1. An apparatus for efficiently detecting malicious software code in a manner that reduces processing and memory utilization, the apparatus comprising: a computing device comprising processing circuitry and a memory configured to analyze code to detect malware, the processing circuitry configured to execute instructions for: receiving query binary code for analysis to determine if the query binary code includes malware; generating token sequence n-grams based on the query binary code; hashing the token sequence n-grams; partitioning samples by length to compare selected samples based on length, wherein the samples are based on the token sequence n-grams; generating an n-gram score using a dynamic decimation of a selected sample based on the token sequence n-grams and a plurality of reference samples, wherein the n-gram score is indicative of a similarity between the selected sample and at least one of the reference samples; and reporting, based on the n-gram score, a malware threat as an output to a user, wherein the reporting includes the n-gram score and an indication of a match between the selected sample and the at least one of the reference sample.