So you have a header/footer sequence that we sort of know is required (remember the MZ and chksum for .EXE files) but we have no idea what that bits in between does except we can read the letters and copied it in part from the actual virus.