In CEH v13 Module 06: Malware Threats, code emulation is defined as a technique used by modern antivirus software where a virtual CPU and memory are created to safely execute and analyze malware in a sandboxed environment.

This allows the detection engine to observe runtime behavior of suspicious code without risking the actual system.

It’s more effective than signature-based detection for catching polymorphic and obfuscated malware.