1. A system, comprising: a processor configured to: initialize, as a copy-on-write overlay associated with an original virtual machine image, a first virtual machine instance; apply one or more modifications to the first virtual machine instance, wherein at least one modification includes the installation of startup instructions, and wherein at least one modification is associated with the installation of a honey file; start the modified virtual machine instance, including by executing a selected first sample within the started virtual machine instance; capture a first set of modifications resulting from executing the first virtual machine instance; and determine, based at least in part on an analysis of the captured modifications that the selected first sample is malicious; and a memory coupled to the processor and configured to provide the processor with instructions.