1. A system for computer code behavior analysis of a target program, the system comprising: a physical processor of a host real computer system configured to create a behavior record in memory to store behavior flags representative of computer code behavior observed by virtually executing the computer code of the target program under analysis within a virtual machine system, the virtual machine system comprising computer code executed by the physical processor; a sequencer comprising computer code executed by the physical processor that stores a sequence in which behavior flags are set and reset in the behavior record during virtual execution of the target program under analysis by the virtual machine system; and computer code executed by the physical processor which simulates memory within the virtual machine system and automatically configured with a memory map of the virtual machine system comprising assigned areas for receiving predetermined types of data from the target program based on a file format of the target program; computer code executed by the physical processor which simulates an operating system within the virtual machine system, the operating system comprising one or more layered operating system shells that correspond with the memory map so that the virtual machine system in conjunction with the physical processor is capable of executing DOS target programs, the target program under analysis interacting with the memory of the virtual machine system and the operating system of the virtual machine system to generate the behavior flags, the one or more layered operating system shells simulating values of the host real computer system; execution of the computer code of the target program by the virtual machine system causing the physical processor to set and reset behavior flags in the sequencer that tracks behavior of the target program in response to the simulated values during execution of the target program by the virtual machine system; wherein the virtual machine system passes data representative of the behavior record to the host real computer system prior to termination of the virtual machine system; and the host real computer system evaluating the behavior flags and sequence in which the behavior flags are set and reset to determine if the target program contains malicious code.