Course · NCMA

NSD Certified Malware Analyst

Take malware apart, from the first infection to memory forensics.

A course by the Cybersecurity & AI Initiative, an ISAC Foundation centre.

Length
62 hours
Format
E-learning videos with Cyberange virtual labs; advanced training on request for groups of 10 or more
Certification
Listed in the National Security Database at Falcon level; two attempts to pass
Before you start
NCRE recommended

About the course

A programme for experienced cybersecurity learners on reversing and malware analysis: from infection vectors and sandboxing through static and dynamic code analysis, unpacking and memory forensics, to evasive malware.

What you become

A malware analyst listed in the National Security Database at Falcon level.

Who it is for

  • Security researchers
  • Students and professionals keen on forensics and malware investigation
  • Security teams
  • Law-enforcement agencies
  • Military and police personnel

Curriculum

  1. Infection vectors and discovery

    Sandboxing, PE and ELF formats, packers, assembly primer

    Infection vectors and malware discovery; sandboxing and runtime analysis; PE and ELF file formats; executable metadata and packers; an assembly primer.

  2. Building the toolkit

    Static properties, behaviour, static and dynamic code analysis

    Assembling a malware-analysis toolkit; static properties; behavioural analysis; static and dynamic code analysis of Windows executables.

  3. Low-level analysis

    x86 and x64 assembly, control flow, Windows API behaviours

    Low-level software and x86/x64 assembly; disassemblers and control flow; recognising malware behaviours at the Windows API level.

  4. Malicious documents and fileless malware

    JavaScript, PDF and Office files, unpacking, injection, memory forensics

    Malicious websites and JavaScript deobfuscation; PDF, Office and RTF documents; packed malware and unpacking; fileless malware; code injection and API hooking; memory forensics.

  5. Evasive malware

    Anti-debugging, anti-VM, obfuscation, process hollowing

    Anti-debugging, anti-disassembly, anti-VM and obfuscation techniques; process hollowing; dynamic, static and memory analysis; reversing Python, Java and .NET bytecode.

What is included

  • 60 days of e-learning and Cyberange virtual labs

Enrol

Send an enquiry to the Cybersecurity & AI Initiative from this page.