Introduction to Malware Analysis

Jason Geffner & Scott Lambert

Register Now // july 24 - 27

USA 2010 Weekend Training Session //CANCELLED

USA 2010 Weekday Training Session //July 26-27

Overview:

Security researchers are facing a growing problem in the complexity of malicious executables. While dynamic black-box automation tools exist to discover what malware will do on a given execution, it is often important for an analyst to know the full capabilities of a given malware sample. What port does it listen on? What password does it expect for backdoor access? What files will it write to? What will it do tomorrow that it didn't do today?

This class will focus on teaching attendees the steps required to understand the functionality of given malware samples.

This is a hands-on course. Attendees will work on real-world malware through a series of lab exercises designed to build their expertise in understanding the analysis process.

Course Schedule

Day 1

  • Administrivia and Background Information
  • Dynamic Analysis vs. Static Analysis
  • Windows Internals
  • Code and Data Flow on x86 Systems
  • x86 Assembly Language
  • PE File Format

Day 2

  • Analyzing malware with IDA Pro
  • Analyzing malware with OllyDbg
  • Exploits and Shellcode
  • Malware Deobfuscation

Who Should Attend:

This class is for security analysts who wish to learn how to statically and dynamically analyze malware to understand its functionality. Previous experience is not required with reverse engineering or Windows internals.

What Do I Get:

Hard copies of lecture slides and lab exercises.

A CD containing all of the freely distributable tools that will be used in the course.

Course Length:

Two days. All course materials, lunch and two coffee breaks will be provided. A Certificate of Completion will be offered. You must provide your own laptop.

What to bring:

Attendees must bring their own laptop with Microsoft Windows XP, Microsoft Windows Server 2003, or Microsoft Windows Vista installed inside of a virtual machine.

Attendees are expected to have the following software installed in a virtual machine prior to the first day of the course:

Trainers:

Jason Geffner joined Next Generation Security Software Ltd. in June of 2007 as a Principal Security Consultant. Jason focuses on performing security reviews of source code and designs, reverse engineering software protection methods and DRM protection methods, penetration testing web applications and network infrastructures, and developing automated security analysis tools.

Prior to joining NGS, Jason spent three years as a Reverse Engineer on Microsoft Corporation's Anti-Malware Team, where his work involved analyzing malware samples, deobfuscating binaries, and writing tools for analysis and automation. Jason was the Security Research & Response owner of the Windows Malicious Software Removal Tool (MSRT). He chose which new malware families for the MSRT to detect and clean each month based on his analysis of the telemetry and trends of the underground malware community. Jason authored tens of thousands of malware signatures and dozens of malware analyses based on static and dynamic analyses of obfuscated binaries. His work on the MSRT helped hundreds of millions of Windows users each month keep their computers safe and secure. While at Microsoft, Jason was recognized for his reverse engineering skills and for his efforts to drive awareness of reverse engineering practices throughout the company by being given the formal job title "Reverse Engineer"; Jason was the only Microsoft employee with this title.

Jason holds several patents in the fields of reverse engineering and network security. He is a Program Committee member of the Reverse Engineering Conference (REcon) and of the International Conference on Malicious and Unwanted Software, is a regular trainer at Black Hat and other industry conferences, is often credited in industry talks and publications, and has been actively reverse engineering and analyzing software protection methods since 1995.

Scott Lambert is a senior Security Researcher on the Microsoft Malware Protection Center (MMPC) team. Much of Scott's current research centers around binary reverse engineering frameworks that leverage a combination of both static and dynamic binary instrumentation, taint analysis and SMT solvers to aid in vulnerability analysis and signature development. In his spare time he supports the Microsoft Vulnerability Research (MSVR) program by developing proof of concept code execution exploits and serving as a technical expert on 3rd party vendor engagements.

Prior to joining Microsoft, Lambert developed, maintained and supported numerous computer security applications ranging from Vulnerability Assessment and Risk Management software to Network and Host-Based Intrusion Detection/Prevention Systems for companies such as L-3 Network Security, Veridian Information Solutions, Symantec Corporation and TippingPoint, a division of 3Com.

Super Early:
Ends Apr 1
Early:
Ends May 1

Regular:
Ends Jul 1

Late:
Ends Jul 22

Onsite:

$2000

$2200

$2400

$2600

$2900