Abstract: Systems and methods generate and apply identification codes or “fingerprints” with respect to software functions contained in executable files. Utilizing such fingerprinting procedures, the function identification codes for known malicious files and/or known benign can be stored in the database. Subsequently, received files can be processed in the same manner and the function identification codes generated for the received files can be compared against the function identification codes for the known malicious files and/or known benign files in the database to determine a level of similarity between the functions of received executable files and those of known categorized executable files in the database. This can be used to determine whether a received file is malicious or benign along with a score describing the confidence in that determination.