EC-Council Certified Ethical Hacker (CEH) v12Malware ThreatsEasy
Which of the following best describes the primary characteristic of a polymorphic virus?
- AIt spreads by attaching itself to legitimate programs.
- BIt creates a backdoor for remote access to the infected system.
- CIt encrypts its code to evade signature-based detection, changing its signature with each infection.
- DIt remains dormant on a system until a specific trigger event occurs.
Show answer & explanationAnswer & explanation
Correct answer: C. It encrypts its code to evade signature-based detection, changing its signature with each infection.
Polymorphic viruses are specifically designed to evade signature-based detection by changing their executable code and encryption keys with each infection, resulting in a different signature each time while retaining the same malicious functionality.
Why the other options are wrong
- A. This describes a general characteristic of a virus, but not specifically a polymorphic one.
- B. This describes a backdoor or Trojan functionality, not the defining characteristic of polymorphism.
- D. This describes a logic bomb, not a polymorphic virus.
Polymorphic Virus
A type of malware that changes its executable code and encryption keys each time it infects a new system, making it difficult for signature-based antivirus software to detect.
- Evades signature-based detection.
- Changes its code and signature with each infection.
- Maintains the same malicious functionality.
Memory trick: Poly-morphic means 'many forms' to hide its true face.