Win32.Harnig commented IDB

[ocean]

That dropper contains only a few antidebug/antitrace, TEA decoder and internal PE loader. Since it's not that difficult to reverse engineer, I only published the IDB containing some comments instead of writing a paper about it.

http://inseclab.netsons.org/2009/08/04/win32-harnig-idb-with-comments/

cheers,
ocean

[Evilcry]

Nice work ocean =)