Malware Forensic

Course Description:

The main objective of this course is to give short and focused introduction to malware forensic analysis with emphasis on malware analysis techniques.
Students will gain comprehensive knowledge and practical skills of the topics covered with theories, concepts, and hands-on exercises.
The course covers strategies and techniques for analyzing even the most sophisticated malicious programs. It also shows when to use specified technique and why. Basics of malware collection and detecting are presented with memory forensic techniques and tools. Executable code analysis is introduced with various tools and techniques. Interesting topics such as memory analysis, PDFs, and Office documents analyses for suspicious content, basics of reverse engineering common encoding and encryption algorithms are covered too. At the end of course, sandboxes and their purpose is explained on different examples.
Practical skills will be obtained during lab work using virtual machines and isolated lab network by working on real-life scenarios.

Learning Outcomes:

1. Perform system analysis on malware impact.
2. Create reports on malware digital forensic analysis.
3. Apply processes of malware identification and analysis.
4. Malware identification and classification.
5. Analyze malware behavior.
6. Malware analysis on Windows operating systems.
7. Malware analysis on Linux operating systems.

Course content lectures:

1. Introduction to the Malware Forensics
2. Taxonomy of malicious code
3. Malware threats
4. Legal aspects
5. Creating safe environment for malware analysis
6. Types of analysis: dynamic, static, hybrid
7. Monitoring computer processes
8. Analysis of computer registry
9. Extraction and analysis of malware
10. Tools for malware analysis
11. Monitoring and analysis of network
12. PDF and Microsoft office vulnerabilities
13. Static malware analysis
14. Linux and MAC malware analysis
15. Sandbox
16. Creating reports on malware analysis