A computer-implemented method of clustering files by a file characterization system comprising one or more computers, wherein the method comprises: receiving, by the one or more computers, a plurality of files, wherein each file in the plurality of files is in a format, and the formats of the files include formats that are different from each other; accessing data identifying, for each of the file formats, a respective set of file features to be extracted from files having that format, wherein the respective set of file features for the file format is different from the respective sets of file features for other respective file formats; for each of the files of the plurality of files: determining, by the one or more computers, a format of the file; selecting, by the one or more computers and based on the format of the file, file features associated with the format, the file features being the respective set of file features identified for the file format of the file; extracting, by the one or more computers and for each file feature of the file features, a respective feature value for the file feature from the file; generating, by the one or more computers and based on the feature values, a hash for the file, wherein files that have matching feature values for each file feature have a same hash; and storing, in an index that lists files by their respective hashes, the file using the generated hash; receiving a known malware file; submitting, as a search query to search the index, a hash generated from feature values extracted from the known malware file; identifying, in response to submitting the search query, all files that are indexed by the generated hash for the known malware file; and providing data identifying the files identified in response to submitting the search query, wherein the files identified in response to submitting the search query belong to a family of malware files that includes the known malware file. receiving, by the one or more computers, a plurality of files, wherein each file in the plurality of files is in a format, and the formats of the files include formats that are different from each other; accessing data identifying, for each of the file formats, a respective set of file features to be extracted from files having that format, wherein the respective set of file features for the file format is different from the respective sets of file features for other respective file formats; for each of the files of the plurality of files: determining, by the one or more computers, a format of the file; selecting, by the one or more computers and based on the format of the file, file features associated with the format, the file features being the respective set of file features identified for the file format of the file; extracting, by the one or more computers and for each file feature of the file features, a respective feature value for the file feature from the file; generating, by the one or more computers and based on the feature values, a hash for the file, wherein files that have matching feature values for each file feature have a same hash; and storing, in an index that lists files by their respective hashes, the file using the generated hash; determining, by the one or more computers, a format of the file; selecting, by the one or more computers and based on the format of the file, file features associated with the format, the file features being the respective set of file features identified for the file format of the file; extracting, by the one or more computers and for each file feature of the file features, a respective feature value for the file feature from the file; generating, by the one or more computers and based on the feature values, a hash for the file, wherein files that have matching feature values for each file feature have a same hash; and storing, in an index that lists files by their respective hashes, the file using the generated hash; receiving a known malware file; submitting, as a search query to search the index, a hash generated from feature values extracted from the known malware file; identifying, in response to submitting the search query, all files that are indexed by the generated hash for the known malware file; and providing data identifying the files identified in response to submitting the search query, wherein the files identified in response to submitting the search query belong to a family of malware files that includes the known malware file.