Part 1

Reverse Engineering for Security Investigations

Investigate an unfamiliar executable

Start with a suspicious program found during an incident. Establish what it can do, what deserves attention and which questions require deeper analysis. Introduce executable formats, imports and assembly through discoveries about the specimen, while distinguishing suspicious features from evidence of malicious behavior.