1. A non-transitory computer readable medium comprising computer instructions stored thereon to cause one or more processing units to: receive an indication of detection of malware, the malware accessible from a computer system; identify a file, separate from the malware, in response to the indication of detection, the identified file utilized to automatically initiate execution of code in the computer system; determine whether the identified file is configured to automatically initiate execution of the detected malware; and classify the identified file as malware based on the determination.