How to distinguish malware?