A method for cluster classifying portable executable, PE, virus files, comprising: A: statically analyzing binary data of virus files which need to be classified, so as to obtain portable executable structure data of the virus files; B: comparing the portable executable structure data of the virus files which need to be classified, and classifying virus files which have the portable executable structure data meeting a specified similarity condition into a same category; and C: performing a secondary cluster classification on the virus files in each of the categories classified in the step B, wherein for the virus files in a same category classified in the step B, the secondary cluster classification comprises: C1: statically analyzing binary data of each of the virus files to obtain section data of each virus file; C2: performing block-division on the section data of each virus file with a same block division mode, and calculating a hash value of each section data block; and C3: comparing the hash values of the section data blocks for the virus files, and classifying virus files of which the hash values of the section data blocks have a specified hash similarity into a secondary category, wherein the similarity is represented by the number of the data blocks same for the two compared virus files, or by the number of the consecutive data blocks same for the two compared virus files. A: statically analyzing binary data of virus files which need to be classified, so as to obtain portable executable structure data of the virus files; B: comparing the portable executable structure data of the virus files which need to be classified, and classifying virus files which have the portable executable structure data meeting a specified similarity condition into a same category; and C: performing a secondary cluster classification on the virus files in each of the categories classified in the step B, wherein for the virus files in a same category classified in the step B, the secondary cluster classification comprises: C1: statically analyzing binary data of each of the virus files to obtain section data of each virus file; C2: performing block-division on the section data of each virus file with a same block division mode, and calculating a hash value of each section data block; and C3: comparing the hash values of the section data blocks for the virus files, and classifying virus files of which the hash values of the section data blocks have a specified hash similarity into a secondary category, wherein the similarity is represented by the number of the data blocks same for the two compared virus files, or by the number of the consecutive data blocks same for the two compared virus files. C1: statically analyzing binary data of each of the virus files to obtain section data of each virus file; C2: performing block-division on the section data of each virus file with a same block division mode, and calculating a hash value of each section data block; and C3: comparing the hash values of the section data blocks for the virus files, and classifying virus files of which the hash values of the section data blocks have a specified hash similarity into a secondary category, wherein the similarity is represented by the number of the data blocks same for the two compared virus files, or by the number of the consecutive data blocks same for the two compared virus files.