PDF Course Advanced Malware Analysis PDF

MANDIANT Advanced Malware Analysis
As malware authors continue to improve in their efforts to thwart the reverse engineering of their tools,
analysts must learn to combat this sophisticated malware by studying its anti-analysis techniques. This
course is focused on advanced topics related to combating malware defense mechanisms. Designed for
the experienced malware analyst, students will learn to create scripts for IDA Pro and various debuggers
to overcome challenging or repetitive tasks. Students will also learn how to defeat packed and armored
executables and will be challenged to demonstrate these skills several times throughout the course.
Additional topics covered will include malware stealth techniques such as process injection and rootkit
technology along with tools and techniques to aid in their analysis. All concepts and material presented
are reinforced with demonstrations, real-world case studies, follow-along exercises and student labs to
allow students to practice what they have learned.
Duration 5 days
Who Should Attend Information security staff, forensic investigators, or others requiring an
understanding of how to overcome difficult challenges in malware
analysis.
Prerequisites Training or experience in malware analysis and extensive knowledge of

computer and operating system fundamentals is required. Exposure to
software development and completion of MANDIANTs Intermediate
Malware Analysis course is also highly recommended.
Students Will Learn IDA Pro scripting

How to use scriptable debuggers
How to conduct analysis of nontraditional programs
How to unpack strongly protected binaries
How to defeat anti-reverse engineering techniques
How to recognize and defeat data encryption and encoding
techniques
How to capture and analyze stealth malware
Exercises & Labs Using scripts to simplify Identifying stealth techniques

disassembly and debugging such as process injection
Identifying obfuscation Identifying anti-analysis
methods techniques
Familiarization with various Final exercise: analysis of
programming languages several pieces of advanced
malware from real-world
intrusions
Course Materials Student manual Course certificate

Class handouts MANDIANT gear
Suggested Next Courses MANDIANT Enterprise Incident Response
Contact 1.800.647.7020
[email protected]
www.mandiant.com/education.htm
2011 MANDIANT All Rights Reserved

Advanced Static Analysis Anti-Reverse Engineering
Clever malware authors will attempt to complicate In this section we discuss the latest techniques
the reverse engineering process by forcing the that malware authors use to complicate analysis.
malware analyst to conduct fairly complex tasks in Topics include:
repetitive fashion. Defeating malware of this Virtual machine detection
nature may take days or weeks if attempted by Debugger detection
hand. In this section we will discuss scripting the Hardware breakpoint detection
IDA Pro disassembler to tackle these challenges as Software breakpoint detection
well as other tools to enhance and expedite the Anti-disassembler tricks
static analysis process.
Data Encryption & Encoding

Advanced Dynamic Analysis
An important trick of the trade in malware
Several scriptable debugging systems are analysis is the ability to recognize and reverse
introduced in this section to prepare students for various methods used to encode data. Malware
the difficult protection mechanisms and packers authors encode data to hide the data from a
used by todays malware authors. The Windows casual observer. For example, strings within a
Debugging API is introduced with in-depth binary file or data in a network packet are
coverage of debugging internals. Students are obfuscated to defeat the strings and other text
taught how to script and control the debugging inspection utilities.
process in C or Python as well as proprietary
debugging languages. Topics in this section will
include OllyDbg with OllyScript, The PaiMai Stealth Malware
Framework, Immunity Debugger, using the
Windows Debugging API, API interception and A fascinating and increasingly relevant area of
other advanced techniques. malware defense strategies is to employ stealth
techniques to prevent the detection and capture of
the malware itself. This section will cover in-depth
Non-Traditional Binaries the technique of process injection in all its forms.
Several practical samples are presented for
The malware authors choice of programming detection and analysis. Kernel level rootkit
language can play a large role in hindering the technologies are introduced as well as tools to aid
malware analysis process. Without detailed in their analysis.
understanding of the inner-workings of compiled
binaries from many modern high-level
programming languages, understanding a Analyzing Shellcode and Exploits
programs high level constructs might remain an
elusive target. In this section we will discuss and An agile malware analyst must learn to step
analyze binaries compiled with C++, .NET, Visual outside the bounds of conventional software.
Basic, Delphi and Perl2Exe. Malicious code can come in many forms besides a
standard executable or DLL file. This section will
introduce the student to the challenges of reverse
Packers engineering software exploits and the malicious
executable payloads known as shellcode.
Approximately 70% of the malware MANDIANT
encounters is packed. Packing of malware is a
major issue for the analyst since any static Class Exercises
analysis of packed code is almost entirely useless.
In this section we discuss the internals of several The capstone of the course challenges the student
packers, present techniques to unpack code and to apply all their new knowledge and skill against
tools and methods necessary to reconstitute an a series of well protected malware samples in a
unpacked binary into an easier to analyze real world scenario.
unpacked version of the packed program.
2011 MANDIANT All Rights Reserved

PDF Course Advanced Malware Analysis PDF

Uploaded by

Copyright:

Available Formats

PDF Course Advanced Malware Analysis PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

PDF Course Advanced Malware Analysis PDF

Uploaded by

Copyright:

Available Formats

MANDIANT Advanced Malware Analysis

Prerequisites Training or experience in malware analysis and extensive knowledge of

Students Will Learn IDA Pro scripting

Exercises & Labs Using scripts to simplify Identifying stealth techniques

Course Materials Student manual Course certificate

Suggested Next Courses MANDIANT Enterprise Incident Response

2011 MANDIANT All Rights Reserved

Data Encryption & Encoding

2011 MANDIANT All Rights Reserved

You might also like