Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data appending/pre-pending), while in metamorphic malware code the code itself gets different each time it propagates (through adding useless instructions, function reordering, loops etc.)? Am I right about these two?

And how about oligomorphic code? It is like a simpler version of polymorphic code but I don't exactly get it in which way it is simpler, so could someone please explain it a bit more?

share|improve this question
I hope the question fits this SE site.. Btw, I am not trying to create any malware, I am just reading a book about it and I wasn't completely sure if I understood these three concepts well enough. – pootzko Jun 18 '11 at 9:42
up vote 11 down vote accepted

Polymorphic code: The (same) code takes many forms (like encryptions)
Oligomorphic code: The (same) code takes one of a few predefined forms (and thus can be possibly matched against signatures that can cover all cases)
Metamorphic code: The code mutates, so the code itself is different in each execution (but the functionality the same)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.