Project 94: Malware Reverse Engineering

Module: Module 10: Advanced Detection Engineering & Zero-Day Research  |  Level: Advanced  | 
Primary tool: Ghidra (free) + Any.Run (free sandbox tier)  |  Estimated time: 2–4 hours

Objective: Combine static (Ghidra) and dynamic (sandbox) analysis to fully characterize a sample.

Free lab environment

MalwareBazaar (abuse.ch) + a fully offline analysis VM — https://bazaar.abuse.ch/

MalwareBazaar is a free, legitimate malware-sample repository run by abuse.ch for researchers and defenders. Only ever detonate or inspect samples inside a fully network-isolated virtual machine (host-only or no networking, snapshot taken beforehand) that you are prepared to destroy afterward. Never run a live sample on your host OS or a network-connected VM.

Lab workflow

1. Before anything else: confirm your analysis environment has no real network access and is a disposable snapshot you are prepared to destroy afterward. Do not proceed until this is true.
2. Obtain your sample from a sample from MalwareBazaar, analyzed only in Any.Run’s free sandbox and Ghidra offline — a legitimate, purpose-built research source, never a random internet download.
3. Using Ghidra (free) + Any.Run (free sandbox tier), perform your analysis with the specific goal of learning to combine static (Ghidra) and dynamic (sandbox) analysis to fully characterize a sample.
4. Record every observable indicator of compromise (IOC) as you find it: file paths, registry keys, network callbacks, process names.
5. Summarize the sample’s behavior in plain English, as if briefing someone who cannot read the raw tool output themselves.
6. Destroy or revert the VM snapshot once you have exported your evidence — don’t leave a live sample sitting in a running environment.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• Ghidra’s decompiled view of the sample’s key function
• the sandbox’s dynamic-behavior report for the same sample, cross-referenced in your write-up

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.