Learning resource
RPISEC Malware Analysis course (CSCI 4976)
Materials from the student-run Malware Analysis course that RPISEC taught at Rensselaer Polytechnic Institute in Fall 2015, built around the book Practical Malware Analysis. Twelve lectures run from basic static and dynamic analysis, x86 and IDA through Windows internals, malware behavior, data encoding, covert launching, anti-disassembly, anti-VM and anti-debugging, and packing and unpacking to the Windows kernel and rootkit techniques, with ten labs and four projects that include runtime process manipulation, unpacking automation and an APT sample analysis.
- Targets
- Binary
- Category
- Learning resources
- Relationship
- Learning resource
- Sources reviewed
Requirements & limits
- Prerequisites: The course expected working C/C++ and some assembly experience, and students read the matching book chapters before each lecture. It used a Windows 7 32-bit analysis VM, which is not distributed; the v1.0_release (2016-01-14) packages installers for the free tools used, such as IDA Free, OllyDbg, WinDbg, the Sysinternals Suite, PEiD, Regshot and Wireshark.
- Limits: Most lab and project samples are real malware, stored in ZIP archives encrypted with the password infected; the README says to keep them inside a proper analysis environment. Lectures were not recorded, and slides covering book material are outlines.
- License: The repository has no license file and GitHub detects no license; the reviewed master commit dates from 2017-05-11.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · RPISEC/Malware · Revision bbd48df
- Labs GitHub · RPISEC/Malware · Revision bbd48df
- Lectures GitHub · RPISEC/Malware · Revision bbd48df
- https://github.com/RPISEC/Malware/releases/tag/v1.0_release
More in References and learning
- Corkami pics · Learning resource
- Practical Malware Analysis · Learning resource
- Windows Malware Analysis training, volume 1 (malware_training_vol1) · Learning resource
- esp-idf-injection-ng · Research
- RE-Workstation · Learning resource
- Walksnail Ascent VRX UART Protocol · Documentation