> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/binary-exploitation/malware-analysis.md).

# Malware Analysis

## Youtube Videos Crash courses

{% embed url="<https://www.youtube.com/watch?v=d4d8VRsk4-0&list=PLrponziKkpTTz9MhORj96RDvArDby9AGB&index=13&ab_channel=InformationSecurityClubUCalgary>" %}

{% embed url="<https://www.youtube.com/playlist?list=PLBf0hzazHTGMSlOI2HZGc08ePwut6A2Io>" %}

{% embed url="<https://www.youtube.com/watch?v=qA0YcYMRWyI&list=PLrponziKkpTTz9MhORj96RDvArDby9AGB&index=3&t=5152s&pp=gAQBiAQB>" %}

{% embed url="<https://www.youtube.com/watch?v=20xYpxe8mBg&list=PLrponziKkpTTz9MhORj96RDvArDby9AGB&index=5&t=2553s&pp=gAQBiAQB>" %}

## Curated Resources

{% embed url="<https://samsclass.info/126/126_S17.shtml>" %}
Best as university lectures using the practical malware analysis book
{% endembed %}

{% embed url="<https://zeltser.com/start-learning-malware-analysis/>" %}
Basics
{% endembed %}

For a better overview, I have assembled a bunch of resources for you. You don't have to use all of them, but make sure to check out what you would like to learn.

*Overview*: hasherezade's (very respected Reverse Engineer) overview page about getting started (Tools, environments, base knowledge)&#x20;

{% embed url="<https://hshrzd.wordpress.com/how-to-start/>" %}

*Beginner Courses:* Z0F Course:&#x20;

{% embed url="<https://github.com/0xZ0F/Z0FCourse_ReverseEngineering>" %}

Tyler Hudak's 4-part series on RE (Highly recommended!):&#x20;

{% embed url="<https://www.youtube.com/watch?v=GYam_nJKr6E>" %}

Malware Unicorn's RE 101 course:&#x20;

{% embed url="<https://malwareunicorn.org/workshops/re101.html>" %}

*Assembly:* An absolute classic introduction on RE by Dennis Yurichev that introduces you to a number of different architectures:&#x20;

{% embed url="<https://beginners.re/>" %}

Azeria Lab's ARM course (great if you want to know more about ARM):&#x20;

{% embed url="<https://azeria-labs.com/writing-arm-assembly-part-1/>" %}

### Complete resource list

{% embed url="<https://github.com/0xZ0F/Z0FCourse_ReverseEngineering>" %}

{% embed url="<https://github.com/alphaSeclab/awesome-reverse-engineering/blob/master/Readme_full_en.md>" %}

### C++

I'd also like to mention that you should work on your C/C++ knowledge while you're learning RE. You don't have to be an absolute master at it, but some basic knowledge is important. If you want to see some recommended sources for C/C++:

*Recommended C Booklist:* <https://stackoverflow.com/questions/562303/the-definitive-c-book-guide-and-list>

*Recommended C++ Booklist:* <https://stackoverflow.com/questions/388242/the-definitive-c-book-guide-and-list>

*Good online resource for C++:* <https://www.learncpp.com/>

*General Computing/Low-Level stuff:* The OSdev wiki is an amazing resource for everything concerning low-level. You have hours upon hours of reading material here. <https://wiki.osdev.org/Main\\_Page>

## Youtube Videos

{% embed url="<https://www.youtube.com/watch?v=wa3sMSdLyHw&ab_channel=CryptoCat>." %}

{% embed url="<https://www.youtube.com/watch?v=JQr_QKwk9Uk&ab_channel=areyou1or0>" %}

## Most Important

{% embed url="<https://maxkersten.nl/binary-analysis-course/>" %}

{% embed url="<https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Arch1001_x86-64_Asm+2021_v1/about>" %}

{% embed url="<https://guyinatuxedo.github.io/00-intro/index.html>" %}
looks promising
{% endembed %}

{% embed url="<https://0xinfection.github.io/reversing/>" %}

{% embed url="<https://github.com/0xZ0F/Z0FCourse_ReverseEngineering>" %}

{% embed url="<https://challenges.re/>" %}
along with beginners.re
{% endembed %}

{% embed url="<https://0xrick.github.io/win-internals/pe1/>" %}
for pe file structure&#x20;
{% endembed %}

{% embed url="<https://pwn.college/>" %}

{% embed url="<https://github.com/Crypto-Cat/CTF/tree/main/pwn/binary_exploitation_101>" %}

## Malware samples

{% embed url="<https://www.vx-underground.org/>" %}

{% embed url="<https://gist.github.com/tingwei628/e1b46c5fd538271d86338767e5f759a0>" %}