1. A system, comprising: a processor configured to: receive a candidate malware potentially including one or more malicious elements; analyze the candidate malware using a virtual machine, including by: evaluating one or more actions taken by the candidate malware, when executing in the virtual machine, to determine whether the candidate malware is attempting to take an anti-virtual machine action; determine that at least one action taken by the candidate malware when executing in the virtual machine is an anti-virtual machine action, comprising an attempt to check that the candidate malware is running in a virtualized environment; and in response to the determination, generate as output an alert that the candidate malware is malicious; and a memory coupled to the processor and configured to provide the processor with instructions.