The most regular method of detecting malware relies on signature-based detection. Polymorphic malware pose a serious threat to modern computing. The challenge faced with this type of malware is that there is difficult to Antivirus (AV) technology to detect them. This polymorphic malware can't be detected by AV scanners because of mutated code by itself. This mutated code generated by the polymorphic engine, or called as mutation engine to make this malware become more difficult to read. In this paper, researcher examined how to detect polymorphic malware from the list of samples file based on dropped files.