20. A system, comprising: a processor configured to: determine that a PDF file does not include script stream data, wherein the PDF file is known to include malicious content; determine an identified cross-reference table from a plurality of cross-reference tables within the PDF file, wherein the identified cross-reference table is identified from the plurality of cross-reference tables based at least in part on a position of the identified cross-reference table relative to respective positions associated with one or more cross-reference tables other than the identified cross-reference table from the plurality of cross-reference tables; and automatically generate a signature for the PDF file from the identified cross-reference table; and a memory coupled to the processor and configured to provide the processor with instructions.
20. A system, comprising: a processor configured to: determine that a PDF file does not include script stream data, wherein the PDF file is known to include malicious content; determine an identified cross-reference table from a plurality of cross-reference tables within the PDF file, wherein the identified cross-reference table is identified from the plurality of cross-reference tables based at least in part on a position of the identified cross-reference table relative to respective positions associated with one or more cross-reference tables other than the identified cross-reference table from the plurality of cross-reference tables; and automatically generate a signature for the PDF file from the identified cross-reference table; and a memory coupled to the processor and configured to provide the processor with instructions. 26. The system of claim 20 , wherein the processor is further configured to determine a startxref object and two continuous reference objects associated with a predetermined offset range within the identified cross-reference table and to automatically generate the signature associated with the PDF file based at least in part on the startxref object and the two continuous reference objects associated with the predetermined offset range within the identified cross-reference table.