1. A system, comprising: a first device comprising a first processor configured to execute a firewall, and a second device comprising a second processor configured to execute a virtual machine, wherein the executing the firewall using the first processor of the first device comprises: using the firewall to identify an application type associated with a network traffic flow; using the firewall to select a decoder to decode the network traffic flow based at least in part on the identified application type, wherein decoding the network traffic flow includes assembling one or more packets associated with the network traffic flow into a correct order; using the firewall to decrypt the network traffic flow to generate a potential malware sample from at least a portion of the network traffic flow, wherein a preexisting signature does not match the potential malware sample, wherein the potential malware sample is related to a Portable Document Format (PDF) file; and sending the potential malware sample from the firewall to the virtual machine; and wherein the executing the virtual machine using the second processor of the second device comprises: analyzing the potential malware sample using the virtual machine to determine if the potential malware sample is malware, wherein analyzing the potential malware using the virtual machine includes monitoring behavior of the potential malware sample during emulation using the virtual machine to identify malware, wherein the monitored behaviors that indicate potential malware include one or more of the following: visiting a domain associated with a domain name length that exceeds a threshold, and communicating using an HTTP header associated with a shorter than threshold length; determining a score associated with one or more network traffic behaviors associated with the potential malware sample monitored using the virtual machine; automatically generating a signature using the virtual machine if the potential malware sample is determined to be malware, wherein the determination of whether the potential malware sample comprises malware is based at least in part on the score, wherein the signature in the event that the potential malware sample is determined to be malware is generated based at least in part on at least a cross reference table included in the PDF file; and sending the signature from the virtual machine to the firewall, wherein the firewall is configured to enforce a security policy for network access based at least in part on the signature.