1. An apparatus, comprising: a memory; and a hardware processor operatively coupled to the memory, the hardware processor configured to receive a potentially malicious file, the hardware processor configured to calculate an attribute value associated with the potentially malicious file, the attribute value being at least one of: (1) an indication of how often a byte value within a byte value range is within each byte window (a) from a plurality of byte windows of the potentially malicious file and (b) having an informational entropy within an informational entropy range, (2) an indication of how often a combination of the informational entropy range and a byte standard deviation range is associated with the plurality of byte windows of the potentially malicious file, or (3) an indication of how often a combination of a string length range and a string hash value range occurs within the potentially malicious file, the hardware processor configured to calculate, based on the attribute value and using a trained threat model, a probability that the potentially malicious file is malicious.