It’s a Bird, It’s a Plane, It’s Fooperman!

The virus begins by walking the Structured Exception Handler chain to fi nd the topmost handler. At the same time, it registers a new exception handler which points to the host entrypoint. The reason for this will be described below. Once the topmost handler has been found, the virus uses the resulting pointer as the starting location in memory for a search for the MZ and PE headers of kernel32.dll. Once the headers have been found, the virus parses the export table to fi nd the APIs that it needs for infection.