Further reading

• The Wireshark user guide can be found at https://www.wireshark.org/download/docs/user-guide.pdf.
• The tcpdump man page can be found at https://www.tcpdump.org/manpages/tcpdump.1.html.
• The Cisco Firepower support section (from which manuals for each platform can be downloaded) can be found at https://www.cisco.com/c/en/us/support/security/defense-center/tsd-products-support-series-home.html for hardware deployments, and https://www.cisco.com/c/en/us/support/security/defense-center-virtual-appliance/tsd-products-support-series-home.html for virtual (software only) deployments.
• malwarebytes.com includes some good examples of analyzing malware by API calls on their blog. It is accessible from https://blog.malwarebytes.com/threat-analysis/2017/10/analyzing-malware-by-api-calls/.
• A list of common functions in malware analysis can be found from InfoSec Institute at https...