Patent Document ID: 8695096
Application ID: 13115036

Base Claim:
1. A system, comprising: a processor configured to: parse a PDF file to extract script stream data embedded in the PDF file, wherein the PDF file is known to include malicious content; and determine whether to generate a signature associated with the PDF file based at least in part on at least a portion of the extracted script stream data: in the event that the signature associated with the PDF file is determined to be based at least in part on the at least portion of the extracted script stream data, automatically generate the signature associated with the PDF file based at least in part on the at least portion of the extracted script stream data, wherein the signature is configured to be matched against a potentially malicious PDF file; and in the event that the signature associated with the PDF file is determined not to be based at least in part on the at least portion of the extracted script stream data, automatically generate the signature associated with the PDF file from an identified cross-reference table from a plurality of cross-reference tables within the PDF file, wherein the identified cross-reference table is identified from the plurality of cross-reference tables based at least in part on a position of the identified cross-reference table relative to respective positions associated with one or more cross-reference tables other than the identified cross-reference table from the plurality of cross-reference tables; and a memory coupled to the processor and configured to provide the processor with instructions.

---

Claim 9:
9. The system of claim 1 , wherein the processor is configured to automatically generate the signature for the PDF file based at least in part on selecting a plurality of patterns exceeding a suspicious threshold to automatically generate the signature using the plurality of patterns, wherein each of the plurality of patterns is based on different threshold numeric values.