicious objects
• Office documents and embedded macros
• Shellcode found inside documents
• Following a delivery chain to the final stage

You build A delivery-chain analysis from a malicious document to its final payload, with indicators.

Managed code compiles to a form that decompiles cleanly, which helps and misleads. You analyze .NET programs with decompilers and debuggers, deal with obfuscators, and recover configuration and logic.

• How .NET assemblies are structured
• Decompiling with dnSpy and ILSpy
• Debugging managed code
• Common .NET obfuscation and its removal
• Extracting embedded resources and configuration
• Loaders that load assemblies from memory

You build A decompilation analysis of a .NET sample with its recovered configuration and logic.

Take an unknown sample from first contact to a report. You apply static, behavioral and code analysis as the sample demands, document the functions and indicators, and write detections that other teams can use.

• Triage and the first hypothesis
• Choosing and combining analysis methods
• Documenting capabilities and indicators
• Writing detections and response advice
• Presenting the report to a responder

You build A complete malware analysis report with capabilities, indicators and detection content.