Dr Josh Stroschein Courses

Finding Functions from Export Directory and Using Seeds for API Checksums - Part 6

Explore Lockbit's runtime-linking techniques, including EXPORT_DIRECTORY usage and DLL name seed for API checksum computation. Learn to debug and find APIs efficiently.

• YouTube
• 16 minutes
• On-Demand
• Free Video

Performing Basic Triage Analysis and Unpacking with x64dbg - Ransomware Analysis - Part 2

Perform basic triage analysis on ransomware binaries, compare obfuscated and unobfuscated versions, and learn to unpack using x64dbg and Scylla for effective malware analysis.

• YouTube
• 21 minutes
• On-Demand
• Free Video

Walking the PEB, Enhancing IDA's Output with Structures, and Unlocking Runtime-Linking - Lecture 4

Explore PEB usage in malware, learn runtime DLL location techniques, and enhance IDA analysis with custom structures for improved reverse engineering.

• YouTube
• 16 minutes
• On-Demand
• Free Video

Practical Steps to False Positive Reduction and Benign File Analysis

Learn efficient techniques for identifying false positives and analyzing clean files in malware analysis. Gain actionable tips from real-world examples to enhance your workflow and save time and resources.

• YouTube
• 55 minutes
• On-Demand
• Free Video

PE File Format Basics for Malware Analysis and Reverse Engineering - MM#08

Explore PE file format essentials for malware analysis using tools like Detect-It-Easy, PEStudio, and Malcat. Learn to interpret tool outputs and understand file structure for effective triage analysis.

• YouTube
• 1 hour 3 minutes
• On-Demand
• Free Video

Leveraging Online Sandboxes for Triage Analysis - MM#07

Explore popular online sandboxes for malware analysis, including AnyRun, Triage, and VirusTotal's behavioral output. Learn effective techniques for leveraging these tools in investigations.

• YouTube
• 1 hour 13 minutes
• On-Demand
• Free Video

Analyzing Malicious Network Traffic with Suricata - Malware Mondays Episode 06

Learn to analyze malicious network traffic using Suricata in REMnux. Explore alert generation, protocol dissection, file identification, and contextual flow information for effective threat detection.

• YouTube
• 1 hour 6 minutes
• On-Demand
• Free Video

The AddressOfEntryPoint and Tips for Finding Main in PE Files

Explore the AddressOfEntryPoint field in PE files, its relation to the main function, and techniques for locating it. Learn about PE file structure and entry point analysis.

• YouTube
• 13 minutes
• On-Demand
• Free Video

TLS Callbacks in PE Files - Detection and Analysis

Explore TLS callbacks in PE files, their use in malware, and detection methods. Learn to identify and analyze these anti-debugging techniques using various tools and Yara rules.

• YouTube
• 17 minutes
• On-Demand
• Free Video

Finding Digital Certificates in PE File Format

Learn to identify and extract digital signatures in PE files using the DATA_DIRECTORY structure, RVAs, and tools like Malcat for enhanced cybersecurity and malware analysis skills.

• YouTube
• 13 minutes
• On-Demand
• Free Video

Performing Rapid Triage Analysis using ANY.RUN

Explore rapid triage analysis using ANY.RUN for efficient malware assessment. Learn to gather crucial indicators of compromise and prioritize potential threats effectively.

• YouTube
• 23 minutes
• On-Demand
• Free Video

Tracing Stack Usage and Stack Frames in a Debugger

Explore stack usage and stack frames in a debugger, tracing function calls to understand stack operations, calling conventions, and frame unwinding during program execution.

• YouTube
• 12 minutes
• On-Demand
• Free Video

Creating Trampolines and Re-Obfuscating Function Pointers in Runtime Linking - Part 7

Delve into advanced runtime linking techniques, focusing on trampoline creation, function pointer resolution, and memory debugging in reverse engineering and malware analysis.

• YouTube
• 30 minutes
• On-Demand
• Free Video

Binary File Dissection with Malcat - Features and Live Demo

Explore Malcat's powerful features for binary file analysis. Dive into hexadecimal editing, disassembly, and live demo of NSIS dropper dissection and shellcode emulation with the creator.

• YouTube
• 1 hour 47 minutes
• On-Demand
• Free Video

Lockbit's DLL Name Seeding Technique for API Hashing - Part 5

Explore Lockbit's runtime-linking technique, focusing on DLL name usage for API hashing seed creation and its impact on reverse engineering efforts.

• YouTube
• 14 minutes
• On-Demand
• Free Video