# RPISEC Malware Analysis course (CSCI 4976)

> Materials from the student-run Malware Analysis course that RPISEC taught at Rensselaer Polytechnic Institute in Fall 2015, built around the book Practical Malware Analysis. Twelve lectures run from basic static and dynamic analysis, x86 and IDA through Windows internals, malware behavior, data encoding, covert launching, anti-disassembly, anti-VM and anti-debugging, and packing and unpacking to the Windows kernel and rootkit techniques, with ten labs and four projects that include runtime process manipulation, unpacking automation and an APT sample analysis.

- Type: Learning resource
- Targets: Binary
- Category: Learning resources
- Relationship: Learning resource
- Sources reviewed: 2026-11-05
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/RPISEC/Malware>
- Primary source: <https://github.com/RPISEC/Malware/blob/bbd48df47d709a702b9345e5d38cee16af3b37bd/README.md>
- Catalog page: <https://awesomerea.org/resources/rpisec-malware-analysis-course/>
- Record JSON: <https://awesomerea.org/resources/rpisec-malware-analysis-course/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/rpisec-malware-analysis-course/index.md)

## Requirements & limits

- **Prerequisites:** The course expected working C/C++ and some assembly experience, and students read the matching book chapters before each lecture. It used a Windows 7 32-bit analysis VM, which is not distributed; the v1.0_release (2016-01-14) packages installers for the free tools used, such as IDA Free, OllyDbg, WinDbg, the Sysinternals Suite, PEiD, Regshot and Wireshark.
- **Limits:** Most lab and project samples are real malware, stored in ZIP archives encrypted with the password infected; the README says to keep them inside a proper analysis environment. Lectures were not recorded, and slides covering book material are outlines.
- **License:** The repository has no license file and GitHub detects no license; the reviewed master commit dates from 2017-05-11.

## Primary sources

1. <https://github.com/RPISEC/Malware/blob/bbd48df47d709a702b9345e5d38cee16af3b37bd/README.md>
2. <https://github.com/RPISEC/Malware/tree/bbd48df47d709a702b9345e5d38cee16af3b37bd/Labs>
3. <https://github.com/RPISEC/Malware/tree/bbd48df47d709a702b9345e5d38cee16af3b37bd/Lectures>
4. <https://github.com/RPISEC/Malware/releases/tag/v1.0_release>

## More in References and learning

- [Corkami pics](https://awesomerea.org/resources/corkami-pics/index.md) · Learning resource
- [Practical Malware Analysis](https://awesomerea.org/resources/practical-malware-analysis/index.md) · Learning resource
- [Windows Malware Analysis training, volume 1 (malware_training_vol1)](https://awesomerea.org/resources/malware-training-vol1/index.md) · Learning resource
- [esp-idf-injection-ng](https://awesomerea.org/resources/esp-idf-injection-ng/index.md) · Research
- [RE-Workstation](https://awesomerea.org/resources/re-workstation/index.md) · Learning resource
- [Walksnail Ascent VRX UART Protocol](https://awesomerea.org/resources/walksnail-ascent-vrx-uart/index.md) · Documentation

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.