pinksawtooth/how_to_become_a_malware_analystCurated guide to becoming a malware analyst, covering essential knowledge, reverse engineering, analysis tools, and LLM-assisted learning with practical exercises and resources.
This is @PINKSAWTOOTH's personal opinion and may not necessarily be the best method for you. I hope you can refer to it as one example of a study method.
Before reading this, the malware analyst I respect, @hasherezade, has written a blog post on how to start studying malware analysis. There may be some overlap, but I recommend giving it a read. Also, since the blogs below are mainly English sources, I would like to introduce sources that are as Japanese-centric as possible.
[!NOTE]
2026 Addendum: Malware Analysis Learning in the LLM Era
When I started writing this page, we were not yet in an era where LLMs and AI Agents could be used as casually as they are today. As of 2026, if you are studying malware analysis or reverse engineering, I recommend actively using LLMs in addition to books and online materials. They are especially useful for creating practice programs, explaining code and assembly, analysis, writing analysis scripts, and organizing analysis results.
On the other hand, there are an increasing number of situations where LLMs surpass humans in many analysis techniques. However, that does not mean foundational knowledge has become unnecessary. To understand LLM output and verify its basis and correctness yourself, having specialized knowledge is important (though the day may soon come when that work becomes meaningless...). This document assumes using LLMs not as "answer-generating devices" but as "teachers to learn with, and assistants during analysis."
First, I will briefly explain the prerequisite knowledge for malware analysis. Before learning about malware analysis, you need at minimum knowledge of computer science.
For these, it should be sufficient if you understand the content covered in university or vocational school courses. (You can learn more specific content by checking the online syllabi of some universities.) This document does not cover how to learn programming languages or computer science, but the following are recommended materials.
The knowledge required for malware analysis can be broadly divided into the following five categories.
First, you need to learn what malware is and what kind of work malware analysis entails. I will introduce recommended materials and books for learning about malware analysis in general.
