Browser Cases return deterministic, recorded tool output; no specimen is downloaded or executed in a Browser Case. Optional Live Labs use externally referenced specimens inside a learner-managed isolated VM.
MAA analyst shell — emulated. Nothing executes.
Type 'help', or tap a command below.
$ file loader.dll
loader.dll: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
The Browser Case uses emulated, recorded output. No specimen is downloaded or executed in this Browser Case; indicators are defanged.
Try it now · no signup
A Browser Case with recorded analyst output
Type the guided commands or explore on your own. The Browser Case returns deterministic, pre-recorded tool output; no specimen is downloaded or executed in this Browser Case.
DO-IT · loader.dll triage
- 1
Identify the file
Confirm the format before anything else.
- 2
Pull strings, spot the C2
Filter printable strings for the defanged C2 URL (hxxp).
- 3
Inspect the PE structure
Entry point, sections, and suspicious imports.
- 4
Map capabilities to ATT&CK
Turn behavior into technique IDs.
- 5
Confirm with a rule
Run a YARA rule to corroborate the family.
MAA analyst shell — emulated. Nothing executes.
Type 'help', or click a step on the left.
73
Lessons
6
Learning paths
20
Modules
29
Graded exercises
Core disciplines for malware analysis
Each module pairs guided lessons with hands-on exercises and real sample references — scored on IOC accuracy, reasoning, and reporting.
Static Analysis
Dissect PE headers, extract strings, identify packing, and map imports without executing a single instruction.
Dynamic Analysis
Observe runtime behavior in sandboxed VMs using Procmon, Wireshark, and FakeNet-NG to capture IOCs.
Reverse Engineering
Navigate Ghidra decompilation, trace API call chains, and reconstruct malware capabilities from assembly.
Detection Engineering
Write YARA rules from byte patterns, build Sigma detections for Sysmon events, and validate against samples.
Incident Response
Build behavioral timelines, prioritize containment actions, and produce actionable analyst reports.
Threat Intelligence
Map findings to MITRE ATT&CK, extract C2 infrastructure patterns, and contextualize campaigns.
A curriculum that builds on itself
Start with the mandatory foundations, then specialize at your own pace.
Core Analyst Path
Windows Malware Internals
Reverse Engineering
Dynamic Analysis & Detection
Capstone Labs
Malicious Document & Script Analysis
Start with an evidence-led investigation.
Triage a reviewed Windows PE from recorded analyst output, defend each conclusion, and leave with an editable report. No account or specimen download is required.