In both cases, code is scanned for suspicious characteristics, but in active mode, the scanner uses an emulator environment to execute and trace the code.