Which component generates randomized decryption routines?

Which component generates randomized decryption routines?

• A. System Sector Virus
• B. Polymorphic viruses
• C. Mutation engine
• D. Decryptor routine

Answer: (D)

In polymorphic malware, the key idea is that the decryptor—the code that actually reverses the payload’s encryption—is not kept constant. To dodge signature-based detection, the decryptor is regenerated in each infection. This generation of new, varied decryptors is done by a mutation engine. The mutation engine takes the original decryptor and rewrites it in many different ways, inserting junk code and changing instructions so each variant looks different but still performs the same decryption task. So, the component that generates randomized decryption routines is the mutation engine. The decryptor routine itself is the function that performs decryption; it doesn’t create new variants by itself, it’s just the payload being decrypted.

In polymorphic malware, the key idea is that the decryptor—the code that actually reverses the payload’s encryption—is not kept constant. To dodge signature-based detection, the decryptor is regenerated in each infection. This generation of new, varied decryptors is done by a mutation engine. The mutation engine takes the original decryptor and rewrites it in many different ways, inserting junk code and changing instructions so each variant looks different but still performs the same decryption task.

So, the component that generates randomized decryption routines is the mutation engine. The decryptor routine itself is the function that performs decryption; it doesn’t create new variants by itself, it’s just the payload being decrypted.