So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets as address and don't contain absolute addresses of the destination.
Now, can the relative offset between functions or instructions change if the binary is compiled again with the same compiler? How about with another compiler?
Do you guys think using a call instruction as part of a signature is good?