get_filename and get_malware one gets the actual filename while the other the actual malware object.
We are actually getting the filename of the malware which can be open and then used to calculate the compression distance metric.