Regarding malware, on some occasions we have made graphic representations of it. This reminds me of a study carried out in PandaLabs that dealt with analyses of malware families, in which the similarities among variants of the same family could be observed just by looking at the graphic representation of the calls to several functions made in each file.

We have recently come across a quite odd case, belonging to one of so many bots (Gaobot.AAF). When we took a look at the results, we thought that something had gone wrong with our algorithm. So, we studied it in depth and, actually, the results were right. This was the graphic result that surprised us so much:


Perhaps Star Wars fans have recognised the picture at once, it is similar to the Death Star.

One of the characteristics of the Gaobot family is that their source code has been massively published on the net, in such a way that several virus-writing communities have been adding new functionalities, such as exploitation of new vulnerabilities, etc, which gives rise to very complex and little optimised code. It is not a surprise either, as virus writers are not precisely characterised by being good programmers.