For a semester exam, which option is correct about malware polymorphism?

A. a software testing phase B. a project costing model C. a database join type D. changing malware code appearance to evade signature detection