What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data appending/pre-pending), while in metamorphic malware code the code itself gets different each time it propagates (through adding useless instructions, function reordering, loops etc.)? Am I right about these two?

And how about oligomorphic code? It is like a simpler version of polymorphic code but I don't exactly get it in which way it is simpler, so could someone please explain it a bit more?


Polymorphic code: The (same) code takes many forms (like encryptions)
Oligomorphic code: The (same) code takes one of a few predefined forms (and thus can be possibly matched against signatures that can cover all cases)
Metamorphic code: The code mutates, so the code itself is different in each execution (but the functionality the same)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.