1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to: identify a particular sample comprising code; generate a structure to represent the particular sample, wherein the structure represents a plurality of functions included in the particular sample; identify, in each of the functions, respective control flow fragments of the function; identify a subset of the fragments of the plurality of functions as features of the particular sample based on each of the subset of fragments comprising an instance of a respective one of a predefined set of fragment types; generate a feature set for the particular sample from the identified features; and classify the particular sample based on a determination that feature sets of a cluster of other samples overlap with the feature set of the particular sample.