CEH Practice Question: Malware, Social Engineering and Network Attacks

Which TWO of the following are characteristics of a polymorphic virus?

⚠ Common exam trap

Watch out — candidates often confuse the method of propagation (e.g., email) or activation trigger (e.g., date) with the core definition of polymorphism, which is solely about code mutation to evade signature detection.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It changes its code signature each time it infects a new file

A polymorphic virus changes its decryption routine and code signature each time it infects a new file, making signature-based detection difficult. This mutation is achieved by using a polymorphic engine that generates varied decryption loops while preserving the malicious payload.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
It changes its code signature each time it infects a new file
Why this is correct
Polymorphic malware is specifically designed to alter its internal structure and appearance with each new infection. This constant mutation means that the virus's binary code, and consequently its cryptographic hash or signature, changes every time it replicates. This characteristic is fundamental to its ability to evade signature-based antivirus detection systems, which rely on identifying fixed patterns.
✗
It spreads via email attachments
Why it's wrong here
Spreading via email attachments describes a common propagation vector for many types of malware, including worms and trojans, but it is not a defining characteristic of polymorphism itself. Polymorphism refers to the malware's ability to change its internal code structure to evade detection, irrespective of how it initially reaches a system or spreads to others. A polymorphic virus could spread through various means, not exclusively email.
✓
It uses encryption with a variable key
Why this is correct
A primary mechanism for achieving polymorphism involves encrypting the malicious payload with a different, randomly generated key for each new infection. The virus then includes a small, variable decryption routine (mutating stub) that uses this unique key to decrypt the payload at runtime. This process ensures that the overall code signature of the encrypted virus body constantly changes, making it difficult for static signature analysis to identify.
✗
It remains dormant until a specific date or time
Why it's wrong here
A time-based trigger, such as a specific date or time, defines a logic bomb, not a polymorphic virus. The core mechanism of a polymorphic virus is mutation of its decryption routine with each infection to evade signature-based detection, not dormancy scheduling. This option is tempting because many malware families, such as ransomware, do use time bombs to delay activation, making it a plausible characteristic for a generic virus, but it does not satisfy the stem’s requirement for polymorphism.
✗
It can infect the Master Boot Record (MBR)
Why it's wrong here
The ability to infect the Master Boot Record (MBR) describes a specific infection target or location within a system, common to boot sector viruses. While some polymorphic malware might indeed target the MBR, this capability is not inherent to or defining of polymorphism itself. Polymorphism solely refers to the malware's capacity to alter its code's appearance to avoid detection, independent of where it resides or what system component it compromises.

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question