# Malware Analysis Fundamentals (Intermediate) Canonical URL: ## Overview This course covers static analysis (examining a file without running it) and dynamic analysis (reading behavior out of sandbox and monitoring reports), building the judgment for which technique fits which situation. It follows NIST SP 800-83 Rev. 1 and works in the tools analysts actually reach for — disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen. Dynamic analysis is taught through explanation and example reports alone; no lab, sandbox, or live sample is required. A thread on sample sensitivity, data handling, and structured reporting runs the length of the course. The course closes by tying it together: participants track a single sample from first triage through a written report modeled on the CISA Malware Analysis Report (MAR) format — the structure most analysts already have to produce — built to read cleanly for both a technical and a leadership audience. ## What you'll learn - Static analysis: triage, string and metadata extraction, YARA, basic disassembly - Read dynamic analysis output (sandboxing, monitoring, network simulation) and recognize evasive behavior from example reports - Capture network IOCs and correlate them with threat intel and MITRE ATT&CK - Reach for FLARE-VM, REMnux, and CISA Malware Next-Gen where each is appropriate, as against public multi-scanners - Write a CISA-MAR-style report that serves both technical and leadership readers - Track a single sample from first triage through to final report in a worked example ## Prerequisites Incident response fundamentals (NIST 800-61) and basic forensics (NIST 800-86); comfortable with the Windows/Linux command line. Intermediate level. ## Schedule - Jan 20, 2027 – Jan 21, 2027 — Live Online - Mar 4, 2027 – Mar 5, 2027 — Live Online - Apr 2, 2027 – Apr 5, 2027 — Live Online - Jun 7, 2027 – Jun 8, 2027 — Live Online - Jul 1, 2027 – Jul 2, 2027 — Live Online ## Pricing **Tuition:** $1049