ViruXine.W32 virus hides its presence by changing the underlying executable code. This virus code mutates while keeping the original algorithm intact - the code changes itself each time it runs, but the function of the code (its semantics) does not change at all.

Here is a section of the virus code (refer to image), where the loop performs XOR encryption and changes the way the code looks every time it is executed.
What is this technique called?
Correct Answer: B
The virus described changes its own code with each execution but still performs the same actions. This is the hallmark of a Metamorphic Virus. Unlike polymorphic viruses (which use encrypted code with a changing decryptor), metamorphic viruses rewrite their own code entirely - including their decryption and execution routines - to avoid pattern detection by antivirus software.
Key characteristics of metamorphic viruses seen in the scenario:
Mutates completely on every execution.
Keeps overall functionality identical (semantics intact).
Alters its appearance and logic flow.
From CEH v13 Courseware:
Module 6: Malware Threats # Types of Viruses and Obfuscation Techniques CEH v13 Study Guide states:
"Metamorphic viruses modify their own code structure and appearance with each iteration, without altering their underlying behavior. This makes them more difficult to detect through signature-based mechanisms." Incorrect Options:
A: Polymorphic viruses encrypt themselves with a changing decryptor stub but do not change their core logic.
C: "Dravidic Virus" is not a recognized term in cybersecurity.
D: Stealth viruses hide their presence (e.g., by intercepting system calls), but do not change their code structure.
Reference:CEH v13 Study Guide - Module 6: Malware Types # Metamorphic and Polymorphic VirusesNIST SP 800-83r1 - Guide to Malware Incident Prevention and Handling Let me know if you'd like to continue with more malware-related questions or other CEH topics.