A system comprising a first computing device running a security agent and a second computing device running a security service, wherein: the security agent is configured to: determine context data associated with a file present at the first computing device by: carrying out first operations to: block an attempt to execute the file; and determine context data comprising runtime information associated with the attempt; or carrying out second operations to: block an operation of the file during execution of the file, the file comprising processor-executable instructions to carry out the operation of the file; and determine context data comprising runtime information associated with the operation of the file; and transmit the context data and an indication of the file to the security service; and the security service is configured to: determine a synthetic context based on the context data; detonate the file in the synthetic context to provide detonation data; and locate, in a corpus of malware samples, a malware sample that is similar to the file based on the detonation data. the security agent is configured to: determine context data associated with a file present at the first computing device by: carrying out first operations to: block an attempt to execute the file; and determine context data comprising runtime information associated with the attempt; or carrying out second operations to: block an operation of the file during execution of the file, the file comprising processor-executable instructions to carry out the operation of the file; and determine context data comprising runtime information associated with the operation of the file; and transmit the context data and an indication of the file to the security service; and determine context data associated with a file present at the first computing device by: carrying out first operations to: block an attempt to execute the file; and determine context data comprising runtime information associated with the attempt; or carrying out second operations to: block an operation of the file during execution of the file, the file comprising processor-executable instructions to carry out the operation of the file; and determine context data comprising runtime information associated with the operation of the file; and carrying out first operations to: block an attempt to execute the file; and determine context data comprising runtime information associated with the attempt; or block an attempt to execute the file; and determine context data comprising runtime information associated with the attempt; or carrying out second operations to: block an operation of the file during execution of the file, the file comprising processor-executable instructions to carry out the operation of the file; and determine context data comprising runtime information associated with the operation of the file; and block an operation of the file during execution of the file, the file comprising processor-executable instructions to carry out the operation of the file; and determine context data comprising runtime information associated with the operation of the file; and transmit the context data and an indication of the file to the security service; and the security service is configured to: determine a synthetic context based on the context data; detonate the file in the synthetic context to provide detonation data; and locate, in a corpus of malware samples, a malware sample that is similar to the file based on the detonation data. determine a synthetic context based on the context data; detonate the file in the synthetic context to provide detonation data; and locate, in a corpus of malware samples, a malware sample that is similar to the file based on the detonation data.