Should I read Practical Malware Analysis or Practical Reverse Engineering first?

Practical Malware Analysis first. It is the more accessible introduction and the labs do most of the teaching. Practical Reverse Engineering is the architecture-level companion that picks up where PMA leaves off; it assumes you already know the basic workflow.

Are the Practical Malware Analysis labs still worth doing in 2026?

Yes. The labs are the book — skipping them turns a great training course into expensive wallpaper. Plan three to four months and do every one. The samples are intentionally simple compared to modern malware, but the workflow they teach (static, dynamic, behavioural triage) transfers directly.

What is the best book on modern malware evasion techniques?

Evasive Malware by Kyle Cucci, published in 2024. It covers the modern catalog of anti-VM, anti-debug, anti-sandbox, packers, and control-flow obfuscation — exactly the gap Practical Malware Analysis (2012) leaves. Read PMA first, then Evasive Malware.

Do I need IDA Pro or can I use Ghidra for malware analysis?

Either works for the work itself. Most published malware-analysis literature still assumes IDA, so reading along with The IDA Pro Book is easier with IDA. For students or hobbyists, Ghidra plus the official NSA documentation is enough; serious analysts at vendors usually have IDA available.

7 Best Malware Analysis Books to Read in 2026 — Honest Reviews

Malware analysis is one of the few subfields where the right book genuinely shortcuts years of trial and error. Here are the seven that matter, in roughly the order you should read them.

The picks at a glance

Practical Malware Analysis — the canonical starting point. Do every lab.
Practical Reverse Engineering — the architecture-first companion (x86, x64, ARM, kernel).
Practical Binary Analysis — modern automated analysis (DBI, taint tracking, symbolic execution).
The IDA Pro Book — reference for the disassembler that anchors most workflows.
Rootkits and Bootkits — below-the-OS persistence, kernel rootkits, UEFI bootkits.
The Art of Mac Malware — the only serious macOS malware book in print.
Evasive Malware — anti-VM, anti-debug, anti-sandbox, packers, modern obfuscation.

Plus Malware Data Science if you work somewhere with telemetry and need to scale beyond manual triage.

Start here: the standard

Practical Malware Analysis by Sikorski and Honig is the canonical starting point. The labs are the book. If you skip the labs you'll skip the learning. Plan three to four months and do every one.

If you finish PMA and want to know what to read next, that's the rest of this list.

Layer in the architecture

Practical Reverse Engineering is the architecture-first companion. PMA teaches you Windows malware techniques; PRE teaches you how the CPU and OS actually work. x86, x64, ARM, kernel mode. You need both. Read PMA first, but don't skip PRE.

Practical Binary Analysis by Dennis Andriesse is where you graduate from manual analysis. Static and dynamic instrumentation, taint tracking, symbolic execution. Modern malware analysts are tool-builders as much as tool-users; this book is how you become one.

The IDA Pro reference

The IDA Pro Book by Chris Eagle is dated on the most recent IDA versions but still the only comprehensive book on the disassembler that anchors most analysts' workflow. Use it as a reference, not a read-through.

Specialized tracks

Rootkits and Bootkits by Matrosov, Rodionov, and Bratus is the deep dive into below-the-OS persistence. Required if you ever look at firmware-level threats; safely ignored if you focus on commodity malware.

The Art of Mac Malware by Patrick Wardle is the only serious book on macOS malware in print. If your work touches Apple platforms, read it; otherwise it's optional.

Evasive Malware by Kyle Cucci is the modern complement to PMA, focused entirely on anti-analysis: anti-VM, anti-debug, anti-sandbox, packers, control-flow obfuscation. Read it after PMA + PRE; it'll teach you everything PMA glossed over because it didn't yet exist as a category.

The data-science angle

Malware Data Science by Saxe and Sanders is for analysts who want to scale beyond manual triage. Classification, clustering, similarity, ML applied to the malware corpus. Useful if you work somewhere with telemetry; less useful if you only see one sample at a time.

A realistic study path

For someone starting from zero and wanting to be employable as a junior malware analyst:

Months 1 to 4: Practical Malware Analysis, all labs, slowly.
Months 5 to 6: Practical Reverse Engineering, paired with hands-on RE on real samples.
Months 7 to 8: Practical Binary Analysis, plus Evasive Malware to understand the cat-and-mouse.
Ongoing: keep IDA Pro Book and your specialized track (Rootkits / Mac / data science) on the shelf for when you need them.

The single thing that distinguishes analysts who make it from those who don't is sample volume. After a year of books, the next year is malware itself: pull from MalwareBazaar, work through write-ups, post your own analyses publicly. The books unblock; the samples teach.