> For the complete documentation index, see [llms.txt](https://docs.virusis.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.virusis.com/ai-explainers/what-is-malware-analysis.md).

# What Is Malware Analysis?

Malware analysis is the process of combining different signals to decide whether a suspicious sample is safe, risky, or malicious.

## What It Means In Virusis

Virusis does not do this through a single layer. The current product flow brings together at least:

* provider verdicts
* hash-based sample identity
* scoring layers
* threat enrichment
* static analysis

## Why a single verdict is not enough

Because the same sample can be:

* clean in one provider
* suspicious in another
* high-entropy in static analysis
* associated with a tactic in the enrichment layer

Analysis is the act of reading those signals together.

## Where analysis appears in Virusis

* the scanner starts the submission
* engine cards stream onto the result page
* score cards and checksums add orientation
* threat intelligence and static analysis provide depth

## Short conclusion

In Virusis, malware analysis is not a single verdict from one external service. It is a layered investigation workflow.