detection - Why is so difficult to detect polymorphic malware? -

why difficult detect polymorphic malware?

is not enough build signature after decompress encrypted part of malware?

and match signature possible version of malware doing similar process?

with similar process mean decompress on real time encrypted part of malware using software peid, , test against signatures generated.

with signature, doing reference classic signature used in antivirus software, sintactic signature (regular expresion of hexadecimals example).

edit:

why don't consider malware software can't correctly unpacked?

benign software use custom pack methods?

edit:

¿how know if software packed? ¿if software packed can aware of that? ¿can know beginning of obfuscated part of malware?

¿what mimimorphism?

is there book or handbook specific polymorphic malware? or obfuscated malware? appreciate reference.

well, no it's not simple. first of all, peid detects packer used pack sample signature. assuming packer has constant signature, not polymorphism. polymorphism method obfuscate (encrypt, pack or encode) file deobfuscation part (decryptor) of file changing on every infection, no static signature can extracted peid. more generalized idea metamorphism, not decryptor changes, entire code, no need encrypt/decrypt since file not constant .. hard write.

another challenge when decide automatically stop decompression process. open problem until now. there heuristics detect end of decryption, can work weak obfuscation methods.