nerdexam
EC-Council

312-50V11 · Question #682

ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but

The correct answer is A. Polymorphic Virus. Polymorphic viruses mutate their code or encryption each time they execute while preserving the original payload algorithm, making them difficult to detect by signature-based antivirus tools.

Malware Threats

Question

ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but the function of the code (its semantics) will not change at all. Here is a section of the Virus code:

What is this technique called?

Exhibits

312-50V11 question #682 exhibit 1
312-50V11 question #682 exhibit 2

Options

  • APolymorphic Virus
  • BMetamorphic Virus
  • CDravidic Virus
  • DStealth Virus

How the community answered

(24 responses)
  • A
    92% (22)
  • C
    4% (1)
  • D
    4% (1)

Why each option

Polymorphic viruses mutate their code or encryption each time they execute while preserving the original payload algorithm, making them difficult to detect by signature-based antivirus tools.

APolymorphic VirusCorrect

A polymorphic virus changes its observable binary signature each time it replicates or runs, typically through variable encryption keys or code obfuscation routines. However, the core payload algorithm and semantics remain completely unchanged - only the appearance of the code changes. This matches the described behavior precisely: code that mutates on each execution while the original function stays intact.

BMetamorphic Virus

A metamorphic virus goes further than polymorphism by completely rewriting its own code logic and structure each iteration, potentially altering the algorithm itself rather than just changing an encrypted wrapper.

CDravidic Virus

Dravidic Virus is not a recognized malware classification in any standard security taxonomy and does not describe any documented virus behavior.

DStealth Virus

A stealth virus hides its presence by intercepting OS system calls to conceal file size or timestamp changes, not by mutating its own executable code each run.

Concept tested: Polymorphic vs metamorphic virus code mutation evasion

Source: https://csrc.nist.gov/publications/detail/sp/800-83/rev-1/final

Topics

#polymorphic virus#code mutation#malware evasion#virus types

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice