A device, comprising: one or more processors to: identify a plurality of files for a multi-file malware analysis; execute the plurality of files concurrently in a malware testing environment; monitor the malware testing environment for behavior indicative of malware; detect the behavior indicative of malware; and perform a first multi-file malware analysis based on detecting the behavior indicative of malware, the first multi-file malware analysis including a scoring technique that modifies a plurality of malware scores, corresponding to the plurality of files, to identify a file, included in the plurality of files, that includes malware; where the one or more processors, when performing the first multi-file malware analysis, are to: modify the plurality of malware scores corresponding to the plurality of files; identify an additional plurality of files for the multi-file malware analysis, the additional plurality of files including at least one file that is not included in the plurality of files; analyze the additional plurality of files for malware concurrently; modify an additional plurality of malware scores, corresponding to the additional plurality of files, based on analyzing the additional plurality of files; determine that a malware score, of the plurality of malware scores or the additional plurality of malware scores, satisfies a threshold after modifying the plurality of malware scores; identify a particular file associated with the malware score; analyze the particular file for malware; and identify the file that includes malware based on analyzing the particular file for malware, the particular file and the file being a same file. identify a plurality of files for a multi-file malware analysis; execute the plurality of files concurrently in a malware testing environment; monitor the malware testing environment for behavior indicative of malware; detect the behavior indicative of malware; and perform a first multi-file malware analysis based on detecting the behavior indicative of malware, the first multi-file malware analysis including a scoring technique that modifies a plurality of malware scores, corresponding to the plurality of files, to identify a file, included in the plurality of files, that includes malware; where the one or more processors, when performing the first multi-file malware analysis, are to: modify the plurality of malware scores corresponding to the plurality of files; identify an additional plurality of files for the multi-file malware analysis, the additional plurality of files including at least one file that is not included in the plurality of files; analyze the additional plurality of files for malware concurrently; modify an additional plurality of malware scores, corresponding to the additional plurality of files, based on analyzing the additional plurality of files; determine that a malware score, of the plurality of malware scores or the additional plurality of malware scores, satisfies a threshold after modifying the plurality of malware scores; identify a particular file associated with the malware score; analyze the particular file for malware; and identify the file that includes malware based on analyzing the particular file for malware, the particular file and the file being a same file. modify the plurality of malware scores corresponding to the plurality of files; identify an additional plurality of files for the multi-file malware analysis, the additional plurality of files including at least one file that is not included in the plurality of files; analyze the additional plurality of files for malware concurrently; modify an additional plurality of malware scores, corresponding to the additional plurality of files, based on analyzing the additional plurality of files; determine that a malware score, of the plurality of malware scores or the additional plurality of malware scores, satisfies a threshold after modifying the plurality of malware scores; identify a particular file associated with the malware score; analyze the particular file for malware; and identify the file that includes malware based on analyzing the particular file for malware, the particular file and the file being a same file.