312-50V9 · Question #592
ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but
The correct answer is A. Polymorphic Virus. The described virus mutates its code on every execution while keeping its original algorithm and behavior unchanged, which is the defining characteristic of a polymorphic virus. This mutation defeats signature-based antivirus detection.
Question
ViruXine.W32 virus hides their presence by changing the underlying executable code. This Virus code mutates while keeping the original algorithm intact, the code changes itself each time it runs, but the function of the code (its semantics) will not change at all. Here is a section of the Virus code:
What is this technique called?
Exhibit
Options
- APolymorphic Virus
- BMetamorphic Virus
- CDravidic Virus
- DStealth Virus
How the community answered
(26 responses)- A88% (23)
- B4% (1)
- C8% (2)
Why each option
The described virus mutates its code on every execution while keeping its original algorithm and behavior unchanged, which is the defining characteristic of a polymorphic virus. This mutation defeats signature-based antivirus detection.
A polymorphic virus changes its binary signature each time it replicates, typically by re-encrypting its payload with a different key and mutating the decryption routine, while the underlying payload logic and behavior remain identical. This technique renders signature-based scanners ineffective because each copy presents a unique byte pattern. The question's description - 'code changes itself each time it runs, but the function of the code will not change' - is the textbook definition of polymorphic malware behavior.
A metamorphic virus completely rewrites its own code and can restructure its algorithmic logic on each iteration, going further than encryption-based mutation - the question specifies the original algorithm remains intact, which is inconsistent with metamorphic behavior.
Dravidic Virus is not a recognized malware classification or technical term in any established cybersecurity taxonomy.
A stealth virus evades detection by intercepting OS system calls to hide changes to file sizes or contents on disk, which is a fundamentally different evasion mechanism from code mutation.
Concept tested: Polymorphic virus code mutation and signature evasion
Source: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/polymorphic-malware
Topics
Community Discussion
No community discussion yet for this question.
