Course Overview

Arm yourself with knowledge and bring the fight to the bad guys! Practical Malware Analysis & Triage (PMAT) brings the state of the art of malware analysis to you in engaging instructional videos and custom-made, practical labs.

Welcome to Practical Malware Analysis & Triage. I’m Matt, aka HuskyHacks, and I’m excited to be your instructor for this course. I had a blast putting it together and I hope that you will come along with me and learn the art of splicing, slicing, inspecting, and dissecting malware samples.

Featuring two malware analysis lab build options: local virtual machines and a rapid-deployable cloud malware analysis network! Learn how to spin up a malware analysis network on AWS from anywhere in the world!

Skill Level

Basic-Plus to Intermediate. The course includes a selection of advanced topics. All concepts are taught in an accessible, foundational manner.


English with optional English subtitles.


Why this course?

This course is centered on practical labs that bring malware samples to bear in a safe, controlled environment.

First, you will learn to handle malware safely and construct an isolated lab environment. Then, you will learn the basics of malware analysis on samples designed to teach you the core analysis concepts. As the labs progress, the level of offensive tradecraft employed by these samples grows.

By the end of the course, you’ll be using automated workflows and advanced analysis to extract key facts about real-world specimens.

Finally, and most importantly, you’ll learn the keys to writing detection rules and triage reports to tell the world what you have learned.


Who should take this course?

  • IT professionals of all skill levels who are looking to gain foundational knowledge of malware analysis.
  • Network defenders looking to deepen their knowledge of the state of the art of malware analysis.
  • Penetration Testers/Red Teamers looking to pick up the skill of malware analysis to increase tradecraft/provide higher threat emulation fidelity.
  • Anyone who wants to learn an in-demand skill set and bring the fight to the bad guys!



  • Basic IT knowledge.
  • Knowledge of the general classes of malware (virus, trojan, worm, etc). Knowledge of how these malware classes function on the technical level is not required.
  • Comfort in the command line of Linux and Windows. All tools and techniques taught in the course are explained step-by-step but working knowledge of Bash and the Windows command prompt is recommended.
  • For a local lab build, you need:
  • A computer that:
  • Has at least 6GB of available RAM.
  • Has at least 40GB of available storage.
  • Can run Oracle VirtualBox and host two lab virtual machines at the same time (with the option to host a third for additional development).
  • Has an internet connection.
  • For a cloud malware analysis lab, you need:
  • An AWS account and a way to pay for AWS resource utilization.
  • Knowledge of x86 Assembly and other low level computer programming concepts is not required.



  • Familiarity with programming concepts is recommended but not required.
  • Familiarity with offensive cybersecurity Tactics, Techniques & Procedures (TTPs) will be helpful but is not required.


Course Topics

  1. Safety Always! Build good habits for handling malware safely and create an analysis lab.
  2. Safe Malware Sourcing. Learn where to source malware samples safely (no need for the dark web!).
  3. Basic Analysis. Learn basic analysis methodology, including interpreting strings, inspecting Windows API calls, identifying packed malware, and discovering host-based signatures. Then, detonate malware to collect network signatures and identify malicious domains and second-stage payloads!
  4. Intro to the x86 Assembly Language. Dip your toes into the low-level world of Assembly Language! Learn the foundations of x86 Assembly and use it to perform advanced analysis.
  5. Advanced Analysis. Use sophisticated tools like Cutter and x32dbg to discover key insights about malware samples at the lowest possible level. Control the execution flow of a program and manipulate its low-level instructions in a debugger.
  6. Patch It Out: Binary Patching & Anti-analysis. Learn the crafty practice of patching binaries at the ASM level to alter the flow of their programs. Then, learn to identify and defeat anti-analysis techniques.
  7. Gone Phishing. Learn to analyze malicious documents and document-delivered malware, including malicious macros and remote template injections.
  8. What the Shell? Learn to identify and carve out embedded shellcode.
  9. Off Script. Identify scripted, obfuscated malware delivery techniques that use PowerShell and Visual Basic Script.
  10. Stay Sharp. Decompile and reverse engineer C# assemblies and learn about reverse engineering the .NET Framework! Then, reverse engineer an encrypted malware C2 dropper back to near-perfect original source code with DNSpy!
  11. Go Time. Learn the analysis considerations of malware written in Go.
  12. Get Mobile! Use MobSF to reverse engineer malicious Android applications.
  13. The Bossfight! Use everything you have learned to do a full analysis of one of the most infamous malware samples in history.
  14. Automating the Process. Use Jupyter Notebooks and malware sandboxes to automate the analysis process.
  15. Tell the World! Write YARA rules to aid in the detection of malware samples and learn how to write effective analysis reports to publish findings.
  16. Course Final. Apply everything you’ve learned to display your mastery of the art and science of malware analysis!


What will I receive from this course?

  • Access to the student-only channel on Discord to receive support from the instructor and other students.
  • Access to 9+ hours of engaging, instructional video content.
  • Access to the PMAT Lab repository containing dozens of malware samples designed to teach you the fundamentals.
  • Course completion certificate.

Practical Malware Analysis and Triage Logo
Excellent 5 Star Review

Cyril H., Cybersec Padawan

“Practical Malware Analysis and Triage, another WAY-beyond-expectation installment in the TCM Academy library! The course progression is excellent, with practical, walk-along exercises in a majority of the videos. I particularly enjoy the rate-of-flow from Husky's pedagogical style -- it has a pristine blend of step-by-step instruction alongside a pace that deters distraction or boredom. Thanks Husky!” 

Big 5 Star Review

David R., Cybersecurity Student

“It's a fantastic course packed to the brim with information. Everything is explained in a way that makes it very easy to understand. Instead of just spitting information at you, there are built-in challenges that give you an opportunity to put your understanding to the test. This is one if the highest quality courses I've taken in a while, and I couldn't be happier with it.” 

5 Star Review for this Course!

Syed H., Security Engineer, DFIR

“The course curriculum is properly designed to take an analyst from the start till the end. I loved how Matt explained concepts to ensure everyone could be on the same playing field.… Should you get it? YES.” 

Course Curriculum - 10+ Hours

  Course Introduction
Available in days
days after you enroll
  Safety Always! Building Your Malware Analysis Lab & Malware Safety
Available in days
days after you enroll
  Basic Static Analysis
Available in days
days after you enroll
  Basic Dynamic Analysis
Available in days
days after you enroll
  Challenge 1: SillyPutty
Available in days
days after you enroll
  Advanced Static Analysis: Assembly Language, Decompiling, & Disassembling Malware
Available in days
days after you enroll
  Advanced Dynamic Analysis: Debugging Malware
Available in days
days after you enroll
  Challenge 2: SikoMode
Available in days
days after you enroll
  Binary Patching & Anti-analysis
Available in days
days after you enroll
  Specialty Malware Classes
Available in days
days after you enroll
  Gone Phishing: Maldoc Analysis
Available in days
days after you enroll
  What The Shell? Shellcode Analysis
Available in days
days after you enroll
  Off-Script: Scripted Malware Delivery Mechanisms
Available in days
days after you enroll
  Stay Sharp: Reversing C# Malware
Available in days
days after you enroll
  Go Time: Analyzing Go Malware
Available in days
days after you enroll
  Get Mobile! Mobile Malware Analysis
Available in days
days after you enroll
  The Bossfight! Analyzing Real-World Malware Samples
Available in days
days after you enroll
  Automation: Sandboxes & Pipelines
Available in days
days after you enroll
  Tell The World: Rule Writing & Report Publishing
Available in days
days after you enroll
  Course Final
Available in days
days after you enroll
  Course Conclusion
Available in days
days after you enroll

This course is included in our
All-Access Membership
starting at $29.99/month

Get full access to the Practical Ethical Hacking course and our full course catalog when you enroll in our All-Access Pass Membership.

Matt Kiely Course Instructor

About the Instructor

Matt Kiely (HuskyHacks) is a seasoned practitioner with 10 years of experience in IT and cybersecurity. Matt has worked as a Lead Cybersecurity Analyst at the Massachusetts Institute of Technology Lincoln Laboratory Space Research Division, Red Team Operator & Exploit Developer at a large financial institution, Principal Cybersecurity Content Architect & Instructor at SimSpace, and served as a United States Marine.

Matt holds a Bachelor of Science in Information Technology from Northeastern University and a Graduate Certificate in Cybersecurity from the Rochester Institute of Technology. Some of Matt's professional certifications include OSCP, eCPPT, eCPTX, CRTO, and CRTP.

Follow Matt on Social Media:

GitHub -




Frequently Asked Questions

Can I get a refund if I'm unhappy with my purchase?

Yes. All purchases come with a 3-day money-back guarantee.

Will I receive a certificate of completion when I finish a course?

Yes. All courses come with a certificate of completion.

Do the courses count as Continuing Education Units (CEUs)?

Yes. Every certificate of completion comes with the total CEUs earned listed on the certificate.

What is the All-Access Pass?

As of July 1st, 2023 TCM Academy transitioned to a monthly subscription model, where you now receive full access to all of the courses on our platform for as long as your subscription remains active.

What if you already own courses on TCM Academy?

If you already own a course on our platform, you will continue to own that course forever. Previously owned courses will not be affected by this change.