A device, comprising: one or more processors to: receive a file to be analyzed in a sandbox environment; determine configuration information for configuring the sandbox environment, the configuration information being determined based on at least one of: file information associated with the file to be analyzed, or client device information associated with a client device for which the file is intended, and the configuration information indicating a system configuration; determining a first likelihood that the sandbox environment will identify the file as malware based on the sandbox environment being configured using a first type of the system configuration, the first likelihood being determined using a probabilistic model, the probabilistic model being generated using a training set of files; determining a second likelihood that the sandbox environment will identify the file as malware based on the sandbox environment being configured using a second type of the system configuration, the second likelihood being determined by using the probabilistic model; configure the sandbox environment using the first type of the system configuration when the first likelihood is higher than the second likelihood or the second type of the system configuration when the second likelihood is higher than the first likelihood; and analyze the file in the sandbox environment based on configuring the sandbox environment using the first type of the system configuration or the second type of the system configuration. receive a file to be analyzed in a sandbox environment; determine configuration information for configuring the sandbox environment, the configuration information being determined based on at least one of: file information associated with the file to be analyzed, or client device information associated with a client device for which the file is intended, and the configuration information indicating a system configuration; file information associated with the file to be analyzed, or client device information associated with a client device for which the file is intended, and the configuration information indicating a system configuration; determining a first likelihood that the sandbox environment will identify the file as malware based on the sandbox environment being configured using a first type of the system configuration, the first likelihood being determined using a probabilistic model, the probabilistic model being generated using a training set of files; determining a second likelihood that the sandbox environment will identify the file as malware based on the sandbox environment being configured using a second type of the system configuration, the second likelihood being determined by using the probabilistic model; configure the sandbox environment using the first type of the system configuration when the first likelihood is higher than the second likelihood or the second type of the system configuration when the second likelihood is higher than the first likelihood; and analyze the file in the sandbox environment based on configuring the sandbox environment using the first type of the system configuration or the second type of the system configuration.