CEH Practice Question: Malware, Social Engineering and Network Attacks

Which type of malware is characterized by being able to change its code signature each time it replicates to evade signature-based detection?

⚠ Common exam trap

Candidates often confuse 'polymorphic' with 'metamorphic'—polymorphic changes the decryption routine while keeping the payload constant, whereas metamorphic rewrites the entire code—or they mistakenly think all self-replicating malware (like worms) are polymorphic by default.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Polymorphic virus

Polymorphic virus is correct because it mutates its code signature each time it replicates, using a mutation engine to generate new decryption routines while keeping the payload intact. This allows it to evade signature-based detection, as each copy appears different to antivirus software that relies on static signatures.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Boot sector virus
Why it's wrong here
A boot sector virus primarily infects the Master Boot Record (MBR) or Volume Boot Record (VBR) of storage devices. Its core functionality involves ensuring execution upon system startup by replacing or modifying legitimate boot code. While highly persistent, these viruses typically maintain a consistent code signature, as their infection strategy relies on occupying a critical, fixed location rather than dynamically altering their own binary structure to evade signature-based detection.
✓
Polymorphic virus
Why this is correct
A polymorphic virus is specifically designed to evade detection by antivirus software through its ability to change its internal structure and signature with each new infection. It achieves this by encrypting its own code and using a different decryption routine or "mutation engine" for each instance. This constant mutation of its executable code and decryption stub makes it extremely difficult for traditional signature-based antivirus scanners to identify it consistently, as its binary pattern is never the same.
✗
Macro virus
Why it's wrong here
A macro virus infects data files, such as Microsoft Office documents, by embedding malicious scripts written in macro languages like VBA. Its propagation relies on users enabling macros, allowing the malicious code to execute within the application's environment. While effective at spreading, macro viruses do not inherently possess the capability to alter their own code signature dynamically to evade detection; their signature is typically derived from the static macro code itself, which remains consistent across infections unless manually modified.
✗
Worm
Why it's wrong here
A worm is a standalone malware program that replicates itself to spread to other computers, typically across network connections, without needing to attach to an existing program. Its primary characteristic is self-propagation and independent execution, often exploiting vulnerabilities to spread rapidly. While a worm might incorporate polymorphic capabilities to enhance its stealth, polymorphism is not an inherent or defining feature of a worm; its classification is based on its propagation method rather than its ability to change its signature for evasion.

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question