1. A system, comprising: a processor configured to: receive a Portable Document Format (PDF) file that is known to include malicious content; parse the PDF file to identify a cross-reference table included in the PDF file; and generate a signature associated with the PDF file from the identified cross-reference table; and a memory coupled to the processor and configured to provide the processor with instructions.
1. A system, comprising: a processor configured to: receive a Portable Document Format (PDF) file that is known to include malicious content; parse the PDF file to identify a cross-reference table included in the PDF file; and generate a signature associated with the PDF file from the identified cross-reference table; and a memory coupled to the processor and configured to provide the processor with instructions. 5. The system of claim 1 , wherein generating the signature associated with the PDF file is based at least in part on content included in the identified cross-reference table.