1. A method for implementation by one or more data processors forming part of at least one computing device the method comprising: receiving or accessing, by at least one data processor, data comprising a structured file encapsulating data required by an execution environment to manage executable code wrapped within the structured file; iteratively identifying, by the at least one data processor, code and data regions in the structured file; extracting, by the at least one data processor and based on the identifying, code start points for subsequent use in disassembly; extracting, by the at least one data processor using the extracted coded start points, at least one first order feature from the structured file by analyzing at least a portion of the identified code and data regions, the extracted at least one first order feature indicating whether a collection of import names is ordered lexicographically; analyzing, by the at least one data processor, negative space within the structured file to extract at least one additional feature, the negative space being different from the identified code and data regions; and providing, by the at least one data processor, both of the extracted at least one feature and the extracted at least one additional feature to a machine learning model such that the machine learning model consumes at least a portion of these features.