receiving a target binary file;

reducing the target binary file to its architecture-agnostic functions that are called at runtime, wherein the architecture-agnostic functions are not dependent on a processor architecture for which a source code of the target binary file was compiled;

forming the architecture-agnostic functions of the target binary file into an input string;

calculating a target digest of the input string;

identifying a cluster comprising digests of malicious binary files that are similar to the target digest; and

in response to identifying the cluster, detecting the target binary file to be malicious and of a same malware family as the malicious binary files.