EC-Council Certified Ethical Hacker (CEH) v12Malware ThreatsMedium
A cybersecurity researcher is analyzing a sophisticated piece of malware that employs advanced evasion techniques. The malware dynamically generates its code and uses various encryption methods for different parts of its payload, making signature-based detection extremely difficult. Furthermore, it modifies its decryption routine with each infection, presenting a unique signature for every infected host. Which specific type of malware exhibits this behavior?
- AMacro Virus
- BPolymorphic Malware
- CArmored Virus
- DStealth Virus
Show answer & explanationAnswer & explanation
Correct answer: B. Polymorphic Malware
Polymorphic malware changes its identifiable features (like its code or encryption) each time it replicates or infects, making it very difficult for signature-based antivirus software to detect. The scenario explicitly describes dynamic code generation and modification of decryption routines with each infection.
Why the other options are wrong
- A. Macro viruses infect documents and rely on macros, not dynamic code generation.
- C. Armored viruses employ techniques to hinder reverse engineering, not necessarily changing their code with each infection.
- D. Stealth viruses hide their presence from the operating system, but don't necessarily change their code each time.
Polymorphic Malware
Malware that changes its internal structure and signature with each infection, while retaining its original functionality.
- Uses encryption and different decryption routines.
- Evades signature-based detection.
- Its 'shape' changes, but its 'purpose' remains constant.
Memory trick: Polymorphs Change Shapes, Avoid Detection.