Picture Picture in the Worm

I came across a worm this week that had some interesting properties.

The worm was written using a copy of Visual Basic. Nothing unusual about that. This time, however, the author decided to include a portrait as an icon.

I can’t say for sure this is a portrait of the author. In fact, the resolution is grainy enough to render the picture unrecognizable. I do know, however, that the author based this icon on a higher resolution picture. How, you ask? Because the higher resolution picture is actually stored in the worm file itself.


It may very well be that the author decided to use a random picture. It might also be the case that the author, secure in the anonymity provided by the lumpy 32×32 resolution, decided to use his own portrait as an icon but failed to realize that Visual Basic will store the full sized image.

I’m going to give the author the benefit of the doubt and assume the former.