Viruses used to have specific "signatures" which anti-virus software used to identify them. However, in today's world, viruses can change their code (while maintaining purpose) at specific points in time, after certain numbers of infections, and so on to avoid detection (polymorphic viruses). What are good example lines of code found in anti-virus software that can recognize polymorphic viruses?
Signatures are only created after a piece of malware has been analysed. So whenever a malware comes out with a different byte pattern, the av relies on behavioral analysis of the malware, like if the malware if dropping a certain registry key or a file with a specific name, hooking a certain api function from windows etc.