# Windows Malware Analysis training, volume 1 (malware_training_vol1)

> Slides and exercises for a Windows malware analysis training that builds an understanding of common malware techniques through programming, reverse engineering and Windows internals, and shows how analysis tools are used for particular goals. Module 1 covers compilation, the PE format, processes, WoW64, shellcode and PE loaders; module 2 introduces malware missions and tactics, hooking, persistence and banking trojans; module 3 introduces evasion and self-defence and fingerprinting, with obfuscation, anti-hooking, deobfuscation and kernel-mode components planned.

- Type: Learning resource
- Targets: Binary
- Category: Learning resources
- Relationship: Learning resource
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/hasherezade/malware_training_vol1>
- Primary source: <https://github.com/hasherezade/malware_training_vol1/blob/acf72d45009140fed514c1dfa429122f01a2f6c0/README.md>
- Catalog page: <https://awesomerea.org/resources/malware-training-vol1/>
- Record JSON: <https://awesomerea.org/resources/malware-training-vol1/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/malware-training-vol1/index.md)

## Requirements & limits

- **Prerequisites:** Aimed at people who already know the basics of programming and reverse engineering and want to enter Windows malware analysis. Slides are in slides/ and exercises in exercises/.
- **Limits:** The README marks the material as a work in progress: several topics still lack slides or exercises. The reviewed main commit dates from 2024-07-01.
- **License:** Published under the Creative Commons Attribution 4.0 license, per the README; the repository has no license file.

## Primary sources

1. <https://github.com/hasherezade/malware_training_vol1/blob/acf72d45009140fed514c1dfa429122f01a2f6c0/README.md>
2. <https://github.com/hasherezade/malware_training_vol1/tree/acf72d45009140fed514c1dfa429122f01a2f6c0/exercises>
3. <https://github.com/hasherezade/malware_training_vol1/tree/acf72d45009140fed514c1dfa429122f01a2f6c0/slides>

## More in References and learning

- [esp-idf-injection-ng](https://awesomerea.org/resources/esp-idf-injection-ng/index.md) · Research
- [RE-Workstation](https://awesomerea.org/resources/re-workstation/index.md) · Learning resource
- [Walksnail Ascent VRX UART Protocol](https://awesomerea.org/resources/walksnail-ascent-vrx-uart/index.md) · Documentation
- [T2 platform research](https://awesomerea.org/resources/t2-platform-research/index.md) · Research
- [Glaurung Models](https://awesomerea.org/resources/glaurung-models/index.md) · Research
- [CrackMes](https://awesomerea.org/resources/crackmes-writeups/index.md) · Learning resource

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.