The fast growth of malware and the continuous development of new techniques to hide malicious behavior have made traditional detection methods, such as signature-based and heuristic approaches, less effective. Today’s cybersecurity needs systems that are accurate, scalable, and capable of dealing with new and unknown types of attacks. Deep learning models such as Convolutional Neural Networks (CNNs) and Long Short-Term Memory networks (LSTMs) have shown strong ability in analyzing API call sequences and detecting malware behavior. However, when these models are trained on small or unbalanced datasets, they often suffer from overfitting and weak generalization. In addition, many previous studies did not include external features from services like Hybrid Analysis, or they used costly transformations such as converting binaries into images, which reduced the practical value of their systems. To address these problems, we propose a hybrid CNN–LSTM framework that combines API sequence analysis with external features. API calls are integer-encoded to preserve their order, while extra attributes such as malicious ratios, detection counts, and threat scores were collected through the official API of Hybrid Analysis system. A variety of optimization methods were used such as dropout, token dropout, batch normalization, L2 regularization, adaptive learning-rate scheduling with AdamW and stratified dataset splitting. These techniques increased the generalization, training stability and decreased overfitting. It was tested on 3 datasets, Dataset 1 (MalBehavD-V1 + Oliveira 3,500 samples), Dataset 2 (the same dataset with external features with Hybrid Analysis API), and Dataset 3 (a large scale dataset with 2025 85,594 balanced samples). The proposed model achieved 95.43% accuracy on Dataset 1, 97.49% on Dataset 2, and 99.52% on Dataset 3, consistently surpassing standalone CNN and LSTM baselines in accuracy and AUC. These results demonstrate that combining behavioral API sequences with lightweight external features yields a precise, scalable malware detection system suitable for practical cybersecurity deployments.