HackTheKnowledge logoES
IntermediateWindows Malware16h of content · 2 guided labsAudio:ES750 XP

Windows Malware Intermediate

Hands-on Windows malware analysis at intermediate level: bypass anti-debugging and sandbox evasion with ScyllaHide, manually unpack protected binaries with x64dbg, detect process injection and process hollowing, extract C2 configurations from live traffic, and deliver professional DFIR reports with MITRE ATT&CK TTPs, IOCs, and detection rules.

14-day money-back guarantee · No subscription · Lifetime access

Preview the student experience

No login · Free interactive demo

Try demo →

2

Guided labs

Isolated VM environment

16h

Of content

Videos + labs + practice + exams

5

Modules

Progressive difficulty

2–4h

Per lab session

Unlimited restarts

HTKWhat's included
  • Full Intermediate course (video lessons + written content)
  • 2-4 guided labs — less guided, more complex than Beginner
  • Advanced per-module exams
  • HTK Intermediate certificate
  • Lifetime access, unlimited lab restarts
  • Expert instructor reviews your reports & assignments
159 €

One-time payment, no subscription

Start Learning →

Lab tools you will use

FLARE-VMEnvironmentx64dbgDebuggerScyllaHideLab toolPE-StudioStatic analysisProcmonMonitoringProcess ExplorerMonitoringCAPADetectionYARADetectionFakeNet-NGNetworkWiresharkNetworkFLARE-VMEnvironmentx64dbgDebuggerScyllaHideLab toolPE-StudioStatic analysisProcmonMonitoringProcess ExplorerMonitoringCAPADetectionYARADetectionFakeNet-NGNetworkWiresharkNetwork
AutorunsPersistenceDIEStatic analysisFLOSSStringsScyllaUnpackingPE-sieveDetectionHollowsHunterLab toolCyberChefDecoderSysmonEndpoint logsSigmaDetectionAutorunsPersistenceDIEStatic analysisFLOSSStringsScyllaUnpackingPE-sieveDetectionHollowsHunterLab toolCyberChefDecoderSysmonEndpoint logsSigmaDetection

Before you start — quick answers

Not for beginner courses. They start from scratch with guided, step-by-step instructions.

Each lab session opens a 2–4 hour maximum VM session window. You can restart it as many times as you need — unlimited restarts are included with your purchase.

Yes. Unlimited restarts are included with your purchase. Practice as much as you want.

Yes. Your HTK certificate is issued upon completing the final lesson of the last module. Course progress is sequential — each lesson unlocks the next.

Course Syllabus

5 modules · 16h of content

Each phase maps to a module in this course. Scroll to see how the curriculum builds, module by module.

1

Module 1

Intermediate

Packing, Obfuscation, and Anti-Analysis Techniques

  • •Packing fundamentals: stub + payload architecture, entropy analysis with DIE and PEStudio (7.8/8 entropy as packing indicator), UPX and custom packer identification
  • •Disabling ASLR for controlled analysis: dynamic-base PE flag, BCD edit and CFF Explorer techniques
  • •String obfuscation: XOR, RC4, and base64 encoding chains — decoding with FLOSS and CyberChef recipes
  • •Anti-debugging bypass: IsDebuggerPresent, PEB BeingDebugged flag, NtGlobalFlag, heap flag patching — manual bypass and ScyllaHide plugin (3 bypass levels)
  • •Timing-based anti-debugging: GetTickCount and RDTSC delta checks — detecting and neutralizing with conditional jump patching
  • •Anti-VM and sandbox evasion: VMware/VirtualBox artifact checks, hardware heuristics (RAM, CPU cores, screen resolution), sleep gating, user interaction detection
  • •MITRE ATT&CK: T1027 (Obfuscated Files), T1622 (Debugger Evasion), T1497 (Virtualization/Sandbox Evasion)
  • •Module exam
2

Module 2

Intermediate

Manual Unpacking with x64dbg and Scylla

  • •Packed binary identification: DIE + PEStudio entropy analysis, imported function count as a packing signal
  • •EP vs OEP: understanding the packer stub execution flow and tail jump patterns (jmp rax, push+ret, call-return sequences)
  • •x64dbg unpacking workflow: load sample → set breakpoints on VirtualAlloc/VirtualProtect → trace stub execution → reach OEP
  • •Dump with Scylla: image dump at OEP, diagnosing and fixing wrong-module and wrong-timing failures
  • •IAT reconstruction: Scylla IAT AutoSearch → Get Imports → Fix Dump — resolving thunks and invalid pointers
  • •Validating the unpacked binary: re-triage with DIE, PEStudio, and CAPA on the dump output
  • •Multi-layer packing indicators and how to identify further packed stages for repeated unpacking
  • •Module exam
3

Module 3

Intermediate

Process Injection and Process Hollowing Analysis

  • •Classic shellcode injection: OpenProcess → VirtualAllocEx → WriteProcessMemory → CreateRemoteThread — step-by-step trace in x64dbg
  • •Private executable memory as key forensic artifact: no module name, RX/RWX permissions — identification in Process Explorer and Process Hacker
  • •DLL injection via LoadLibrary: detecting Load Image events in Procmon, confirming the module list in Process Explorer
  • •Reflective DLL injection: no LoadLibrary call, no module list entry — automated detection with PE-sieve
  • •Process hollowing (RunPE): CreateSuspended → NtUnmapViewOfSection → WriteProcessMemory → SetThreadContext → ResumeThread
  • •Entry point and base relocation mechanics in hollowing — why image base and EP must align for the hollow to execute correctly
  • •Detection with PE-sieve, HollowsHunter, Process Explorer/Hacker, and Procmon: suspicious parent-child process trees and memory-disk mismatches
  • •MITRE ATT&CK: T1055 (Process Injection), T1055.012 (Process Hollowing), T1055.001 (DLL Injection) — Defense Evasion + Execution
  • •Module exam
4

Module 4

Intermediate

C2 Traffic Analysis and Configuration Extraction

  • •Beaconing patterns: periodicity and jitter analysis (Cobalt Strike default 60s, Meterpreter 5s) — visualizing timing anomalies with Wireshark IO Graph
  • •HTTP C2 indicators: consistent URI paths (gate.php patterns), user-agent spoofing, base64-encoded POST body, content-length consistency
  • •HTTPS C2 analysis: SNI extraction, self-signed certificate detection, JA3/JA3S fingerprinting, short-validity and no-SAN flags
  • •DNS-based C2: fast-flux (many IPs, low TTL), domain rotation, DGA identification via NXDOMAIN burst analysis
  • •Alternative C2 channels: DNS-over-HTTPS, ICMP tunneling, Cobalt Strike SMB named-pipe beacon, C2 over GitHub and Pastebin (malleable C2)
  • •Static configuration extraction: locating encrypted blobs in .rdata/.data sections, recognizing config keyword markers (cfg, gate, sleep, jitter, URI)
  • •Dynamic configuration extraction: let the malware decrypt itself in x64dbg → search memory → dump the decrypted config region
  • •Decoding with CyberChef: base64 + XOR chain recipes and custom decode pipeline construction
  • •Sysmon correlation: event IDs 3 (network connection), 22 (DNS query), 4688 (process create), and mutex names as host-based IOCs
  • •MITRE ATT&CK: T1071 (Application Layer Protocol), T1573 (Encrypted Channel), T1568 (Dynamic Resolution), T1041 (Exfiltration over C2)
  • •Module exam
5

Module 5

Intermediate

End-to-End Case Study — From Sample to DFIR Report

  • •Full analyst pipeline: SHA256 → VirusTotal → static triage (DIE, PEStudio, FLOSS, CAPA) → unpacking (x64dbg + ScyllaHide + Scylla) → dynamic analysis (FakeNet-NG, Procmon, Process Explorer) → injection detection (PE-sieve) → Wireshark C2 analysis → CyberChef config decoding → MITRE mapping → IOC report
  • •Guided case study: UPX-packed loader → anti-debug bypass with ScyllaHide → OEP identification → Scylla dump + IAT fix → process injection into Notepad.exe (T1055) → registry persistence via HKCU Run key (T1547.001) → C2 beacon with gate.php, POST, base64 body, 30s + jitter → JSON config extraction (C2 URL, user-agent, campaign ID, mutex name)
  • •DFIR report structure: executive summary, MITRE ATT&CK TTP table with forensic evidence, IOC list (hashes, domains, IPs, file paths, registry keys, mutex names, network patterns), and defensive recommendations
  • •Detection deliverables: YARA rule for the unpacked payload, Sigma rule for process injection behavior, Sysmon configuration additions for environment-wide hunting
  • •HTK Intermediate certification exam

What you will learn

  • Move from simple samples to evasive malware: recognize and work through packing, obfuscated strings/config, anti-debug, and anti-VM/anti-sandbox techniques as a visibility problem
  • Manually detect and unpack packed binaries (UPX and beyond) with x64dbg — locate the OEP via the tail-jump, dump the process, and rebuild the IAT with Scylla — and understand multi-layer packing and commercial protectors like Themida and VMProtect
  • Deobfuscate strings and config data with FLOSS and CyberChef (Base64, hex, XOR brute-force, RC4, chained recipes), and deobfuscate malicious JavaScript/PowerShell
  • Identify and bypass anti-debugging checks (IsDebuggerPresent, PEB flags, timing checks) with ScyllaHide and manual PEB/jump patching, and recognize anti-VM/anti-sandbox techniques mapped to MITRE T1497 using Pafish and Al-Khaser
  • Understand and forensically confirm code/process injection — DLL injection, reflective DLL injection, process hollowing — with tools like PE-sieve
  • Analyze C2 traffic in depth (HTTP/DNS/ICMP, JA3 fingerprinting, malleable C2 profiles, jittered beaconing), extract and decode malware config blobs from memory or strings, and map the full chain to MITRE ATT&CK in a professional incident report

Hands-on Lab

Two hands-on capstones. First, take on a batch of evasive samples — confirm packing, extract hidden strings/configs, bypass anti-debug checks, and diagnose anti-VM/anti-sandbox behavior. Then close the course with case_final.exe, a realistic UPX-packed loader that injects into notepad.exe and beacons to an HTTP C2: manually unpack it with x64dbg and Scylla (watch imports jump from 7 to ~78), confirm the injection forensically with PE-sieve, extract and decode a Base64+XOR configuration blob into structured JSON, and deliver a full DFIR report mapped to MITRE ATT&CK.

2⬡ 2 guided labs
2–4hSession window
UnlimitedRestarts
AutoFlag validation
Experience a lab preview →

Requirements

  • ·Completing the HTK Windows Malware Beginner course (or equivalent hands-on experience with static/dynamic analysis) is treated as a prerequisite — this course builds directly on it
  • ·Working knowledge of the PE format, imports/exports, sections, and entropy-based triage
  • ·Basic comfort with a debugger and assembly-level concepts (registers, breakpoints, memory regions, jumps/calls) — x64dbg is taught in depth, but this shouldn't be your first disassembler
  • ·Comfortable with the Windows registry, process internals, and core networking (HTTP, DNS, TCP) to follow the C2 traffic analysis — this is an intermediate-level course, not for security beginners

Career Outcomes

At this level you can aim for a real malware analyst role — not junior — for serious DFIR positions where you're expected to reconstruct a full incident, and for threat intelligence teams that need clean configs and IOCs. It also opens the door to red team work: understanding how malware injects and hides is exactly what you need to build your own evasion techniques on the offensive side.

Malware AnalystDFIRThreat IntelligenceRed Team

Frequently Asked Questions

Complete answers about this course, labs, certificates, and refunds

Not for beginner courses. They start from scratch with guided, step-by-step instructions.

Each lab session opens a 2–4 hour maximum VM session window. You can restart it as many times as you need — unlimited restarts are included with your purchase.

Yes. Unlimited restarts are included with your purchase. Practice as much as you want.

Yes. Your HTK certificate is issued upon completing the final lesson of the last module. Course progress is sequential — each lesson unlocks the next.

Yes. 14-day money-back if lesson progress is below 20% and you have not completed the HTK certificate path (all lessons + labs) for that course. Details in our Refund Policy.

Yes. Once purchased, you have permanent access to all course materials and future updates.

Yes. All professional tools come pre-installed and configured in the VM, no local setup needed.

Most students complete the course in 2–4 weeks studying part-time. You set your own pace.

Start from the beginning?

Windows Malware Beginner

Not ready for intermediate yet? Windows Malware Beginner covers the foundational skills and guided labs you need before tackling the advanced material.

◷ 14h of content⬡ 1 guided lab119 €
View Beginner Course →
Ready to level up?

Build real Windows Malware skills

Get hands-on with real Windows Malware scenarios, professional-grade tools, and validated flag objectives. No prior experience needed.

From159€or 199 € for the complete path
One-time payment, no recurring chargesLifetime access, course updates included14-day money-back guarantee