4-day live training over Zoom
28 hours of intensive, hands-on training, with one year of access to every session recording for self-paced review.
4-DAY LIVE ONLINE · 2027
[ADVANCED][14 MODULES][CERTIFIED]
Hands-on Malware Analysis & Reverse Engineering_
Next live edition
Jun 7 – Jun 10, 2027
Sessions
4PM CET / 10AM EST
Registration closes
Jun 4, 2027
Learn to analyze, investigate, and respond to sophisticated malware and APT attacks, working hands-on with real-world samples from ransomware to APT toolkits. Amr Thabet.
Duration4days
Live hours287h / day
Modules14
CPE Credits28hours
Amr Thabet
CYBERSECURITY EXPERT · MALWARE RESEARCHER
Author of "Mastering Malware Analysis" book
// Overview
Overview
Cyber attacks against government, military, public, and private organizations keep rising. Attackers want to steal valuable information, extort money through ransom, or damage reputations, and a large share of what organizations face today is advanced malware, APT activity, and zero-day attacks.
As adversaries get more sophisticated, detecting and responding to these intrusions has become a core skill for every security professional. The knowledge, skills, and tools needed to analyze malicious software are what let you detect, investigate, and defend against these attacks.
This training covers the entire incident response process, not just reverse engineering. You will move from static and behavioral analysis into assembly, IDA Pro, and debuggers, then tackle packed samples, encryption, and ransomware. On the final day you will bring it all together with Windows forensics, memory forensics with Volatility, and professional report writing.
The focus stays on the common, high-impact threats seen in the wild rather than theoretical or rare cases. Around 80% of the training is hands-on, using more than 100 real malware samples, from malicious documents and banking Trojans to modern ransomware and APT toolkits, all inside a safe lab environment.
// Training Benefits
Why this training is different
Instant access to a bonus course
Start building the fundamentals right away with our Malware Incident Response Training course, available as soon as you enroll.
Mastering Malware Analysis, 2nd Edition
A digital copy of the book written by your instructor, the reference guide for malware analysts.
Ready-to-use virtual machine
The Malware Incident Response VM, with over 100 pre-installed and configured tools, available for both VMware and Hyper-V.
// What You Will Learn
What you will learn
Day 1 sets the foundation with APT attacks and the full malware analysis workflow: static analysis, behavioral analysis, sandboxing, and malicious document analysis. You will work with real-world spear-phishing documents, examining VBA macros and malicious PDFs, and start extracting indicators of compromise from the first hour.
Day 2 takes you into code-level analysis. You will learn enough x86/x64 assembly to read malware in IDA Pro and x64dbg, then apply it immediately to real samples, analyzing droppers, keyloggers, banking Trojans, and packed malware. You will also write your first YARA rules to detect what you find.
Day 3 is about the hard problems: encryption and ransomware. You will reverse basic and complex encryption algorithms (RC4, AES, public key), uncover encrypted strings and C2 domains, and analyze real ransomware samples to assess whether decryption is possible.
Day 4 brings it all together with Windows forensics, memory forensics using the Volatility framework, and professional report writing. You will analyze a Stuxnet memory dump, detect process hollowing and injected DLLs, build attack timelines, and write a report that answers the questions management asks during an incident.
// Full Syllabus
14 modules · 4 days of intense learning
Day 01
APT Attacks & Malware Analysis Foundations
7h live01
APT Attacks & Malware Analysis
- Understanding advanced persistent threats
- Attacker tactics, techniques, and procedures (MITRE ATT&CK)
- The incident response process for malware attacks
- APT attack vectors and types of malware
- Setting up an isolated lab environment
02
Basic Static Analysis
- Investigating malware decrypted strings
- Examining malware PE headers
- Understanding functionality through imported Windows APIs
- Detecting and unpacking encrypted malware
- Hands-on lab with real malware samples
03
Behavioral Analysis & Sandboxing
- Network forensics for malware activity
- Monitoring process, file system, and registry activity
- Determining indicators of compromise (IoCs)
- Hands-on lab analyzing real malware
04
Spear-phishing Attacks with Malicious Documents
- Analyzing malicious Office documents with VBA macros
- Examining and dissecting malicious PDF files
- Hands-on lab with real phishing documents
Day 02
Code Analysis & Malware Capabilities
7h live05
Intro to x86/x64 Assembly
- CPU registers and assembly instructions
- Assembly language and memory handling
- Reversing assembly code to higher-level languages
- Working with variables and memory structures
06
Static & Dynamic Code Analysis
- Using IDA Pro for static analysis
- Hands-on lab with static code analysis
- Using OllyDbg and x64dbg for dynamic analysis
- Investigating Windows API calls
- Key indicators in code analysis
07
Malware Functionalities Analysis
- Analyzing droppers and downloaders
- Persistence mechanisms
- Keylogging techniques
- Banking Trojans and Man-in-the-Browser attacks
- Point-of-Sale malware characteristics
- Writing custom YARA rules
08
Unpacking Packed Samples
- Using generic unpackers
- Manual unpacking techniques
- Overcoming anti-reverse engineering protections
Day 03
Encryption Analysis & Ransomware
7h live09
Dealing with Encryption
- Reversing basic encryption algorithms
- Working with complex encryption (RC4, AES, public key)
- Uncovering encrypted strings, APIs, and C2 domains
- Hands-on lab with encrypted malware
10
Ransomware Analysis
- Basic analysis of ransomware behavior
- Code analysis of encryption functionality
- Understanding file encryption algorithms
- Assessing decryption possibilities
- Real-world ransomware case study
Day 04
Forensics, Advanced Techniques & Reporting
7h live11
Windows Forensics & Timeline Analysis
- Digital forensics goals and acquisition techniques
- Analyzing the NTFS Master File Table and deleted files
- Windows change logs and Prefetch analysis
- Registry analysis for persistence
- Creating attack timelines
12
Advanced Techniques: Fileless Malware & API Hooking
- Understanding process internals
- Detecting code injection techniques
- Process hollowing analysis (the Stuxnet technique)
- API hooking and IAT hooking detection
13
Memory Forensics & Volatility
- Memory acquisition techniques
- Introduction to the Volatility framework
- Identifying suspicious processes
- Detecting injected and hidden DLLs
- Hands-on with a Stuxnet memory dump
14
Reporting & Threat Hunting
- Professional malware analysis report writing
- Introduction to threat hunting
- Endpoint threat hunting with Sysmon
- Creating Sigma rules
// Target Audience
Who this training is for
Cybersecurity Investigators
Professionals who investigate incidents and threats and need advanced skills in malware analysis and incident handling.
Security Heads & Managers
Security leaders who need to understand advanced threats, build response strategies, and guide their teams during malware incidents.
Incident Responders & Analysts
SOC analysts, incident responders, and threat hunters who want to get better at analyzing and responding to advanced malware incidents.
// Prerequisites
- At least 2 years of experience in a technical cybersecurity field
- Basic understanding of operating systems and networking concepts
- Familiarity with Windows environments and basic security principles
- Willingness to dive into technical details, including assembly and Windows internals
- Laptop with at least 8GB RAM and 50GB free disk space (tools and setup instructions are sent before the training)
// Takeaways
What you'll walk away with
- 01
Response strategy mastery
Learn the strategies, tactics, and techniques to respond to malware and ransomware attacks in enterprise environments, with a structured approach from identification to containment.
- 02
In-depth analysis skills
Perform professional malware analysis to extract indicators of compromise, understand malware capabilities, and disrupt attacker communication channels.
- 03
A complete investigation process
Conduct digital and memory forensics, build effective containment plans, and communicate findings to management with technical precision.
// Training Structure
How the training is structured
Every topic is taught with a real sample. You will not analyze toy binaries. The exercises use the same malware that organizations encounter in actual incidents. The lab environment comes with over 100 pre-installed tools and more than 100 real malware samples ready to analyze.
The training is cumulative. Each day builds on the previous one, so by day 4 you can take a sample you have never seen before, analyze it from static analysis through code analysis, deal with its encryption, and produce a professional report with timelines and IoCs.
// Your Trainers
Learn from people who do this work
LeadAmr Thabet
CYBERSECURITY EXPERT · MALWARE RESEARCHER
Amr Thabet is a cybersecurity expert with 12+ years of experience in malware research and incident handling. He has worked with Fortune 500 companies worldwide and is the author of "Mastering Malware Analysis". Amr specialises in advanced malware hunting, digital forensics, threat hunting, and Windows internals security.
Author of "Mastering Malware Analysis" book
// ROI for Your Organization
Persuade your manager
Faster, in-house incident response
Your team learns to extract IoCs, understand what a sample does, and contain it without waiting on an outside vendor in the middle of an incident.
Answers management can use
Analysts learn to write professional malware analysis reports and answer the business questions leadership asks during a ransomware or APT incident.
Lasting team resources
The analysis VM, report templates, YARA templates, and the instructor's book stay with your team long after the four days are over.
// Pricing
Register early. Save more.
Early Bird
$1,260
Ends Apr 26
Regular
$1,800
Ends Jun 4
4 days of live, instructor-led training over Zoom (28 hours)
Certificate of completion
1-year access to all session recordings
Access to a cloud-based lab environment for the duration of the training
Training slides
Exercise workbook with all exercises and step-by-step solutions
Instant access to the Malware Incident Response Training bonus course
Digital copy of Mastering Malware Analysis, 2nd Edition
Malware Incident Response VM with 100+ pre-installed tools (VMware and Hyper-V)
Real-world malware samples, source code, and analysis tools
Custom YARA rule templates and cheat sheets
Professional malware analysis report templates
Post-training support and community access
All prices net, VAT excl.
// Register · June 7 · 4PM CET
Learn it live.
Use it on your next case.
4 days · 14 modules · live and hands-on with Amr Thabet. Limited to 30 participants.
All prices net, VAT excl.
