# Malware Analysis Fundamentals (Intermediate) Course (Self-Paced) Canonical URL: ## Overview This course covers static analysis (examining a file without running it) and dynamic analysis (observing behavior via sandbox/monitoring reports), building the judgment for which technique to use when. It follows NIST SP 800-83 Rev. 1 and threads in the real tools and government resources analysts use — disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen. Dynamic analysis is taught purely through explanation and example reports; no lab, sandbox, or live sample is required. In addition, a federal thread on sample sensitivity, data handling, and reporting runs throughout. This course Completes the Digital Forensics & Incident Response certificate (alongside Federal Incident Response and Digital Forensics & Incident Investigation) — part of the Cyber Operations Professional credential. ## What you'll learn - Static analysis: triage, string/metadata extraction, YARA, basic disassembly - Interpret dynamic analysis (sandboxing, monitoring, network simulation) and evasive behavior from example reports - Capture and correlate network IOCs with threat intel and MITRE ATT&CK - Use FLARE-VM, REMnux, and CISA Malware Next-Gen appropriately (vs. public multi-scanners) - Write a CISA-MAR-style report for technical and leadership audiences - Follow a sample end to end through a worked example ## Prerequisites Federal IR (NIST 800-61) + basic forensics (NIST 800-86); Windows/Linux command-line comfort. Intermediate. ## Curriculum #### Module 1 Foundations & Isolated Analysis Environments #### Module 2 Static Analysis Fundamentals #### Module 3 Static Analysis: Disassembly & Code-Level Review #### Module 4 Dynamic Analysis Fundamentals — via example reports, no lab #### Module 5 Network & Behavioral Analysis #### Module 6 Toolkits & Federal Analysis Platforms #### Module 7 Reporting, MARs & Best Practices #### Module 8 Capstone Analysis Exercise & Program Development ## Pricing **Tuition:** $1049