Evergreen Alliance Training Program for GIAC Reverse Engineering Malware Certification (GREM)

Analyzing Malicious Office Macros
The candidate will be able to analyze macros and scripts embedded in suspicious Microsoft Office files to assess their capabilities and potential threats.

Analyzing Malicious PDFs
The candidate will be able to examine suspicious PDFs and any embedded scripts to understand the nature of the threat they may present.

Analyzing Malicious RTF Files
The candidate will be able to evaluate suspicious RTF files and embedded shellcode to determine their malicious capabilities.

Analyzing Obfuscated Malware
The candidate will be able to identify packed Windows executables and obfuscated malicious JavaScript, and unpack them to gain insight into their key functions.

Behavioral Analysis Fundamentals
The candidate will be able to analyze the static properties of a suspected malware sample, develop hypotheses regarding its behavior, and determine appropriate next steps for analysis.

Common Malware Patterns
The candidate will be able to identify common API calls used by malware and understand the capabilities these APIs provide to malware. The candidate will also recognize common techniques used by malware, including code injection, hooking, and process hollowing.

Core Reverse Engineering Concepts
The candidate will apply dynamic analysis techniques using a debugger to examine malware samples and will use static analysis to interpret common assembly instructions and patterns found in Windows malware through a disassembler.

Examining .NET Malware
The candidate will be able to analyze .NET-based malware to understand its functionality and behavior.

Identifying and Bypassing Anti-Analysis Techniques
The candidate will be able to identify common debugger detection mechanisms and data protection techniques used by malware, as well as strategies to bypass security tool detection.

Malware Analysis Fundamentals
The candidate will be able to explain the key methods for analyzing malicious software and identify the necessary tools and environment for conducting malware analysis.

Malware Flow Control and Structures
The candidate will be able to analyze common control flow mechanisms, such as loops and conditionals, in assembly language to understand malware execution paths.

Overcoming Misdirection Techniques
The candidate will be able to identify and overcome misdirection techniques used by malware to disrupt analysis, such as altering execution workflows.

Reversing Functions in Assembly
The candidate will be able to analyze malware functions in assembly language to understand how parameters are used, how return values are handled, and how other structural elements are implemented.

Static Analysis Fundamentals
The candidate will be able to analyze the static properties of a suspected malware sample, form hypotheses about its nature, and determine the next steps for deeper analysis.

Unpacking and Debugging Packed Malware
The candidate will demonstrate the process of unpacking packed malware using a debugger and repairing the unpacked version for further detailed analysis.