During security testing, you use virus code that rewrites itself entirely and changes the signatures with each infection but preserves functionality. What type of virus is this?

During security testing, you use virus code that rewrites itself entirely and changes the signatures with each infection but preserves functionality. What type of virus is this?

• A. Oligomorphic
• B. Polymorphic
• C. Metamorphic
• D. Transmorphic

Answer: (C)

Mutating code that rewrites its entire body with every infection while keeping the same functionality is a metamorphic virus. It essentially reconstitutes itself into a completely new form each time, so there’s no stable signature to rely on for detection. Yet the actions it performs remain the same, so its behavior isn’t altered even though the code looks different. Oligomorphic malware switches among a small set of decryptors; polymorphic malware mutates its decryptor and uses encryption, but doesn’t rewrite the entire program; transmorphic isn’t a standard term for this behavior. Therefore, metamorphic is the best fit.

Mutating code that rewrites its entire body with every infection while keeping the same functionality is a metamorphic virus. It essentially reconstitutes itself into a completely new form each time, so there’s no stable signature to rely on for detection. Yet the actions it performs remain the same, so its behavior isn’t altered even though the code looks different.

Oligomorphic malware switches among a small set of decryptors; polymorphic malware mutates its decryptor and uses encryption, but doesn’t rewrite the entire program; transmorphic isn’t a standard term for this behavior. Therefore, metamorphic is the best fit.