Which of the following is a characteristic of metamorphic worm code?

The correct answer is B. After a trigger event the worm will decode and reveal new functionality or behavior. In addition to changing their appearance using polymorphism, new worms will also change their behavior dynamically, undergoing metamorphosis. Using this technique, additional attack capabilities are concealed inside the worm. After a given event occurs (time duration, infection…

Malware Analysis & Advanced Persistent Threats

Question

Options

AThe worm will use code from various legitimate files to infect multiple operating systems.
BAfter a trigger event the worm will decode and reveal new functionality or behavior.
CAfter a trigger event the worm will alter its code but not its functionality or behavior.
DThe worm will use code from various legitimate files to evade filter detection.

How the community answered

(25 responses)

A
4% (1)
B
84% (21)
C
4% (1)
D
8% (2)

Explanation

In addition to changing their appearance using polymorphism, new worms will also change their behavior dynamically, undergoing metamorphosis. Using this technique, additional attack capabilities are concealed inside the worm. After a given event occurs (time duration, infection rate, or other trigger), the worm morphs by decoding the hidden functionality, revealing new functionality (such as backdoors, information stealing, Denial of Service, etc.) The use of code from legitimate files is not a reason a program would be considered

Topics

#metamorphic malware#worm behavior#code mutation#malware classification

Community Discussion

No community discussion yet for this question.

Full GCIH Practice