312-50V10 · Question #682
ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but
The correct answer is A. Polymorphic Virus. A polymorphic virus mutates its code signature on each replication cycle while leaving its underlying payload logic unchanged.
Question
ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but the function of the code (its semantics) will not change at all. Here is a section of the Virus code:
What is this technique called?
Exhibits
Options
- APolymorphic Virus
- BMetamorphic Virus
- CDravidic Virus
- DStealth Virus
How the community answered
(27 responses)- A93% (25)
- C4% (1)
- D4% (1)
Why each option
A polymorphic virus mutates its code signature on each replication cycle while leaving its underlying payload logic unchanged.
Polymorphic viruses use a built-in mutation engine to re-encrypt or otherwise alter their binary representation with each infection, producing a different byte signature every time to evade static signature-based detection. The core algorithm and malicious payload remain functionally identical across all variants; only the code's appearance changes.
A metamorphic virus fully rewrites its entire code - not merely re-encrypts it - on each replication, which is a more advanced transformation than the mutation-with-intact-algorithm behavior described in the question.
Dravidic virus is not a recognized classification in any standard malware taxonomy and is a fabricated distractor.
A stealth virus conceals its presence by intercepting OS calls and returning falsified file or memory data, which is a hiding technique unrelated to code mutation.
Concept tested: Polymorphic virus mutation engine and signature evasion
Source: https://csrc.nist.gov/glossary/term/polymorphic_virus
Topics
Community Discussion
No community discussion yet for this question.

