nerdexam
EC-Council

312-50V10 · Question #682

ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but

The correct answer is A. Polymorphic Virus. A polymorphic virus mutates its code signature on each replication cycle while leaving its underlying payload logic unchanged.

Malware Threats

Question

ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but the function of the code (its semantics) will not change at all. Here is a section of the Virus code:

What is this technique called?

Exhibits

312-50V10 question #682 exhibit 1
312-50V10 question #682 exhibit 2

Options

  • APolymorphic Virus
  • BMetamorphic Virus
  • CDravidic Virus
  • DStealth Virus

How the community answered

(27 responses)
  • A
    93% (25)
  • C
    4% (1)
  • D
    4% (1)

Why each option

A polymorphic virus mutates its code signature on each replication cycle while leaving its underlying payload logic unchanged.

APolymorphic VirusCorrect

Polymorphic viruses use a built-in mutation engine to re-encrypt or otherwise alter their binary representation with each infection, producing a different byte signature every time to evade static signature-based detection. The core algorithm and malicious payload remain functionally identical across all variants; only the code's appearance changes.

BMetamorphic Virus

A metamorphic virus fully rewrites its entire code - not merely re-encrypts it - on each replication, which is a more advanced transformation than the mutation-with-intact-algorithm behavior described in the question.

CDravidic Virus

Dravidic virus is not a recognized classification in any standard malware taxonomy and is a fabricated distractor.

DStealth Virus

A stealth virus conceals its presence by intercepting OS calls and returning falsified file or memory data, which is a hiding technique unrelated to code mutation.

Concept tested: Polymorphic virus mutation engine and signature evasion

Source: https://csrc.nist.gov/glossary/term/polymorphic_virus

Topics

#polymorphic virus#code mutation#obfuscation#malware analysis

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice