Abstract: A system, method and computer program product for identifying new variants of certain data objects, for example, malware-carrying files, including (a) dividing a file into a plurality of N pieces; (b) for each of the N pieces, calculating an average value of bytes in that piece; (c) generating a furl of length N elements, wherein each element of the furl has a value that represents the average value of its corresponding file piece; (d) calculating the distance between the furl and a second furl that corresponds to the file known to contain malware; and (e) based on the distance, determining whether the file is likely to carry a malicious object. The malicious object is, for example, a trojan, a virus, a rootkit or a worm. The second furl can be selected by comparing file size, and taking into account whether the file is packed. The furl elements are bytes, words, half words, etc. The distance is calculated based on, e.g.