Malicious Documents Analysis

This course provides an introduction to the file formats, tools, and methodologies used to perform malware analysis on malicious documents using a practical hands-on approach. Students can learn to pinpoint and analyze suspicious document components and how to extract host and network-based indicators from them. This course includes demonstrations and hands-on labs that contain real malware.

Prerequisites: General knowledge of computer and operating system fundamentals. Exposure to programming fundamentals is recommended.

After completing this course, learners should be able to:

• Dissect and analyze malicious document formats
• Extract network and host-based indicators
• Extract noteworthy components that require further isolated analysis
• Detect suspicious patterns and common exploitation techniques
• Utilize modern analysis tools including OffVis and 010 editor
• Create and automate custom tools for your specific organization

Malware researchers, software developers, information security professionals, incident responders, computer security researchers, corporate investigators, and others who need to understand how malware operates and the processes involved in performing malware analysis.

In-classroom instructor-led training

• 2 days (in-person delivery)

Students are required to bring their own laptop that meets the following specs:

• VirtualBox 7+
• At least 30 GB of free HDD space