Certified Ethical Hacker (CEH) Practice Question

Malware that transfers a stand-alone copy of itself across network connections and runs without modifying existing files is defined as a worm. The hallmark of a worm is autonomous propagation-after initial execution it locates other systems and replicates over the network (in this case via SMB on port 445). A file-infector virus, in contrast, must attach its code to host executables; a macro virus embeds itself in document macros; ransomware is categorized by its goal of encrypting data for payment, not by its propagation method. Because the observed sample spreads automatically and does not attach to files, it fits the definition of a network worm.