Explore Malware Analysis

You start where most beginners don't: not "is this malicious," but "what does this thing actually do." That question has no shortcut. A sandbox report that comes back quiet doesn't settle it — it might mean the sample found the sandbox and went dormant on purpose. Nugget pushes on that instinct until checking for evasion becomes automatic, not an afterthought.

Sessions move the way real analysis does: static first, because it's safe and often gives you more than you'd expect from a hash lookup and a strings dump, then dynamic when static hits its ceiling — a packed binary showing nothing but an unpacker stub, an import table with only LoadLibrary and GetProcAddress, code deliberately hiding its real behavior until runtime. Nugget sketches the PE layout or the process tree on the whiteboard first, then works you across it: what does this section's entropy tell you, why does this loop XOR the same byte against a growing offset, what is this sample trying to survive a reboot as.

None of this replaces your coursework or a real lab environment — it sharpens the judgment calls those environments don't have time to slow down for.