A computer-implemented method, comprising: identifying a number of call instructions in a binary executable; for each of the number of call instructions: storing in a call stack a default value generated for the call instruction; executing the call instruction, wherein executing the call instruction causes a return address after the call instruction to be stored in the call stack; sequentially executing a plurality of instructions subsequent to a target of the call instruction; determining that a value identified by a stack pointer of the call stack is equal to the default value; in response to the determination that the value identified by the stack pointer is equal to the default value, determining if there is a non-obfuscation signal present, the non-obfuscation signal including a failure of the call instruction to execute, or the execution of a return from the call; if there is a non-obfuscation signal present, identifying the call instruction as a non-obfuscated call instruction; if there is not a non-obfuscation signal present, identifying the call instruction as a possibly obfuscated call instruction; determining whether the number of call instructions identified as possibly obfuscated call instructions exceeds a threshold number; in response to the determination that the number of call instructions identified as possibly obfuscated call instructions exceeds the threshold number, identifying the binary executable as an obfuscated executable; and in response to the determination that the number of call instructions identified as possibly obfuscated call instructions does not exceed the threshold number, identifying the binary executable as a non-obfuscated executable. identifying a number of call instructions in a binary executable; for each of the number of call instructions: storing in a call stack a default value generated for the call instruction; executing the call instruction, wherein executing the call instruction causes a return address after the call instruction to be stored in the call stack; sequentially executing a plurality of instructions subsequent to a target of the call instruction; determining that a value identified by a stack pointer of the call stack is equal to the default value; in response to the determination that the value identified by the stack pointer is equal to the default value, determining if there is a non-obfuscation signal present, the non-obfuscation signal including a failure of the call instruction to execute, or the execution of a return from the call; if there is a non-obfuscation signal present, identifying the call instruction as a non-obfuscated call instruction; if there is not a non-obfuscation signal present, identifying the call instruction as a possibly obfuscated call instruction; determining whether the number of call instructions identified as possibly obfuscated call instructions exceeds a threshold number; in response to the determination that the number of call instructions identified as possibly obfuscated call instructions exceeds the threshold number, identifying the binary executable as an obfuscated executable; and in response to the determination that the number of call instructions identified as possibly obfuscated call instructions does not exceed the threshold number, identifying the binary executable as a non-obfuscated executable. storing in a call stack a default value generated for the call instruction; executing the call instruction, wherein executing the call instruction causes a return address after the call instruction to be stored in the call stack; sequentially executing a plurality of instructions subsequent to a target of the call instruction; determining that a value identified by a stack pointer of the call stack is equal to the default value; in response to the determination that the value identified by the stack pointer is equal to the default value, determining if there is a non-obfuscation signal present, the non-obfuscation signal including a failure of the call instruction to execute, or the execution of a return from the call; if there is a non-obfuscation signal present, identifying the call instruction as a non-obfuscated call instruction; if there is not a non-obfuscation signal present, identifying the call instruction as a possibly obfuscated call instruction; determining whether the number of call instructions identified as possibly obfuscated call instructions exceeds a threshold number; in response to the determination that the number of call instructions identified as possibly obfuscated call instructions exceeds the threshold number, identifying the binary executable as an obfuscated executable; and in response to the determination that the number of call instructions identified as possibly obfuscated call instructions does not exceed the threshold number, identifying the binary executable as a non-obfuscated executable.