Sigreturn Labs Contact
Training

Malware analysis, online.

Learn to take a malware sample apart, from the first look to the final report. A self-paced video course for beginners, built and recorded by a researcher who has done this work for a decade, for police forces, European agencies and private companies.

201video lessons
28 hof video
19sections
28hands-on videos

Join the waitlist Enrolment opens soon. Section 00 will be free to watch.

What you will be able to do.

By the end, you analyse a sample from end to end, in the order a real analysis follows.

  • Look at a sample without running it, and tell its family and what it can do
  • Watch it run, and find the traces it leaves in Windows
  • Read its code in Ghidra, and run it one step at a time in x64dbg
  • Get past packing and the tricks samples use against your tools
  • Find the encryption a sample uses, and recover the keys when it uses it badly
  • Write indicators of compromise, YARA rules and a clear report
Audience

Who it is for.

DFIR specialists, SOC analysts and law enforcement investigators, and also system administrators, developers who read C, and students curious about how malware works.

Before you start

Basic knowledge of Windows and Linux, simple C (variables, functions, loops, pointers) and a command line. A little Python or assembly helps; the course shows you the basics of both. For the labs you need an Intel or AMD computer that runs VirtualBox, with at least 16 GB of memory, four cores and about 60 GB of free disk.

Practice in a lab you build yourself.

Section 01 builds your lab VM with a builder we provide: Windows 11 from Microsoft's official image, every analysis tool, and the practice files for each lab. You take a snapshot and go back to it after every analysis.

  • 28 hands-on videos, 22 labs and 15 mini-labs
  • Each lab: a written statement, three hints you open one at a time, and a video where the solution is worked through
  • Every sample you handle was written for the course and is harmless
  • Real malware appears in a few videos, run in our own isolated lab, and is never sent to you
Curriculum

Every lesson, in order.

Nineteen sections that follow a real analysis. Go at your own pace: one section a week takes about four months.

00Welcome Free5 lessons · 18 min
  1. 0.0Start here: how this course works4:46
  2. 0.1What you will be able to do at the end4:09
  3. 0.2Who this course is for, prerequisites and setup2:03
  4. 0.3How the course is built: plan, lessons, labs, the lab VM3:26
  5. 0.4Safety and the law: read this before you download anything3:35
01Building the lab7 lessons · 28 min
  1. 1.1What an analysis lab actually needs4:35
  2. 1.2Installing VirtualBox and the Sigreturn lab VM4:32
  3. 1.3Snapshots, the only habit that will save you3:21
  4. 1.4Network isolation, and when to break it on purpose3:25
  5. 1.5Handling samples without infecting yourself3:01
  6. 1.6A tour of the toolbox3:52
  7. 1.7Hands-on - Set up your lab, step by step5:28
02Windows internals14 lessons · 1 h 53
  1. 2.1Hands-on - Process Explorer10:31
  2. 2.2Processes, threads and handles8:25
  3. 2.3Hands-on - First steps in x64dbg11:24
  4. 2.4Virtual memory and paging8:33
  5. 2.5Segmentation, a leftover6:04
  6. 2.6User land and kernel land5:14
  7. 2.7System calls6:30
  8. 2.8The PEB and the TEB11:00
  9. 2.9Hands-on - Process Monitor and regedit10:06
  10. 2.10The registry6:54
  11. 2.11The filesystem6:07
  12. 2.12Hands-on - PE-bear5:08
  13. 2.13DLLs, the loader and imports9:15
  14. 2.14LAB-02 - Read a live process (correction)7:21
03The PE format15 lessons · 3 h 10
  1. 3.1From source code to executable11:57
  2. 3.2Hands-on - Compile a program yourself9:49
  3. 3.3Hands-on - Ghidra, first steps, one gesture at a time14:14
  4. 3.4Symbols, debug info, and what strip removes8:13
  5. 3.5MZ, PE, and the headers that matter19:18
  6. 3.6Hands-on - Use a hex editor15:22
  7. 3.7Image base, RVA, virtual address: the arithmetic you will redo daily16:12
  8. 3.8Sections: .text, .data, .rdata, .rsrc, and the odd ones13:09
  9. 3.9The import table, read by hand12:34
  10. 3.10The export table and how DLLs are called12:09
  11. 3.11Resources, and what hides in them11:53
  12. 3.12Reading a real PE in PE-bear and in Ghidra13:10
  13. 3.13LAB-03 - Compile it, then take it apart15:12
  14. 3.14ELF, the PE of Linux, header, segments and sections8:08
  15. 3.15ELF imports, exports and symbols9:04
04Static analysis12 lessons · 2 h 04
  1. 4.1Triage, the five minutes that decide the next five hours10:45
  2. 4.2File type identification, and how it lies9:13
  3. 4.3Hands-on - Python in the lab, from zero16:53
  4. 4.4Hashes, MD5, SHA-256, imphash and ssdeep9:17
  5. 4.5Strings, properly: ASCII, UTF-16, minimum length, stack strings10:24
  6. 4.6Hands-on - Read the strings of a file10:03
  7. 4.7Imports as a behaviour map12:00
  8. 4.8Entropy, overlays and appended data8:37
  9. 4.9VirusTotal, what it gives you and what it costs you6:47
  10. 4.10Writing your first YARA rule9:20
  11. 4.11Hands-on - Write and run a first YARA rule13:46
  12. 4.12LAB-04 - Triage three unknown samples6:31
05Dynamic analysis17 lessons · 2 h 16
  1. 5.1What running a sample tells you that reading it does not5:35
  2. 5.2Procmon, filters first, then events9:57
  3. 5.3Process Explorer and the process tree8:55
  4. 5.4Hands-on - Install Sysmon and read the event log9:28
  5. 5.5Sysmon, the same thing, but keepable7:31
  6. 5.6Hands-on - Capture and read network traffic in Wireshark11:19
  7. 5.7Watching the network, with a server that answers9:45
  8. 5.8Dumping a process and mining its memory8:54
  9. 5.9Memory forensics with Volatility 39:17
  10. 5.10Sandboxes, what they do for you, and what they miss6:37
  11. 5.11LAB-05 - Determine what a sample does, without reading its code5:14
  12. 5.12Hands-on - Before and after, with Regshot9:54
  13. 5.13Talking back, what a sample does with its server's answers11:21
  14. 5.14LAB-05B - Make a sample obey your server6:40
  15. 5.15Seeing inside HTTPS, and the man in the middle4:33
  16. 5.16Exfiltration you do not see, DNS and ICMP4:13
  17. 5.17LAB-05C - Find the leak6:55
06x86-64 assembly14 lessons · 2 h 21
  1. 6.1Why you need assembly, and how little of it8:41
  2. 6.2Registers, and their sizes11:21
  3. 6.3RSP, RBP, RIP: the three you must never confuse10:29
  4. 6.4Moving data: mov, lea, push, pop10:25
  5. 6.5Arithmetic and logic, and what the flags remember9:10
  6. 6.6Comparisons and jumps: turning branches back into if10:43
  7. 6.7The stack, frame by frame9:11
  8. 6.8The heap, and why it matters to you7:22
  9. 6.9Prologue, epilogue, and the shape of a function8:15
  10. 6.10The Microsoft x64 calling convention, and a word on System V12:39
  11. 6.11LAB-06 - Read a function and rewrite it in C13:41
  12. 6.12Hands-on - Reading thirty-two-bit code13:16
  13. 6.13x86, x86-64 and ARM, side by side7:24
  14. 6.14Reading a little ARM648:45
07Ghidra10 lessons · 1 h 14
  1. 7.1Installing Ghidra and creating a project9:08
  2. 7.2The first import, what Ghidra decides for you6:36
  3. 7.3The listing view, and reading disassembly without drowning7:12
  4. 7.4The function graph5:15
  5. 7.5The decompiler, and how to distrust it8:46
  6. 7.6Strings, and cross-references6:59
  7. 7.7The symbol tree and the function list4:49
  8. 7.8Renaming, retyping, commenting, making a binary yours7:15
  9. 7.9Structures and arrays in the decompiler9:05
  10. 7.10LAB-07 - Reverse a small binary end to end8:57
08x64dbg11 lessons · 1 h 12
  1. 8.1What a debugger lets you do that a disassembler does not5:42
  2. 8.2The x64dbg window, laid out once and for all9:10
  3. 8.3Breakpoints: software, hardware, memory8:42
  4. 8.4Step into, step over, run to: the four keys6:07
  5. 8.5Reading and editing registers and memory6:58
  6. 8.6Breaking on API calls7:39
  7. 8.7Patching a binary, in memory and on disk6:19
  8. 8.80xCC, and why a malware can see your breakpoints6:27
  9. 8.9LAB-08A - Find the password, the simple version4:34
  10. 8.10LAB-08B - Find the password when it is never stored5:25
  11. 8.11LAB-08C - Get in without the password, by patching4:54
09Persistence and artefacts12 lessons · 2 h 00
  1. 9.1Persistence, what the attacker wants and when9:08
  2. 9.2Hands-on - Autoruns, Registry Explorer and Task Scheduler12:24
  3. 9.3Run keys, RunOnce, and their user and machine difference11:16
  4. 9.4Services and scheduled tasks10:23
  5. 9.5Startup folders, DLL hijacking, and the doors left open9:26
  6. 9.6WMI subscriptions, COM hijacking, and other modern spots9:49
  7. 9.7Hidden and system files, the default that hides them6:26
  8. 9.8Execution traces, Prefetch, ShimCache, AmCache9:00
  9. 9.9Event logs, and what Sysmon adds to them8:24
  10. 9.10Browser history, chat caches, antivirus quarantine, deleted files11:06
  11. 9.11Hands-on - Autopsy, one disk image from start to finish9:46
  12. 9.12LAB-09 - Find and remove persistence12:44
10Obfuscation and packing15 lessons · 2 h 00
  1. 10.1Why malware hides, and what it costs the attacker5:59
  2. 10.2Packing, the idea, and what it looks like from outside8:09
  3. 10.3UPX, packed and unpacked, side by side6:42
  4. 10.4Finding the original entry point by hand8:57
  5. 10.5Dumping and rebuilding the import table7:42
  6. 10.6Custom packers, code in a resource, code in a new section8:54
  7. 10.7Commercial protectors, what you are really up against6:23
  8. 10.8Inline functions, dead code and spaghetti9:43
  9. 10.9Dynamic API resolution by hash8:37
  10. 10.10Anti-debug, IsDebuggerPresent, the PEB flag, timing10:37
  11. 10.11Exceptions as a trap, SEH and VEH6:32
  12. 10.12Anti-VM and anti-sandbox checks, and what still works in 202610:37
  13. 10.13LAB-10A - Unpack a packed sample and find its original entry point6:32
  14. 10.14LAB-10B - Get past three anti-debug checks6:52
  15. 10.15LAB-10C - Three packers, one method7:16
11Code injection9 lessons · 1 h 11
  1. 11.1Stages, dropper, loader, payload5:58
  2. 11.2Classic DLL injection, seen from the debugger11:08
  3. 11.3Process hollowing, step by step9:59
  4. 11.4Hands-on - Catch a hollowed payload before it runs5:06
  5. 11.5Shellcode, recognising it and running it safely8:44
  6. 11.6The API sequence that gives an injector away9:32
  7. 11.7Hooks and keyloggers, read from the code5:10
  8. 11.8Memory permissions, the RWX smell8:07
  9. 11.9LAB-11 - Identify the injection technique from a memory trace7:25
12Cryptography in malware11 lessons · 1 h 40
  1. 12.1Encoding, hashing, encrypting: three different things10:54
  2. 12.2Symmetric ciphers you will meet: XOR, RC4, AES11:34
  3. 12.3Asymmetric encryption, and why ransomware needs it7:58
  4. 12.4How a ransomware actually encrypts a disk10:50
  5. 12.5Where the key lives, and why it is usually gone5:13
  6. 12.6Spotting crypto in a binary: constants, S-boxes, loops9:09
  7. 12.7When the implementation is broken: real recovery cases9:33
  8. 12.8LAB-12 - Identify a cipher from its code, and rebuild it6:51
  9. 12.9Case study, a real ransomware, run in the lab13:14
  10. 12.10Breaking Rhysida, time as a key9:13
  11. 12.11Rhysida's files back, with the decrypter from the paper5:55
13Scripts and .NET20 lessons · 2 h 40
  1. 13.1Why so much malware is not a PE at all6:30
  2. 13.2Office macros, and extracting them without opening the document12:26
  3. 13.3Obfuscated PowerShell, layer by layer10:12
  4. 13.4LOLBins, living off the land7:41
  5. 13.5HTML smuggling, disk images, shortcuts, notebooks9:06
  6. 13.6Malicious PDF files, object by object5:37
  7. 13.7Hands-on - Take a PDF apart with pdfid and pdf-parser6:33
  8. 13.8RTF files, and the shellcode inside them8:47
  9. 13.9Obfuscated JavaScript, and suspicious web pages9:52
  10. 13.10Hands-on - Peel a JScript dropper without running it6:55
  11. 13.11ClickFix and the copy-paste infection6:37
  12. 13.12Hands-on - ILSpy and dnSpy9:58
  13. 13.13.NET malware with dnSpy and ILSpy10:52
  14. 13.14Fileless, PowerShell, the registry, and Assembly.Load10:55
  15. 13.15Go and Rust, why your tools suddenly stop helping8:58
  16. 13.16Hands-on - oletools and Python on a macro document7:54
  17. 13.17Hands-on - oledump, stream by stream3:22
  18. 13.18LAB-13 - Extract and de-obfuscate a macro payload6:01
  19. 13.19LAB-13B - From a PDF to the script it hides6:16
  20. 13.20LAB-13C - Find the payload that never touched the disk5:10
14Case study: a stealer6 lessons · 45 min
  1. 14.1What a stealer takes, and how it is delivered8:56
  2. 14.2Finding the modules, and reading only what matters6:47
  3. 14.3Following the credentials to the exfiltration call7:37
  4. 14.4Reading an "encrypted" webhook with one breakpoint7:21
  5. 14.5The same sample under Procmon and Wireshark8:42
  6. 14.6LAB-14 - Recover the exfiltration endpoint5:37
15ATT&CK, IOCs and the report8 lessons · 1 h 16
  1. 15.1The attack lifecycle, end to end15:21
  2. 15.2Exfiltration channels that look legitimate10:12
  3. 15.3Mapping what you found onto MITRE ATT&CK7:23
  4. 15.4Extracting indicators that are worth keeping9:48
  5. 15.5Turning indicators into YARA rules that survive7:35
  6. 15.6Sharing: MISP, STIX, and who you are really telling7:15
  7. 15.7Evidence: integrity, chain of custody, and the mistakes that cost cases9:21
  8. 15.8Writing the report someone will actually read9:02
16The final challenge7 lessons · 52 min
  1. 16.1The scenario, four encrypted files and one screenshot5:39
  2. 16.2Rules of engagement for the challenge4:38
  3. 16.3Walkthrough 1, triage and finding the encryption routine10:43
  4. 16.4Walkthrough 2, recovering the key from the screenshot7:26
  5. 16.5Walkthrough 3, why running the encryptor again destroys a file12:31
  6. 16.6Walkthrough 4, writing your own decryptor7:01
  7. 16.7The tournament, how it works3:57
17Going further5 lessons · 44 min
  1. 17.1Hands-on - A configuration extractor in Python8:48
  2. 17.2Hands-on - A Ghidra script that decodes every hidden string9:49
  3. 17.3Hands-on - Emulate a whole program with Speakeasy7:55
  4. 17.4Hands-on - A second emulator, Qiling8:44
  5. 17.5Hands-on - A first look at Frida8:32
18Closing3 lessons · 12 min
  1. 18.1What to analyse next, and where to get safe samples5:37
  2. 18.2Building a practice routine that sticks4:22
  3. 18.3Thank you, and where to find me1:40

A final challenge, graded by a person.

A ransomware program has encrypted four files. You get the program and a screenshot from the victim's machine, and your job is to get the files back. You hand in a written report, and it is read and graded by hand by the course author, not by a script. Once it is accepted, you receive a signed certificate of completion that anyone can verify online.

Pricing

€1,490

one payment, VAT included

  • Lifetime access, updates included
  • All lessons, labs and exercise sheets
  • Questions answered under each lesson
  • Final challenge and certificate

One email when enrolment opens. Privacy.

14-day guarantee: if the course is not for you, ask for a refund within 14 days of purchase, as long as you have watched less than 10% of the paid videos and have not downloaded a lab solution or the lab builder.

Questions.

When does enrolment open?

Soon. Join the waitlist and you get one email when it does. Section 00 will be free to watch with an account before then.

How long do I keep access?

For life, including every update to the lessons and labs.

Where do I watch it?

In your browser, on a computer, tablet or phone, on up to three devices. Nothing to install. The labs themselves need a computer that runs VirtualBox.

What language is it in?

English, in plain words, with subtitles on every video.

Can I download the videos?

No. The videos stream only, and each copy is marked for the account that watches it. Exercise sheets are downloadable PDFs.

Do I get an invoice?

Yes, with VAT, issued automatically at purchase.

Can my company buy seats for a team?

Yes. Write to [email protected] and we will invoice the seats. For a live session with your team, see the five-day course.

Who teaches it.

Adam Taguirov, founder of Sigreturn Labs: ten years of malware analysis and vulnerability research in law enforcement and in the private sector, in France and abroad. Every lesson was written and recorded by him, and he answers the questions.

The team · Full CV · Public research