Malware does things like record your keystrokes and send them to bad people. Or redirect browser URLs to fake websites. Or encrypt all your files and ask for money.
Slowness, of itself, does not indicate malware. It is more likely to be caused by:
A system disk that is running out of free space to work with.
Not enough RAM for the available processes.
Processes using large % of the CPU resources.
If this is an 8Gb RAM model with 256 Gb disk (a common base model), then it's possible that the disk is getting full; or that she's trying to do too much with it. (If she uses Chrome, then that's a terrible browser that uses lots of CPU and RAM.)
Check Activity Monitor (in /Applications/Utilities), and see what apps are using lots of CPU and Memory. It will also show you the "Memory Pressure", giving you an indication of how much the memory is being compressed.
This is not an exhaustive list, but these things are much more likely than malware, which is often leaves no obvious signs.