Chandler works as a pen-tester in an IT-firm in New York. As a part of detecting viruses in the systems, he uses a detection method where the…

Code emulation involves running a suspicious program in a controlled, virtualized environment (a sandbox or virtual machine) to observe its behavior. The antivirus tool simulates the necessary CPU and memory operations to trick the malware into executing its malicious routines. By analyzing the actions the code takes within this safe environment, such as modifying files or making network connections, the antivirus can identify it as malicious without risking the actual host system. This is a form of dynamic analysis.

A. Heuristic analysis examines the static code for suspicious characteristics, patterns, or instructions without actually executing it in a simulated environment.

C. Scanning is a static technique that compares the file's signature (e.g., a hash) against a database of known malware signatures. It does not involve execution.

D. Integrity checking involves comparing current file hashes against a previously stored baseline of known-good hashes to detect unauthorized modifications.

- Egele, M., Scholte, T., Kirda, E., & Kruegel, C. (2008). A survey on automated dynamic malware analysis techniques and tools. ACM Computing Surveys (CSUR), 40(2), 1-42. (Section 2.1 describes the use of emulators and virtual machines for dynamic analysis). DOI: https://doi.org/10.1145/1346333.1346335

- Kirat, D., & Vigna, G. (2015). MALFOI: Automatic malware forensics and incident response. Proceedings of the 22nd Annual Network and Distributed System Security Symposium (NDSS). (This paper discusses dynamic analysis techniques that rely on executing malware in controlled environments like emulators).