Which technique do antivirus products use to execute suspicious code in a controlled environment to detect encrypted and polymorphic viruses?

Which technique do antivirus products use to execute suspicious code in a controlled environment to detect encrypted and polymorphic viruses?

• A. Code Emulation
• B. Sandboxing
• C. Virtualization
• D. Heuristics

Answer: (A)

This question is about analyzing suspicious code safely to reveal hidden or obfuscated malware behavior, especially for encrypted or polymorphic threats. Code emulation interprets and executes code instruction by instruction inside a software emulator rather than on the actual system. This lets the antivirus observe what the code would do when it decrypts or unpacks itself, allocates memory, or calls notable API functions, all in a controlled environment. By watching these steps, the system can detect malicious activity that isn’t visible in the encrypted or packed form, making it possible to identify polymorphic or encrypted payloads without risking real machine compromise. Sandboxing and virtualization also provide isolated environments, but code emulation specifically analyzes the code logic at the instruction level to uncover hidden behavior without needing a full guest operating system or real execution context. Heuristics looks at suspicious patterns, but it doesn’t inherently reveal unpacked or decrypted payloads the way emulation does.

This question is about analyzing suspicious code safely to reveal hidden or obfuscated malware behavior, especially for encrypted or polymorphic threats. Code emulation interprets and executes code instruction by instruction inside a software emulator rather than on the actual system. This lets the antivirus observe what the code would do when it decrypts or unpacks itself, allocates memory, or calls notable API functions, all in a controlled environment. By watching these steps, the system can detect malicious activity that isn’t visible in the encrypted or packed form, making it possible to identify polymorphic or encrypted payloads without risking real machine compromise.

Sandboxing and virtualization also provide isolated environments, but code emulation specifically analyzes the code logic at the instruction level to uncover hidden behavior without needing a full guest operating system or real execution context. Heuristics looks at suspicious patterns, but it doesn’t inherently reveal unpacked or decrypted payloads the way emulation does.