>
CERTIFIED CRIMEWARE DEFENDER PROGRAM
STOP
READING.
START FIGHTING.
LEARN FROM REAL THREAT HUNTERS — NOT TEXTBOOKS
// CCWD — Certified Crimeware Defender
INSTRUCTOR Dan Regalado aka DanuX
BACKGROUND Symantec · FireEye/Mandiant · U42
SPEAKS AT DEF CON · RECon · RSA
FORMAT CTF-based · hands-on · 1200+ min
STATUS ▶ ENROLLMENT OPEN — 50% OFF LAUNCH
1200+
Minutes of Content
10
Modules
CCWD
Certification
IDA Pro•
WinDbg•
Ransomware Analysis•
Process Injection•
.NET Reversing•
Anti-Debug Bypass•
NeZa Deobfuscation•
CTF Challenges•
Crimeware Hunting•
Threat Intelligence•
IDA Pro•
WinDbg•
Ransomware Analysis•
Process Injection•
.NET Reversing•
Anti-Debug Bypass•
NeZa Deobfuscation•
CTF Challenges•
Crimeware Hunting•
Threat Intelligence•
// CURRICULUM
TRAINING MODULES
0
MODULE 0
Windows Binaries
5 classes · PE format, .NET, Windows Loader
1
MODULE 1
Dynamic Analysis
5 classes · Sandbox, VM analysis, monitoring
2
MODULE 2
Tool Arsenal
8 classes · PE Editor, WinDbg, IDA Pro, Wireshark
3
MODULE 3
Reverse Engineering
11 classes · Assembly, calling conventions, passwords
4
MODULE 4
Packers & Obfuscators
9 classes · UPX, ASPack, Carnita methodology
5
MODULE 5
Anti-Malware Tricks
6 classes · Anti-debug, Anti-VM, patching
6
MODULE 6
Process Injection
7 classes · RemoteThread, shellcode, x32dbg
7
MODULE 7
.NET Reversing
10 classes · Reflection, DnSpy, WinDbg SOS
8
MODULE 8
Infostealers
9 classes · Scripts, PowerShell, JS extensions
9
MODULE 9
Fighting Ransomware
7 classes · RSA/AES keys, Ryuk, NeZa recovery
// ENDORSEMENTS
TRUSTED BY INDUSTRY LEADERS
“
I\'ve seen countless training programs, but HackDef Academy is different. Twenty years in the trenches at Mandiant, Symantec, and Palo Alto Networks, plus DEFCON and REcon expertise. Don\'t just learn theory—learn from battle-tested experience. This is where serious defenders level up.
“
From anti-debug traps to .NET reversing and ransomware teardown — every module in this academy mirrors real-world scenarios. If you\'re serious, this is your training ground.
“
Training talent to handle real-world malware isn\'t easy. This academy delivers hands-on scenarios and techniques used directly in SOCs and incident response. The Certified Crimeware Defender certification gives you a strong edge in the job market.
// GRADUATES
WHAT ARE OUR GRADS SAYING?
50% OFF
// ENROLLMENT
$1,499
$2,998
- ▶ 1200+ minutes of streaming + text-based content
- ▶ 10 training modules with CTF-format challenges
- ▶ HackDef Virtual Machine with all tools pre-loaded
- ▶ Exclusive NeZa deobfuscation tool access
- ▶ IDA Pro student classroom license
- ▶ CCWD certification exam included
- ▶ Career connection with Silicon Valley recruiters
- ▶ Discord student community access
// CERTIFICATION
Certified Crimeware Defender — CCWD
Malicious software designed primarily for financial gain is known as crimeware. One of the most significant and widespread families within this category is ransomware — malware that hijacks a computer, encrypts its data, and then demands a ransom in exchange for unlocking the files. Ransomware is among the most challenging types of malware to analyze, and this course prepares students to dissect these sophisticated threats efficiently and effectively.
Build expertise through hands-on labs using industry-standard tools like IDA Pro, WinDbg, and dnSpy. Reverse engineer diverse malware samples—from PowerShell scripts to .NET executables—then automate indicator extraction with NeZa for large-scale analysis. Ready to become a malware analysis expert?
CCWD Syllabus
- Module 0: Windows Binaries
- Module 1: Dynamic Analysis
- Module 2: Tool Arsenal
-
Module 3: Reverse Engineering
- Class 1 (Brief): Disassembler Process
- Class 2 (Brief): Assembly Operand
- Class 3 (Brief): Calling Convetion
- Class 3.1 (Chall): Calling Convetion
- Class 3.2 (Chall): Calling Convetion
- Class 4 (Lab): Windows 32-bit Calling Convention
- Class 4.1 (Lab): Windows 32-bit Calling Convention
- Class 4.2 (Chall): Windows 32-bit Calling Convention
- Class 5 (Lab): Find the Password
- Class 5.1 (Lab): Find the Password
- Class 6 (Chall): G0T Password?
-
Module 4: Packers & Obfuscator
- Class 1 (Brief): Carnita Methodology
- Class 2 (Brief): Unpacking & Deobfuscation Strategy
- Class 3 (Lab): Unpacking UPX
- Class 3.1 (Lab): Unpacking UPX
- Class 4 (Lab): Unpacking ASPack
- Class 4.1 (Lab): Unpacking ASPack
- Class 4.2 (Chall): Unpacking ASPack
- Class 5 (Chall): Unpacking UPX your way
- Class 6 (Chall): Unpacking for Flag
- Module 5: Anti-Malware Tricks
- Module 6: Process Injection
-
Module 7: .NET Reversing
- Class 1 (Lab): Reflection 101
- Class 2 (Lab): Deobfuscating First Stage From Resourses
- Class 3 (Lab): Patching binary for Dumping
- Class 4 (Lab): Limitation of DnSpy
- Class 4.1 (Lab) Introducing WinDbg SOS Plugin
- Class 4.1.2 (Lab) WinDBG SOS Update
- Class 4.2 (Lab) Finding Second Stage Entry Point
- Class 4.3 (Chall): Found the Parent
- Class 4.4 (Lab) Finding & Automating the Decryption of Third Stage
- Class 4.5 (Chall): Find the Keylogger Actor
-
Module 8: Dissecting Infostealers like a BOSS
- Class 1 (Lab): Scripts 101
- Class 2 (Lab): Dissecting BAT Downloader
- Class 3 (Lab): Dissecting Powershell Dropper
- Class 3.1 (Lab): Dissecting Powershell Dropper
- Class 4 (Lab): Dissecting Javascript Browser Extension
- Class 4.1 (Lab): Dissecting Javascript Browser Extension
- Class 4.2 (Lab): Dissecting Javascript Browser Extension
- Class 5 (Chall): Case Study Infostealer - Extracting Next Stages
- Class 5.1 (Chall): Case Study InfoStealer - Dissecting Infostealer
-
Module 9: Fighting Ransomware
- Class 1 (Lab): Intercepting RSA key with NeZa
- Class 2 (Lab): Intercepting AES key with NeZa
- Class 3 (Lab): Unhooking a locked machine with NeZa
- Class 4 (Lab): Reversing Ryuk Ransomware with IDA
- Class 4.1 (Lab): Recovering Ryuk Files with NeZa
- Class 5 (Chall): Restoring Locked Keyboard
- Class 6 (Chall): Recovering Encrypted Machine
Got any questions? Please reach out at: hackdef@hack-defender.mx
Copyright © 2025 Hack Defender. All rights reserved · Powered by Mellivora