Tool tutorials

One tool, one sitting. These are hands-on tutorials for the software analysts actually reach for — YARA, Ghidra, the PE tooling — with real commands, real output, and defanged indicators throughout.

TutorialMalware Analysis AcademyAugust 4, 20268 min read

Read a PE header by hand (and why it still matters)

Tools will parse a PE for you. Knowing which fields matter — and which ones lie — is what lets you tell a packed sample from a legitimate binary in about thirty seconds.

Read the post

TutorialMalware Analysis AcademyJuly 6, 20267 min read

YARA rules in 10 minutes

Write your first YARA rule, understand strings and conditions, and learn why most beginner rules are far too fragile to survive a repack.

Read the post