Skip to content
Knowledge Base

Knowledge Base

A collection of practical guides to malware analysis and reverse engineering, written by Intezer’s Research Team. Each section starts with the fundamentals of a format or technique and then works through real samples using open-source and free tools.

  • Beginner’s guide to malware analysis and reverse engineering - Start here. What malware analysis is, how to decide how deep an analysis needs to go, and the initial triage steps: identifying the format, checking whether the threat is known, spotting packing, and reading strings and the import table.
  • Malware Reverse Engineering for Beginners - Assembly language, the CPU and the stack, disassemblers, and how malware is packed, obfuscated, and delivered.
  • How to Analyze - Format-by-format guides to the file types attackers use for delivery: LNK shortcuts, Microsoft Office documents, PDFs, phishing emails, and MSI installers.
  • Executable and Linkable Format (ELF) files - The Linux executable format in depth: sections and segments, symbols, relocations, and dynamic linking.
  • ELF Malware Analysis 101 - The Linux threat landscape, followed by hands-on static and dynamic analysis of ELF malware.
  • .NET Malware 101 - How managed code is compiled and executed, and how to read the metadata, tokens, and method bodies inside a .NET assembly.
  • Memory Analysis 101 - Finding fileless threats and injected code in volatile memory, and the forensic tools used to do it.
  • URL Analysis 101 - How phishing URLs are manipulated to look trustworthy, and how to detect them at scale with machine learning.