14. A computer-readable medium storing instructions, the instructions comprising: one or more instructions that, when executed by one or more processors, cause the one or more processors to: receive data; identify executable code contained in the data; execute the executable code within an environment; generate a trace based on executing the executable code; generate, based on the trace, a call list that includes information identifying: an ordered list of calls to one or more functions that allow the executable code to interact with the environment, a quantity of the calls to the one or more functions, and one or more arguments passed to the one or more functions, the one or more functions being defined outside of the executable code; generate, based on the trace, an optimized code by replacing a portion of the executable code with an alternative portion, the portion and the alternative portion being equivalent with respect to interaction with the environment during execution; modify whitespace contained in the optimized code based on a whitespace normalizing scheme; modify identifiers contained in the optimized code based on an identifier normalizing scheme; provide the optimized code, after modifying the whitespace and after modifying the identifiers, for matching against a code signature to determine whether the executable code is malicious, the code signature being associated with determining whether the executable code is malicious; and provide the call list for matching against a list signature to determine whether the executable code is malicious, the list signature being associated with determining whether the executable code is malicious.
14. A computer-readable medium storing instructions, the instructions comprising: one or more instructions that, when executed by one or more processors, cause the one or more processors to: receive data; identify executable code contained in the data; execute the executable code within an environment; generate a trace based on executing the executable code; generate, based on the trace, a call list that includes information identifying: an ordered list of calls to one or more functions that allow the executable code to interact with the environment, a quantity of the calls to the one or more functions, and one or more arguments passed to the one or more functions, the one or more functions being defined outside of the executable code; generate, based on the trace, an optimized code by replacing a portion of the executable code with an alternative portion, the portion and the alternative portion being equivalent with respect to interaction with the environment during execution; modify whitespace contained in the optimized code based on a whitespace normalizing scheme; modify identifiers contained in the optimized code based on an identifier normalizing scheme; provide the optimized code, after modifying the whitespace and after modifying the identifiers, for matching against a code signature to determine whether the executable code is malicious, the code signature being associated with determining whether the executable code is malicious; and provide the call list for matching against a list signature to determine whether the executable code is malicious, the list signature being associated with determining whether the executable code is malicious. 18. The computer-readable medium of claim 14 , where the one or more instructions, that cause the one or more processors to generate the optimized code, cause the one or more processors to: generate an abstract syntax tree based on the executable code; determine, from the trace, a behavior associated with one or more nodes of the abstract syntax tree; generate one or more substitute nodes associated with the behavior; and generate the optimized code based on the abstract syntax tree and the one or more substitute nodes.