Question

A polymorphic virus can .............

• A. Spreading through social media platforms
• B. Change its appearance
• C. Deleting files randomly
• D. Only infecting specific file types

Hint:

To distinguish between evasion techniques:
- Polymorphic virus: Constantly changes its external decryption routine and keys (changes its appearance).
- Metamorphic virus: Rewrites its entire core code structure using different instructions with each infection (changes its entire structure).

Answer 1

The Correct Option is B

Step 1: Understanding the Concept:
In computer security, malware uses evasion techniques to bypass detection by security systems.
A polymorphic virus is a type of malicious software designed to alter its binary signature (appearance) every time it infects a new system, while keeping its core payload and function identical.

Step 3: Detailed Explanation:
Let us analyze how a polymorphic virus operates:
Traditional antivirus software relies on signature-based detection, searching for known, static strings of binary code unique to specific malware.
To evade this, a polymorphic virus uses an encryption engine combined with a mutation engine.
When the virus replicates and infects a new file or system:
1. The mutation engine generates a completely new decryption routine.
2. The virus encrypts its main body using a different key.
3. Because the decryption routine and key change with each infection, the physical file signature and overall binary "appearance" change completely.
Despite these structural changes, the underlying functional code remains the same once decrypted in memory.
Let us evaluate the other options:
- Option (A): Spreading through social media is a transmission vector typical of worms and Trojans, not a defining characteristic of polymorphism.
- Option (C): Deleting files randomly describes a payload action, which can be performed by non-polymorphic viruses or randsomware.
- Option (D): Infecting specific file types is a host-selection trait, not related to the code-mutation capability of polymorphism.
Therefore, the defining characteristic of a polymorphic virus is its ability to change its appearance.

Step 4: Final Answer:
A polymorphic virus is characterized by its ability to change its appearance to evade detection, matching Option (B).