Video analyses
Step-by-step reverse engineering and malware analysis sessions on real samples. Each video is paired with synchronized lab notes and follow-up resources.
Introduction to Malware Analysis: Triage & x86 Architecture
Foundational lecture on what malware is, the three-question triage method, and the x86 fundamentals every analyst needs.
The Foundations of Malware Analysis & x86 Theory
A deeper, more academic exploration of x86 internals, instruction encoding, the EFLAGS register, and the operand model.
Real-World Malware Case Studies & Code Evasion
Three landmark cases — Stuxnet, Colonial Pipeline, and REvil/Kaseya — paired with the code-level evasion taxonomy every analyst must know.
The Malware Analysis Pipeline: Static & Dynamic Techniques
The full pipeline from receiving a sample to producing a verdict, covering PE structure, hashes, IAT analysis, sandbox detonation, and persistence checks.
Reversing Malicious Code: Process Hollowing & API Hooking
How malware injects code into other processes and intercepts function calls. The four major injection techniques and the three layers of API hooking.
The Explainer: Dissecting Process Hollowing
A focused, single-topic walkthrough of process hollowing — the API sequence, the memory state at each step, and how to detect it.
Malware's Perfect Disguise: Inside Advanced Code Injection
Living off the Land binaries, fileless execution, and the techniques attackers use to disappear into legitimate Windows processes.
Malicious Web & Document Files: Phishing & Drive-By Downloads
How attackers compromise targets through browsers and documents instead of executables. Drive-by downloads, weaponised PDFs and Office documents, JavaScript de-obfuscation.
In-Depth Malware Analysis: Unpacking & Memory Forensics
Identifying packed binaries, manual unpacking with the ESP breakpoint, IAT reconstruction, and Volatility memory forensics workflow.
Defeating Self-Defending Malware: Anti-Debugging & Evasion
How elite malware detects debuggers, identifies VMs, sabotages analysis, and protects embedded data — and how the analyst defeats each defence.