CINXE.COM

<!DOCTYPE html> <html lang="en" dir="ltr" xmlns:og="https://ogp.me/ns#"> <head> <link rel="profile" href="https://www.w3.org/1999/xhtml/vocab" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut icon" href="https://nostarch.com/sites/default/files/favicon.ico" type="image/vnd.microsoft.icon" /> <meta name="description" content="Malware analysis is big business, and attacks can cost a company dearly. When malware breaches your defenses, you need to act quickly to cure current infections and prevent future ones from occurring." /> <meta name="generator" content="Drupal 7 (http://drupal.org)" /> <link rel="image_src" href="https://nostarch.com/sites/default/files/practical_malware_analysis.png" /> <link rel="canonical" href="https://nostarch.com/malware" /> <link rel="shortlink" href="https://nostarch.com/node/184" /> <meta property="og:type" content="article" /> <meta property="og:url" content="https://nostarch.com/malware" /> <meta property="og:title" content="Practical Malware Analysis" /> <meta property="og:description" content="Malware analysis is big business, and attacks can cost a company dearly. When malware breaches your defenses, you need to act quickly to cure current infections and prevent future ones from occurring." /> <meta property="og:updated_time" content="2024-08-19T12:19:17-07:00" /> <meta property="og:image:url" content="https://nostarch.com/sites/default/files/practical_malware_analysis.png" /> <meta property="og:image:secure_url" content="https://nostarch.com/sites/default/files/practical_malware_analysis.png" /> <meta name="twitter:card" content="summary" /> <meta name="twitter:site" content="@nostarch" /> <meta name="twitter:url" content="https://nostarch.com/malware" /> <meta name="twitter:title" content="Practical Malware Analysis" /> <meta name="twitter:description" content="Malware analysis is big business, and attacks can cost a company dearly. When malware breaches your defenses, you need to act quickly to cure current infections and prevent future ones from occurring." /> <meta name="twitter:image" content="https://nostarch.com/sites/default/files/practical_malware_analysis.png" /> <meta property="product:price:amount" content="59.99" /> <meta property="product:price:currency" content="USD" /> <meta property="product:isbn" content="9781593272906" /> <meta property="article:published_time" content="2011-02-07T13:03:04-08:00" /> <meta property="article:modified_time" content="2024-08-19T12:19:17-07:00" /> <meta property="product:retailer_part_no" content="malware-Combo" /> <meta property="product:mfr_part_no" content="malware-Combo" /> <title>Practical Malware Analysis | No Starch Press</title> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_lQaZfjVpwP_oGNqdtWCSpJT1EMqXdMiU84ekLLxQnc4.css" media="all" /> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_guSWpwqRBCVb2J7ivC8BaNuaPffCXmbkGB5xDBqKKu8.css" media="all" /> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_Dw0rmhFX_owMmlf1HH5Y-_BnOHcMlkri1yMjYHD4ffs.css" media="all" /> <link type="text/css" rel="stylesheet" href="https://nostarch.com/sites/default/files/css/css_XJm3Wqia1GUjoI4j54duSLNZVR3Kxhbwy0s3UwuhhHg.css" media="all" />   <script src="//ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script>window.jQuery || document.write("<script src='/sites/all/modules/contrib/jquery_update/replace/jquery/2.2/jquery.min.js'>\x3C/script>")</script> <script src="https://nostarch.com/misc/jquery-extend-3.4.0.js?v=2.2.4"></script> <script src="https://nostarch.com/misc/jquery-html-prefilter-3.5.0-backport.js?v=2.2.4"></script> <script src="https://nostarch.com/misc/jquery.once.js?v=1.2"></script> <script src="https://nostarch.com/misc/drupal.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/modules/contrib/jquery_update/js/jquery_browser.js?v=0.0.1"></script> <script src="https://nostarch.com/misc/form-single-submit.js?v=7.102"></script> <script src="https://nostarch.com/sites/all/modules/contrib/ubercart/uc_file/uc_file.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/libraries/colorbox/jquery.colorbox-min.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/js/colorbox.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/styles/plain/colorbox_style.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/js/colorbox_load.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/modules/contrib/colorbox/js/colorbox_inline.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/modules/contrib/ubercart/uc_cart/uc_cart_block.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/modules/contrib/google_analytics/googleanalytics.js?snm0ir"></script> <script src="https://www.googletagmanager.com/gtag/js?id=UA-5027625-1"></script> <script>window.google_analytics_uacct = "UA-5027625-1";window.dataLayer = window.dataLayer || [];function gtag(){dataLayer.push(arguments)};gtag("js", new Date());gtag("set", "developer_id.dMDhkMT", true);gtag("config", "UA-5027625-1", {"groups":"default","anonymize_ip":true});gtag("config", "G-51XGZT9Y4H", {"groups":"default","anonymize_ip":true});</script> <script src="https://nostarch.com/sites/all/themes/nostarch/js/bootstrap.min.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/themes/nostarch/js/main.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/themes/nostarch/js/front_grid_height.js?snm0ir"></script> <script>jQuery.extend(Drupal.settings, {"basePath":"\/","pathPrefix":"","setHasJsCookie":0,"ajaxPageState":{"theme":"nostarch","theme_token":"9sbPGvPj4-XzFKltXXpChjeVNBdUbTFzMPY3FSebLr0","js":{"sites\/all\/modules\/contrib\/addthis\/addthis.js":1,"sites\/all\/libraries\/shariff\/shariff.min.js":1,"sites\/all\/themes\/contrib\/bootstrap\/js\/bootstrap.js":1,"\/\/ajax.googleapis.com\/ajax\/libs\/jquery\/2.2.4\/jquery.min.js":1,"0":1,"misc\/jquery-extend-3.4.0.js":1,"misc\/jquery-html-prefilter-3.5.0-backport.js":1,"misc\/jquery.once.js":1,"misc\/drupal.js":1,"sites\/all\/modules\/contrib\/jquery_update\/js\/jquery_browser.js":1,"misc\/form-single-submit.js":1,"sites\/all\/modules\/contrib\/ubercart\/uc_file\/uc_file.js":1,"sites\/all\/libraries\/colorbox\/jquery.colorbox-min.js":1,"sites\/all\/modules\/contrib\/colorbox\/js\/colorbox.js":1,"sites\/all\/modules\/contrib\/colorbox\/styles\/plain\/colorbox_style.js":1,"sites\/all\/modules\/contrib\/colorbox\/js\/colorbox_load.js":1,"sites\/all\/modules\/contrib\/colorbox\/js\/colorbox_inline.js":1,"sites\/all\/modules\/contrib\/ubercart\/uc_cart\/uc_cart_block.js":1,"sites\/all\/modules\/contrib\/google_analytics\/googleanalytics.js":1,"https:\/\/www.googletagmanager.com\/gtag\/js?id=UA-5027625-1":1,"1":1,"sites\/all\/themes\/nostarch\/js\/bootstrap.min.js":1,"sites\/all\/themes\/nostarch\/js\/main.js":1,"sites\/all\/themes\/nostarch\/js\/front_grid_height.js":1},"css":{"modules\/system\/system.base.css":1,"modules\/field\/theme\/field.css":1,"sites\/all\/modules\/contrib\/logintoboggan\/logintoboggan.css":1,"modules\/node\/node.css":1,"sites\/all\/modules\/contrib\/uc_fedex\/uc_fedex.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_file\/uc_file.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_order\/uc_order.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_product\/uc_product.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_store\/uc_store.css":1,"sites\/all\/modules\/contrib\/views\/css\/views.css":1,"sites\/all\/modules\/contrib\/ckeditor\/css\/ckeditor.css":1,"sites\/all\/modules\/contrib\/uc_discounts_alt\/uc_discounts\/uc_discounts.css":1,"sites\/all\/modules\/contrib\/colorbox\/styles\/plain\/colorbox_style.css":1,"sites\/all\/modules\/contrib\/ctools\/css\/ctools.css":1,"sites\/all\/modules\/contrib\/ubercart\/uc_cart\/uc_cart_block.css":1,"sites\/all\/libraries\/shariff\/shariff.complete.css":1,"sites\/all\/themes\/nostarch\/css\/en_styles.css":1,"sites\/all\/themes\/nostarch\/css\/custom.css":1,"sites\/all\/themes\/nostarch\/css\/bootstrap-3-vert-offset.css":1,"sites\/all\/themes\/nostarch\/css\/bootstrap-3-autoclear.css":1,"sites\/all\/themes\/nostarch\/css\/glyphicons.css":1}},"colorbox":{"opacity":"0.85","current":"{current} of {total}","previous":"\u00ab Prev","next":"Next \u00bb","close":"Close","maxWidth":"98%","maxHeight":"98%","fixed":true,"mobiledetect":true,"mobiledevicewidth":"480px","file_public_path":"\/sites\/default\/files","specificPagesDefaultValue":"admin*\nimagebrowser*\nimg_assist*\nimce*\nnode\/add\/*\nnode\/*\/edit\nprint\/*\nprintpdf\/*\nsystem\/ajax\nsystem\/ajax\/*"},"better_exposed_filters":{"views":{"topics":{"displays":{"block":{"filters":[]}}},"related_products":{"displays":{"block":{"filters":[]}}}}},"googleanalytics":{"account":["UA-5027625-1","G-51XGZT9Y4H"],"trackOutbound":1,"trackMailto":1,"trackDownload":1,"trackDownloadExtensions":"7z|aac|arc|arj|asf|asx|avi|bin|csv|doc(x|m)?|dot(x|m)?|exe|flv|gif|gz|gzip|hqx|jar|jpe?g|js|mp(2|3|4|e?g)|mov(ie)?|msi|msp|pdf|phps|png|ppt(x|m)?|pot(x|m)?|pps(x|m)?|ppam|sld(x|m)?|thmx|qtm?|ra(m|r)?|sea|sit|tar|tgz|torrent|txt|wav|wma|wmv|wpd|xls(x|m|b)?|xlt(x|m)|xlam|xml|z|zip","trackColorbox":1},"urlIsAjaxTrusted":{"\/malware":true},"bootstrap":{"anchorsFix":"0","anchorsSmoothScrolling":"0","formHasError":1,"popoverEnabled":1,"popoverOptions":{"animation":1,"html":0,"placement":"right","selector":"","trigger":"click","triggerAutoclose":1,"title":"","content":"","delay":0,"container":"body"},"tooltipEnabled":1,"tooltipOptions":{"animation":1,"html":0,"placement":"auto left","selector":"","trigger":"hover focus","delay":0,"container":"body"}}});</script> </head> <body class="html not-front not-logged-in two-sidebars page-node page-node- page-node-184 node-type-product uc-product-node"> <div id="skip-link"> <a href="#main-content" class="element-invisible element-focusable">Skip to main content</a> </div> <header id="" class="header" role="banner" class="navbar navbar-default"> <div class="container"> <div class="row"> <nav role="navigation" class="navbar navbar-default visible-xs"> <div class="navbar-header"> <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar" aria-expanded="false" aria-controls="navbar"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> <a class="navbar-brand text-uppercase" href="/"><img src="https://nostarch.com/sites/all/themes/nostarch/logo.png" alt="Home" class="img-responsive"/></a> </div> <div id="navbar" class="navbar-collapse collapse text-center"> <ul class="menu nav navbar-nav"><li class="first leaf"><a href="/catalog.htm" title="Explore our catalog">Catalog</a></li> <li class="leaf"><a href="https://nostarch.com/merchandise-0" title="Merchandise">Merchandise</a></li> <li class="leaf"><a href="/blog" title="The No Starch Press blog">Blog</a></li> <li class="leaf"><a href="https://nostarch.com/early-access-program" title="Media contact">Early Access</a></li> <li class="leaf"><a href="/writeforus" title="Submit a book proposal">Write for Us</a></li> <li class="leaf"><a href="/about" title="About No Starch Press">About Us</a></li> <li class="last leaf"><a href="/contactus" title="Contact Us">Contact Us</a></li> </ul> <div class="region region-navigation"> <section id="block-uc-cart-cart" class="block block-uc-cart clearfix"> <h2 class="block-title"><a href="/cart"><span class="cart-block-icon-empty" title="View your shopping cart."></span></a><span class="cart-block-title-bar" title="Show/hide shopping cart contents.">Shopping cart<span class="cart-block-arrow arrow-down"></span></span></h2> <p class="cart-block-items collapsed uc-cart-empty">There are no products in your shopping cart.</p><table class="cart-block-summary"><tbody><tr><td class="cart-block-summary-items"><span class="num-items">0</span> Items</td><td class="cart-block-summary-total"><label>Total:</label> <span class="uc-price">$0.00</span></td></tr></tbody></table> </section> <section id="block-search-api-page-site-search" class="block block-search-api-page clearfix"> <form action="/malware" method="post" id="search-api-page-search-form-site-search" accept-charset="UTF-8"><div><div class="form-item form-item-keys-2 form-type-textfield form-group"><input placeholder="Search" class="form-control form-text" type="text" id="edit-keys-2" name="keys_2" value="" size="15" maxlength="128" /> <label class="control-label element-invisible" for="edit-keys-2">Enter your keywords</label> </div><input type="hidden" name="id" value="2" /> <button class="icon glyphicon glyphicon-search btn-primary form-control btn form-submit" type="submit" id="edit-submit-2" name="op" value=""></button> <input type="hidden" name="form_build_id" value="form-wwuxJKB_jzqWJq97q1dg3IUczguAlzWyUY_yxr6dTgg" /> <input type="hidden" name="form_id" value="search_api_page_search_form_site_search" /> </div></form> </section> </div> </div> </nav> <div class="navbar-header"> <div class="logo-wrapper col-sm-6 hidden-xs"> <a class="logo navbar-btn pull-left" href="/" title="Home"> <img src="https://nostarch.com/sites/all/themes/nostarch/logo.png" alt="Home" class="img-responsive"/> </a> </div> <div class="logo-wrapper col-sm-6 hidden-xs"> <div class="region region-navigation"> <div class="region region-navigation"> <section id="block-uc-cart-cart" class="block block-uc-cart clearfix"> <h2 class="block-title"><a href="/cart"><span class="cart-block-icon-empty" title="View your shopping cart."></span></a><span class="cart-block-title-bar" title="Show/hide shopping cart contents.">Shopping cart<span class="cart-block-arrow arrow-down"></span></span></h2> <p class="cart-block-items collapsed uc-cart-empty">There are no products in your shopping cart.</p><table class="cart-block-summary"><tbody><tr><td class="cart-block-summary-items"><span class="num-items">0</span> Items</td><td class="cart-block-summary-total"><label>Total:</label> <span class="uc-price">$0.00</span></td></tr></tbody></table> </section> <section id="block-search-api-page-site-search" class="block block-search-api-page clearfix"> <form action="/malware" method="post" id="search-api-page-search-form-site-search" accept-charset="UTF-8"><div><div class="form-item form-item-keys-2 form-type-textfield form-group"><input placeholder="Search" class="form-control form-text" type="text" id="edit-keys-2" name="keys_2" value="" size="15" maxlength="128" /> <label class="control-label element-invisible" for="edit-keys-2">Enter your keywords</label> </div><input type="hidden" name="id" value="2" /> <button class="icon glyphicon glyphicon-search btn-primary form-control btn form-submit" type="submit" id="edit-submit-2" name="op" value=""></button> <input type="hidden" name="form_build_id" value="form-wwuxJKB_jzqWJq97q1dg3IUczguAlzWyUY_yxr6dTgg" /> <input type="hidden" name="form_id" value="search_api_page_search_form_site_search" /> </div></form> </section> </div> </div> </div> </div> </div> </div> <div class="container"> <div class="row"> <div class="navbar-collapse collapse"> <nav role="navigation"> <ul class="menu nav navbar-nav"><ul class="menu nav navbar-nav"><li class="first leaf"><a href="/catalog.htm" title="Explore our catalog">Catalog</a></li> <li class="leaf"><a href="https://nostarch.com/merchandise-0" title="Merchandise">Merchandise</a></li> <li class="leaf"><a href="/blog" title="The No Starch Press blog">Blog</a></li> <li class="leaf"><a href="https://nostarch.com/early-access-program" title="Media contact">Early Access</a></li> <li class="leaf"><a href="/writeforus" title="Submit a book proposal">Write for Us</a></li> <li class="leaf"><a href="/about" title="About No Starch Press">About Us</a></li> <li class="last leaf"><a href="/contactus" title="Contact Us">Contact Us</a></li> </ul></ul> </nav> </div> </div> </div> </header> <div class="main-container container"> <header role="banner" id="page-header"> </header>  <div class="row"> <aside class="col-sm-3" role="complementary"> <div class="region region-sidebar-first well"> <section id="block-views-topics-block" class="block block-views clearfix"> <button class="btn btn-primary btn-block visible-xs vert-offset-top-2" data-toggle="collapse" data-target="#topics"><span class="glyphicon glyphicon-menu-down pull-left"></span> <span class="btn-text">Topics</span><span class="glyphicon glyphicon-menu-down pull-right"></span></button> <h2 class="block-title hidden-xs">Topics</h2> <div id="topics" class="view-content collapse dont-collapse animateCollapse"> <div class="view view-topics view-id-topics view-display-id-block view-dom-id-5a67cd0af34174845a30199ea354a4d2"> <div class="view-content"> <div class="item-list"> <ul> <li class="views-row views-row-1 views-row-odd views-row-first"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/art-photography-design">Art & Design</a></span> </div></li> <li class="views-row views-row-2 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/general-computing">General Computing</a></span> </div></li> <li class="views-row views-row-3 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/security">Hacking & Computer Security</a></span> </div></li> <li class="views-row views-row-4 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/hardware-and-diy">Hardware / DIY</a></span> </div></li> <li class="views-row views-row-5 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/kids">Kids</a></span> </div></li> <li class="views-row views-row-6 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/lego">LEGO®</a></span> </div></li> <li class="views-row views-row-7 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/linux-bsd-unix">Linux & BSD</a></span> </div></li> <li class="views-row views-row-8 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/manga">Manga</a></span> </div></li> <li class="views-row views-row-9 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/programming">Programming</a></span> </div></li> <li class="views-row views-row-10 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/python">Python</a></span> </div></li> <li class="views-row views-row-11 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/rforall">R for All</a></span> </div></li> <li class="views-row views-row-12 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/science-math">Science & Math</a></span> </div></li> <li class="views-row views-row-13 views-row-odd"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/scratch">Scratch</a></span> </div></li> <li class="views-row views-row-14 views-row-even"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/system-administration">System Administration</a></span> </div></li> <li class="views-row views-row-15 views-row-odd views-row-last"> <div class="views-field views-field-name"> <span class="field-content"><a href="/catalog/early-access">Early Access</a></span> </div></li> </ul></div> </div> <div class="view-footer"> <style> <![CDATA[/* ><!]]>*/ </style> </div> </div> </div> </section><section id="block-block-12" class="block block-block clearfix"> <div class="rounded_border_block"><span style="font-family:Arial,Helvetica,sans-serif"><strong><span style="font-size:12px"><span style="color:#c0392b"><a href="https://nostarch.com/about_ebooks.htm">FREE ebook edition with every print book purchased from nostarch.com!</a></span></span></strong></span></div> <p class="rtecenter"><span style="font-size:22px">+</span></p> <div class="rounded_border_block"><span style="font-family:Arial,Helvetica,sans-serif"><strong><span style="font-size:12px"><a href="https://nostarch.com/early-access-program"><span style="color:#c0392b">EARLY ACCESS lets you read full chapters months before a title's release date!</span></a></span></strong></span></div> </section> <section id="block-nostarch-custom-login-block" class="block block-nostarch-customclearfix"> <h2 class="block-title">User login</h2> <ul> <li><a href="/user">Log in</a></a></li> <li><a href="/user/register">Create account</a></a></li> </ul> </section> <section id="block-block-78" class="block block-block clearfix"> <script data-account="eeqOpWOUyZ" src="https://cdn.userway.org/widget.js"></script> </section> </div> </aside>  <section class="col-sm-6" style=""> <a id="main-content"></a> <div class="region region-content"> <section id="block-system-main" class="block block-system clearfix"> <div class="ds-1col node node-product view-mode-full clearfix"> <div class=""> <div class="field field-name-field-image-cache field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><div class="product-image"><div class="main-product-image"><a href="https://nostarch.com/sites/default/files/styles/uc_product_full/public/practical_malware_analysis.png?itok=m4QQ6WAD" title="Practical Malware Analysis" class="colorbox" rel="uc_image_0"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/uc_product/public/practical_malware_analysis.png?itok=LgOtRr5y" alt="Practical Malware Analysis" title="Practical Malware Analysis" /></a></div></div></div></div></div><div class="field field-name-entity-title field-type-ds field-label-hidden"><div class="field-items"><div class="field-item even"><h1 class="page-header">Practical Malware Analysis</h1></div></div></div><div class="field field-name-field-subtitle field-type-text field-label-hidden"><div class="field-items"><div class="field-item even">The Hands-On Guide to Dissecting Malicious Software</div></div></div><div class="field field-name-field-author field-type-text field-label-hidden"><div class="field-items"><div class="field-item even">by Michael Sikorski and Andrew Honig</div></div></div><div class="field field-name-released-date field-type-ds field-label-hidden"><div class="field-items"><div class="field-item even">February 2012, 800 pp.</div></div></div><div class="field field-name-field-isbn13 field-type-text field-label-inline clearfix clearfix"><div class="field-label">ISBN-13: </div><div class="field-items"><div class="field-item even">9781593272906</div></div></div><div class="field field-name-field-special field-type-text field-label-hidden"><div class="field-items"><div class="field-item even">Lay-flat binding</div></div></div><div class="add-to-cart"><form action="/malware" method="post" id="uc-product-add-to-cart-form-184" accept-charset="UTF-8"><div><div id="uc_product_add_to_cart_form-184-attributes" class="attributes"><div class="attribute attribute-1 odd"><div class="form-item form-item-attributes-1 form-type-radios form-group"><div id="edit-attributes-1" class="form-radios"><div class="form-item form-item-attributes-1 form-type-radio radio"> <label class="control-label" for="edit-attributes-1-3"><input type="radio" id="edit-attributes-1-3" name="attributes[1]" value="3" checked="checked" class="form-radio" />Print Book and FREE Ebook, $59.99</label> </div><div class="form-item form-item-attributes-1 form-type-radio radio"> <label class="control-label" for="edit-attributes-1-2"><input type="radio" id="edit-attributes-1-2" name="attributes[1]" value="2" class="form-radio" />Ebook (PDF, Mobi, and ePub), $47.99</label> </div></div></div></div></div><input type="hidden" name="qty" value="1" /> <input type="hidden" name="form_build_id" value="form-PLwZKPQ1f2qyGYERsNgQcRa5nVmDEM7pWBY7k_97Rog" /> <input type="hidden" name="form_id" value="uc_product_add_to_cart_form_184" /> <div class="form-actions form-wrapper form-group" id="edit-actions"><button class="node-add-to-cart btn btn-success form-submit icon-before" type="submit" id="edit-submit-184" name="op" value="Add to cart"><span class="icon glyphicon glyphicon-plus" aria-hidden="true"></span> Add to cart</button> </div></div></form></div><div class="field field-name-product-menu field-type-ds field-label-hidden"><div class="field-items"><div class="field-item even"><div class="menu-wrapper"><ul class="menu nav"><li><a href="#content">Contents</a></li><li><a href="#reviews">Reviews</a></li><li><a href="#updates">Updates</a></li></ul></div></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><ul> <li><u><a href="/download/samples/practical-malware-analysis_ch12.pdf" target="_blank">Download Chapter 12: Covert Malware Launching</a></u> (PDF)</li> <li><u><a href="https://github.com/mikesiko/PracticalMalwareAnalysis-Labs" target="_blank">Download the labs</a></u></li> <li><u><a href="http://practicalmalwareanalysis.com/" target="_blank">Visit the authors' website for news and other resources</a></u></li> </ul> <blockquote>"The book every malware analyst should keep handy." —<strong>Richard Bejtlich, CSO of Mandiant & Founder of TaoSecurity</strong></blockquote> <p>Malware analysis is big business, and attacks can cost a company dearly. When malware breaches your defenses, you need to act quickly to cure current infections and prevent future ones from occurring.</p> <p>For those who want to stay ahead of the latest malware, <em>Practical Malware Analysis</em> will teach you the tools and techniques used by professional analysts. With this book as your guide, you'll be able to safely analyze, debug, and disassemble any malicious software that comes your way.</p> <p>You'll learn how to:</p> <ul> <li>Set up a safe virtual environment to analyze malware</li> <li>Quickly extract network signatures and host-based indicators</li> <li>Use key analysis tools like IDA Pro, OllyDbg, and WinDbg</li> <li>Overcome malware tricks like obfuscation, anti-disassembly, anti-debugging, and anti-virtual machine techniques</li> <li>Use your newfound knowledge of Windows internals for malware analysis</li> <li>Develop a methodology for unpacking malware and get practical experience with five of the most popular packers</li> <li>Analyze special cases of malware with shellcode, C++, and 64-bit code</li> </ul> <p> </p> <p>Hands-on labs throughout the book challenge you to practice and synthesize your skills as you dissect real malware samples, and pages of detailed dissections offer an over-the-shoulder look at how the pros do it. You'll learn how to crack open malware to see how it really works, determine what damage it has done, thoroughly clean your network, and ensure that the malware never comes back.</p> <p>Malware analysis is a cat-and-mouse game with rules that are constantly changing, so make sure you have the fundamentals. Whether you're tasked with securing one network or a thousand networks, or you're making a living as a malware analyst, you'll find what you need to succeed in <em>Practical Malware Analysis</em>.</p> </div></div></div><div class="field field-name-field-author-bio field-type-text-long field-label-abovec"><div class="field-label">Author Bio </div><div class="field-items"><div class="field-item even"><p><strong>Michael Sikorski</strong> is a malware analyst, researcher, and security consultant at Mandiant. His previous employers include the National Security Agency and MIT Lincoln Laboratory. Mike frequently teaches malware analysis to a variety of audiences including the FBI and Black Hat.</p> <p><strong>Andrew Honig</strong> is an Information Assurance Expert for the Department of Defense. He teaches courses on software analysis, reverse engineering, and Windows system programming. Andy is publicly credited with several zero-day exploits in VMware's virtualization products.</p> </div></div></div><div class="field field-name-field-toc field-type-text-long field-label-abovec" id="content"><div class="field-label">Table of contents </div><div class="field-items"><div class="field-item even"><p>Introduction<br /> Chapter 0: Malware Analysis Primer</p> <p><strong>Part 1: Basic Analysis</strong><br /> Chapter 1: Basic Static Techniques<br /> Chapter 2: Malware Analysis in Virtual Machines<br /> Chapter 3: Basic Dynamic Analysis</p> <p><strong>Part 2: Advanced Static Analysis</strong><br /> Chapter 4: A Crash Course in x86 Disassembly<br /> Chapter 5: IDA Pro<br /> Chapter 6: Recognizing C Code Constructs in Assembly<br /> Chapter 7: Analyzing Malicious Windows Programs</p> <p><strong>Part 3: Advanced Dynamic Analysis</strong><br /> Chapter 8: Debugging<br /> Chapter 9: OllyDbg<br /> Chapter 10: Kernel Debugging with WinDbg</p> <p><strong>Part 4: Malware Functionality</strong><br /> Chapter 11: Malware Behavior<br /> Chapter 12: Covert Malware Launching<br /> Chapter 13: Data Encoding<br /> Chapter 14: Malware-Focused Network Signatures</p> <p><strong>Part 5: Anti-Reverse-Engineering</strong><br /> Chapter 15: Anti-Disassembly<br /> Chapter 16: Anti-Debugging<br /> Chapter 17: Anti-Virtual Machine Techniques<br /> Chapter 18: Packers and Unpacking</p> <p><strong>Part 6: Special Topics</strong><br /> Chapter 19: Shellcode Analysis<br /> Chapter 20: C++ Analysis<br /> Chapter 21: 64-Bit Malware</p> <p>Appendix A: Important Windows Functions<br /> Appendix B: Tools for Malware Analysis<br /> Appendix C: Solutions to Labs</p> <p>View the detailed <a href="/download/samples/practical-malware-analysis_toc.pdf" target="_blank">Table of Contents</a> (PDF)<br /> View the <a href="/download/samples/practical-malware-analysis_index.pdf" target="_blank">Index</a> (PDF)</p> </div></div></div><div class="field field-name-field-reviews field-type-text-long field-label-abovec" id="reviews"><div class="field-label">Reviews </div><div class="field-items"><div class="field-item even"><p>"<b>Digital Forensics Book of the Year</b>" - <a href="http://forensic4cast.com/forensic-4cast-awards/2013-results/"> 2013 Forensic 4cast Awards</a></p> <p>"A hands-on introduction to malware analysis. I'd recommend it to anyone who wants to dissect Windows malware."<br /> <b>—Ilfak Guilfanov, Creator of IDA Pro</b></p> <p>"The book every malware analyst should keep handy."<br /> <b>—Richard Bejtlich, CSO of Mandiant & Founder of TaoSecurity</b></p> <p>"This book does exactly what it promises on the cover; it's crammed with detail and has an intensely practical approach, but it's well organised enough that you can keep it around as handy reference."<br /> <b>—Mary Branscombe, ZDNet</b> (<a href="https://www.zdnet.com/practical-malware-analysis-book-review-7000003422/">Read More</a>)</p> <p>"If you're starting out in malware analysis, or if you are are coming to analysis from another discipline, I'd recommend having a nose."<br /> <b>—Paul Baccas, Naked Security from Sophos</b> (<a href="http://nakedsecurity.sophos.com/2012/09/14/book-review-practical-malware-analysis/">Read More</a>)</p> <p>"An excellent crash course in malware analysis."<br /> <b>—Dino Dai Zovi, Independent Security Consultant</b></p> <p>"The most comprehensive guide to analysis of malware, offering detailed coverage of all the essential skills required to understand the specific challenges presented by modern malware."<br /> <b>—Chris Eagle, Senior Lecturer of Computer Science at the Naval Postgraduate School</b></p> <p>"A great introduction to malware analysis. All chapters contain detailed technical explanations and hands-on lab exercises to get you immediate exposure to real malware."<br /> <b>—Sebastian Porst, Google Software Engineer</b></p> <p>"Brings reverse engineering to readers of all skill levels. Technically rich and accessible, the labs will lead you to a deeper understanding of the art and science of reverse engineering. I strongly recommend this book for beginners and experts alike. I strongly believe this will become the defacto text for learning malware analysis in the future."<br /> <b>—Danny Quist, PhD, Founder of Offensive Computing</b></p> <p>“An awesome book. . . written by knowledgeable authors who possess the rare gift of being able to communicate their knowledge through the written word.”<br /> <b>—Richard Austin, IEEE Cipher</b> (<a href="http://www.ieee-security.org/Cipher/BookReviews/2012/Sikorski_by_austin.html">Read More</a>)</p> <p>"If you only read one malware book or are looking to break into the world of malware analysis, this is the book to get."<br /> <b>—Patrick Engebretson, IA Professor at Dakota State University and Author of <i>The Basics of Hacking and Pen Testing</i></b></p> <p>"An excellent addition to the course materials for an advanced graduate level course on Software Security or Intrusion Detection Systems. The labs are especially useful to students in teaching the methods to reverse engineer, analyze and understand malicious software."<br /> <b>—Sal Stolfo, Professor, Columbia University</b></p> <p>"The explanation of the tools is clear, the presentation of the process is lucid, and the actual detective work fascinating. All presented clearly and hitting just the right level so that developers with no previous experience in this particular area can participate fully. Highly recommended."<br /> <b>—Dr. Dobb's</b> (<a href="http://drdobbs.com/tools/232602534" target="new">Read More</a>)</p> <p>"This book is like having your very own personal malware analysis teacher without the expensive training costs."<br /> <b>—Dustin Schultz, TheXploit</b> (<a href="http://thexploit.com/reviews/book-review-practical-malware-analysis/" target="new">Read More</a>)</p> <p>"I highly recommend this book to anyone looking to get their feet wet in malware analysis or just looking for a good desktop reference on the subject."<br /> <b>—Pete Arzamendi, 403 Labs</b> (<a href="http://blog.403labs.com/post/24416051236/practical-malware-analysis-another-hit-from-no-starch" target="new">Read More</a>)</p> <p>“I do not see how anyone who has hands-on responsibility for security of Windows systems can rationalize not being familiar with these tools.”<br /> <b>—Stephen Northcutt, SANS Institute</b> (<a href="http://www.sans.edu/research/book-reviews/article/br-malware-analysis">Read More</a>)</p> <p>"<em>Practical Malware Analysis</em> is another book that should be within reaching distance in anyone’s DFIR shop. I went ahead and purchased <em>PMA</em> hoping the book would improve my knowledge and skills when faced with malware. What I ended up with was knowledge, a process and tools I can use to analyze any program I encounter. <em>PMA</em> gets a five star review (5 out of 5)."<br /> <b>—Journey Into Incident Response</b> (<a href="https://journeyintoir.blogspot.com/2012/05/practical-malware-analysis-book-review.html" target="new">Read More</a>)</p> <p>“Highly recommend it to those looking to enter the malware analysis field.”<br /> <b>—Linux Ninja</b> (<a href="http://blog.linux-ninja.com/2012/04/practical-malware-analysis-review.html">Read More</a>)</p> <p>"If you are a beginner to this hacking field, then this book will be an excellent choice for you."<br /> <b>—Hackerzzz</b></p> <p>"I cannot recommend it enough."<br /> <b>—Tony Robinson, Security Boulevard</b></p> <p><b>Selected by <a target="_blank">Cyber Defense Magazine</a> as 1 of 100 Best CyberSecurity Books</b></p> </div></div></div><div class="field field-name-field-updates field-type-text-long field-label-abovec" id="updates"><div class="field-label">Updates </div><div class="field-items"><div class="field-item even"><p>View the <a href="/download/PracticalMalwareAnalysis_errata_p18.pdf" target="_blank" style="text-decoration:underline;"><u><b>latest errata</b></u></a>.</p> </div></div></div> </div> </div> </section> <section id="block-shariff-shariff-block" class="block block-shariff clearfix"> <div class="shariff" data-services="["facebook","print","twitter"]" data-theme="colored" data-orientation="horizontal" data-twitter-via="nostarch" data-lang="en"></div> </section> </div> </section> <aside class="col-sm-3" role="complementary"> <div class="region region-sidebar-second"> <section id="block-system-navigation" class="block block-system block-menu clearfix"> <h2 class="block-title">Navigation</h2> <ul class="menu nav"><li class="first last leaf"><a href="/user" title="">My account</a></li> </ul> </section> <section id="block-block-52" class="block block-block clearfix"> <p><a href="/mailchimp/subscribe">Want sweet deals? <br />Sign up for our newsletter.</a></p> </section> <section id="block-views-related-products-block" class="block block-views clearfix"> <h2 class="block-title">You might also like...</h2> <div class="view view-related-products view-id-related_products view-display-id-block auto-clear view-dom-id-7eef2a8297d7c8750841f920e726c357"> <div class="view-content"> <div class="views-row views-row-1 views-row-odd views-row-first col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/black-hat-python2E"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/BlackHatPython2e_cover.png?itok=2V0CqOZo" width="90" height="119" alt="Black Hat Python, 2nd Edition cover" title="Black Hat Python, 2nd Edition cover" /></a></div> </div> </div> <div class="views-row views-row-2 views-row-even col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/smartgirlsguide"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/sggp_frontcvr_final.png?itok=8Vjrunvd" width="90" height="136" alt="The Smart Girl's Guide to Privacy" title="The Smart Girl's Guide to Privacy" /></a></div> </div> </div> <div class="views-row views-row-3 views-row-odd col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/evading-edr"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/EvadingEDR_cover.png?itok=mTttZke_" width="90" height="119" alt="Evading EDR cover" title="Evading EDR cover" /></a></div> </div> </div> <div class="views-row views-row-4 views-row-even col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/serious-cryptography-2nd-edition"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/SeriousCryptography2e_frontcover.png?itok=5T4rwR8F" width="90" height="119" alt="Serious Cryptography, 2nd Edition placeholder cover" title="Serious Cryptography, 2nd Edition placeholder cover" /></a></div> </div> </div> <div class="views-row views-row-5 views-row-odd col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/cybersecurity-small-networks"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/CybersecuritySmallNetworks_front.png?itok=uZBcuW55" width="90" height="119" alt="Cybersecurity for Small Networks Cover" title="Cybersecurity for Small Networks Cover" /></a></div> </div> </div> <div class="views-row views-row-6 views-row-even views-row-last col-xs-6 col-sm-6 col-md-12"> <div class="views-field views-field-field-image-cache"> <div class="field-content"><a href="/bughunting"><img class="img-responsive" src="https://nostarch.com/sites/default/files/styles/product/public/bughunting_frontcvr_rgb_REV2%20HM.png?itok=J6QvAzty" width="90" height="119" alt="Real-World Bug Hunting" title="Real-World Bug Hunting" /></a></div> </div> </div> </div> </div> </section> </div> </aside>  </div> </div> <footer class="footer container"> <div class="region region-footer"> <section id="block-block-16" class="block block-block clearfix"> <div id="footer-links"> <br> <a class="footer-links" href="/about.htm">About Us</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/Jobs.htm">Jobs!</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/distribution.htm">Sales and Distribution</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/rights">Rights</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/media.htm">Media</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/academic.htm">Academic Requests</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/conferences.htm">Conferences</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/orderfaq.htm">FAQ</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/contactus">Contact Us</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/writeforus">Write for Us</a>  <span class="footer-divider">|</span>  <a class="footer-links" href="/privacypolicy.htm">Privacy</a> </div> </section> <section id="block-nostarch-custom-custom-footer-copyright" class="block block-nostarch-custom clearfix"> <div class="block-block"> <p>Copyright 2024. No Starch Press, Inc</p> </div> </section> </div> </footer> <script src="https://nostarch.com/sites/all/modules/contrib/addthis/addthis.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/libraries/shariff/shariff.min.js?snm0ir"></script> <script src="https://nostarch.com/sites/all/themes/contrib/bootstrap/js/bootstrap.js?snm0ir"></script>  <script> !function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement("script");t.src="https://www.redditstatic.com/ads/pixel.js",t.async=!0;var s=d.getElementsByTagName("script")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','t2_6acpsf9y');rdt('track', 'PageVisit'); </script>   <script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8e93144498ebcde6',t:'MTczMjcyMDU4NC4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script></body> </html>