nerdexam
GIAC

GCFA · Question #154

Adam works as a Security Analyst for Umbrella Inc. He suspects that a virus exists in the network of the company. He scanned the client system with latest signature-based anti-virus, but no…

The correct answer is A. When the user runs the infected file in the disk, it loads virus into the RAM. B. The mutation engine of polymorphic virus generates a new encrypted code, this changes the signature C. It has the ability to mutate and can change its known viral signature and hide from signaturebased. Polymorphic viruses use a mutation engine to continuously alter their code and signature, evading signature-based detection while still exhibiting standard viral behaviors like loading into RAM on execution.

Threat Hunting & Timeline Analysis

Question

Adam works as a Security Analyst for Umbrella Inc. He suspects that a virus exists in the network of the company. He scanned the client system with latest signature-based anti-virus, but no productive results have been obtained. Adam suspects that a polymorphic virus exists in the network. Which of the following statements are true about the polymorphic virus? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AWhen the user runs the infected file in the disk, it loads virus into the RAM.
  • BThe mutation engine of polymorphic virus generates a new encrypted code, this changes the signature
  • CIt has the ability to mutate and can change its known viral signature and hide from signaturebased
  • DThe new virus resides in the main memory of the computer and does not infect other files of the operating

How the community answered

(48 responses)
  • A
    75% (36)
  • D
    25% (12)

Why each option

Polymorphic viruses use a mutation engine to continuously alter their code and signature, evading signature-based detection while still exhibiting standard viral behaviors like loading into RAM on execution.

AWhen the user runs the infected file in the disk, it loads virus into the RAM.Correct

When an infected file is executed, the virus code is loaded into RAM, which is standard behavior for executable viruses and applies to polymorphic viruses as well.

BThe mutation engine of polymorphic virus generates a new encrypted code, this changes the signatureCorrect

The mutation engine is the core component of a polymorphic virus - it re-encrypts the viral payload with a new key each time, producing a different binary signature and defeating static signature scanning.

CIt has the ability to mutate and can change its known viral signature and hide from signaturebasedCorrect

The defining characteristic of a polymorphic virus is its ability to mutate its own code with each replication cycle, changing its detectable signature and hiding from antivirus tools that rely on known static signatures.

DThe new virus resides in the main memory of the computer and does not infect other files of the operating

This statement is false - polymorphic viruses do infect other files as they replicate; a virus that only resides in memory without spreading to other files would be a different category of malware.

Concept tested: Polymorphic virus mutation engine and signature evasion

Source: https://csrc.nist.gov/glossary/term/polymorphic_virus

Topics

#polymorphic virus#malware evasion#signature mutation#anti-virus bypass

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCFA Practice