1. A computer program product embodied on a non-transitory tangible computer readable medium and configured to: search a computer program for external call instructions; compare the external call instructions within the computer program with at least one predetermined external call instruction characteristic corresponding to known malware, wherein the at least one predetermined external call characteristic comprises relative position information specifying relative positions of at least one external call instruction with respect to another external call instruction within the computer program; and identify the computer program as containing malware if the external call instructions within the computer program match the at least one predetermined external call instruction characteristic corresponding to known malware; and perform at least one action if the computer program is identified as containing malware.