1. A non-transitory computer readable storage medium having stored thereon logic that, upon execution by one or more processors implemented within a network device, performs operations during processing of a first object in a virtual machine, comprising: launching the first object in the virtual machine; querying a document object model corresponding to an object-type of the first object to determine whether an embedded object is included in the first object; responsive to querying the document object model, receiving metadata associated with the embedded object, the metadata including an object-type of the embedded object; responsive to determining the object-type of the embedded object is one of a predetermined set of object-types based on the metadata, processing the embedded object in the virtual machine; and determining whether at least one of the first object or the embedded object is malicious.