ElearnSecurity: Malware Analysis Professional Version 1

chrisone

New ElearnSecurity Webinar Malware Analysis Professional (MAP). 

https://www.elearnsecurity.com/resources/webinars/mapv1_launch

Join eLearnSecurity for a webinar announcing our newest training course, Malware Analysis Professional (MAP). MAP was designed to train cyber security professionals in the intricacies of dissecting and understanding malicious software. On May 19th at 1pm EDT, our expert course creators will detail what you’ll learn from our brand new course--including various solutions for dynamic and static analysis--and demonstrate one of the many new labs available throughout the course. Help spread the word by inviting your friends and colleagues. As always, launch events come with special discounts and giveaways for attendees.

JDMurray

I just registered. This webinar is Tue, 19 May, 10-11AM PDT. I'll post my thoughts afterward.

Thanks for the heads-up!

chrisone

I am waiting for the PTXv2 updates

If anyone has the time check out this video by John Hammond about eCPPT. Towards the end, he also addresses the elephant in the room (oscp vs ecppt) lol 

JoJoCal19

I'm registered. Really interested in seeing how this compares to ARES, or if it's a complete replacement for it since ARES hasn't been updated in forever.

chrisone

I have ARES and never really touched it. The author of the course left elearnsecurity many years ago, so this is probably the end of that course. 

chrisone

BUMP, looks like its starting in 40 minutes. Curious what other experienced malware analysis professionals think about the topics covered. As I am still not really sold on needing a malware analysis certification, but that may change after the webinar. 

JoJoCal19

I'm highly interested in how well the course covers both RE in general and malware analysis. I have a huge interest in doing RE for research and fun (and profit lol). 

chrisone

I have a couple interests\reasons for RE\MA. 
1. Fun & pick up a new skill
2. Speaking with many AWE class attendees and OSEE cert holders, they have mentioned RE\MA was one of the keys. The students felt stuck during the class because they didn't have enough experience with RE\MA. OSEE is a 2 year goal I have. 

30 mins....well see

JDMurray

I'm in the webinar now and waiting for the commercial block to complete.

JoJoCal19

Oh snap!!! ARES is now REP and included with MAP. Gimme that 30% existing student discount and I'm in!

chrisone

Well now I want to know if I can get a further minor discount on MAP for already owning ARES?

JDMurray

Ugh, this is more information than I wanted to know. Someone just post a summary for me, plz  

chrisone

Hmmm All 15 modules the RE section of the MAP course comes from the ARES course. That is more than half the course I already own.

Syllabus

Section: MALWARE ANALYSIS

• Module 1 : Introduction to Malware Analysis
• Module 2 : Static Analysis Techniques
• Module 3 : Assembly Crash Course
• Module 4 : Behavior Analysis
• Module 5 : Debugging and Disassembly Techniques
• Module 6 : Obfuscation Techniques

Section: REVERSE ENGINEERING 

• Module 1 : The Necessary Theory - Part 1
• Module 2 : The Necessary Theory - Part 2
• Module 3 : The Necessary Theory - Part 3
• Module 4 : VA/RVA/OFFSET and PE File Format
• Module 5 : String References and Basic Patching
• Module 6 : Exploring the Stack
• Module 7 : Algorithm Reversing
• Module 8 : Windows Registry Manipulation
• Module 9 : File Manipulation
• Module 9 : File Manipulation
• Module 10 : Anti-Reversing Tricks - Part 1
• Module 11 : Anti-Reversing Tricks - Part 2
• Module 12 : Anti-Reversing Tricks - Part 3
• Module 13 : Code Obfuscation
• Module 14 : Analyzing Packers and Manual Unpacking
• Module 15 : Debugging Multi-Thread Applications

JDMurray

Ask if the ARES information now included in MAP has been recently updated.

JoJoCal19

Soooo it looks like MAP is basically combining their RE course with Malware Analysis to create a new course. Which I'm here for. I've been close to pulling the trigger on ARES for about a year but it seemed so outdated so I've held out for a new course. The material doesn't necessarily needs to change, but as long as they reformatted it then that's good.

chrisone

ok it is confirmed, ARES(REP) content has NOT been updated.

chrisone

wow! because I had ARES I got the MAP course ELITE edition for $250! Yep I bought it lol

Speaking only from my current situation, originally I really did not have any plans on buying this course. I just didn't see the immediate need for a malware analysis course for my career. For the price at which I got the course I couldn't deny it was a great deal I could not pass up. As it stands, I do not have plans to study or pursue the course at this moment. I am looking forward to the eCPTx2 upgrade hopefully later this year. I have enough on my plate to work on this year.  

SteveLavoie

HUmm.. you are getting me near to pull the trigger..  I know that RE/MA is not something I will need soon, but it look fun.  I dont think they will discount more than 1599$ with edition upgrade and 20% off.. However I have much on my plate.. GPEN exam in a few week.. ECJPT is not finished... 

SteveLavoie

Ah... I will start by the Malware Analysis Learning path on Pluralsight..30h of video.. it should give me more than enough for now

nathandrake

Slightly off topic.  Did anyone that was registered for this webinar get an email yesterday stating:
"Thank you for enrolling into our MAPv1 training course! By now you probably know that this course focuses on the hands-on training, using our industry leading virtual labs. With your enrollment you got a limited number of hours to access those labs. While those might be enough, we got many students asking for additional lab hours to prepare even better for the exam, or to simply keep on practicing and trying new things forever."

Based on this email, I was almost certain that I was going to be one of the people that won the free course.  I was slightly disappointed when they didn't call me name, but I also need to focus on finishing the MASPT course and then enrolling in the WAPTX course before I start trying to learn another skill.  So probably for the best.  

chrisone

Wow what a tease! I didn't get that email, must have been a glitch in the matrix. I feel the same as you, if you already have other elearn courses, you maybe better off finishing those courses. I just asked myself, is an employer for a blue team position really going to desire RE\MA skills over the others? I hate to pit one skill against the next as ALL will help a security career, but I don't think most blue team jobs are going to have you spend time reverse engineering malware, unless the position is very specific in REM. I just want REM skills to help me with exploit development which is another skill set that wont be asked of, unless again the position is a very specific red team role in exploit dev. Eventually sometime early next year I will focus my attention on this cert, for now there are more important topics to cover. 

just my two cents, willing to always change my opinion.

jeremy_dfir

Couldn't resist and bought the course (myself, no company budget this time ). I think the below clarifies things. MAP (the new stuff) is a fully featured course... See the attached from the forums...

The old ARES modules are like 40-50 slides each. I wouldn't even name them modules TBH. MAP has really lengthy modules. So, MAP is the biggest part and ARES is just a supplement in this case.

chrisone

Very cool! I am assuming the cert has nothing to do with ARES\REP? But one should probably still work on REP for supplemental knowledge.

jeremy_dfir

Yeap!

The MAP content (not the ARES part) are a whole/complete course by themselves. 

I will go through the whole course soon since I deal a lot with malware at work and I want to see how good/applicable it is.

I will post an update here soon. 

JoJoCal19

Would it make sense to go through the REP first to get a better understanding of RE before diving into actual malware analysis?

jeremy_dfir

I think so yes. 

Also note that REP (the old ARES) covers x86 assembly whereas the new contents of MAP covers x64 assembly.