Efficient detection of split personalities in malware