Malware Analysis and Reverse Engineering

Overview

Malware analysts answer practical questions about a suspicious file: is it malicious, what does it do, how does it persist, who does it talk to, and how can we find it everywhere else? Quick triage takes minutes; full reverse engineering can take days.

The work moves from safe, simple steps (hashes, strings, sandbox runs) to deep analysis in a disassembler and debugger. It needs a careful, isolated lab, an understanding of operating system internals and assembly, and a lot of patience.

Why it matters

Every incident involving unknown code needs someone who can analyse it. Malware analysis feeds detection, threat intelligence and incident response, and good reverse engineers are rare.

Typical job roles

• EntrySOC analyst doing malware triage Runs samples through sandboxes and basic tools, and escalates what looks serious.
• Mid-levelMalware analyst Analyses samples statically and dynamically and writes reports and detections.
• SeniorReverse engineer Takes apart complex or obfuscated malware in a disassembler and debugger.
• LeadMalware research lead Leads research on new families and shapes detection strategy.

Prerequisites

• Solid Windows knowledge: processes, the registry, services and the file system.
• Programming in C and Python.
• Networking basics and reading packet captures.
• Willingness to learn x86-64 assembly.

Foundations of computer science Cybersecurity

Tools and technologies

• Ghidra Open source Disassembler and decompiler from the NSA.
• IDA Free Free Free version of the classic disassembler.
• x64dbg Open source Windows debugger.
• FLARE-VM Open source Windows analysis VM setup scripts.
• REMnux Open source Linux toolkit for malware analysis.
• capa Open source Identifies capabilities in executables.
• CAPE Sandbox Open source Malware sandbox with configuration extraction.
• YARA Open source Pattern matching to find malware families.
• oletools Open source Analyse Office documents and macros.

Certifications

Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.

1. Advanced GIAC Reverse Engineering Malware (GREM) GIACThe best-known malware analysis certification.
2. Intermediate Certified Defensive Security Analyst (CDSA) Hack The BoxHands-on defensive skills including malware basics.Cost and exam details
3. Advanced GIAC Certified Incident Handler (GCIH) GIAC (SANS)Incident handling context for analysis work.Cost and exam details

Resources

• Practical Malware Analysis BookPaidMichael Sikorski and Andrew Honig (No Starch Press)
• OpenSecurityTraining2 CourseFreeOpenSecurityTraining2
• MalwareBazaar PracticeFreeabuse.ch
• Malware Traffic Analysis PracticeFreeBrad Duncan
• crackmes.one PracticeFreecrackmes.one
• Malpedia DocsFreeFraunhofer FKIE
• FOR610: Reverse-Engineering Malware CoursePaidSANS Institute
• Practical Binary Analysis BookPaidDennis Andriesse (No Starch Press)

Frameworks and standards

• MITRE ATT&CK A knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
• CAPEC (Common Attack Pattern Enumeration and Classification) A catalogue of attack patterns, the common ways weaknesses are exploited.
• STIX and TAXII The standard language (STIX) and transport (TAXII) for sharing cyber threat intelligence between tools and organisations.

All frameworks and standards

Career path

A common progression. Titles vary between companies.

1. SOC analyst or developer0–2 years
2. Junior malware analyst1–3 years
3. Malware analyst3–6 years
4. Reverse engineer6–9 years
5. Malware research lead10+ years

Related domains to move into

• Digital Forensics and Incident Response (DFIR) Most samples you analyse come from incidents.
• Threat Intelligence (CTI) Your findings become intelligence on actors.
• Detection Engineering Turn behaviour into detections.
• Vulnerability Research Reverse engineering skills carry straight over.