Chandler works as a pen-tester in an IT-firm in New York. As a part of detecting viruses in the systems, he uses a detection method where the anti-virus executes the malicious codes on a virtual…

Heuristic analysis examines code structure and patterns statically or monitors behavior rules without fully executing the code in a virtual CPU/memory simulation.

Code emulation (also called dynamic analysis or sandbox execution) works by running malicious code within a controlled virtual machine environment that simulates real CPU and memory operations. This allows the antivirus to observe the actual runtime behavior of the code - such as file writes, registry changes, or network calls - without risking the real system, which matches exactly what the question describes.

Integrity checking computes and compares cryptographic hashes or checksums of files to detect unauthorized modifications, not malicious code behavior.

Scanning refers to signature-based detection that matches file byte patterns against a database of known malware signatures, not runtime execution.