Chandler works as a pen-tester in an IT-firm in New York. As a part of detecting viruses in the systems, he uses a detection method where the anti-virus executes the malicious codes on a virtual machi

Heuristic analysis inspects code structure and behavioral patterns without fully executing it in a virtual machine - it flags suspicious characteristics rather than simulating execution.

Code emulation (also called dynamic analysis or sandboxing) works by actually executing the malicious code within a controlled virtual environment. The AV engine monitors the simulated CPU instructions and memory operations in real time, allowing detection of polymorphic or obfuscated malware that evades static signatures.

Integrity checking computes checksums or hashes of files to detect unauthorized modifications; it does not execute code or simulate CPU and memory activity.

Scanning refers to signature-based detection that compares file content against a database of known malware patterns; it does not involve executing code on a virtual machine.