5. A computer implemented method comprising: identifying one or more commands that when called trigger an instruction pointer redirection to a predetermined memory address; identifying the memory address to be redirected to if the one or more commands are called, the memory address comprising malware monitoring code; executing script code by a script application programming interface (API); detecting, by a decoder, an event in the script code, the event comprising an indirect branch call; redirecting an instruction pointer to a predetermined memory location pointer based on the detection of the indirect branch call, the predetermined memory location comprising malware monitoring code; executing, by a hardware processor, the malware monitoring code in a sandbox upon execution of the redirection of the instruction pointer to the predetermined memory location; identifying, by the malware monitoring code, the script code in a heap memory, the script code loaded into the heap memory by the script API; and evaluating, by the malware monitoring code, the script code in the heap memory for malicious code prior to execution of the script code; the method further comprising: identifying, by the malware monitoring code, a start of an execution of the script code in the sandbox; identifying, by the malware monitoring code, an end of the execution of the script code in the sandbox; and determining, by the malware monitoring code, that the script code contains malicious code based on a time difference from the start of the execution to the end of the execution of the script code.
8. The computer implemented method of claim 5 , further comprising: determining, by an interpreter implemented at least partially in hardware, that one or more application versions are compatible with the script code; and executing, by the malware monitoring code, the script code in the sandbox based on the determination that one or more application versions are compatible with the script code.