Malware News

W32/Winemmem infects packages, installers and self-extracting archives (files with extra data, so called "overlay"). It rewrites the code section of the original application and relocates a random size block of code from the beginning of code section and OEP to the end of the file, increasing the size of extra data. This Virus does not create new sections, it does not modify the PE header.