~/elow

TCM PMRP Review

Reviewing TCM Practical Malware Research Professional (PMRP) course and exam.

6 min readcert-review

table of contents

What is TCM PMRP?

Practical Malware Research Professional (PMRP) CertificationGain expertise in malware analysis and research with the Practical Malware Research Professional (PMRP) certification.certifications.tcm-sec.com

TCM Practical Malware Research Professional (PMRP) certificate comes with 12 month access to training content and 2 exam attempts.

The training content can be purchased seperately by itself and it covers core malware analysis concepts and techniques.

I find the training content lacks depth for the advanced analysis sections but that is to be expected for a beginner level course and would be good for someone with minimal malware knowledge looking to learn the basics. It’s worth noting that the previous name for this certificate was Practical Junior Malware Researcher (PJMR) but has since rebranded due to community feedback.

Not saying that this isn’t good for an experienced analyst, the course is aimed more towards individuals just starting out and wants fully structured training for malware analysis. If you’re a SOC analyst that already deals with malware on a somewhat regular basis, you’ll do just fine in the exam with skipping earlier sections of the course and dive straight into advanced analysis.

What have I learned

Having analysed malware in my daily job, it is refreshing to learn how to get my hands dirty without any fancy internal tools. The new tools that I’ve got familiar with during the course was Cutter and x32/64dbg.

While I already have a good sense of direction when it comes to analysing malware, the part that I think most early professionals would get the most out of is the Advanced Dynamic Analysis section. I’m not familiar with assembly myself and the course breaks it down nicely for beginners in this area. I was also recommended to look into the Assembly 101 course offered by TCM as well, however I’ve passed on that due to time constraints. Quickly glancing through the syllabus now, I feel like it would be overkill for passing PMRP as you only need to understand and document the key capabilities of a sample and not break down every single function. It is definitely sufficient to pass just by doing the course content.

How did I prepare

The course consists of 9 hours worth of video lectures and samples corresponding to each course section that you can practice on your virtual machine. The highlight for this would be the malware samples.

This is the first cybersecurity course I’ve done without any written resources. As a visual learner, the videos slowed down my learning process as I found myself often having to replay the video a couple times to catch and note down important bits. Also, the platform (Educate360) currently hosting the videos isn’t the best when it comes to video playback, I’ve had annoyances with video resolutions and closed captions when I used it.

I would instead recommend going through the first 5 hours of the course through the YouTube version before continuing off on Educate360.

Malware Analysis In 5+ Hours - Full Course - Learn Practical Malware Analysis!youtube.com · HuskyHacks

Having gone through the course on and off throughout the past year, I’ve only started locking in for a week before the exam and re-reading my notes for the advanced analysis section. I’ve also gone through some of the malware samples again as a refresher to strengthen my methodology for the exam.

The final days before the exam were spent scouring through Reddit and Discord looking for tips and tricks. I’ve stumbled upon the following video that helped with my approach to the exam.

How I Passed the Practical Malware Research Professional Certification (It took 7 days)youtube.com · Astra

Other than the course, I’ve also gone through some CyberDefender labs and watched Anuj Soni’s video on advanced dynamic analysis.
These are definitely overkill in hindsight. The exam samples are on par with what’s taught in the course but extra content would help with speeding through the exam and help with understanding the samples a little bit better.

Exam

Before starting, you’ll read through the exam instructions - these were up to date in regards to sample scoring, but I found them confusing overall, as I don’t believe they’re being updated in step with the newer samples added to the exam pool over time.

AI usage is allowed during the exam, but only if it’s justified and disclosed in your report. I’ve only used AI for a sample where “manual labour” is required so I’m unclear of the extent where the acceptable AI use lies with TCM but ensure any AI usage passes the restrictions listed on their official site:

AI Tools and Certification ExamsHow can you use AI tools on TCM Certification exams? Our latest policy update explains why we allow the use of AI tools on our exams.tcm-sec.com

The entire allocated exam duration is 7 days (5 days for access to samples + 2 days for report writing). In my opinion, this is more than enough time to complete the exam. If you’re working full time during the exam, I reckon it could work but I would still recommend having at least 2 full days to write up the report.

I started the exam around 6 PM local time because I was feeling whimsical and spent my first day crawling through every single sample briefly. This helped me quickly categorise the difficulty level so I can allocate the appropriate time on each of them based on scoring weight.

First day was basically documenting the sample’s hash, looking at PE Studio and strings. No dynamic analysis.

Only until the second day is when I realised my exam environment had a network connection issue and needed TCM support. They responded within 10 minutes and directed me to The HuskyPack Discord server’s FAQ section and I was able to resolve it shortly after. I got lucky that support was online while I was doing the exam during ungodly hours in my timezone, otherwise expect delays outside their business hours.

I started documenting and structuring my report on the second day. Instead of leaving report writing until I no longer have access to the samples, I decided to complete writeups whenever I finish analysing a sample for the next 3 days.

The recommendation I have is to take screenshots as you go, I’ve had to boot up the VM again to grab screenshots which was annoying and costed me time.

By day 4, I was exhausted with the report writing process as I kept overthinking and ballooned my report into 130+ pages. In retrospect, I may have gone overboard with the amount of details and went out of scope for PMRP. After finishing up the executive summary, I was confident with hitting the passing mark so I submitted it after proofreading a couple times.

Final Verdict

I submitted the report on Wednesday morning and results back the following Tuesday which was within the 5-7 business days timeframe mentioned in TCM’s Discord server. There was no feedback or marks returned so it’s not exactly clear with how I did on each sample or report writing.

PMRP is a solid, well-structured introduction to malware analysis rather than an advanced certification, and it should be judged against that goal. For someone starting out and wanting a guided path from static analysis through to basic assembly, debugging, and anti-analysis techniques, it delivers exactly what it promises.

The video-only delivery and Educate360 platform are the weakest parts of the experience so start the course with the free YouTube portion where you can. The exam itself is fair and the 7-day timeframe is generous even for a first attempt.

Would I recommend it?
Yes, particularly to SOC analysts and junior researchers who want a structured, hands-on introduction to malware analysis without needing to piece one together themselves.

“Can you still analyse malware without internal tooling”

  • This is something I’ve always reiterated to juniors I’ve mentored. Don’t rely on a single set of proprietary tools. You’ll have a hard time once those tools get taken away!