| Date | Day | Time | Duration |
| 22 Nov | Monday | 0900-17:00 GST/GMT+4 | 8 Hours |
| 23 Nov | Tuesday | 0900-17:00 GST/GMT+4 | 8 Hours |
This course explains through practical and real examples how to analyze malicious documents, which are the main vector of infection by malware in the current days and, different of the common intuition, can be very hard to analyze. During the class, students will learn how to perform static and dynamic analysis of different types of documents such as pdf, doc/docx, xls/xlsx, rtf, msi, and so on, which adversaries use many anti-forensic tricks such as obfuscated shellcodes, embedded documents, obfuscated scripts, and many other tactics.
The class (almost 100% practical) is focused and guided by practical examples, where the instructor analyzes real malicious documents in real time followed by students at same time.
The course is composed by the following topics:
1. Introduction
2. Creating a lab and fundamental concepts
3. Analyzing Malicious PDF Documents.
4. Analyzing Malicious MS Office Documents
5. Analyzing Malicious MS Office Documents – Dynamic Analysis
6. Miscellaneous
Students will analyze, in real time, several document (and other formats) files for two days, which makes this course an almost 100% hands-on course!
This very short section presents the motivations about learning malicious documents analysis. A real fact (provided by Kaspersky in 2019 and 2020) is that about 70% of malware compromises cases has occurred due the usage of malicious documents as a vector. * There isn't hands-on lab in this section.
This section explains and shows how to create a suitable lab for making experiments with malicious documents. Additionally, the internal structure of a PDF file is explained to help students in their analysis. * There isn't hands-on lab in this section.
This section presents several real PDF documents to be analyzed in real time by the instructor and students. These malicious PDF documents use several tricks such as embedded shellcode, embedded obfuscated scripts, embedded malicious Microsoft Office Documents, hidden executables, encoding and so on. * This a completely practical (hands-on based) section, which the instructor proposes the malicious documents and solve it step-by-step together with students. Additionally, few exercises are proposed to be solved only by students.
This section presents several real malicious Microsoft Office Documents to be analyzed in real time by the instructor and students. Different formats solved such as doc/docx, xls/xlsx, ppt/pptx and rtf documents. On these malicious samples, adversaries use different tricks such as VBA and JavaScript obfuscation, encoding and packing in multiple stages. * This a completely practical (hands-on based) section, which the instructor proposes the malicious documents and solve it step-by-step together with students. Additionally, few exercises are proposed to be solved only by students.
This section presents several real malicious Microsoft Office Documents to be analyzed in real time by the instructor and students using a dynamic approach. Different formats solved such as doc/docx, xls/xlsx and so on. On these malicious samples, adversaries use different tricks such as VBA and JavaScript obfuscation, encoding, password locking and packing in multiple stages. * This a completely practical (hands-on based) section, which the instructor proposes the malicious documents and solve it step-by-step together with students. Additionally, few exercises are proposed to be solved only by students.
This section is composed by a mixed batch of documents to be analyzed by students during the hands-on lab. They'll will use their just learned knowledge to analyze different malicious documents without any kind of hints. A final note: this course is almost 100% hands-on based and offers 35 examples solved in real time by instructor and students, together.
