The Beast Within - Evading Dynamic Malware Analysis Using Microsoft COM

This course aims to teach learners how to evade dynamic malware analysis using Microsoft COM. The learning outcomes include understanding the challenges posed by COM interfaces in malware analysis, identifying practical approaches for dynamic COM malware analysis, and learning how to monitor COM calls effectively. The course covers skills such as parsing different formats of COM function call parameters, detecting transitions transparently in a hypervisor, and creating a detailed list of COM calls executed by malware. The teaching method involves a presentation of various aspects of automated dynamic COM malware analysis, showcasing real-world examples of COM interfaces used by malware, and demonstrating how to overcome the limitations of existing dynamic analysis solutions. This course is intended for cybersecurity professionals, malware analysts, and anyone interested in understanding and countering the use of COM interfaces by malware.