Malware that does not execute in a sandbox environment often contains anti-analysis techniques, such as anti- virtualization code. This code detects when the malware is running in a virtualized environment and alters its behavior to avoid detection. Checking for anti-virtualization code is a logical next step because:
It helps determine if the malware is designed to evade analysis tools.
Identifying such code can provide insights into the malware's behavior and intent.
This step can also inform further analysis methods, such as running the malware on physical hardware.
References:
CompTIA Security+ Study Guide
SANS Institute, "Malware Analysis Techniques"
"Practical Malware Analysis" by Michael Sikorski and Andrew Honig