Every malware analysis reading list starts with the same book: Practical Malware Analysis by Michael Sikorski and Andrew Honig. It was published in 2012. Fourteen years later, it is still the most recommended first book in the field.
That raises a fair question: is a 2012 book still relevant when malware has evolved so much?
What the Book Covers
The book follows a structured progression from basic to advanced:
Part 1: Static Analysis (Chapters 1-4)
Extract information from binaries without executing them. Strings, imports, PE sections, packer identification. Tools: PEiD, Dependency Walker, CFF Explorer.
Part 2: Dynamic Analysis (Chapters 5-7)
Run malware in a controlled environment and observe behavior. Process creation, file modifications, network connections, registry changes. Tools: Process Monitor, Wireshark, FakeNet.
Part 3: IDA Pro Deep Dive (Chapters 8-14)
Navigate disassembly, read control flow graphs, recognize API call patterns, and identify data structures. This is the largest section and where most of the learning happens.
Part 4: Anti-Analysis (Chapters 15-18)
Debugger detection, VM evasion, packers, and obfuscation. How malware fights back against your analysis.
The 60+ Labs Are the Real Value
Each chapter includes lab exercises with purpose-built malware samples. These are not CTF challenges. They are designed to teach specific techniques:
- Lab 1-1: Basic static analysis of a DLL and EXE pair
- Lab 9-1: OllyDbg debugging with anti-debug bypass
- Lab 13-1: Data encoding with XOR and Base64
- Lab 18-1: Packed malware requiring manual unpacking
The samples ship with the book and solutions are available online. The structured progression from "run strings" to "manually unpack and decrypt C2 config" is what makes this book work as a learning path.
What's Timeless
The methodology. The book teaches you to think in a specific sequence:
1. Triage → file, strings, imports (30 seconds)
2. Static → PE structure, sections, entropy (5 minutes)
3. Dynamic → Sandbox execution, behavioral indicators (15 minutes)
4. Deep dive → Disassembly, debugging, decryption (hours)
This workflow applies to any malware, regardless of when it was written. The tools change, the thinking does not.
Other timeless elements:
- PE format analysis (still the dominant executable format on Windows)
- x86 assembly patterns (function prologues, API calling conventions)
- C2 communication patterns (DNS, HTTP callbacks, custom protocols)
- Anti-analysis concepts (the cat-and-mouse game is the same, just more sophisticated)
What's Outdated
Be honest about the gaps:
| Missing topic | Why it matters in 2026 |
|---|---|
| Fileless malware | PowerShell, .NET in-memory execution dominate modern attacks |
| Go/Rust malware | Statically linked, stripped binaries need different tooling |
| Linux/macOS | Cloud and container malware is surging |
| YARA/Sigma rules | Detection engineering is now a core analyst skill |
| ARM architecture | Mobile and IoT malware |
| AI-assisted analysis | LLM-powered disassembly annotation, automated triage |
The book assumes Windows x86 PE malware. That was 95% of the threat landscape in 2012. Today it is maybe 60-70%.
Should You Read It?
Yes, if you are starting in malware analysis. No other single resource builds the foundational methodology as well. Read it, do every lab, and you will have a solid base.
Supplement with modern resources for the gaps:
- Go/Rust binaries: GoReSym, redress, and practice on modern samples from MalwareBazaar
- Linux malware: ELF analysis (readelf, objdump) and REMnux
- Detection engineering: YARA and Sigma rule writing
- Fileless attacks: PowerShell deobfuscation and .NET analysis with dnSpy
The book gives you the thinking framework. Modern tools and samples give you current relevance. You need both.
Originally published at MalwareIntel. MalwareIntel is a free threat intelligence platform monitoring 13 public CTI sources.
Free resources:
- Defense Kit — Sigma + YARA + IOCs per malware family
- Detection Gap Analyzer — Check your MITRE ATT&CK coverage
- CTI Assessment — Rate your threat intel maturity in 5 min
Top comments (0)