system
Given the following post, respond as if you're commenting on Reddit:
human
Can someone provide a very simple explanation of how malware "changes itself" to avoid detection?

First year comp sci student. I'm just trying to understand how malware "changes itself". 

...would it be something like keeping track of how many times a section of the code executes, and then after 'n' times it will switch to another section that ultimately has the same outcome but just does so in a different way?
gpt
It could be very simple, or very complex. Something simple might be to add usless variables or functions that will change the signature of the file. An example of a more complex change would be altering the execution flow to add extra system system calls (or to remove some) so behavior based protection might miss it.