What You Will Learn

As defenders hone their analysis skills and automated malware detection capabilities improve, malware authors have worked harder to achieve execution within the enterprise. The result is malware that is more modular with multiple layers of obfuscated code that executes in-memory to reduce the likelihood of detection and hinder analysis. Malware analysts must be prepared to tackle these advanced capabilities and use automation whenever possible to handle the volume, variety and complexity of the steady stream of malware targeting the enterprise.

FOR710: Advanced Code Analysis continues where FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques course leaves off, helping students who have already attained intermediate-level malware analysis capabilities take their reversing skills to the next level. Authored by SANS Certified Instructor Anuj Soni, this course prepares malware specialists to dissect sophisticated Windows executables, such as those that dominate the headlines and preoccupy incident response teams across the globe.

Developing deep reverse-engineering skills requires consistent practice. This course not only includes the necessary background and instructor-led walk throughs, but also provides students with numerous opportunities to tackle real-world reverse engineering scenarios during class.

“As malware gets more complicated, malware analysis has as well. In recent years, malware authors have accelerated their production of dangerous, undetected code using creative evasion techniques, robust algorithms, and iterative development to improve upon weaknesses. Proficient reverse engineers must perform in-depth code analysis and employ automation to peel back the layers of code, characterize high-risk functionality and extract obfuscated indicators.” – Anuj Soni

FOR710 Advanced Code Analysis Will Prepare You To:

Tackle code obfuscation techniques that hinder static code analysis, including the use of steganography.
Identify the key components of program execution to analyze multi-stage malware in memory.
Locate and extract deobfuscated shellcode during program execution.
Develop comfort with non-executable file formats during malware analysis.
Probe the structures and fields associated with a PE header.
Use WinDBG Preview for debugging and assessing key process data structures in memory.
Identify encryption algorithms in ransomware used for file encryption and key protection.
Recognize Windows APIs that facilitate encryption and articulate their purpose.
Investigate data obfuscation in malware, pinpoint algorithm implementations, and decode underlying content.
Create Python scripts to automate data extraction and decryption.
Build rules to identify functionality in malware.
Use Dynamic Binary Instrumentation (DBI) frameworks to automate common reverse engineering workflows.
Write Python scripts within Ghidra to expedite code analysis.
Use Binary Emulation frameworks to simulate code execution.

Course Topics:

Code deobfuscation
Program execution
Shellcode analysis
Steganography
Multi-stage malware
WinDbg Preview
Encryption algorithms
Data obfuscation
Python scripting for malware analysis
Dynamic Binary Instrumentation (DBI) Frameworks
Binary emulation frameworks
Payload and config extraction
Scripting with Ghidra
YARA rules
Yara-python
SMDA disassebler

What You Will Receive With This Course:

Windows 10 VM with pre-installed malware analysis and reversing tools.
Real-world malware samples to examine during and after class.
Coursebooks and workbook with detailed step-by-step exercise instruction.

Listen to course author Anuj Soni as he provides a course preview in this livestream

Syllabus (36 CPEs)

Download PDF

Code Deobfuscation and Execution
Overview
Malware authors complicate execution and obfuscate code to hide data, obscure code, and hinder analysis. Using evasion techniques and in-memory execution, malicious developers continue to thwart detection and complicate reverse engineering efforts. To facilitate an in-depth discussion of code deobfuscation and execution, this section first discusses the creative use of steganography to hide malicious content. Then, we discuss the key steps in program execution, so we can identify how code is launched and label functions accordingly. This includes a review of the Windows loader and an inspection of the Portable Executable (PE) file format. Finally, we cover how to analyze shellcode with the support of WinDbg Preview, a powerful Windows debugger.
Exercises
- Investigating Code Deobfuscation Using Steganographic Techniques
- Analyzing Malicious Program Execution
- Analyzing Shellcode Execution
Topics
- Analyzing Code Deobfuscation
- Identifying Program Execution
- Understanding Shellcode Execution
Encryption in Malware
Overview
This section tackles a critical area of reverse-engineering malware: the use of encryption in malware. Cryptography is used by adversaries for a variety of reasons, including to encrypt files, protect keys, conceal configuration settings, and obfuscate command and control (C2) communications. To perform comprehensive investigations of high-impact malware, skillful reverse engineers must be prepared to investigate routines that implement encryption and articulate their purpose.
Exercises
- Encryption Essentials Knowledge Quiz
- Identifying File Encryption and Key Protection in Ransomware
- Analyzing Data Encryption In Malware
Topics
- Encryption Essentials
- File Encryption and Key Protection
- Data Encryption in Malware
Automating Malware Analysis
Overview
In this section, we discuss approaches to automating malware analysis. We introduce the Python programming language and write scripts to decrypt configuration data, deobfuscate strings, and extract payloads. We also explore a Dynamic Binary Instrumentation (DBI) framework, and students use this capability to inject and execute code within a process to examine its internals. We write Python scripts to automate the debugging process and dump unpacked code.
Exercises
- Automating Config Extraction with Python
- Automating Payload Extraction with Frida
Topics
- Python for Malware Analysis
- Malware Analysis with Dynamic Binary Instrumentation (DBI) Frameworks
Automating Malware Analysis (Continued)
Overview
In this section, we continue discussing approaches to automating malware analysis. We introduce Ghidra’s API and write Python scripts to accelerate static code analysis. We also examine the value of binary emulation frameworks and use the Qiling framework to simulate execution and deobfuscate code and data.
Exercises
- Scripting with Ghidra
- Emulating Code with Qiling (using Ghidra)
- Emulating Code with Qiling (using SMDA)
Topics
- Automating Analysis within Ghidra
- Binary Emulation Frameworks
Advanced Malware Analysis Tournament (Extended Access)

Overview
The final section of this course gives students an opportunity to flex their new knowledge and skills in a more independent, competitive environment. Participants will have extended access (beyond a 5-day live class) to a capture the flag (CTF) platform, where they will attempt a combination of multiple choice and short-answer challenges. Students must recall key concepts and perform workflows discussed in class to successfully navigate the tournament and accumulate points. Whether or not competition motivates you, this section presents an excellent opportunity to analyze real-world, complex malware samples and reinforce your new advanced code analysis skills.

Prerequisites

FOR710 is an advanced level Windows reverse-engineering course that skips over introductory and intermediate malware analysis concepts. This course assumes that students have knowledge and skills equivalent to those discussed in the SANS FOR610 Reverse-Engineering Malware course. Students should have at least six months of experience performing behavioral analysis, dynamic code analysis (i.e., using a debugger), and static code analysis (i.e., analyzing disassembled executable content). In addition, students should have some prior exposure to the Ghidra reverse engineering framework. If you're not familiar with this capability, consider watching this brief introduction by Anuj Soni.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

MANDATORY FOR710 SYSTEM HARDWARE REQUIREMENTS

CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
16GB of RAM or more is required.
200GB of free storage space or more is required.
At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

MANDATORY FOR710 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
Download VMware Workstation Pro 17.5.X+ for Windows hosts or VMWare Fusion Pro 13.5.X+ for macOS hosts prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. This course requires a "Pro" version of VMware software. The "Player" versions are not sufficient.
On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact customer service.

Author Statement

"As malware gets more complicated, malware analysis has as well. In recent years, malware authors have accelerated their production of dangerous, undetected code using creative evasion techniques, robust algorithms, and iterative development to improve upon weaknesses. Proficient reverse engineers must perform in-depth code analysis and employ automation to peel back the layers of code, characterize high-risk functionality and extract obfuscated indicators" - Anuj Soni

Ways to Learn

OnDemand

Cybersecurity learning – at YOUR pace! OnDemand provides unlimited access to your training wherever, whenever. All labs, exercises, and live support from SANS subject matter experts included.

Live Online

The full SANS experience live at home! Get the ultimate in virtual, interactive SANS courses with leading SANS instructors via live stream. Following class, plan to kick back and enjoy a keynote from the couch.

View Available Dates & Time Zones

In Person (5 days)

Did someone say ALL-ACCESS? On-site immersion via in-classroom course sessions led by world-class SANS instructors fill your day, while bonus receptions and workshops fill your evenings.

View Available Dates & Locations

Who Should Attend FOR710?

Cyber security professionals who want to improve upon their intermediate-level reverse-engineering skills.

Reverse engineers who need to improve their abilities to analyze obfuscated code, assess encryption capabilities in malware, and automate analysis tasks.

NICE Framework Work Roles:

Cyber Defense Incident Responder (OPM 531)
Cyber Crime Investigator (OPM 221)
Law Enforcement/Counter Intelligence Forensics Analyst (OPM 211)
Cyber Defense Forensics Analyst (OPM 212)

See prerequisites

Need to justify a training request to your manager?

Use this justification letter template to share the key details of this training and certification opportunity with your boss.

Download the Letter

Reviews

The labs and exercises for the automation were excellent and really showed off what is needed to perform RE through automation.

Daniel T.

DOJ

I was recently named our IR lead, and coming from purple teaming/pentesting I needed the content of this course to make meaningful improvements to the program. I feel well prepared to tackle the challenges ahead now

Ryan M.

I really enjoyed this course. I felt that it was a good and logical next step after taking FOR610. The material made sense and was relevant to what I see at work every day.

Daniel R.

CrowdStrike

FOR710: Reverse-Engineering Malware: Advanced Code Analysis™

Course Authors:

Anuj Soni

What You Will Learn

FOR710 Advanced Code Analysis Will Prepare You To:

Course Topics:

What You Will Receive With This Course:

Syllabus (36 CPEs)

Code Deobfuscation and Execution

Overview

Exercises

Topics

Encryption in Malware

Overview

Exercises

Topics

Automating Malware Analysis

Overview

Exercises

Topics

Automating Malware Analysis (Continued)

Overview

Exercises

Topics

Advanced Malware Analysis Tournament (Extended Access)

Overview

Prerequisites

Laptop Requirements

MANDATORY FOR710 SYSTEM HARDWARE REQUIREMENTS

MANDATORY FOR710 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

Author Statement

Ways to Learn

Who Should Attend FOR710?

Need to justify a training request to your manager?

Reviews

Filters:

Register for FOR710

Loading...