1. A computer implemented method of detecting malware in a specimen of computer content or network traffic, the method comprising: responsive to receiving a specimen, determining, by a controller, an analysis plan for analyzing whether the received specimen should be classified as malware, the analysis plan identifying at least a first analysis and a second analysis to be performed with respect to the specimen, each of the first analysis and the second analysis identified in the analysis plan including at least one of a static analysis and a dynamic analysis; performing the first analysis in accordance with the analysis plan to identify one or more suspicious indicators associated with malware and one or more characteristics related to processing of the specimen; performing the second analysis in accordance with the analysis plan, including processing of the specimen in a virtual environment including with one or more monitors to identify one or more unexpected behaviors each having one or more processing or communications anomalies; determining by a classifier whether the specimen should be classified as malicious based on the one or more identified suspicious indicators and the one or more identified anomalies; and storing the analysis plan, the one or more identified indicators, the one or more characteristics, and the one or more identified anomalies in a persistent memory.