The virus scan engine analyzes each file’s binary patterns and compares them against the binary information in the pattern files. If there is a match, the file is determined to be malicious.