1. A computer-implemented method for detecting malicious documents based on component-object reuse, at least a portion of the method being performed by at least one computing device comprising at least one processor, the method comprising: identifying, by the at least one computing device, a plurality of malicious digital documents that contain malware; extracting, by the at least one computing device, a plurality of benign digital component objects from the plurality of malicious digital documents, wherein each benign digital component object from the plurality of benign digital component objects is: contained within at least one malicious digital document from the plurality of malicious digital documents; not known to contain malware; receiving, by the at least one computing device from a digital-document source device, an unknown digital document that is not known to be malicious or benign and that comprises: at least one benign digital component object that is benign; at least one malicious digital component object that is malicious; extracting, by the at least one computing device, the benign digital component object from the unknown digital document; determining, by the at least one computing device, that the benign digital component object extracted from the unknown digital document matches one of the plurality of benign digital component objects; determining, by the at least one computing device based at least in part on the benign digital component object extracted from the unknown digital document matching one of the plurality of benign digital component objects, that an attacker likely reused the benign digital component object extracted from the unknown digital document to create the unknown digital document; disarming, by the at least one computing device, the malicious digital component object of the unknown digital document by performing a security action on the unknown digital document based at least in part on determining that an attacker likely reused the benign digital component object extracted from the unknown digital document to create the unknown digital document.
1. A computer-implemented method for detecting malicious documents based on component-object reuse, at least a portion of the method being performed by at least one computing device comprising at least one processor, the method comprising: identifying, by the at least one computing device, a plurality of malicious digital documents that contain malware; extracting, by the at least one computing device, a plurality of benign digital component objects from the plurality of malicious digital documents, wherein each benign digital component object from the plurality of benign digital component objects is: contained within at least one malicious digital document from the plurality of malicious digital documents; not known to contain malware; receiving, by the at least one computing device from a digital-document source device, an unknown digital document that is not known to be malicious or benign and that comprises: at least one benign digital component object that is benign; at least one malicious digital component object that is malicious; extracting, by the at least one computing device, the benign digital component object from the unknown digital document; determining, by the at least one computing device, that the benign digital component object extracted from the unknown digital document matches one of the plurality of benign digital component objects; determining, by the at least one computing device based at least in part on the benign digital component object extracted from the unknown digital document matching one of the plurality of benign digital component objects, that an attacker likely reused the benign digital component object extracted from the unknown digital document to create the unknown digital document; disarming, by the at least one computing device, the malicious digital component object of the unknown digital document by performing a security action on the unknown digital document based at least in part on determining that an attacker likely reused the benign digital component object extracted from the unknown digital document to create the unknown digital document. 8. The computer-implemented method of claim 1 , wherein performing the security action on the unknown digital document comprises convicting the unknown digital document as being malicious.