Malware Analysis
Understanding suspicious samples defensively — safe handling, static and dynamic analysis, behavior, persistence, network activity — and turning what a sample DOES into IOCs, ATT&CK mappings and detections. Recommended prior knowledge: Cyber Foundations or Digital Forensics.
What you will be able to do
- Handle and triage a suspicious sample safely, choosing static or dynamic analysis by question.
- Determine a sample's capabilities, persistence and network behavior from safe synthetic artifacts.
- Convert observed behavior into IOCs, ATT&CK techniques and a detection handoff.
Units
- 01
Foundations & Safe Handling
What defensive malware analysis is, safe handling, the isolated analysis environment, the triage workflow, and static vs dynamic analysis.
BeginnerAvailableWhy you are learning this
A single careless double-click can infect the analyst's own network. This module builds the safety discipline everything else depends on.
- 02
Static Analysis
File types and PE structure, hashes, strings, imports and exports, sections and entropy, and packing awareness — all WITHOUT executing the sample.
BeginnerAvailableWhy you are learning this
Static analysis is the safe first look that shapes everything after it: it costs nothing and never runs the code, yet often reveals a sample's capabilities.
Unit contents7
Theory Lessons(6)
Practical Labs(1)
- 03
Dynamic & Behavioral Analysis
Detonating safely in a sandbox, process creation and command lines, file and registry activity, and reading sandbox-style behavior reports.
BeginnerAvailableWhy you are learning this
What a sample actually DOES when it runs is the ground truth static analysis can only guess at. This module reads behavior directly.
Unit contents7
Theory Lessons(6)
Practical Labs(1)
- 04
Persistence, Injection & Anti-Analysis
Persistence mechanisms, process injection and hollowing concepts, credential-access behavior, and anti-analysis: VM/debugger/sandbox evasion.
Job-ReadyAvailableWhy you are learning this
Advanced samples hide, persist and fight back. This module teaches recognizing those techniques so 'nothing happened' is never mistaken for 'it detected me'.
- 05
Network Behavior & C2
DNS and HTTP behavior, C2 indicators and beaconing, mutexes and named pipes, dropped files and LOLBin abuse in traffic.
Job-ReadyAvailableWhy you are learning this
Malware that communicates reveals its infrastructure and rhythm. This module turns network behavior into the most durable, shareable indicators.
Unit contents7
Theory Lessons(6)
Practical Labs(1)
- 06
IOCs, Detection Handoff & the ZAHF Case
IOC extraction and confidence, ATT&CK mapping, YARA and Sigma awareness, the detection handoff, the analyst report, family-attribution caution — and the integrated ZAHF capstone.
Job-ReadyAvailableWhy you are learning this
An analysis that produces no detection and no report defended nobody. This module closes the loop from sample to protection — then proves it on a full case.
Unit contents7
Recommended next
Detection Engineering
Turning attacker behavior and telemetry into high-quality, maintainable detections — from requirements and data quality through detection logic, testing, false-positive tuning, coverage and production readiness. Tool-neutral (Sigma-style logic). Recommended prior knowledge: SOC, Threat Hunting or Malware Analysis.
Digital Forensics (DFIR)
Reconstructing what happened from evidence — execution artifacts, registry, event logs, filesystem metadata, memory and network traces — into a defensible timeline and report. Recommended prior knowledge: Cyber Foundations or Incident Response.