# Malware Analysis Fundamentals (Intermediate) Course Canonical URL: ## Overview This course covers static analysis (examining a file without running it) and dynamic analysis (reading behavior out of sandbox and monitoring reports), building the judgment for which technique fits which situation. It follows NIST SP 800-83 Rev. 1 and works in the tools and government resources analysts actually reach for — disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen. Dynamic analysis is taught through explanation and example reports alone; no lab, sandbox, or live sample is required. A federal thread on sample sensitivity, data handling, and reporting runs the length of the course. This course completes the Digital Forensics & Incident Response certificate, alongside Federal Incident Response and Digital Forensics & Incident Investigation — part of the Cyber Operations Professional credential. ## What you'll learn - Static analysis: triage, string and metadata extraction, YARA, basic disassembly - Read dynamic analysis output (sandboxing, monitoring, network simulation) and recognize evasive behavior from example reports - Capture network IOCs and correlate them with threat intel and MITRE ATT&CK - Reach for FLARE-VM, REMnux, and CISA Malware Next-Gen where each is appropriate, as against public multi-scanners - Write a CISA-MAR-style report that serves both technical and leadership readers - Track a single sample from first triage through to final report in a worked example ## Prerequisites Federal IR (NIST 800-61) + basic forensics (NIST 800-86); Windows/Linux command-line comfort. Intermediate. ## Curriculum **Module 1** Foundations & Isolated Analysis Environments **Module 2** Static Analysis Fundamentals **Module 3** Static Analysis: Disassembly & Code-Level Review **Module 4** Dynamic Analysis Fundamentals — via example reports, no lab **Module 5** Network & Behavioral Analysis **Module 6** Toolkits & Federal Analysis Platforms **Module 7** Reporting, MARs & Best Practices **Module 8** Capstone Analysis Exercise & Program Development ## Schedule - Dec 8, 2026 – Dec 9, 2026 — Live Online - Jan 11, 2027 – Jan 12, 2027 — Live Online - Feb 11, 2027 – Feb 12, 2027 — Live Online - Mar 10, 2027 – Mar 11, 2027 — Live Online - Apr 21, 2027 – Apr 22, 2027 — Live Online - May 19, 2027 – May 20, 2027 — Live Online - Jun 7, 2027 – Jun 8, 2027 — Live Online - Jul 1, 2027 – Jul 2, 2027 — Live Online ## Instructors ### Wes Bryan — Instructor Wes Bryan resides in Gainesville, Florida, and has built his career around technology, education, and helping others understand complex subjects. He values continuous learning, clear communication, and practical problem-solving. Outside of work, Wesley enjoys running, hiking, fishing, and spending time outdoors. He also has a strong interest in music and literature, enjoys reading both fiction and nonfiction, as well as playing guitar. ### Chuck Moore — Instructor With more than 25 years of experience in IT and cybersecurity, Chuck has built a career on a strong foundation in security, networking, help desk operations, and technical training. He has helped organizations strengthen their security posture by identifying vulnerabilities, conducting threat assessments, implementing security controls, and ensuring compliance with industry standards. Combining extensive technical expertise with a passion for education, Chuck equips professionals with the knowledge and practical skills needed to recognize risks, risks and respond effectively. ## Pricing **Tuition:** $1049