1. A method for protecting a digital data processing device from attack, the method comprising: within a virtual environment in at least one hardware processor: receiving at least one attachment to a first electronic mail; executing the at least one attachment to the first electronic mail; determining whether anomalous behavior occurs; and generating feedback based on the execution of the at least one attachment to the first electronic mail when anomalous behavior is determined to have occurred; receiving at least one attachment to a second electronic mail; and based on the feedback and the at least one attachment to the second electronic mail, performing filtering on the second electronic mail.