PMAT-labs - Labs for Practical Malware Analysis & Triage

项目说明

<p align="center">
<img src=" />
</p>

<di="center">

PMAT-labs 🔬

Welcome to the labs for Practical Malware Analysis &amp; Triage.

---

[![Release ][img-]][release] [![Course Link][course]][course-link] [![EULA][img-license-badge]][eula]

---

🔴 WARNING 🔴

</div>

Read this carefully before proceeding.

This repository contains li samples for use in the Practical Malware Analysis & Triage course (PMAT). These samples are either written to emulate common malware characteristics or are li, "caught in the wild" samples. Both categories are dangerous. These samples are to be handled with extreme caution at all times.

Do not download these samples to a computer you do not own.

Do not execute any of these samples on a computer you do not own.

Do not download and/or execute these samples in an en where you cannot revert to a sa, i.e. a machine.

Practice safe malware handling procedures at all times when using these samples.

By downloading the contents of this repository, regardless of whether you ha the course or not, you are agreeing to the End User License Agreement. Please refer to EULA.md for more information.

---

About the Course ✏️📕

If you're here after purchasing the course, welcome! Thank you for supporting me as a content creator. Read on to the next section to learn how the lab repo works.

If you're here not having purchased the course, welcome! The labs for the course are free (and always will be) and are hosted here on GitHub for anyone who is interested. But if you don't quite know where to begin and/or are interested in learning malware analysis from 9+ hours of high-quality video content, consider buying the course! The were made with love to build you into a capable, knowledgeable malware analyst.

If you want to purchase the course and support me as a content creator, please also consider using my affiliate link!

<di="center">

[![Course Link][course]][course-link]

</div>

---

🧭 Structure 🗺️

The structure of this repository maps to the course . The top directory contains the name of the section, and the subdirectories are the samples in use during that part of the course. For example:

In the example above, the 0-1.HandlingAndSafety directory contains a zipped copy of Malware.Calc.exe.7z and the other files that sample is provided with. It is used in the Handling and Safety section in the course.

Underneath the Handling and Safety sample, the 1-1.BasicStaticAnalysis directory contains two samples that are used in that section. The whole course follows this structure, so check to see which section you're currently in and then the will reference the sample to work on.

---

Topics 📚

Each section is broken down by topic:

0. Malware Handling and Safety

This section covers basic malware handling and safety, including defanging malware and safe practices for transfer and storage.

1. Basic Static | Basic Dynamic

This section covers initial triage, static analysis, initial detonation, and the primary methodology of basic analysis.

2. Ad Static | Ad Dynamic

This section covers ad malware analysis methodology and introduces Assembly, debugging, decompiling, and inspecting the Windows API at the ASM level.

3. Specialty Class Malware

This section covers different specialty classes of malware like maldocs, C# assemblies, and script-based malware. It also includes a section on mobile platform malware analysis.

4. Bossfights!

The Bossfights pit you against infamous real-world samples of malware and require you to do a full analysis.

5. Automation | Rule Writing | Report Writing

This section covers effecti writing, Yara rule writing, and automating the initial stages of triage with Blue-Jupyter.

6. Course Conclusion: Course Final | References | Resources | Further Readings

The course final consists of a capstone in which you will combine all relevant skills in this course to write and publish open-source information about a gi from the course.

The course conclusion includes further readings, references, and helpful resources for further learning.

Please note: some samples are used multiple times in different sections. Check to make sure which sample the course are referencing and that you have the correct one for a gi.

---

🏋️‍♀️ Challenges 🏋️

The challenge samples in this course are used as mini-capstones for the different sections. Each sample marked as a Challenge includes a set of questions to answer about the sample as well as an answers/ directory. The README in the answers/ directory contains brief answers to each question in the Challenge. Try to get as far as you can without looking at the answers first!

---

Password 🔒

Each sample is zipped and password-protected. The password for all malware samples is infected.

---

Report Template ☑

In one of the final sections of the course, I teach how to write a simple Malware Analysis report. The template used in that section is here. Feel free to use this as a template for this course or any other malware reports you want to create.

<di="center">

!image

</div>

Cosmo? 🐈

You may be wondering, why is there a picture of a handsome cat in the root directory?

That's Cosmo, my cat. He's not very good at malware analysis, so he's along for the ride to learn things. I don't have high hopes for him (he is just a cat after all).

cosmo.jpeg serves two functions.

A Surrogate Data File

The malware samples in this course are built to perform different functions. Some are designed to destroy data. Some are designed to steal it. Some don't touch your data at all.

cosmo.jpeg is a placeholder for the precious, precious data that an a end user may have on their host. Some malware samples in this course will steal him, encrypt him, encode and exfiltrate him, the whole nine yards. So to accurately represent what data theft or destruction might look like, the custom-written malware samples in this course are going to target this file specifically.

It's a bit of a hefty file (about 1.6MB), unlike Cosmo himself who is not a hefty cat at all. So it should serve well as a data file placeholder.

En Keying

I wrote the samples for this course from the ground up to be as safe as possible. I am aware that putting malware samples out into the world, regardless of your intention for doing so, imparts risk. So to help mitigate the possibility that these samples could be used maliciously, I' them to this particular file. This is a red team tactic that ensures a payload will only trigger if there are certain identifiers present in the en. cosmo.jpeg present on the Desktop of FLARE-VM acts as the key for most of the malware samples in this course.

Instructions

When you are done downloading and extracting this lab repository, take cosmo.jpeg and copy it to the desktop of the main user account on the Windows FLARE-VM host. That's all!

<!--
Links
-->

[release]:
[repo]: "PMAT-lab repo ➶"
[eula]: "EULA ➶"
[course-link]:
[course-affil-link]:

<!--
Badges
-->

[students]:
[course]:
[course-affil]:
[img-]:
[lastcommit]:
[img-license-badge]:
[student-count]:

项目信息

开发语言：HCL

Star 数：1161

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Labs for Practical Malware Analysis & Triage展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。