1. A method for detecting malware, comprising: identifying, via a processor, an application identifier of a first application paired with a universal resource locator (URL) scheme, wherein the URL scheme of the first application enables an external process to execute the first application; storing, via the processor, the identified pairing of the application identifier and URL scheme of the first application in a database, wherein the database stores URL scheme pairings of a plurality of applications; identifying a second application as an unknown application; detecting a request to register a URL scheme pairing of the second application; querying the database based on the request to register the URL scheme pairing of the second application to determine whether the URL scheme pairing for the second application includes the URL scheme of the first application; determining whether the second application is potential malware based on a result of the querying; marking the second application as potential malware based at least in part on the determining; and performing a malware scan on the second application.