From malware static triage to x64dbg unpacking, anti-debugging bypass, process injection and hollowing analysis, C2 configuration extraction, and MITRE ATT&CK-mapped DFIR reports — all in isolated FLARE-VM labs with professional-grade tooling.
Lab tools you will use
Master the fundamentals of Windows malware analysis: static triage, dynamic execution, C2 detection, persistence hunting, and MITRE ATT&CK mapping in a guided FLARE-VM lab environment.
119 EUR
Intermediate Windows malware analysis: bypass anti-debug and sandbox evasion, manually unpack binaries with x64dbg and ScyllaHide, detect process injection and hollowing, extract C2 configs, and deliver DFIR reports.
159 EUR
Get the Beginner + Intermediate courses bundled together and unlock exclusive extras.
Each phase maps to a course module. Scroll to assemble your full progression — from beginner fundamentals to intermediate mastery.
Phase 1
BeginnerBefore touching a sample you stand up the environment and learn what each instrument in it is actually for.
Phase 2
BeginnerMost triage decisions are made before execution. You learn to read what a binary declares about itself and where it lies.
Phase 3
BeginnerDetonation under observation, where you record what the sample does to a machine instead of guessing from its code.
Phase 4
BeginnerWhat a sample says on the wire is often the fastest route to what it is for, and to the operator behind it.
Phase 5
IntermediatePacked samples show you a wrapper. This is where you learn to reach the code that actually runs.
Phase 6
IntermediateSerious families check whether they are being watched. You learn what they look at and how to stay invisible.
Phase 7
IntermediateModern malware rarely runs as itself. This phase is about finding it hiding inside legitimate processes.
Phase 8
IntermediateThe analysis only pays off if it catches the next variant. You finish by producing something a defensive team can deploy.
The Windows Malware path takes you from opening an unknown binary for the first time to producing a report an incident response team can act on. It is built around the work analysts actually do: deciding quickly whether a sample matters, understanding what it does to a machine, and turning that understanding into detection that catches the next one.
The order is deliberate. Static triage first, because it is fast and carries no execution risk. Then dynamic analysis in an isolated lab, where behaviour that static analysis can only hint at becomes observable. Then debugging and unpacking, because most real samples are packed and everything before that point only saw the wrapper. Finally, extracting configuration and writing detection, which is what makes the analysis useful to somebody other than you.
Every phase happens on real samples in an isolated FLARE-VM environment, not on toy binaries written to be easy. The labs run on disposable virtual machines you can break without consequence, and each one ends with a validation flag so you know you actually got the answer rather than a plausible-looking one.
The path uses more tools than fit here. These are the ones that define the work.
| Tool | Category | What for |
|---|---|---|
| FLARE-VM | Environment | Mandiant's Windows analysis distribution — the environment every lab in this path runs on |
| PE-Studio | Static analysis | First-look triage of PE headers, imports and embedded resources, without executing anything |
| x64dbg | Debugging | Stepping through packed samples to reach the unpacked payload in memory |
| ScyllaHide | Anti-anti-debug | Hiding the debugger from samples that check whether they are being analysed |
| PE-sieve / HollowsHunter | Injection detection | Spotting process hollowing and injected code in a live system |
| Procmon | Dynamic analysis | Recording every file, registry and process operation a sample performs |
| FakeNet-NG | Network simulation | Answering the sample's C2 traffic so it keeps running without real egress |
| YARA | Detection | Turning what you found into a rule that catches the family, not just the sample |
Structured the way an IR team consumes it: findings, evidence, and what to do about it
Written from characteristics you extracted yourself, tested against related samples
Pulled out of a packed sample, the deliverable threat intel teams need most
Behaviour translated into the shared vocabulary detection teams work in
Malware analysis sits at the point where SOC work, incident response and threat intelligence meet, so the skills transfer across several roles rather than locking you into one.
Reverses samples, extracts indicators and configurations, and documents capability
Reconstructs intrusions from disk, memory and log evidence
Converts observed adversary behaviour into rules that fire reliably
Tracks families and actors over time and briefs decision-makers
Complete answers about this path, labs, certificates, and refunds
Not to begin. The beginner course works at the level of behaviour and static indicators, and introduces assembly gradually where it is needed. The intermediate course does require reading disassembly comfortably, and by then you will have been building up to it.
Only inside a properly isolated lab, which the path covers before any sample is handled. The labs also run on disposable cloud virtual machines, so you can complete the path without exposing your own hardware at all.
Tools change every couple of years; the method does not. The path is organised around the decisions an analyst makes and why, with tools introduced where they answer a question you already have rather than as a catalogue.
Both courses together are around 40 hours of material, but the lab work is what sets the pace. Most students spread it across two to three months alongside a job.
You will be able to triage it, observe its behaviour safely, extract indicators and write detection for it. Deep reversing of a sophisticated ransomware family's cryptography is a specialisation beyond this scope, but this is the groundwork it is built on.
Each course issues an HTK certificate on completion, and completing both covers the full path. The certificate reflects lab work you actually finished, since every lab is validated by flag rather than by attendance.
