Security Operations · Intermediate

Polymorphic Malware

Malware that changes its code appearance with each infection, often through encryption, to evade signature detection.

Definition

Polymorphic malware uses a mutation engine to encrypt its payload with a different key and alter its decryptor each time, so the file hash and signature change while functionality stays the same. Behavioral and heuristic detection are more effective than signatures. It differs from metamorphic malware, which rewrites its own code entirely.

Related terms