1. A computing device comprising: a memory and at least one processor to execute a plurality of modules including: a static code analysis module to generate a set of tokens from an application under test according to rules; a signal generation module to determine a set of signal tokens from the set of tokens; and a classification module to compare the set of signal tokens with a signal token database to determine a likelihood of whether malware is included in the application under test.