312-50V10 · Question #79
A virus that attempts to install itself inside the file it is infecting is called?
The correct answer is B. Cavity virus. A cavity virus installs itself into unused spaces within a file, avoiding file size changes that might trigger detection.
Question
A virus that attempts to install itself inside the file it is infecting is called?
Options
- ATunneling virus
- BCavity virus
- CPolymorphic virus
- DStealth virus
How the community answered
(33 responses)- A3% (1)
- B85% (28)
- C3% (1)
- D9% (3)
Why each option
A cavity virus installs itself into unused spaces within a file, avoiding file size changes that might trigger detection.
A tunneling virus intercepts operating system and antivirus interrupt calls to bypass security hooks, not to hide code inside file cavities.
A cavity virus, also called a space-filler virus, targets empty or unused sections within an executable file and inserts its malicious code there. Because the file size does not change, it is harder for signature-based scanners to detect. This technique of hiding inside existing file cavities is the defining characteristic of this virus type.
A polymorphic virus mutates its own code on each infection to evade signature detection, rather than targeting unused space within a host file.
A stealth virus hides its presence by intercepting OS read requests and returning clean data, which is an evasion technique unrelated to file cavity insertion.
Concept tested: Cavity virus file infection technique
Source: https://www.cisa.gov/sites/default/files/publications/Understanding_Hidden_Threats_Rootkits_and_Botnets.pdf
Topics
Community Discussion
No community discussion yet for this question.