1. A method comprising: receiving first image data, wherein said first image data comprises a first icon; performing a discrete cosine transformation (DCT) on at least a portion of the first image data to create a DCT matrix; determining a plurality of features from coefficients of a plurality of areas of the DCT matrix, wherein the features comprise a sign of a coefficient, a magnitude of the coefficient, a neighbor variance of the coefficient, and a differential between a magnitude of the coefficient and a reference average magnitude; encoding the plurality of features of the coefficients into a first hash string; and determining a weighted distance between the first hash string and a second hash string associated with a second icon for use in determining whether the first icon is a suspicious icon that is potentially associated with malware.