This paper I wrote back in 2006, after analyzing the Blackmal virus. I was looking at packet captures, while setting up Ethereal for my next test, the notifier alerted me of an incoming email. The notification and some of its content were not encrypted. Simple binary analysis and the curiosity of how bad my system would crash if I guessed wrong are what motivated me to proceed. This paper takes into assumption the reader is familiar with hex editors and hexadecimal.