Malware Analysis
and Reverse
Engineering
Dr. K. Sabri
Course Description
Malware Analysis and Reverse Engineering Assembly Language
C Language
Windows OS
Dr. Khair Eddin Sabri Networking
Cryptography
Cyber Security Department, Princess Sumaya University for Technology Resources
Amman, Jordan Tools
Certification
Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Instructor
Malware Analysis
and Reverse
Engineering
Dr. K. Sabri
Course Description
Dr. Khair Eddin Sabri Assembly Language
C Language
Windows OS
Email: [Link]@[Link]
Networking
Cryptography
Office Hours: S,M,T,W,T: 11-12 Resources
Tools
Certification
Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Course Description
Malware Analysis
and Reverse
Engineering
This course will introduce students to modern malware Dr. K. Sabri
analysis techniques through readings and hands-on Course Description
interactive analysis of real-world samples. Assembly Language
C Language
Windows OS
After taking this course, the students will be equipped
Networking
with the skills to analyze advanced contemporary
Cryptography
Malware using both static and dynamic analysis.
Resources
Tools
Students will learn how analyze malicious software Certification
using the concepts of reverse engineering. Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Why Studying Malware Analysis
Malware Analysis
and Reverse
Malware analysis is critical for anyone who responds to Engineering
computer security incidents. Dr. K. Sabri
Course Description
When analyzing suspected malware, your goal will Assembly Language
typically be to determine exactly what the malware can C Language
do, how to detect it on your network, and how to Windows OS
measure and contain its damage. Networking
Does the malware spread across the network? Cryptography
Does it steal credentials and other sensitive Resources
information? Tools
Certification
All this information helps evaluate the impact of the
Grades
attack more precisely and find appropriate solutions to
Academic Honesty
prevent it from happening in the future.
Dr. K. Sabri Malware Analysis and Reverse Engineering
Tentative Syllabus
Malware Analysis
and Reverse
Engineering
Dr. K. Sabri
Course Description
Basic Analysis
Assembly Language
Environment Setup C Language
Advanced Static Analysis Windows OS
Advanced Dynamic Analysis Networking
Cryptography
Advanced Topics: Packing, Obfuscation, Process
Resources
Injection Tools
Certification
Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Assembly
Malware Analysis
and Reverse
Engineering
Dr. K. Sabri
Assembly language is a low-level computer language.
Course Description
Assembly Language
It is processor-dependent.
C Language
Windows OS
Example of Assembly instructions: mov, add, cmp, jmp Networking
Cryptography
Resources
The assembler translates the assembly instructions into Tools
the commands a particular CPU understands, on a Certification
one-to-one basis. Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Assembly language and Malware
Malware Analysis
and Reverse
Engineering
Most malware is written in high-level languages and Dr. K. Sabri
then compiled into machine code. Course Description
Assembly Language
Malware is typically distributed as compiled binaries C Language
Windows OS
e.g., exe file, meaning its original source code is
Networking
unavailable.
Cryptography
Resources
Reverse engineering tools like Cutter, IDA Pro, and Tools
Ghidra disassemble malware into assembly code, Certification
allowing analysts to understand its functionality. Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
C Language
Malware Analysis
and Reverse
Engineering
Dr. K. Sabri
Most malware is written in C programming language. Course Description
Assembly Language
C Language
C Provides direct access to system resources.
Windows OS
Networking
C is faster than many high-level languages. Cryptography
Resources
Tools
C can be used to access Windows API. Certification
Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Windows OS Malware Analysis
Malware Analysis
and Reverse
Engineering
Windows is usually the primary target for malware.
Dr. K. Sabri
Course Description
Windows is the most used operating system for Assembly Language
desktops and laptops. C Language
Windows OS
Networking
The focus of this course is on how to analyze malware
Cryptography
once it has been found.
Resources
Tools
We focus on malware found on the Windows operating Certification
system, but the skills you learn will serve you well when Grades
analyzing malware on any operating system. Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Windows Internals
Malware Analysis
and Reverse
Process and Threads: A process is an executing Engineering
program. One or more threads run in the context of Dr. K. Sabri
the process.
Course Description
Assembly Language
Registry: A central hierarchical database used in C Language
Windows used to store information that is necessary to Windows OS
configure the system for one or more users, Networking
Cryptography
applications, and hardware devices.
Resources
Tools
Windows API: is an application programming interface Certification
(API) that allows a computer program to access the Grades
features of the Microsoft Windows operating system in Academic Honesty
which the program is running.
Dr. K. Sabri Malware Analysis and Reverse Engineering
Windows Internals
Malware Analysis
and Reverse
Engineering
Dr. K. Sabri
Course Description
Windows Services: is a computer program that Assembly Language
operates in the background. C Language
Windows OS
Networking
exe and dll files: EXE is a program that can be Cryptography
executed, while DLL is a library. Resources
Tools
Certification
Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Networking
Most modern malware relies on network Malware Analysis
and Reverse
communications, either to connect to remote servers or Engineering
to send sensitive information. Dr. K. Sabri
Course Description
An IP address identifies a machine in a network. Assembly Language
C Language
A port number is a way to identify a specific process to Windows OS
Networking
which a network packet is to be forwarded when it
Cryptography
arrives at a server.
Resources
Tools
Malware often establishes connections (bind, connect, Certification
send, recv) Grades
Academic Honesty
Tools such as Wireshark is used for packet capture and
analysis.
Dr. K. Sabri Malware Analysis and Reverse Engineering
Cryptography
Malware Analysis
and Reverse
Engineering
Dr. K. Sabri
Course Description
Malware authors use encryption to hide their code. Assembly Language
C Language
Windows OS
Ransomware uses encryption to lock files.
Networking
Cryptography
Encrypt data before sending it over the network. Resources
Tools
Certification
Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Resources
Malware Analysis
and Reverse
Engineering
Dr. K. Sabri
Practical Malware Analysis by Michael Sikorski and
Course Description
Andrew Honig, 2012.
Assembly Language
C Language
Mastering Malware Analysis by Alexey Kleymenov and Windows OS
Amr Thabet, Second Edition, 2022. Networking
Cryptography
Resources
Malware Science A comprehensive guide to detection, Tools
analysis, and compliance by Shane Molinari, 2023. Certification
Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Tools
Malware Analysis
and Reverse
Engineering
Virtual Box and Virtual Machines Dr. K. Sabri
PEiD Course Description
PEViewer Assembly Language
C Language
PEStudio
Windows OS
Cutter Networking
X64dbg Cryptography
Resources
Wireshark
Tools
Procmon Certification
Process Explorer Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Certification
Malware Analysis
and Reverse
Engineering
Dr. K. Sabri
Course Description
The Practical Junior Malware Researcher (PJMR) Assembly Language
(TCM) C Language
Windows OS
Networking
GIAC Reverse Engineering Malware Certification Cryptography
(GREM) Resources
Tools
Certification
Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Grades
Malware Analysis
and Reverse
Engineering
Midterm: 30% Dr. K. Sabri
Course Description
Final: 40% Assembly Language
C Language
Windows OS
Quizzes: 10% Networking
Cryptography
Resources
Project: 10%
Tools
Certification
Practical Assignments: 10% Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering
Academic Honesty
Malware Analysis
and Reverse
Engineering
Dr. K. Sabri
Course Description
All the work in this course should be done Assembly Language
independently. C Language
Windows OS
Networking
Plagiarism in doing the project/assignments is not Cryptography
permitted. Resources
Tools
Certification
Grades
Academic Honesty
Dr. K. Sabri Malware Analysis and Reverse Engineering