adplus-dvertising
frame-decoration

Question

What is the benefit of using metamorphism in malware?

a.

It makes the program run faster

b.

It encrypts the program's body and makes slight alterations in the decryption engine

c.

It makes each version of the malware look radically different from any other versions

d.

It makes the program more easily identifiable by antivirus programs

Posted under Reverse Engineering

Answer: (c).It makes each version of the malware look radically different from any other versions Explanation:The benefit of metamorphism (from a malware writer’s perspective) is that each version of the malware can look radically different from any other versions. This makes it very difficult (if not impossible) for antivirus writers to use any kind of signature-matching techniques for identifying the malicious program.

Engage with the Community - Add Your Comment

Confused About the Answer? Ask for Details Here.

Know the Explanation? Add it Here.

Q. What is the benefit of using metamorphism in malware?

Similar Questions

Discover Related MCQs

Q. What is required for a metamorphic engine to work?

Q. What kind of alterations can be automatically applied to a program by a metamorphic engine?

Q. What is a metamorphic engine?

Q. What are some parameters that can be randomized by a metamorphic engine?

Q. How does reversing a condition affect the program's code?

Q. What is garbage insertion?

Q. How can metamorphic engines make malware more difficult to identify?

Q. What should you do before attempting to analyze malware?

Q. What is the recommended method for transferring executables to the test system?

Q. Why is it important to rename the malicious program with a nonexecutable extension?

Q. What is the Trojan/Backdoor.Hacarmy.D?

Q. What is the file extension used for screen savers?

Q. What is the purpose of using a file name like "Webcam Shots.scr" for the Trojan?

Q. How is the Trojan/Backdoor.Hacarmy.D typically distributed?

Q. What is the purpose of running an executable through DUMPBIN or a similar program?

Q. What is UPX?

Q. Why does the Backdoor program use UPX?

Q. How can the problem of reversing the program in its compressed form be avoided?

Q. What should be done after permanently decompressing the Backdoor program with UPX?

Q. Why is reversing the Backdoor program in its decompressed form a more straightforward task?