1. A computer-implemented method for categorizing virtual-machine-aware applications for further analysis, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: categorizing a plurality of virtual-machine-aware applications by determining that each of the plurality of virtual-machine-aware applications exhibits at least one behavior when the virtual-machine-aware application detects that the virtual-machine-aware application is executing in a physical computing environment that the virtual-machine-aware application does not exhibit in a virtual computing environment, wherein each virtual-machine-aware application is designed to detect whether the virtual-machine-aware application is executing in the physical computing environment or in the virtual computing environment in order to avoid being detected by a malware detection system operating within the virtual computing environment; categorizing a plurality of non-virtual-machine-aware applications by determining that the non-virtual-machine-aware-applications do not exhibit different behavior when executed in the physical computing environment rather than in the virtual computing environment; determining, at least in part by using telemetry data gathered from at least one end user computing system to compare the virtual-machine-aware applications with the non-virtual-machine-aware applications, at least one characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications; analyzing an uncategorized application to determine whether the uncategorized application comprises the characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications; in response to determining that the uncategorized application comprises the characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications, preventing the uncategorized application from evading complete analysis by sending the uncategorized application to the physical computing environment for further analysis to identify malicious behaviors performed on the physical computing environment by the uncategorized application that indicate the uncategorized application comprises malware; analyzing an additional uncategorized application to determine that the additional uncategorized application does not comprise the characteristic; and in response to determining that the additional uncategorized application does not comprise the characteristic, preventing an expenditure of physical computing resources by sending the additional uncategorized application to the virtual computing environment rather than the physical computing environment for further analysis to identify malicious behaviors performed on the virtual computing environment by the uncategorized application that indicate the uncategorized application comprises malware.