1. A method, comprising: monitoring a system to detect an unknown file; disassembling the unknown file to obtain one or more disassembled functions, each of the one or more disassembled functions comprising a block of assembly code that is configured to be referenced by one or more instructions; determining, via a processing unit, a function characteristic value for each of the one or more disassembled functions; determining a plurality of weight values for each one of the one or more disassembled functions based on at least the function characteristic value(s), each of the weight values for a given disassembled function indicating a reliability that the given disassembled function is an identifier of a different malware family in a plurality of known malware families; characterizing the unknown file as belonging to a particular one of the plurality of known malware families based on at least the weight values; based on the characterization of the unknown file as belonging to the particular one of the known malware families, automatically generating a signature for the unknown file; and providing access to the signature to an antivirus program for use in detecting malware.