An anti-analysis check is code that tries to detect whether malware is being watched or studied before it runs its full payload. Common checks look for debuggers, virtual machines, emulators, sandbox artifacts, or signs of instrumentation such as unusual processes, files, or timing delays.
This matters because security teams often detonate suspicious files in controlled environments to observe their behavior. If the sample notices that it is being analyzed, it may exit, sleep, or reveal only harmless behavior, making detection harder. In real attacks, these checks are often combined with encryption, delayed execution, and API or syscall evasion to reduce visibility. Defenders look for the check itself: debugger queries, VM fingerprinting, anti-sandbox logic, and suspicious timing loops are useful behavioral indicators even when the final payload never fully appears.