1. At least one non-transitory computer readable medium comprising one or more instructions that when executed by a processor, cause the computer readable medium to: receive script data; determine a checksum tree for the script data; compare each checksum of the checksum tree to one or more subtree checksums, wherein each of the one or more subtree checksums is a malware checksum or a benign checksum; assign one or more classifications to the script data, wherein the assigned classification includes a likely malware family name or a benign label; and store the assigned classifications in memory.