nerdexam
EC-Council

312-50V9 · Question #592

ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but

The correct answer is A. Polymorphic Virus. The described virus mutates its code on every execution while keeping its original algorithm and behavior unchanged, which is the defining characteristic of a polymorphic virus. This mutation defeats signature-based antivirus detection.

Malware Threats

Question

ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but the function of the code (its semantics) will not change at all. Here is a section of the Virus code:

What is this technique called?

Exhibit

312-50V9 question #592 exhibit

Options

  • APolymorphic Virus
  • BMetamorphic Virus
  • CDravidic Virus
  • DStealth Virus

How the community answered

(26 responses)
  • A
    88% (23)
  • B
    4% (1)
  • C
    8% (2)

Why each option

The described virus mutates its code on every execution while keeping its original algorithm and behavior unchanged, which is the defining characteristic of a polymorphic virus. This mutation defeats signature-based antivirus detection.

APolymorphic VirusCorrect

A polymorphic virus changes its binary signature each time it replicates, typically by re-encrypting its payload with a different key and mutating the decryption routine, while the underlying payload logic and behavior remain identical. This technique renders signature-based scanners ineffective because each copy presents a unique byte pattern. The question's description - 'code changes itself each time it runs, but the function of the code will not change' - is the textbook definition of polymorphic malware behavior.

BMetamorphic Virus

A metamorphic virus completely rewrites its own code and can restructure its algorithmic logic on each iteration, going further than encryption-based mutation - the question specifies the original algorithm remains intact, which is inconsistent with metamorphic behavior.

CDravidic Virus

Dravidic Virus is not a recognized malware classification or technical term in any established cybersecurity taxonomy.

DStealth Virus

A stealth virus evades detection by intercepting OS system calls to hide changes to file sizes or contents on disk, which is a fundamentally different evasion mechanism from code mutation.

Concept tested: Polymorphic virus code mutation and signature evasion

Source: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/polymorphic-malware

Topics

#polymorphic virus#code mutation#malware obfuscation#self-modifying code

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice