Your transaction is in progress.
Please Wait...
Course Details
KTO KARATAY UNIVERSITY
Trade and Industry Vocational School
Programme of Information Security Technology
Course Details
Course Code Course Name Year Period Semester T+A+L Credit ECTS
08131110 Malware Analysis and Reverse Engineering 2 Autumn 3 2+2+0 5 5
Course Type Elective
Course Cycle Associate (Short Cycle) (TQF-HE: Level 5 / QF-EHEA: Short Cycle / EQF-LLL: Level 5)
Course Language Turkish
Methods and Techniques -
Mode of Delivery Face to Face
Prerequisites -
Coordinator -
Instructor(s) Lect. Merve AKIN
Instructor Assistant(s) -
Course Instructor(s)
Name and Surname Room E-Mail Address Internal Meeting Hours
Lect. Merve AKIN C-129 [email protected] 7869 Wednesday
14.00-16.00
Course Content
The course content focuses on the two main methodologies of malware analysis: Static Analysis (examining code without execution) and Dynamic Analysis (executing code in a virtual environment). Students learn to identify different malware types, such as Viruses, Trojans, and Ransomware. The curriculum covers the fundamentals of x86 Assembly language and the use of core reverse engineering tools like Disassemblers (IDA Pro, Ghidra) and Debuggers (x64dbg). Additionally, critical topics include techniques for bypassing malware concealment methods (obfuscation, packing) and the process of properly reporting analysis findings.
Objectives of the Course
The main goal of the "Malware Analysis and Reverse Engineering" course is to provide students with the necessary theoretical knowledge and practical skills to understand how malicious software (malware), a critical part of modern cyber threats, operates. The course aims to equip students with the ability to examine (analyze) and decipher the structure (reverse engineer) such software in a secure environment, thereby uncovering the attacker's intent, capabilities, and targets. Ultimately, this preparation allows future cybersecurity specialists to develop effective defense strategies against both known and zero-day threats.
Contribution of the Course to Field Teaching
Basic Vocational Courses
Specialization / Field Courses X
Support Courses
Transferable Skills Courses X
Humanities, Communication and Management Skills Courses
Relationships between Course Learning Outcomes and Program Outcomes
Relationship Levels
Lowest Low Medium High Highest
1 2 3 4 5
# Program Learning Outcomes Level
P1 He/she has basic, current and practical knowledge about his/her profession. 5
P3 Follows current developments and practices for his/her profession and uses them effectively. 4
P11 Explains and applies data security and encryption methods. 4
P13 Identifies and fixes security vulnerabilities in computer and software systems. 3
Course Learning Outcomes
Upon the successful completion of this course, students will be able to:
No Learning Outcomes Outcome Relationship Measurement Method **
O1 P.1.1 1,3
O2 P.11.1 1,3
O3 P.1.5 1,3
O4 P.11.2 1,3
O5 P.3.1 1,3
O6 P.3.4 1,3
O7 P.13.1 1,3
O8 P.13.2 1,3
** Written Exam: 1, Oral Exam: 2, Homework: 3, Lab./Exam: 4, Seminar/Presentation: 5, Term Paper: 6, Application: 7
Weekly Detailed Course Contents
Week Topics
1 Introduction to Cybersecurity, Types and History of Malware
2 Introduction to Reverse Engineering: Ethics, Legal Status, and Core Concepts
3 Malware Lab Setup: Virtual Machines and Secure Lab Environment
4 Windows Fundamentals: PE Format, DLLs, Windows API, and Compilation
5 Static Analysis I: File Properties, Hashing, and String Analysis
6 Dynamic Analysis I: Behavioral Analysis and System Monitoring Tools (ProcMon, Regshot)
7 Quiz + General Review
8 Midterm Exam
9 x86 Assembly Language Fundamentals: Registers, Instructions, and Memory
10 Static Analysis II: Using Disassemblers (IDA Free / Ghidra) and Understanding Code Flow
11 Dynamic Analysis II: Using Debuggers (x64dbg), Breakpoints, and Stepping
12 Malware Functionality: File Operations, Network Communication, and Code Injection
13 Concealment and Protection Techniques I: Encryption and Packers
14 Concealment and Protection Techniques II: Anti-Debugging and Anti-Virtual Machine Detection
15 Quiz + General Review
16 Final Exam
Textbook or Material
Resources Dennis Yurichev, "Reverse Engineering for Beginners"
Eldad Eilam, "Reversing: Secrets of Reverse Engineering"
SANS Enstitüsü Blogları ve Kaynakları (FOR610 Konuları)
Michael Sikorski & Andrew Honig, "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software"
Evaluation Method and Passing Criteria
In-Term Studies Quantity Percentage
Attendance - -
Laboratory - -
Practice - -
Field Study - -
Course Specific Internship (If Any) - -
Homework 10 10 (%)
Presentation - -
Projects - -
Seminar - -
Quiz 2 20 (%)
Listening - -
Midterms 1 30 (%)
Final Exam 1 40 (%)
Total 100 (%)
ECTS / Working Load Table
Quantity Duration Total Work Load
Course Week Number and Time 16 4 64
Out-of-Class Study Time (Pre-study, Library, Reinforcement) 14 3 42
Midterms 1 6 6
Quiz 2 3 6
Homework 10 2 20
Practice 0 0 0
Laboratory 0 0 0
Project 0 0 0
Workshop 0 0 0
Presentation/Seminar Preparation 0 0 0
Fieldwork 0 0 0
Final Exam 1 12 12
Other 0 0 0
Total Work Load: 150
Total Work Load / 30 5
Course ECTS Credits: 5
Course - Learning Outcomes Matrix
Relationship Levels
Lowest Low Medium High Highest
1 2 3 4 5
# Learning Outcomes P1 P3 P11 P13
O1 Bilişim güvenliği temel kavramlarını tanımlar. 5 4 4 4
O2 Güncel güvenlik trendlerini analiz eder. 5 5 4 4
O3 Alanındaki yenilikleri ve gelişmeleri düzenli olarak takip eder ve mesleki gelişimine uygular. 4 5 4 4
O4 Güncel siber tehditler hakkında bilgi sahibidir. 5 5 4 5
O5 Veri güvenliğinin temel prensiplerini ve amacını tanımlar. 5 4 5 3
O6 Şifreleme algoritmalarının çalışma prensiplerini açıklar. 5 4 5 3
O7 Yazılım ve sistemlerdeki yaygın güvenlik açıklarını ve bu açıkların nedenlerini açıklar. 5 4 4 5
O8 Güvenlik açıklarını bulmak için kullanılan temel analiz ve tarama araçlarını kullanabilir. 5 5 4 5