1. A device comprising: one or more hardware processors to: receive an object; execute the object in a test environment; perform a static analysis of the object including at least one of: scanning the object with anti-virus software, performing a strings search of the object, or disassembling the object; determine, based on executing the object in the test environment and performing the static analysis of the object, test behavior information associated with the object, the test behavior information identifying a first behavior associated with testing the object in the test environment; determine actual behavior information associated with the object, the actual behavior information identifying a second behavior exhibited by the object when the object is opened or executed on a user device; determine that the object is a malicious object based on the actual behavior information being different from the test behavior information; and provide an indication that the object is the malicious object based on determining that the object is the malicious object.