20. A system, comprising: a processor configured to: determine that a PDF file does not include script stream data, wherein the PDF file is known to include malicious content; determine an identified cross-reference table from a plurality of cross-reference tables within the PDF file, wherein the identified cross-reference table is identified from the plurality of cross-reference tables based at least in part on a position of the identified cross-reference table relative to respective positions associated with one or more cross-reference tables other than the identified cross-reference table from the plurality of cross-reference tables; and automatically generate a signature for the PDF file from the identified cross-reference table; and a memory coupled to the processor and configured to provide the processor with instructions.
20. A system, comprising: a processor configured to: determine that a PDF file does not include script stream data, wherein the PDF file is known to include malicious content; determine an identified cross-reference table from a plurality of cross-reference tables within the PDF file, wherein the identified cross-reference table is identified from the plurality of cross-reference tables based at least in part on a position of the identified cross-reference table relative to respective positions associated with one or more cross-reference tables other than the identified cross-reference table from the plurality of cross-reference tables; and automatically generate a signature for the PDF file from the identified cross-reference table; and a memory coupled to the processor and configured to provide the processor with instructions. 24. The system of claim 20 , wherein the processor is further configured to determine a startxref object and two continuous reference objects associated with a predetermined offset range within the identified cross-reference table.