312-50V11 · Question #682
ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but
The correct answer is A. Polymorphic Virus. Polymorphic viruses mutate their code or encryption each time they execute while preserving the original payload algorithm, making them difficult to detect by signature-based antivirus tools.
Question
ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but the function of the code (its semantics) will not change at all. Here is a section of the Virus code:
What is this technique called?
Exhibits
Options
- APolymorphic Virus
- BMetamorphic Virus
- CDravidic Virus
- DStealth Virus
How the community answered
(24 responses)- A92% (22)
- C4% (1)
- D4% (1)
Why each option
Polymorphic viruses mutate their code or encryption each time they execute while preserving the original payload algorithm, making them difficult to detect by signature-based antivirus tools.
A polymorphic virus changes its observable binary signature each time it replicates or runs, typically through variable encryption keys or code obfuscation routines. However, the core payload algorithm and semantics remain completely unchanged - only the appearance of the code changes. This matches the described behavior precisely: code that mutates on each execution while the original function stays intact.
A metamorphic virus goes further than polymorphism by completely rewriting its own code logic and structure each iteration, potentially altering the algorithm itself rather than just changing an encrypted wrapper.
Dravidic Virus is not a recognized malware classification in any standard security taxonomy and does not describe any documented virus behavior.
A stealth virus hides its presence by intercepting OS system calls to conceal file size or timestamp changes, not by mutating its own executable code each run.
Concept tested: Polymorphic vs metamorphic virus code mutation evasion
Source: https://csrc.nist.gov/publications/detail/sp/800-83/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.

