Polymorphic Malware: Mutation Engine vs Signature Detection

Mutation Engine

Mutation rate 18%

Signature threshold (Hamming) 6

Heuristic sensitivity 4%

Scan Result

Evading signature detection

Generation

Hamming distance

0 / 64

Detection rate

Caught by

—

How it works

The malware's body is a 64-byte genome G. A fixed core payload of 16 bytes (the highlighted ring in the grid) never changes — it is what actually does the damage, so it can't mutate without breaking the exploit. The other 48 bytes are the polymorphic shell: junk instructions and an XOR encryption key that a real polymorphic engine rewrites on every copy.

Each generation, each shell byte flips independently
with probability p (Mutation rate):
  G[i]_(t+1) = random byte,  if rand() < p
             = G[i]_t,       otherwise

Hamming distance to the original signature:
  d(t) = Σ [ G[i]_t ≠ G[i]_0 ]   over all 64 bytes

Signature-based AV flags a match when:
  d(t) ≤ T   (Signature threshold)

Heuristic engine flags the sample independently each
generation with a fixed probability h (Heuristic
sensitivity), because it watches what the core payload
*does* at runtime rather than what the file *looks like*.

Mutation rate — how aggressively the shell rewrites itself each generation. Higher rate pushes the Hamming distance past the threshold faster, so the sample "goes dark" to signature scanning sooner.
Signature threshold — how loose the antivirus's fingerprint match is. A high threshold catches more mutated variants but also risks false positives on unrelated files; a low threshold is precise but blind after just a few generations.
Heuristic sensitivity — the chance a behavior-based engine flags the sample this generation regardless of its byte pattern, because the invariant core payload still has to execute the same way to work.
Step / Auto-Mutate — advance one generation at a time or let it run; Reset Sample returns to generation 0 with d = 0.

Real-world relevance: this is the core reason antivirus vendors moved from pure signature matching (fast, but blind to polymorphic and metamorphic malware) toward heuristic and behavioral detection — the payload's behavior is much harder to disguise than its bytes.

Polymorphic shell byte Fixed core payload byte Mutated this generation

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.