1. A computer program product tangibly embodied on non-transient computer readable media, the computer program product comprising instructions operable when executed to: execute script code by a script application programming interface (API); detect, by a decoder, an event in the script code, the event comprising an indirect branch call; redirect an instruction pointer to a predetermined memory location pointer based on the detection of the indirect branch call, the predetermined memory location comprising malware monitoring code; execute the malware monitoring code in a sandbox upon execution of the redirection of the instruction pointer to the predetermined memory location; identify, in a heap memory by the malware monitoring code, the script code loaded into the heap memory; and evaluate, by the malware monitoring code, the script code in the heap memory for malicious code prior to execution of the script code; wherein the instructions are further operable to: identify a start of an execution of the script code in the sandbox; identify an end of the execution of the script code in the sandbox; and determine that the script code contains malicious code based on a time difference from the start of the execution to the end of the execution of the script code.