Understanding different categories of malicious software and their characteristics.
Parasitic, prepending, appending, cavity viruses
MBR infection, boot sequence modification
Self-replicating, network propagation, payload delivery
Code obfuscation, encryption, signature evasion
Backdoor access, command & control, persistence
Form grabbing, keylogging, session hijacking
Secondary payload delivery, staged execution
Kernel-level hiding, system call hooking
Static and dynamic analysis methods for understanding malware behavior.
PE/ELF headers, sections, imports, exports
ASCII/Unicode strings, URL extraction, API calls
x86/x64 assembly, control flow, function analysis
Entropy analysis, packer signatures, unpacking
Behavioral monitoring, API hooking, network analysis
Process creation, file operations, registry changes
C2 communication, DNS queries, HTTP requests
Memory dumps, process injection, code injection
Techniques for understanding and analyzing compiled code.
Registers, instructions, calling conventions
Conditional jumps, loops, function calls
Stack frames, local variables, parameters
Windows API, system calls, library functions
Code obfuscation, anti-debugging, anti-VM
Manual unpacking, automated tools, OEP detection
C-like code reconstruction, variable recovery
Family identification, variant analysis, evolution
Essential tools for malware analysis and reverse engineering.