Malware Analysis and Reverse Engineering: Disassembly, Decompilation & Dynamic Sandboxing

Modern sophisticated cyber threat actors deploy polymorphic, packed, and kernel-evasive malicious binaries designed to blind automated endpoint defenses and evade traditional antivirus signatures. Investigating advanced cyber intrusions, ransomware outbreaks, and state-sponsored espionage operations requires the specialized capability to deconstruct compiled binaries at the byte and instruction levels. This comprehensive, lab-driven masterclass equips digital forensic examiners, incident responders, and reverse engineers with a rigorous, practice-tested methodology for dissecting unknown binaries. Learners begin with rapid static triage—inspecting Portable Executable (PE) headers, computing Shannon entropy, and mapping Import Address Tables. You will then advance to deep static disassembly in IDA Pro and Ghidra, deciphering x86/x64 assembly language, stack frames, calling conventions, and obfuscated control-flow graphs. In the dynamic lab environment, you will execute controlled live detonations, configure network simulation barriers, set hardware breakpoints in x64dbg and WinDbg, dump in-memory unpacked payloads, and systematically defeat anti-debugging and anti-VM countermeasures. The curriculum culminates in extracting volatile memory artifacts via Volatility 3, reversing custom C2 communication protocols, and engineering high-fidelity YARA rules and MITRE ATT&CK-mapped technical intelligence reports.