EC-Council Certified Ethical Hacker (CEH) v12Malware ThreatsEasy

Which of the following best describes the primary characteristic of a polymorphic virus?

  1. AIt spreads by attaching itself to legitimate programs.
  2. BIt creates a backdoor for remote access to the infected system.
  3. CIt encrypts its code to evade signature-based detection, changing its signature with each infection.
  4. DIt remains dormant on a system until a specific trigger event occurs.
Show answer & explanation

Correct answer: C. It encrypts its code to evade signature-based detection, changing its signature with each infection.

Polymorphic viruses are specifically designed to evade signature-based detection by changing their executable code and encryption keys with each infection, resulting in a different signature each time while retaining the same malicious functionality.

Why the other options are wrong

  • A. This describes a general characteristic of a virus, but not specifically a polymorphic one.
  • B. This describes a backdoor or Trojan functionality, not the defining characteristic of polymorphism.
  • D. This describes a logic bomb, not a polymorphic virus.

Polymorphic Virus

A type of malware that changes its executable code and encryption keys each time it infects a new system, making it difficult for signature-based antivirus software to detect.

  • Evades signature-based detection.
  • Changes its code and signature with each infection.
  • Maintains the same malicious functionality.

Memory trick: Poly-morphic means 'many forms' to hide its true face.

More Malware Threats questions