1. A device comprising: one or more processors, at least partially implemented in hardware, to: receive an object; execute the object in a test environment; determine, based on executing the object in the test environment, first behavior information associated with the object; receive, based on at least one of opening, executing, running, or installing the object on a user device, second behavior information associated with the object, the second behavior information identifying a behavior exhibited by the object when the object is at least one of opened, executed, run, or installed on the user device, the second behavior information being determined for a threshold period of time, and the second behavior information being received based on a deviation from the first behavior information being detected; determine whether the first behavior information identifies the behavior; determine that the object is a malicious object based on determining that the first behavior information does not identify the behavior and based on the second behavior information being different from the first behavior information; and provide an indication that the object is the malicious object based on determining that the object is the malicious object.