Malware use several methods to evade anti-virus software, one is to change their code when they are replicating. I saw mainly three type of techniques in the wild which are: metamorphic malware, oligomorphic malware and polymorphic malware (I might have missed one). What are the main differences between theses techniques and what do they do ?
What are the differences between metamorphic, oligomorphic and polymorphic malware?
obfuscation;malware
In order of increasing complexity: oligomorphic, polymorphic, metamorphic.The first two terms are generally applied to decryptors.  We (anti-virus industry) define them this way: oligomorphic - decryptor with few variable elements, which does not affect the size or shape of the code.  It means that the variable elements are usually fixed-size instructions, but it can also apply to the register initialization.Oligomorphic examplestd ;fake, might be replaced by cld / nop / xchg ax, cx / ...mov cx, sizemov ax, ax ;fake, might be replaced by mov bx, bx / or cx, cx / ...mov si, decrypt_srccld ;fakemov di, decrypt_dstor ax, ax ;fakemov bl, keyand bp, bp ;fakedecrypt:xor [di], blxchg dx, ax ;fakeinc dicld ;fakeloop decryptIn this case, the di register could be exchanged with si, for example.  Very simple replacement.Polymorphicdecryptor with potentially highly variable elements, which does affect the size and/or shape of the code.  It means that all kinds of changes can be applied, including subroutine creation, large blocks of garbage instructions, code islands, or even algorithmic register initialisation (example here).Metamorphichighly variable elements are applied directly to the body.  There is generally no decryptor in this case.  The same techniques for polymorphism are applied to the code itself.  The most famous example of this is the Simile virus from 2002 (details here).  There's a detailed paper on the subject with actual examples here)