About this interactive
Malware names are marketing, and the exam knows it. Every card here describes what a piece of code does, and the whole skill is reading a behavior and naming the category it defines — because in an incident you get the behavior first and the name much later, if ever. The trap is that these eight categories do not divide along one axis. Some are defined by how the code spreads, some by what it does once it lands, some by where it lives, and some by when it fires. Knowing which question a category answers is most of the work. Virus and Worm are the pair everyone gets asked about and the pair most often confused, because both self-replicate. The line between them is not speed, damage, or sophistication — it is dependency. A virus needs a host: it writes itself into an existing executable or document, and it does nothing until a person runs that file. Attaching to a legitimate executable and waking when the host runs is the textbook case. So is the macro virus, and that one deserves a second look, because it says the infection spreads when the document is shared. Sharing is a human act. A person emails the file, another person opens it and clicks Enable Content, and only then does the code move. That dependency on a human step is exactly what keeps it a virus. A worm removes the human. It carries its own propagation code, finds reachable hosts itself, and exploits an unpatched service to copy itself across — no user action required, which is the phrase the item uses and the phrase to watch for. The second worm card describes the consequence rather than the mechanism: copying itself to every reachable host on the subnet until bandwidth is gone. Worms are frequently destructive by accident, saturating networks they never intended to take down, and that runaway quality follows directly from needing no permission to continue. Trojan answers a different question entirely. A Trojan does not replicate at all; it is defined by how it gets in, which is deception. The user installs it on purpose, believing it is a game or a free antivirus tool, and it does something else in addition — opens a backdoor, drops a remote shell. Note that both Trojan cards describe a payload that would fit other categories if you only read the second half; what makes them Trojans is the disguise that got them onto the machine. Ransomware and Spyware are both payload categories, defined by the goal rather than the delivery. Ransomware denies you access and monetizes the restoration, whether by encrypting documents and demanding cryptocurrency or by locking the screen before the OS will load. That second variety is worth knowing about because it is often the weaker one: locker ransomware may leave files untouched and be recoverable, while crypto ransomware with sound key management genuinely is not. Spyware monetizes observation instead of denial — logging keystrokes and capturing screenshots to harvest banking credentials at the aggressive end, tracking browsing history and redirecting searches to monetized pages at the adware-adjacent end. Both spyware cards exfiltrate something about the user; neither destroys or blocks anything, which is the tell. Rootkit is about concealment and privilege, and it is the category students most often assign to the wrong evidence. A rootkit is not defined by stealing anything. It is defined by subverting the layer that reports the truth, so the system lies to its own administrator. Patching the kernel to hide a process and its files, or hooking system calls so antivirus and Task Manager cannot see what is running, both describe an attacker who has taken over the reporting mechanism itself. That is why kernel-mode rootkits are so serious and why the standard advice for a confirmed one is to rebuild rather than clean: you cannot trust any tool that asks the compromised kernel a question. Fileless malware is defined by location, not behavior, and this is where the categories genuinely overlap. Living entirely in RAM and the registry means there is no file on disk for signature-based antivirus to match — the classic case. Injecting shellcode into a running explorer.exe with PowerShell is the same idea and the more realistic modern one: the malicious code executes inside the memory space of a process the system already trusts, launched by a signed administrative tool that is supposed to be there. That technique is what the industry means by living off the land, and it is precisely why endpoint detection moved from scanning files to watching behavior. Be honest about the overlap: process injection is also a concealment technique, and a defender might reasonably call that sample a rootkit too. It is binned as Fileless here because leaving nothing on disk is the characteristic the card leads with. Logic Bomb is defined by its trigger and nothing else. The payload can be anything — wiping a drive when the system clock reaches a date, deleting payroll records when a specific employee ID disappears from the HR database. What makes it a logic bomb is that it sits dormant and armed until a condition evaluates true. The second card is the classic insider scenario, and it is the reason logic bombs matter disproportionately to their frequency: the trigger was written by someone with legitimate access, and the condition is that person's own termination. That is a personnel control problem as much as a technical one, which is why separation of duties and code review appear in the same breath as this term. Two habits will carry you past this activity. First, real samples are almost never one category. A modern ransomware operation may arrive as a Trojan, move laterally like a worm, install a rootkit for persistence, run fileless in memory, and detonate on a schedule like a logic bomb — all in one intrusion. Classification questions grade the defining characteristic the description leads with, not the only label that could ever apply. Second, when a card resists you, ask which question the behavior is answering: how did it spread, how did it get in, what does it want, where does it live, or when does it fire. Match that question to the category that exists to answer it, and the sorting stops being memorization.