1. A computer-implementable method for determining the behavior of an executable comprising: (a) selecting evaluation calls made by the executable to the interface of an operating system; (b) loading stubs into a virtual address space, the stubs: (i) mirroring the calls made to the interface of an operating system; and (ii) determining a behavior signature for the selected calls; (c) executing the selected calls inside of a virtual operating environment using the loaded stubs dynamically linked libraries; and (d) determining the behavior signatures resulting from said execution of the selected calls inside of a virtual operating environment.