Polymorphic Malware.

Polymorphic malware uses an encryption/packing layer and a small mutating decryptor so that every copy of the file looks different to signature-based antivirus, even though the decrypted payload is identical. This frustrates static hash-based detection and exact-byte signatures. Polymorphic engines often include random instruction reordering, junk-code insertion and variable register usage. Unlike metamorphic malware, the underlying payload is not rewritten — only its outer wrapper and decryptor change.

The technique is decades old. The 1260 (V2PX) virus, written by Mark Washburn in 1990 from Ralf Burger's disassembly of the Vienna virus, is widely credited as the first polymorphic virus, randomising its decryption routine to vary its signature. In early 1992 the Dark Avenger's Mutation Engine (MtE) turned polymorphism into a reusable toolkit any virus author could bolt on, generating a fresh decryptor and random key per infection; Norton reported detecting roughly 900,000 mutations by late 1992. Modern loaders and packers apply the same idea at scale.

Because the payload is constant once unpacked, effective defences shift away from file bytes: behavioural/EDR telemetry, memory scanning after the decryptor runs, YARA rules matching decrypted strings in memory, sandbox detonation, and machine-learning classifiers trained on dynamic features.

flowchart LR
  A[Constant payload] --> B[Encrypt with random key]
  B --> C[Prepend mutating decryptor + junk code]
  C --> D[New unique file per infection]
  D -->|evades| E[Signature/hash AV]
  D --> F[On execution: decryptor unpacks in memory]
  F --> G[Identical payload revealed]
  G -->|caught by| H[EDR / memory scan / behavioural ML]