1. A computer-implemented method for scanning packed programs in response to detecting suspicious behaviors, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: executing a packed program that comprises: malicious code that has been obfuscated within the packed program; unpacking code that deobfuscates and executes the malicious code when the packed program is executed; receiving scanning criteria that specifies at least one suspicious behavior that will trigger scanning of a portion of memory of the packed program for at least one malware signature that is associated with the at least one suspicious behavior, wherein the at least one suspicious behavior indicates that the unpacking code has deobfuscated and executed the malicious code; monitoring, while the packed program is executing, how the packed program behaves; detecting, while monitoring how the packed program behaves, the at least one suspicious behavior; scanning, in response to detecting the at least one suspicious behavior, the portion of the memory of the packed program for only the at least one malware signature that is associated with the at least one suspicious behavior; wherein the at least one malware signature that is associated with the at least one suspicious behavior comprises a subset of a set of malware signatures used to scan for malware such that scanning the portion of the memory of the packed program for only the at least one malware signature that is associated with the at least one suspicious behavior reduces a number of malware signatures used to scan the packed program for malware.