Tools that are required for analyzing this form of malware are ollydbg/immunity debugger, Virtual machine, and a memory dumper like Lord PE. Binary First Stage The original sample is packed with a custom packer that overwrites heap memory with executable code: [c] 0012FB07 8B75 F8 MOV ESI,DWORD PTR SS:[EBP-8] 0012FB0A 8A0C30 MOV CL,BYTE PTR DS:[EAX+ESI] 0012FB0D 3A8D 70FFFFFF CMP CL,BYTE PTR SS:[EBP-90] 0012FB13 75 24 JNZ SHORT 0012FB39 0012FB15 8A4C30 01 MOV CL,BYTE PTR DS:[EAX+ESI+1] 0012FB19 3A8D 71FFFFFF CMP CL,BYTE PTR SS:[EBP-8F] 0012FB1F 75 18 JNZ SHORT 0012FB39 0012FB21 8A4C30 02 MOV CL,BYTE PTR DS:[EAX+ESI+2] 0012FB25 3A8D 72FFFFFF CMP CL,BYTE PTR SS:[EBP-8E] 0012FB2B 75 0C JNZ SHORT 0012FB39 0012FB2D 8A4C30 03 MOV CL,BYTE PTR DS:[EAX+ESI+3] 0012FB31 3A8D 73FFFFFF CMP CL,BYTE PTR SS:[EBP-8D] 0012FB37 74 0E JE SHORT 0012FB47 0012FB39 8D4F FF LEA ECX,DWORD PTR DS:[EDI-1] 0012FB3C 3BC1 CMP EAX,ECX 0012FB3E 74 70 JE SHORT 0012FBB0 0012FB40 40 INC EAX 0012FB41 3BC7 CMP EAX,EDI 0012FB43 ^72 C2 JB SHORT 0012FB07 0012FB45 EB 2A JMP SHORT 0012FB71 0012FB47 33FF XOR EDI,EDI 0012FB49 03C6 ADD EAX,ESI 0012FB4B 8A4C38 14 MOV CL,BYTE PTR DS:[EAX+EDI+14] 0012FB4F 888C3D C4C2FFFF MOV BYTE PTR SS:[EBP+EDI-3D3C],CL 0012FB56 47 INC EDI 0012FB57 81FF AC3A0000 CMP EDI,3AAC 0012FB5D ^72 EC JB SHORT 0012FB4B [/c] Further, when it jumps to that page, it creates itself in a suspended state with CREATION flags set at 0x40, which is the CREATE_SUSPENDED flag....