Spotting the Malicious Moment: Characterizing Malware Behavior Using Dynamic Features