Malware Analysis: Identifying and Defeating Code Obfuscation

Malware authors routinely utilize obfuscation techniques to complicate the analysis of their code. This course will teach you techniques for identifying and defeating code obfuscation so that key characteristics and behaviors can be identified.
Course info
Level
Intermediate
Updated
Jul 12, 2019
Duration
2h 23m
Table of contents
Description
Course info
Level
Intermediate
Updated
Jul 12, 2019
Duration
2h 23m
Description

Malware authors will routinely utilize obfuscation techniques to complicate the analysis of their code. These techniques can prevent the discovery of important indicators of compromise and limit the ability to determine malware functionality. In this course, Malware Analysis: Identifying and Defeating Code Obfuscation, you will gain the skills necessary to not only identify prevalent obfuscation techniques, but also how to effectively defeat them. First, you will see how obfuscation will affect your analysis and effective strategies for defeating a variety of obfuscation methods. Next, you will explore how to identify and detect obfuscation techniques in interpreted code. This includes software routinely abused by malware authors such as Powershell and Visual Basic for Applications. You will next be able to expand your skills by learning about code obfuscation in native code. Finally, you will discover how malware authors use cryptography for obfuscation and ways to detect it. Each module of this course will include detailed demonstrations and hands-on labs that will allow you to analyze real-world malware. You will be going deep into malware obfuscation techniques with such tools as IDA Pro and WinDbg. By the end of this course, you will have the knowledge and skills to effectively tackle obfuscation!

About the author
About the author

Dr. Josh Stroschein is an Assistant Professor at Dakota State University where he teaches malware analysis, software exploitation, reverse engineering and penetration testing

More from the author
Getting Started with Reverse Engineering
Beginner
3h 40m
Aug 29, 2018
Section Introduction Transcripts
Section Introduction Transcripts

Course Overview
[Autogenerated] Hi, everyone. My name is Dr Jastrow Shine and welcome to my course Mauer Analysis. Identifying and Defeating Code office Cation. I am an assistant professor at Dakota State University, where I teach Mauer analysis, reverse engineering and software exploitation. I also work is a senior Mauer analyst for Bro Mia and a director of training, an academic outreach for the Open Information Security Foundation. And this course we're going to get hands on with malware obfuscation. Mauer authors will routinely utilize obfuscation techniques to complicate the analysis of their coat. Thes techniques can prevent discovery of important indicators of compromise and prevent you from determining Mauer functionality. Identifying and defeating code office cation is often the first step when analyzing any malicious file. Some of the major topics that we will cover include how office cation affects your analysis. The tools and techniques for identifying code obfuscation and interpreted coat, such as visual basic for applications and power show how'm our authors employ strength and function office station in native code as balls, identifying our use of cryptography, as well as effective ways for detecting and tracing the use of that cryptography. Throughout this course, you will be able to follow along through comprehensive demonstrations and apply yourself through hands on labs with real world Bauer samples. By the end of this course, you will have the knowledge and skills necessary to defeat our office cation before beginning the corks. You should be familiar with the basics of reverse engineering and be comfortable with tools such as the disassembly and an assembly level debunker. You should also be familiar with how to set up a safe Mauer Analysis lab and fire. I hope you'll join me on this journey to learn how to defeat obfuscation with malware analysis. Identifying and defeating code obfuscation at plural site.