There have been many examples of malware detecting being run in a virtual machine to discourage analysis. (I would note that one obvious sign would be the prese

There have been many examples of malware detecting being run in a virtual machine to discourage analysis. (I would note that one obvious sign would be the presence of the guest additions and/or the fact that the PCI bridge will almost always be an i440fx or Q35...) As for VM escapes... Can't guarantee there won't be a sample that comes along eventually that'll try.