Reverse Engineering for Malware Analysis · Hacking Project

Perform end-to-end static and dynamic reverse engineering of malware samples to extract capability, IOCs, and detections.

**The problem**
Modern malware uses packing, obfuscation, anti-analysis, and living-off-the-land techniques that defeat signature detection and overwhelm under-skilled responders. Organizations that cannot analyze a sample cannot extract IOCs, understand capability, or build detections, leaving them dependent on vendors. Malware reverse engineering is a scarce, high-value skill.

**What you'll build**
Build a safe, isolated malware analysis lab and analyze real-world samples through static triage (PE parsing, strings, imports, YARA), unpacking, and dynamic analysis (sandbox behavior, API monitoring), progressing to disassembly and decompilation in Ghidra to map capability. Produce a full analysis report with IOCs, ATT&CK mapping, and derived detection signatures.

**Objective** — Perform end-to-end static and dynamic reverse engineering of malware samples to extract capability, IOCs, and detections.

**Expected outcome** — An isolated analysis lab, per-sample analysis reports with IOCs and ATT&CK mapping, and derived YARA/Sigma detection rules.

**Difficulty** — Expert — requires disassembly, unpacking, anti-analysis defeat, and behavioral reconstruction of hostile binaries.

**Primary category** — Malware Analysis; Secondary = DFIR, Threat Intelligence, Detection Engineering

**Security domains** — Primary = Malware Analysis; Secondary = Threat Intelligence, Digital Forensics, Blue Team, Incident Response

**Technical focus** — Static analysis, dynamic/sandbox analysis, PE/ELF internals, unpacking, disassembly, decompilation, anti-analysis evasion, IOC extraction, YARA authoring, ATT&CK mapping, C2 identification

**Core technologies** — Languages: Python, C, x86/x64 assembly; Frameworks/Libraries: pefile, capa, FLARE tools, YARA; Security Tools: Ghidra, IDA Free, x64dbg, Cuckoo/CAPE sandbox, Wireshark, PE-bear, FLOSS; Cloud/Infra: isolated VMs (REMnux, FLARE-VM), snapshotting, no-internet lab; AI/Data: behavioral clustering; Databases: MISP (IOCs), SQLite

**Where it's valued** — MSSPs, threat-intel vendors, incident-response firms, national CERTs, financial services SOCs, antivirus/EDR vendors

**Careers it builds toward** — Malware Analyst, Reverse Engineer, Threat Intelligence Analyst, DFIR Consultant, Detection Engineer

**Framework alignment**
• MITRE ATT&CK: Obfuscated Files or Information (T1027), Deobfuscate/Decode Files (T1140), Software Packing (T1027.002), Process Injection (T1055), Application Layer Protocol/C2 (T1071), Virtualization/Sandbox Evasion (T1497)
• NIST CSF 2.0: Detect (DE.AE, DE.CM), Respond (RS.AN, RS.MI), Identify (ID.RA)
• OWASP: N/A
• CIS Controls v8: 10 Malware Defenses, 8 Audit Log Management, 13 Network Monitoring