Reverse Engineering Malware: Essential Skills
Spend 8 weeks with Anuj Soni building a hands-on, technical understanding of how attackers execute on Windows so you can validate alerts, assess threat reporting, and turn analysis into action.
A guided program built around consistency, practice, feedback, and mentorship, not just more content to get through.
Anuj Soni
For almost two decades, I’ve reverse engineered malware and taught thousands of cybersecurity analysts how to do the same.
Above all, that experience taught me that technical skills like malware analysis aren’t built by rushing through tools and techniques. They’re built through repeated exposure, hands-on practice, feedback, and mentorship.
The Malware Lab is the program I wish I’d had when I started: a structured, feedback-driven program built around real malware, delivered at a pace that gives you time to practice, absorb, and improve.
Ideal student profile
- SOC analysts who want to move beyond alerts and understand what's actually executing
- Threat hunters and intelligence analysts who need to validate technical claims and reporting
- DFIR specialists building deeper code analysis skills
- Cybersecurity professionals who want to better understand malware, attacker behavior, and code execution on Windows
What success looks like
- A repeatable static + dynamic analysis workflow you trust
- Confidence opening an unfamiliar sample without freezing
- The ability to form, test, and refine hypotheses about program behavior
- Comfort navigating disassembly, pseudocode, and debugger output
- The ability to explain what malware does, and support your conclusions with evidence
- A portfolio of completed analyses you can confidently discuss in interviews
- The vocabulary to communicate findings to engineering teams, leadership, and customers
Structure, repetition, and feedback designed to build real skill
Structured workflow
Follow a clear, repeatable analysis process, from static inspection to behavioral and code analysis, that you can reuse in your daily work.
Real-world samples
Work hands-on with live malware samples inside a safe lab environment so you can apply everything you learn immediately.
Feedback + guidance
Get direct feedback on your lab submissions so you know where you’re improving and what to focus on next.
Hypothesis-driven
Develop and test hypotheses as you analyze samples, helping you stay focused and intentional instead of reactive.
Confidence through repetition
By the end, you’ll have analyzed multiple real threats and built the confidence to tackle new ones on your own.
Active community
Develop the skills to investigate, validate, and explain malicious behavior through hands-on analysis, expert guidance, and weekly feedback.
Intro & Initial Examination (Static File Analysis)
In this session, we focus on first contact with a sample, before execution. You’ll learn how to identify PE file characteristics, extract and interpret strings, review imports to infer likely capabilities, spot common signs of packing or multi-stage loaders, and begin documenting observations using a structured workflow. By the end of this session, students should be able to look at a sample and say “Here’s what stands out, here’s what I think is happening, and here’s what I’d check next.”
Malware in Action (Behavioral Analysis)
This session moves from theory to execution. You’ll safely run malware in a controlled lab, observe process interactions, identify filesystem artifacts, and analyze network activity. You’ll learn how to separate meaningful behavior from noise and turn overwhelming telemetry into actionable analysis notes.
Static Code Analysis (Pseudocode)
This session introduces code analysis with Binary Ninja’s decompiler and high-level views so you can understand malware logic without getting lost in assembly. You’ll learn how to navigate unfamiliar code, pivot from strings and APIs into suspicious functions, follow control flow and decision points, recognize common Windows API usage patterns, and document your findings as analysis progresses. The focus is on building an analyst’s decision-making process so you can prioritize execution paths and avoid unnecessary deep dives into low-level assembly.
Static Code Analysis (Disassembly)
This session builds on the previous code analysis module by dropping down to disassembly to validate decompiled logic and understand malware behavior at the instruction level. You’ll learn how to read and interpret x86 and x64 assembly in Binary Ninja, follow control flow and conditional jumps, recognize function boundaries and calling conventions, and understand how data moves through registers, the stack, and memory. The focus is on connecting low-level instruction patterns back to higher-level malware behavior so you can validate earlier conclusions, accurately locate functionality, and understand how the malware actually executes at runtime.
Dynamic Code Analysis
This session introduces live debugging with x64dbg to observe malware behavior at runtime. You’ll learn how to set meaningful breakpoints, inspect registers, memory, the stack, function arguments, and return values, and step through execution to understand how decisions are made during runtime. You’ll also observe how packed malware transitions during execution and learn how to unpack samples once their real payloads are revealed in memory through the debugger.
Code Deobfuscation and Multi-Stage Execution
This session builds on your debugging foundation by focusing on how to recover and analyze malicious code that is hidden, injected, or generated at runtime. You’ll learn how to deobfuscate additional execution stages such as PE files and shellcode, identify memory allocation and permission changes associated with unpacking and injection, capture malicious code as it is written into memory, and debug DLL-based malware. You’ll also use emulation to quickly analyze extracted payloads and shellcode so you can recover the real code behind multi-stage malware and uncover the malware’s true behavior.
Data Deobfuscation
This session shifts focus from executable code to the hidden data that drives malware behavior, including obfuscated strings and configuration data. You’ll learn how to identify common data obfuscation techniques, locate encoded data in code and memory, and extract decoded content at runtime. By the end of the session, you’ll be able to uncover the hidden data that reveals the functionality attackers attempted to hide.
Evasive Techniques and Anti-Analysis
This session focuses on recognizing when malware alters its behavior to avoid analysis and learning practical ways to safely work around those obstacles. You’ll learn how to identify common anti-debugging and anti-analysis techniques, understand how malware detects debuggers and analysis environments, safely bypass or neutralize evasive logic through methods such as patching, and avoid false conclusions caused by incomplete execution. By the end of the session, you’ll be able to recognize and account for evasion techniques so the behavior you observe more accurately reflects how the malware operates in real-world environments.
Hear from past students
Built for analysts who want to stop guessing.
"I feel significantly more confident in my malware analysis process in having a better workflow, and more importantly, have learned what to look at and how to identify important code when reading disassembly. This was a struggle for me early on, and this program has really filled in those gaps so digging into disassembly doesn't feel nearly as foreign or confusing. Loading a file into a disassembler or debugger doesn't feel nearly as overwhelming, as I now have some ideas and ways to really test out hypotheses and can pivot to important pieces of code for further analysis."
"The training changed my whole conception of malware analysis. REM always scared me a little bit because I had to work with people doing REM and I never felt like I'm interesting a single action/word of malware analysis. The course taught me that we do not have to review an entire code or learn by heart all win api existing! Another point, I learned how much REM is important in CTI and it gaves me a tons of ideas to join both discipline."
"What I loved most was the personalized approach, Anuj took the time to evaluate every single one of our lab submissions and provided tailored feedback that truly made a difference. This experience hasn't just improved my technical skills; it has empowered me to communicate my findings more confidently and has genuinely ignited a passion for digging deeper into malware analysis."
"Beyond exceeding my expectations and making this my number one course recommendation, this program changed the way I approach analysis. It gave me a structured framework to follow, helping me focus on the right areas and avoid unnecessary rabbit holes. As a result, I am more confident in my analytical process and the presentation of my findings."
"What I loved most about the program was the way complex concepts were explained clearly and concisely, without unnecessary details. I also really enjoyed the hands-on labs. Recording myself explaining each lab felt like studying the material twice, which helped reinforce my understanding and improved my ability to communicate technical concepts."
"My confidence and strength in the fundamentals of malware analysis have increased more than I can really describe. I have been able to speak more clearly and articulate my analysis process to peers, employers, and perspective employers in a way that has made me stand as a high performer since starting the course with Anuj."
"I feel a lot more confident in the process of tackling a malware sample and, more importantly, in drawing up theories to effectively reach conclusions. This course exceeded my expectations and provided me with various techniques for handling a malware sample."
"The best part about this program is the hands on labs and sessions where you can build muscle memory on processes and some of the industry standard tools. Its the best way to learn in my opinion for anything."
"The program is second to none and has provided an outstanding learning experience."
Questions, answered.
Ready to get started?
Applications take under 5 minutes. Cohorts are capped to keep feedback personal.
Investment: $2,000 for the full 8-week program. Payment plans available by request.