Refined malware signatures