Practical Malware Analysis
Michael Sikorski and Andrew Honig
The lab book everyone claims they finished. Static, dynamic, packing, and the first time a sample lies to you on purpose.
Open PDF↗- Title
- Practical Malware Analysis
- Authors
- Michael Sikorski and Andrew Honig
- Year
- 2012
- Publisher
- No Starch Press
- Tags
- malware, reverse-engineering, labs, windows
This is the book that taught a generation of us that “open it in a VM and see what it does” is a sentence, not a method.
Sikorski and Honig built a course that happens to be bound. Labs, not folklore. You take a binary apart without asking it for permission, then you learn the binary will still try to notice you. If you have ever felt clever after a strings dump, chapter two is already waiting in the hallway.
I still send people here first. Not because it is new. Because it is complete enough that the next book — the bootkit brick, the kernel paper, the ugly sample that will not unpack — actually makes sense. Static analysis, dynamic analysis, packing, anti-debugging, C2 that looks like weather. The whole first year, in one spine.
Keep a lab notebook. The book will not remember which sample made you swear. You will.