11. A method, comprising: receiving a Portable Document Format (PDF) file that is known to include malicious content; parsing, using a processor, the PDF file to identify a cross-reference table included in the PDF file; and generating a signature associated with the PDF file from the identified cross-reference table.
11. A method, comprising: receiving a Portable Document Format (PDF) file that is known to include malicious content; parsing, using a processor, the PDF file to identify a cross-reference table included in the PDF file; and generating a signature associated with the PDF file from the identified cross-reference table. 13. The method of claim 11 , wherein the identified cross-reference table is identified based at least in part on a position associated with the identified cross-reference table relative to a position associated with at least one other cross-reference table included in the PDF file.