Malware Analysis Basics

Malware Analysis Basics

Learn malware analysis basics by examining suspicious binaries in a controlled and systematic way. Security teams often need to answer immediate questions about a recovered executable: what it is, what it tries to do, what files it touches, and how dangerous it appears. This course teaches you how to gather those answers through static and dynamic analysis using practical Linux tooling.

Why It Matters

Malware analysis does not always begin with full reverse engineering. In many cases, the first priority is to triage an unknown binary quickly and safely. That means extracting useful signals before execution, then observing runtime behavior closely enough to understand the threat.

This course focuses on that triage workflow. You will inspect binaries statically, trace their system and library activity dynamically, and combine those findings into a clearer picture of behavior and intent.

What You Will Learn

• Perform static analysis on suspicious binaries without executing them.
• Extract strings, hashes, architecture details, and other useful malware indicators.
• Use strace to monitor system calls and observable runtime behavior.
• Use ltrace to inspect library-level behavior and hidden program logic.
• Build a basic malware analysis workflow that balances safety and useful insight.

Course Roadmap

• Static Malware Analysis: Examine the binary safely and extract indicators before execution.
• Dynamic Analysis with strace: Observe file, process, and network behavior through system-call tracing.
• Tracing Library Calls with ltrace: Inspect library interactions to understand internal program logic.
• Malware Reverse Engineering Challenge: Combine static and dynamic analysis to investigate a suspicious recovered binary.

Who This Course Is For

• Learners entering malware analysis and incident response triage.
• Security analysts who need a practical starting point for binary investigation.
• Defenders who want to understand malware behavior without jumping directly into advanced reversing.

Outcomes

By the end of this course, you will be able to analyze suspicious binaries more safely, extract meaningful behavior and indicators, and explain how static and dynamic evidence support malware triage.