1. A non-transitory computer readable medium comprising computer executable instructions stored thereon to cause one or more processing units to: identify a sample for submission to a server, wherein the server is configured to perform malware analysis on the submitted sample; receive an indication from the server whether the sample is available to the server; and if the indication is that the sample is not available to the server: split the sample into a plurality of portions according to a set of rules; filter the plurality of portions, wherein the instructions to filter comprise instructions to discard at least a part of the respective portions; create hashes of each of the plurality of filtered portions, wherein each respective filtered portion comprises parts of the portion that were not discarded by the filtering, and wherein each of the created hashes comprises a fingerprint; submit the fingerprints of each of the plurality of filtered portions, along with their respective locations relative to a beginning of the sample, to the server; receive an indication from the server whether each of the plurality of portions is available to the server; and submit to the server only those filtered portions wherein the server indicated that the portion is not available to the server, wherein each submitted filtered portion remains sufficiently similar to the respective portion before filtering, allowing the server to perform the malware analysis.