MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.Malware Analyst Certificate
This certificate is for people who need to take malware apart and respond when it hits. It covers memory forensics, reverse engineering and ransomware response.
DFRTISpecialised certificate
What a holder can show
- Capture and analyse RAM with Volatility 3
- Find injected code, hidden processes and malicious network connections in memory
- Do static analysis of a sample with Ghidra or IDA
- Run samples safely in a sandbox such as CAPE and read the behaviour report
- Write YARA rules to find the same malware on other systems
- Handle a ransomware incident from first contact to recovery plan
- Pull indicators of compromise out of a sample and share them in a usable form
About the Certificate
A ransomware note on an office server, a strange process that only appears in memory, a banking trojan on an accountant's PC. Each of these needs someone who can work out what the code does, how it got in and what it touched. This certificate prepares you for that role.
It brings together three courses: memory forensics, malware reverse engineering and ransomware and threat response. You work only with samples inside isolated lab machines and learn the habits that keep analysis safe.
Who Should Take It
This is a specialised certificate. DFRTI asks for completion of foundation or core forensic courses, or equivalent professional experience, before you start.
- SOC and incident response team members
- Digital forensic analysts who keep meeting malware in their cases
- System administrators responsible for recovery after an attack
- Security researchers who want a structured approach to analysis
How to Earn It
- 01Choose the certification
Select the Malware Analyst Certificate on the certifications page. If you are not sure it is the right level for you, talk to a counsellor first.
- 02Enrol
Fill in the enrolment form and complete the payment. You then get access to the course material and labs on the DFRTI student portal.
- 03Study and practise
Work through the Memory Forensics, Malware Reverse Engineering and Ransomware & Threat Response courses. The portal has video lectures, notes, lab exercises, quizzes and exam preparation material.
- 04Schedule the exam
Book your exam through the DFRTI portal when you feel ready.
- 05Get your certificate
Your certificate carries a unique ID. Anyone can enter that ID on the DFRTI verification page and confirm it online.
What Is Assessed
DFRTI exams combine multiple-choice questions, practical lab work, case study analysis and tool-based exercises, all within a set time. The exact structure depends on the certification.
- Theory questions
Multiple-choice questions on malware types, persistence methods, Windows internals and ransomware behaviour.
- Practical lab
Analyse a memory image from an infected machine and identify the malicious process and its connections.
- Case study
Plan the response to a ransomware attack on a small company, from containment to restoring from backup.
- Tool-based exercise
Examine a sample with Ghidra, a sandbox report and YARA and answer set questions on its behaviour.
Malware Analyst Questions
Are there prerequisites?
Yes. As a specialised certificate it needs completion of foundation or core forensic courses, or equivalent professional experience in areas such as storage forensics or malware and threat investigations.
Do I need to know programming?
Reading code helps a great deal. You do not need to be a developer. You should be comfortable reading simple scripts. Assembly is introduced during the reverse engineering course.
Can I retake the exam if I do not pass?
Yes. DFRTI allows retakes and the number of attempts depends on the certification. A counsellor can explain the current retake rules before you enrol.
How can an employer check my certificate?
Every DFRTI certificate has a unique ID. The employer enters it on the DFRTI verification page and sees at once whether the certificate is genuine.
Related courses
MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.
MalwareIncident Response & Malware AnalysisMalware Reverse EngineeringTake malware apart safely with static and dynamic analysis, Ghidra, x64dbg and YARA.MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.More in Certifications
Not sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.