Malware Types & Building a Safe Analysis Lab

What malware analysis is

Malware analysis is the disciplined study of malicious software to understand what it does, how it works, and how to detect and remove it. The goal is defensive: you produce indicators, detection rules, and clear reports that help others protect systems. You never study a sample to reuse it against real targets.

Analysts group malware by behavior. Common families include trojans that masquerade as legitimate files, worms that self-propagate, ransomware that encrypts data for extortion, backdoors and remote access tools that grant covert control, downloaders that pull further payloads, and rootkits that hide their presence.

Build a safe, isolated analysis lab

Every experiment in this course happens inside an isolated, offline analysis virtual machine that you own. Never run real malware on your host, on a shared network, or on any machine that matters. A slip here can encrypt your files or spread to others.

• Use a hypervisor and give the analysis VM a host-only or fully disconnected network so it cannot reach the internet or your home LAN.
• Take a clean snapshot before each detonation and revert afterward, so every run starts fresh.
• Keep tools on a separate read-only share or an isolated tooling VM; do not mix live samples with your working files.

Handling rules

Treat every sample as live and dangerous. Only analyze samples you are authorized to handle, from a lawful source such as your own honeypot, an approved research feed, or a documented engagement.

• Store samples encrypted and password-protected, and rename executables so they cannot run by accident.
• Record the hash and origin of every sample before you touch it.
• Never share live samples casually; share hashes and reports instead.

⚖️ For authorized, legal testing only.

What's in Malware Analysis & Reverse Engineering

• 1. Malware Types & Building a Safe Analysis LabFree
• 2. Static Analysis: Strings, Hashes & Headers🔒 Analysis
• 3. Dynamic Analysis: Detonating in a Sandbox🔒 Analysis
• 4. Disassembly & Decompilation🔒 Reverse Engineering
• 5. Obfuscation, Packers & Unpacking Basics🔒 Reverse Engineering
• 6. Windows Internals & Persistence Techniques🔒 Reverse Engineering
• 7. Automating Triage with Python🔒 Tooling
• 8. Writing YARA-Style Detection Rules🔒 Detection
• 9. IOCs & Writing a Clear Analysis Report🔒 Reporting
• 10. Practical Exam: Earn Your FHC-MAL🔒 Certification

Continue in the interactive course reader →