Here is something many of you don't know.

In the late 90's the founders of VirusTotal were friends with people from a malware development group (and zine) named '29a Labs'. The current CEO of VirusTotal, Bernardo Quintero, even attended the first 29a Labs meetup in Madrid, Spain. Additionally, during the time Mr. Quintero was a writer for a computer magazine and did an interview with the founder of the 29a Labs. It was released in PC Actual February, 1998.

29a Labs was decades ahead of their time — they released proof-of-concepts, papers, and thoughts and opinions on things. The founders were based out of Spain but had contributors from across the globe. Although, it should probably be noted the definition of malware we are applying to 29a Labs does not necessarily reflect malware we see it today. The 90's malware was primarily infectors, mutation engines, and code capable of self-propagation (worms). It wouldn't be until 2004-ish many of these groups began truly weaponizing their proof-of-concepts (such as the first ideas of ransomware appeared).

29a Labs was (at the time) very much 'black balled' from the cybersecurity scene as VXers were seen as monsters and criminals. Ironically, while 'non-nerds' called hackers monsters and criminals, the 'monsters and criminals' hackers labeled the VXers the real 'monsters and criminals'. This is partially why so many malware people adapted the satanic-esque appearance. The name in of itself, 29a, is 666 in hex.

tl;dr malware nerds demonized by hackers who were demonized by non-nerds

Please note on image 3 Mr. Sandman is discussing using GetModuleHandle and GetProcAddress to dynamically import functionality from Kernel32. In 29a Labs Volume II, 29a Labs would discuss parsing the Export Address Table, something which is still used today. This technique is 27 years old.