18. The method of claim 10 , wherein automatically generating the signature for the PDF file includes selecting a plurality of patterns exceeding a suspicious threshold to automatically generate the signature using the plurality of patterns, wherein each of the plurality of patterns is based on different threshold numeric values.
10. A method, comprising: parsing a PDF file to extract script stream data embedded in the PDF file, wherein the PDF file is known to include malicious content; and determining whether to generate a signature associated with the PDF file based at least in part on at least a portion of the extracted script stream data: in the event that the signature associated with the PDF file is determined to be based at least in part on the at least portion of the extracted script stream data, automatically generating the signature associated with the PDF file based at least in part on the at least portion of the extracted script stream data, wherein the signature is configured to be matched against a potentially malicious PDF; and in the event that the signature associated with the PDF file is determined not to be based at least in part on the at least portion of the extracted script stream data, automatically generating the signature associated with the PDF file from an identified cross-reference table from a plurality of cross-reference tables within the PDF file, wherein the identified cross-reference table is identified from the plurality of cross-reference tables based at least in part on a position of the identified cross-reference table relative to respective positions associated with one or more cross-reference tables other than the identified cross-reference table from the plurality of cross-reference tables.