Malware detection by a sandbox service by utilizing contextual information

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processing resources associated with a sandbox service associated with a network security platform protecting an enterprise network, causes the one or more processing resources to perform a method comprising:

• receiving, by a sandbox service associated with a network security platform protecting an enterprise network, from an endpoint security solution of the network security platform running on an endpoint device of the enterprise network, a file associated with sandbox-evading malware to be classified by the sandbox service and contextual information related to the file;
• and
• classifying, by the sandbox service, the file as being malware by detonating the sandbox-evading malware as a result of performing sandboxing on the file including emulating an environment of the endpoint device based on the contextual information.