Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
Michael Sikorski, Andrew Honig · No Starch Press · First edition · 2012
Identifier: ISBN 978-1-59327-290-6
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A course in Windows malware analysis built around sixty-odd labs with real samples: safe lab construction, static and dynamic analysis, x86 disassembly, debugging, packing and obfuscation, anti-disassembly and anti-VM tricks, and shellcode.
Who it is for, and when
Still the standard way to learn the discipline, because the labs force you to reach a conclusion and then check it. Read it when you need to be able to say what a binary does and support that with observed behaviour rather than a sandbox verdict. There is no second edition despite the persistent rumour; the labs are free on the author's GitHub.
What it does not cover
Fourteen years old and built on IDA Pro and OllyDbg against 32-bit Windows XP-era samples. Nothing on Ghidra or x64dbg, nothing on .NET, PowerShell and script loaders, living-off-the-land technique, packed Go or Rust binaries, or EDR telemetry. The fundamentals chapters age well; treat the tool walkthroughs as historical.
Go to the source
Open at nostarch.com (opens in a new tab)https://nostarch.com/malware
Details
- Type
- Book
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Michael Sikorski, Andrew Honig
- Publisher
- No Starch Press
- Version verified
- First edition
- Year
- 2012
- Identifier
- ISBN 978-1-59327-290-6
- Topics
- malware, reverse-engineering, windows
- Checked at source
Related entries
OpenSecurityTraining2
Partly freeAn Open edX platform hosting long-form, university-length classes in low-level computing: x86-64 assembly, OS internals, firmware and UEFI, debuggers (WinDbg, GDB, IDA, Ghidra, Binary Ninja, HyperDbg), reverse engineering, vulnerability classes, exploitation, fuzzing, trusted computing and Bluetooth security. Actively maintained — 2025 additions include AFL++ fuzzing, Bluetooth reconnaissance and TPM programming in Python, with an introductory emulator course listed for 2026.
Ghidra
FreeAn open-source software reverse engineering framework released by the NSA, with a disassembler, a decompiler producing C-like output, scripting in Java and Python, and support for many processor architectures. The former ghidra-sre.org address now redirects to the GitHub project.
Two closely related open-source reverse engineering frameworks. radare2 is the original Unix-style command-line toolkit for binary analysis, patching, and debugging; Rizin is a fork of radare2 that set out to stabilise the API and command set and ships the Cutter GUI. Both are actively developed and release regularly.
Volatility 3
FreeAn open-source memory analysis framework that parses RAM images into processes, network state, loaded modules, injected code, registry hives resident in memory, and command history. Volatility 3 is the actively developed line; Volatility 2 is legacy and should not be the basis of new work, though its documentation is still used for plugin comparison.
The Volatility Foundation keeps the Volatility Framework — currently Volatility 3 — free and open source on GitHub, with the accompanying project documentation. Separately it endorses instructor-led memory forensics courses; the Foundation's site does not publish prices for those, and the Malware and Memory Forensics class is a commercial offering run through memoryanalysis.net.