nerdexam
EC-Council

312-50V10 · Question #79

A virus that attempts to install itself inside the file it is infecting is called?

The correct answer is B. Cavity virus. A cavity virus installs itself into unused spaces within a file, avoiding file size changes that might trigger detection.

Malware Threats

Question

A virus that attempts to install itself inside the file it is infecting is called?

Options

  • ATunneling virus
  • BCavity virus
  • CPolymorphic virus
  • DStealth virus

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    85% (28)
  • C
    3% (1)
  • D
    9% (3)

Why each option

A cavity virus installs itself into unused spaces within a file, avoiding file size changes that might trigger detection.

ATunneling virus

A tunneling virus intercepts operating system and antivirus interrupt calls to bypass security hooks, not to hide code inside file cavities.

BCavity virusCorrect

A cavity virus, also called a space-filler virus, targets empty or unused sections within an executable file and inserts its malicious code there. Because the file size does not change, it is harder for signature-based scanners to detect. This technique of hiding inside existing file cavities is the defining characteristic of this virus type.

CPolymorphic virus

A polymorphic virus mutates its own code on each infection to evade signature detection, rather than targeting unused space within a host file.

DStealth virus

A stealth virus hides its presence by intercepting OS read requests and returning clean data, which is an evasion technique unrelated to file cavity insertion.

Concept tested: Cavity virus file infection technique

Source: https://www.cisa.gov/sites/default/files/publications/Understanding_Hidden_Threats_Rootkits_and_Botnets.pdf

Topics

#cavity virus#virus types#malware#file infection

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice