SSCP · Question #1106
Which of the following is an attribute of polymorphic code?
The correct answer is A. It mutates while keeping the original algorithm intact. Polymorphic code is malware designed to alter its own code with each infection to evade detection, while its original malicious functionality remains unchanged.
Question
Which of the following is an attribute of polymorphic code?
Options
- AIt mutates while keeping the original algorithm intact
- BIt uses encryption for all the code
- CIt operates based on specific conditions
- DIt is written to self replicate altering the computer configuration
How the community answered
(28 responses)- A89% (25)
- C7% (2)
- D4% (1)
Why each option
Polymorphic code is malware designed to alter its own code with each infection to evade detection, while its original malicious functionality remains unchanged.
Polymorphic code, often found in malware, transforms its own executable code with each infection to create new versions of itself. This mutation helps evade signature-based detection by antivirus software while the underlying malicious functionality remains the same.
While polymorphic code may use encryption as one technique for mutation, it doesn't necessarily encrypt all code, and encryption itself isn't the defining attribute of polymorphism.
Operating based on specific conditions is a general characteristic of many programs and is not specific to polymorphic code.
Self-replication that alters computer configuration is characteristic of viruses or worms, but polymorphism specifically refers to the changing code itself to avoid detection, not just the replication and configuration alteration aspect.
Concept tested: Polymorphic code attributes in malware
Source: https://learn.microsoft.com/en-us/security/compass/incident-response-playbook-malware-analysis-report#polymorphic-code
Topics
Community Discussion
No community discussion yet for this question.