1. A computer-implemented method for assessing danger of software objects, the method comprising: receiving, by a hardware processor, information about: a software object detected on a computer, one or more malicious characteristics of an Application Program Interface (API) function called by the software object, a security rating of the software object, and one or more security rating rules activated by the one or more malicious characteristics of the API to assess the security rating of the software object, determining a priority ranking of each security rating rule; applying the one or more security rating rules in a decreasing priority order until one of the one or more security rating rules indicates whether the software object is malicious or clean based on the one or more malicious characteristics of the API; upon determining that the software object is a clean object, identifying parameters of the API function call that are characteristic of a clean software object; generating a new security rating rule that identifies the software object as clean based on the parameters of the API function call; and assigning to the new security rule a higher priority ranking than the priority ranking of each of the security rating rules activated in assessing the security rating of the software object.