Analysis of a Win32.Delf Variant

We have been noticing quite a few malware samples having references to or communicating with Google's SMTP servers. This post dissects one of these samples and in the process attempts to illustrate to the reader some reversing techniques and information gathering techniques, while explaining the behavior and impact of this virus. At the end of this post you will discover the reasoning for this SMTP reference and see a rather revealing screenshot showing its purpose.