MalClassify.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "import os\n",
    "import sklearn.feature_extraction\n",
    "import numpy as np\n",
    "import pandas as pd\n",
    "import matplotlib.pyplot as plt "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "def load_json(filelist):\n",
    "    flist    = []\n",
    "    fnlist   = []\n",
    "    for filename in filelist:\n",
    "        with open(filename) as f:\n",
    "            flist.append(eval(f.read()))         \n",
    "            f = str.split(filename, '/')\n",
    "            fnlist.append(f[2])\n",
    "    return flist, fnlist "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [],
   "source": [
    "filelist = [os.path.join('data/bad-json', child) for child in os.listdir('data/bad-json')]\n",
    "badfeatures, fnlist = load_json(filelist)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>check_sum</th>\n",
       "      <th>compile_date</th>\n",
       "      <th>datadir_IMAGE_DIRECTORY_ENTRY_BASERELOC_size</th>\n",
       "      <th>datadir_IMAGE_DIRECTORY_ENTRY_EXPORT_size</th>\n",
       "      <th>datadir_IMAGE_DIRECTORY_ENTRY_IAT_size</th>\n",
       "      <th>datadir_IMAGE_DIRECTORY_ENTRY_IMPORT_size</th>\n",
       "      <th>datadir_IMAGE_DIRECTORY_ENTRY_RESOURCE_size</th>\n",
       "      <th>debug_size</th>\n",
       "      <th>export_size</th>\n",
       "      <th>generated_check_sum</th>\n",
       "      <th>...</th>\n",
       "      <th>size_code</th>\n",
       "      <th>size_image</th>\n",
       "      <th>size_initdata</th>\n",
       "      <th>size_uninit</th>\n",
       "      <th>std_section_names</th>\n",
       "      <th>total_size_pe</th>\n",
       "      <th>virtual_address</th>\n",
       "      <th>virtual_size</th>\n",
       "      <th>virtual_size_2</th>\n",
       "      <th>labels</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>175316</td>\n",
       "      <td>1329360236</td>\n",
       "      <td>2152</td>\n",
       "      <td>0</td>\n",
       "      <td>312</td>\n",
       "      <td>60</td>\n",
       "      <td>58056</td>\n",
       "      <td>28</td>\n",
       "      <td>0</td>\n",
       "      <td>310358</td>\n",
       "      <td>...</td>\n",
       "      <td>36352</td>\n",
       "      <td>126976</td>\n",
       "      <td>77824</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>294366</td>\n",
       "      <td>4096</td>\n",
       "      <td>36182</td>\n",
       "      <td>6752</td>\n",
       "      <td>bad</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>0</td>\n",
       "      <td>1134194116</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>692</td>\n",
       "      <td>180</td>\n",
       "      <td>36864</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>373180</td>\n",
       "      <td>...</td>\n",
       "      <td>25600</td>\n",
       "      <td>618496</td>\n",
       "      <td>278528</td>\n",
       "      <td>8192</td>\n",
       "      <td>0</td>\n",
       "      <td>308152</td>\n",
       "      <td>4096</td>\n",
       "      <td>25270</td>\n",
       "      <td>4554</td>\n",
       "      <td>bad</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>339801</td>\n",
       "      <td>1512937434</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>276</td>\n",
       "      <td>40</td>\n",
       "      <td>2560</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>339801</td>\n",
       "      <td>...</td>\n",
       "      <td>262144</td>\n",
       "      <td>274432</td>\n",
       "      <td>8192</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>274432</td>\n",
       "      <td>4096</td>\n",
       "      <td>260396</td>\n",
       "      <td>2588</td>\n",
       "      <td>bad</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>0</td>\n",
       "      <td>1279145053</td>\n",
       "      <td>0</td>\n",
       "      <td>654311424</td>\n",
       "      <td>328</td>\n",
       "      <td>120</td>\n",
       "      <td>1944</td>\n",
       "      <td>0</td>\n",
       "      <td>654311424</td>\n",
       "      <td>233979</td>\n",
       "      <td>...</td>\n",
       "      <td>24576</td>\n",
       "      <td>206848</td>\n",
       "      <td>176128</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>201216</td>\n",
       "      <td>4096</td>\n",
       "      <td>19176</td>\n",
       "      <td>170388</td>\n",
       "      <td>bad</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>145303</td>\n",
       "      <td>1314010393</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>564</td>\n",
       "      <td>40</td>\n",
       "      <td>10312</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>195686</td>\n",
       "      <td>...</td>\n",
       "      <td>102400</td>\n",
       "      <td>135168</td>\n",
       "      <td>28672</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>135168</td>\n",
       "      <td>4096</td>\n",
       "      <td>100888</td>\n",
       "      <td>1540</td>\n",
       "      <td>bad</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 968 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "   check_sum  compile_date  datadir_IMAGE_DIRECTORY_ENTRY_BASERELOC_size  \\\n",
       "0     175316    1329360236                                          2152   \n",
       "1          0    1134194116                                             0   \n",
       "2     339801    1512937434                                             0   \n",
       "3          0    1279145053                                             0   \n",
       "4     145303    1314010393                                             0   \n",
       "\n",
       "   datadir_IMAGE_DIRECTORY_ENTRY_EXPORT_size  \\\n",
       "0                                          0   \n",
       "1                                          0   \n",
       "2                                          0   \n",
       "3                                  654311424   \n",
       "4                                          0   \n",
       "\n",
       "   datadir_IMAGE_DIRECTORY_ENTRY_IAT_size  \\\n",
       "0                                     312   \n",
       "1                                     692   \n",
       "2                                     276   \n",
       "3                                     328   \n",
       "4                                     564   \n",
       "\n",
       "   datadir_IMAGE_DIRECTORY_ENTRY_IMPORT_size  \\\n",
       "0                                         60   \n",
       "1                                        180   \n",
       "2                                         40   \n",
       "3                                        120   \n",
       "4                                         40   \n",
       "\n",
       "   datadir_IMAGE_DIRECTORY_ENTRY_RESOURCE_size  debug_size  export_size  \\\n",
       "0                                        58056          28            0   \n",
       "1                                        36864           0            0   \n",
       "2                                         2560           0            0   \n",
       "3                                         1944           0    654311424   \n",
       "4                                        10312           0            0   \n",
       "\n",
       "   generated_check_sum   ...    size_code  size_image  size_initdata  \\\n",
       "0               310358   ...        36352      126976          77824   \n",
       "1               373180   ...        25600      618496         278528   \n",
       "2               339801   ...       262144      274432           8192   \n",
       "3               233979   ...        24576      206848         176128   \n",
       "4               195686   ...       102400      135168          28672   \n",
       "\n",
       "   size_uninit  std_section_names  total_size_pe  virtual_address  \\\n",
       "0            0                  0         294366             4096   \n",
       "1         8192                  0         308152             4096   \n",
       "2            0                  1         274432             4096   \n",
       "3            0                  0         201216             4096   \n",
       "4            0                  1         135168             4096   \n",
       "\n",
       "   virtual_size  virtual_size_2  labels  \n",
       "0         36182            6752     bad  \n",
       "1         25270            4554     bad  \n",
       "2        260396            2588     bad  \n",
       "3         19176          170388     bad  \n",
       "4        100888            1540     bad  \n",
       "\n",
       "[5 rows x 968 columns]"
      ]
     },
     "execution_count": 30,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_bad  = pd.DataFrame.from_records(badfeatures)\n",
    "df_bad.replace(np.nan, 0, inplace=True)\n",
    "df_bad['labels'] = 'bad'\n",
    "df_bad.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [],
   "source": [
    "no_label = list(df_bad.columns.values)\n",
    "no_label.remove('labels')\n",
    "X = df_bad.as_matrix(no_label)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "image/png": "iVBORw0KGgoAAAANSUhEUgAAAYUAAAERCAYAAACU1LsdAAAABHNCSVQICAgIfAhkiAAAAAlwSFlz\nAAALEgAACxIB0t1+/AAAIABJREFUeJzt3Xl8XHW9//HXJ5OkTdN0I2lT2oYWKAl7W0rLplR20Esr\n4v2xo5d7KwrIIiio1/V6QVFUBEE2FS8PFRUqaLGAFChFlm503+ieljTdl6TN9vn9cU7SaTpJJm0m\nM5N5Px+PecyZc75z5pPTaT455/s9n6+5OyIiIgBZyQ5ARERSh5KCiIg0UVIQEZEmSgoiItJESUFE\nRJooKYiISJO0TApm9pSZbTSz+XG0vcPMFprZXDP7p5kdEbXtejNbFj6uT2zUIiKpz9LxPgUz+ziw\nC3ja3U9oo+0ngHfdvcrMvgiMc/f/Z2b9gBnAaMCBmcAp7r41weGLiKSstDxTcPc3gS3R68zsKDP7\nh5nNNLNpZlYWtp3q7lVhs3eAweHyhcAr7r4lTASvABd10o8gIpKSspMdQAd6DLjR3ZeZ2Vjgl8A5\nzdrcALwULg8C1kZtWxeuExHJWF0iKZhZT+AM4E9m1ri6W7M21xBcKjq7c6MTEUkfXSIpEFwG2+bu\nI2JtNLPzgG8AZ7v73nB1OTAuqtlg4PUExigikvLSsk+hOXffAaw0s88CWODkcHkk8CvgUnffGPW2\nKcAFZtbXzPoCF4TrREQyVlomBTP7PfAvoNTM1pnZDcDVwA1m9gGwABgfNr8f6ElwaWmOmb0A4O5b\ngO8D74eP74XrREQyVloOSRURkcRIyzMFERFJjLTraC4sLPShQ4cmOwwRkbQyc+bMTe5e1Fa7tEsK\nQ4cOZcaMGckOQ0QkrZjZ6nja6fKRiIg0UVIQEZEmSgoiItJESUFERJooKYiISJO0G310MCbNLuf+\nKUtYv62aw/vkcdeFpUwYqYKoIiLNJexMwcy6m9l7ZvaBmS0ws+/GaGNm9qCZLQ9nRhvV0XFMml3O\nPc/No3xbNQ6Ub6vmnufmMWl2eUd/lIhI2kvk5aO9wDnufjIwArjIzE5r1uZiYHj4mAg80tFB3D9l\nCdW19futq66t5/4pSzr6o0RE0l7CkoIHdoUvc8JH80JL4wmm1HR3fwfoY2YDOzKO9duq27VeRCST\nJbSj2cwiZjYH2Egw9eW7zZrENfuZmU00sxlmNqOysrJdMRzeJ69d60VEMllCk4K714cT3wwGxpjZ\nCQe5n8fcfbS7jy4qarN0x37uurCUvJzIfuvyciLcdWHpwYQiItKldcqQVHffBkwFLmq2qRwYEvV6\ncLiuw0wYOYh7LzuRQeGZQW4ki3svO1Gjj0REYkjk6KMiM+sTLucB5wOLmzV7AbguHIV0GrDd3Td0\ndCwTRg5i+t3ncOWYEvJyI4wfcXhHf4SISJeQyDOFgcBUM5tLMLPZK+7+NzO70cxuDNtMBlYAy4HH\ngS8lMB7KigvYXl1LxY69bTcWEclACbt5zd3nAiNjrH80atmBmxIVQ3OlxQUALP5oB8W9u3fWx4qI\npI2MKnNRFiaFJR/tTHIkIiKpKaOSQp8euRT36q6kICLSgoxKChBcQlqspCAiElPGJYWy4gKWV+6i\nrr4h2aGIiKScjEsKpcUF1NQ1sGrz7mSHIiKScjIyKQAs2qBLSCIizWVcUji6f08iWabOZhGRGDIu\nKXTLjjCsMF+dzSIiMWRcUoDgEtKSih3JDkNEJOVkZFIoG1DA2i3V7Npbl+xQRERSSkYmhcbO5qUV\nuoQkIhItI5NCWXEvQOUuRESay8ikMLhvHj1yI0oKIiLNZGRSyMoyjhlQwOKP1NksIhItI5MCwLED\nC1jy0U6C6t0iIgIZnBRKBxSwtaqWyp2acEdEpFHmJoWws1k3sYmI7JOxSUET7oiIHChjk0Lf/Fz6\nF3TTmYKISJSMTQrQOOGORiCJiDTK6KRQVlzAso2acEdEpFFGJ4XS4l7hhDtVyQ5FRCQlZHRSUGez\niMj+MjopHN2/J1kGS9SvICICJDApmNkQM5tqZgvNbIGZ3RqjzTgz225mc8LHtxIVTyzdcyIM1YQ7\nIiJNshO47zrgK+4+y8wKgJlm9oq7L2zWbpq7fyqBcbSqrLiABet1piAiAgk8U3D3De4+K1zeCSwC\nBiXq8w5W6YBerNlSRVWNJtwREemUPgUzGwqMBN6NsfkMM5trZi+Z2fEtvH+imc0wsxmVlZUdGltp\ncQHusLRiV4fuV0QkHSU8KZhZT+AvwG3u3vw6zSygxN1PAn4BTIq1D3d/zN1Hu/vooqKiDo3v2IGN\nI5B0CUlEJKFJwcxyCBLCM+7+XPPt7r7D3XeFy5OBHDMrTGRMzQ3p24MeuRF1NouIkNjRRwY8CSxy\n9wdaaFMctsPMxoTxbE5UTLFkZRnDBxToXgURERI7+uhM4FpgnpnNCdd9HSgBcPdHgcuBL5pZHVAN\nXOFJmPWmbEABry6q6OyPFRFJOQlLCu7+FmBttHkIeChRMcSrtLiAP85YS+XOvRQVdEt2OCIiSZPR\ndzQ3aix3oYqpIpLplBQIzhRANZBERJQUgMN6dqOwpybcERFRUgiVFWsEkoiIkkKotLiApRU7qW/o\n9MFPIiIpQ0khVFpcwN66BlZv3p3sUEREkkZJIaQJd0RElBSaDO9fgBnqbBaRjKakEMrLjTDssHyd\nKYhIRlNSiFJaXMCSCiUFEclcSgpRSosLWLV5N9U19ckORUQkKZQUopSFE+4s26izBRHJTEoKUUqL\newHqbBaRzKWkEKWkXw+652Sps1lEMpaSQpRIlnHMgAJVSxWRjKWk0EypZmETkQympNBMaXEBm3bV\nsGnX3mSHIiLS6ZQUmikLO5t1tiAimUhJoZnSplnYlBREJPMoKTRTVNCNw/JzWaLOZhHJQEoKMZRq\nwh0RyVBKCjEEE+7sokET7ohIhlFSiOHY4l5U19azZktVskMREelUSgoxqLNZRDJVwpKCmQ0xs6lm\nttDMFpjZrTHamJk9aGbLzWyumY1KVDztccyAYMId9SuISKbJTuC+64CvuPssMysAZprZK+6+MKrN\nxcDw8DEWeCR8Tqq83AhH9OvBkgqNQBKRzJKwMwV33+Dus8LlncAiYFCzZuOBpz3wDtDHzAYmKqb2\nKC0u0OUjEck4ndKnYGZDgZHAu802DQLWRr1ex4GJAzObaGYzzGxGZWVlosLcT2lxL1Zt2s2eWk24\nIyKZI+FJwcx6An8BbnP3g7oe4+6Puftodx9dVFTUsQG2oKy4gAaHZRW7OuXzRERSQUKTgpnlECSE\nZ9z9uRhNyoEhUa8Hh+uSbt8IJPUriEjmSOToIwOeBBa5+wMtNHsBuC4chXQasN3dNyQqpvYYelg+\n3bI14Y6IZJZEjj46E7gWmGdmc8J1XwdKANz9UWAycAmwHKgCPp/AeNolkmUMH9CTJRVKCiKSORKW\nFNz9LcDaaOPATYmK4VCVDujFm8s6p2NbRCQV6I7mVpQVF1C5cy9bdtckOxQRkU6hpNAKdTaLSKZR\nUmhF2cAgKaizWUQyhZJCK4p6dqNffq6SgohkjLg7ms0sAgyIfo+7r0lEUKnCzCgdoHIXIpI54koK\nZnYL8G2gAmgIVztwUoLiShmlxQU8O2MtDQ1OVlarg6lERNJevGcKtwKl7r45kcGkorLiAqpq6lm3\ntZqSw3okOxwRkYSKt09hLbA9kYGkKo1AEpFMEu+ZwgrgdTP7O7C3cWUr5Su6jGMG7BuBdMHxxUmO\nRkQkseJNCmvCR274yBj53bIp6deDxSp3ISIZIK6k4O7fhaYy2Lh7RtWTLi0uYPEGXT4Ska4vrj4F\nMzvBzGYDC4AFZjbTzI5PbGipo6y4gFWbqzThjoh0efF2ND8G3OHuR7j7EcBXgMcTF1ZqKS0uoL7B\nWb4xo06QRCQDxZsU8t19auMLd38dyE9IRCmorFjlLkQkM8Q9+sjM/hv4Xfj6GoIRSRlh6GH55GZn\naW4FEeny4j1T+A+gCHgufBSF6zJCdiSLo4t6qtyFiHR58Y4+2gp8OcGxpLSygQVMX74p2WGIiCRU\nq0nBzH7m7reZ2YsEtY724+6XJiyyFFNWXMBzs8rZVlVDnx4ZdauGiGSQts4UGvsQfpzoQFJdaXEv\nABZ/tJPTjjwsydGIiCRGq30K7j4zXBzh7m9EP4ARiQ8vdWgEkohkgng7mq+Pse5zHRhHynt7+SbM\n4NsvLODM+15j0uzyZIckItLh2upTuBK4CjjSzF6I2lQAbElkYKlk0uxyvv78fDzsVSnfVs09z80D\nYMLIQUmMTESkY7XVp/A2sAEoBH4StX4nMDdRQaWa+6csobpZiYvq2nrun7JESUFEupRWk4K7rzaz\ndcCesB8hI63fVt2u9SIi6arNPgV3rwcazKx3e3ZsZk+Z2UYzm9/C9nFmtt3M5oSPb7Vn/53p8D55\n7VovIpKu4i1zsQuYZ2avALsbV7p7aze0/QZ4CHi6lTbT3P1TccaQNHddWMo9z8074BLSWcM1NFVE\nupZ4k0JjeYu4ufubZja0vQGlosZ+g/unLGH9tmoG9u5OQV4Of5qxjk+UDuCiEzQjm4h0DeZ+wI3K\nsRua5QLHhC+XuHttHO8ZCvzN3U+IsW0cQaJZB5QDd7r7ghb2MxGYCFBSUnLK6tWr44o5kapq6rjq\n8XdZuGEHv/38GE4/SmcNIpK6zGymu49uq128k+yMA5YBDwO/BJaa2ccPKUKYBZS4+0nAL4BJLTV0\n98fcfbS7jy4qKjrEj+0YPXKz+fXnTqWkXw/+6+kZzC/fnuyQREQOWbw3r/0EuMDdz3b3jwMXAj89\nlA929x2N03q6+2Qgx8wKD2Wfna1vfi6/u2EMvfNyuP6p91i5aXfbbxIRSWHxJoUcd1/S+MLdlwI5\nh/LBZlZsZhYujwlj2Xwo+0yGgb3zePqGMThw7ZPvUrFjT7JDEhE5aPEmhRlm9kQ4jHScmT0OzGjt\nDWb2e+BfQKmZrTOzG8zsRjO7MWxyOTDfzD4AHgSu8Hg7OFLMUUU9+c3nT2Xr7hque/I9tle12d0i\nIpKS4upoNrNuwE3AWeGqacDD7l6TwNhiGj16tM+Y0Wo+Sprpyzfx+V+/z4mDe/N/N4wlLzeS7JBE\nRIAO7mgGbnT3B9z9svDxU+CLhxZi13Pm0YX8/IoRzF6zlS8+M5Pa+oZkhyQi0i6qktrBLj5xID/4\n9Im8vqSSu/70AQ0NaXlFTEQyVLxVUoc1q5LaiwyqktpeV44pYcvuGu6fsoS++bl861PHEfapi4ik\nNFVJTZAvjTuKzbtqeGr6Sg7Lz+Xmc4YnOyQRkTa1WSUVWG1m5wHV7t5gZscAZcC8zggwXZkZ3/zk\nsWytquHHLy+lb34uV489ItlhiYi0Kt4+hTeB7mY2CHgZuJag4J20IivL+NHlJ3FOWX++OWk+k+dt\nSHZIIiKtindI6ix3H2VmtwB57v4jM5vj7p0+T3MqD0ltSXVNPdc++S6z12ylb34um3fVcHifPO66\nsFST9IhIp+joIalmZqcDVwN/D9dpEH6c8nIjXDZqEA0Om3bV4Oyb0lNzPYtIKok3KdwG3AM87+4L\nzOxIYGriwup6Hp76Ic3PyRqn9BQRSRVxzacQTsX5RtTrFUBrE+xIM5rSU0TSQVv3KfzM3W8zsxfh\ngD90cfdLExZZF3N4nzzKYySA7jkRqmvqVRJDRFJCW2cKvwuff5zoQLq6WFN6ZmcZ1bX1fOaRt/nV\ntacwpF+PJEYoItL2fQozw+c3zKwoXK7sjMC6muZTejaOPuqdl8OX/zCbSx96i4evGsUZR6fVlBIi\n0sW0OSTVzL4D3EzQKW1AHfALd/9ewqOLIR2HpLZl5abdTHx6Bh9W7uLrlxzLDWcNU1kMEelQHTIk\n1czuAM4ETnX3fu7eFxgLnGlmt3dMqDKsMJ/nbzqT848bwP/8fRG3/3EO1TX1bb9RRKSDtTUk9Vrg\nSndf2bgiHHl0DXBdIgPLND27ZfPI1adw5wXH8NcP1nP5o2+zbmtVssMSkQzTVlLIcfdNzVeG/QqH\nNB2nHCgry7j5nOE8ef1o1myu4tKHpvP2hwccfhGRhGkrKbQ2s1qnz7qWKc4pG8Bfbz6Tfvm5XPvk\nezz51krSdKZSEUkzbSWFk81sR4zHTuDEzggwUx1Z1JNJN53JuWX9+f7fFnLHsx+wp1b9DCKSWG0N\nSdUdVUnUs1s2j15zCg9NXc5PX13Kso07+cyowTwxbeV+w1pVVE9EOkpcVVJTSVcckhqPfy6q4Ev/\nN5O99fv/e+XlRLj3shOVGESkVR1dJVWS7NxjB9C7R+4B61VUT0Q6kpJCGqncuTfmehXVE5GOoqSQ\nRg7vkxdzfb/8A88gREQORsKSgpk9ZWYbzWx+C9vNzB40s+VmNtfMRiUqlq7irgtLycvZv+/fgM27\na/jeiwvZW6fRSSJyaBJ5pvAb4KJWtl8MDA8fE4FHEhhLlzBh5CDuvexEBvXJw4BBffL40eUncf3p\nR/DU9JVMePhtllXsTHaYIpLGEjr6yMyGAn9z9xNibPsV8Lq7/z58vQQY5+6tzm6fqaOP2vLa4gru\n+tNcdu2t45ufOo5rxpaoqJ6INEmH0UeDgLVRr9eF6w5gZhPNbIaZzaisVOXuWM4pG8BLt32MsUce\nxn9Pms9/PT2TLbt107mItE9adDS7+2PuPtrdRxcVFSU7nJTVv6A7v/ncqfz3p47jzaWVXPSzN3lr\nmWoniUj8kpkUyoEhUa8Hh+vkEGRlGTecNYznbzqDXnk5XPPku9w7eRE1dQ3JDk1E0kAyk8ILwHXh\nKKTTgO1t9SdI/I4/vDcv3nwW15xWwq/eXMFlj0znw8pdyQ5LRFJcwjqazez3wDigEKgAvk1Ybtvd\nH7WgF/QhghFKVcDn3b3NHmR1NLffyws+4mt/mcue2ga+/W/H0S07ix+/vFT1k0QySLwdzap9lCEq\nduzhjmfnMH35ZrIMGqL+2VU/SaTrS4fRR9KJBvTqzu/+Yyy9umfvlxBA9ZNEZB8lhQySlWXs3FMX\nc5vqJ4kIKClkHNVPEpHWKClkmNbqJ93+xzls1Q1vIhmt1ZnXpOtp7Ey+f8qSptFHt583nDVbq/nl\n1OW8ubSS744/nk+eOFBlMkQykEYfSZNFG3bw1T/PZV75di44bgD/M+EE+vfqnuywRKQDaPSRtNux\nA3vx/JfO4O6Ly3hjaSXnPfAGz85YS7r94SAiB09JQfaTHcnixrOP4qVbP0ZZcS+++ue5XPfUe6zd\nUpXs0ESkEygpSExHFvXkDxNP4/vjj2fW6q1c+LM3+e3bq2hofpODiHQp6lOQNq3bWsXXn5/Pm0sr\nGX1EX354+UnMW7d9v85qlcoQSW0qcyEdyt35y6xyvvfiAnbvrcPMqIs6a1CpDJHUpo5m6VBmxuWn\nDObVr5xNTnbWfgkBVCpDpKtQUpB26V/Qnb21sedmUKkMkfSnpCDt1lKpjMN6qlSGSLpTUpB2a6lU\nxqZdNXzj+Xns2FObnMBE5JCpzIW0W6xSGbeeezRLKnbx6+kr+eeijXx/wgmcf9yAJEcqIu2l0UfS\noeas3cbX/jyXJRU7+eRJA/nOvx1PUUG3ZIclkvE0+kiSYsSQPrx4y1l85fxjeGVBBec98AZ/UqkM\nkbShpCAdLjc7i1vOHc7kW89ieP+e3PXnuVz75Hus2axSGSKpTklBEubo/gU8+4XT+f7445m9JiiV\n8cS0FdSrVIZIylKfgnSK9duq+eak+by2eCMnD+7NfZ85iSUf7VSpDJFOojIXknLcnRfnbuC7Lyxg\ny+4aIlkqlSHSWdTRLCnHzLj05MN55Y6z6Z4TUakMkRSkpCCdrl9+Lntq62NuU6kMkeRKaFIws4vM\nbImZLTezu2NsH2dm281sTvj4ViLjkdTRUqmMvNwIFTv2dHI0ItIoYUnBzCLAw8DFwHHAlWZ2XIym\n09x9RPj4XqLikdQSq1RGJMvYU1vPuPtf54GXl7Brb12SohPJXIk8UxgDLHf3Fe5eA/wBGJ/Az5M0\nMmHkIO697EQG9cnDgEF98vjJZ09m6p3jOOfY/jz42nLG3T+V372zmtr62FVZRaTjJWz0kZldDlzk\n7v8Zvr4WGOvuN0e1GQc8B6wDyoE73X1BjH1NBCYClJSUnLJ69eqExCypY/aardw7eTHvrdrCkUX5\nfO2iMi44bgBmluzQRNJSuow+mgWUuPtJwC+ASbEauftj7j7a3UcXFRV1aoCSHCNL+vLHL5zG49eN\nxoAv/G4m//6rfzFrzdZkhybSpSUyKZQDQ6JeDw7XNXH3He6+K1yeDOSYWWECY5I0Ymacf9wAptz2\ncX7w6RNYuamKy375Njc9M4tVm3YnOzyRLimRpbPfB4ab2TCCZHAFcFV0AzMrBirc3c1sDEGS2pzA\nmCQNZUeyuHrsEYwfMYjH31zBY2+u4OWFH3H12CM4un9PHnn9Q90VLdJBEpYU3L3OzG4GpgAR4Cl3\nX2BmN4bbHwUuB75oZnVANXCFp9st1tJpenbL5vbzj+HqsSX89NVl/ObtVfttL99WzT3PzQNQYhA5\nSCpzIWlrzA9eZePOvQesH9Qnj+l3n5OEiERSV7p0NIsctMoYCQGCM4blG3d1cjQiXYOSgqStlu6K\nBjjvgTf4z9++zzsrNmuCH5F2UFKQtBXrrui8nAjfn3A8t547nFlrtnHFY+8w/uHpvPjBeup0E5xI\nmxI5+kgkoRo7k1uak+GL447iL7PW8cS0ldzy+9kM6pPHDWcN499PHULPbvrqi8Sijmbp8hoanFcX\nVfDEtJW8t2oLBd2zuXrsEXzujKEU9+7OpNnlmuxHujxNsiMSw+w1W3li2kpemr+BSJZx8uDezCvf\nwd66fZeWNNmPdEUafSQSw8iSvjx89SjeuOsTXD32CGau3rZfQgBN9iOZTUlBMtKQfj34zqXHt7h9\n/bZqGhrS6yxapCMoKUhGa2lYqwNn/fA17ntpMUs+2tm5QYkkkZKCZLRYw1q752Rx7WkllBYX8Pi0\nFVz4sze5+OfT+NUbH7Jhu6YLla5N4/Iko7U1rHXTrr38fe4Gnp9dzr0vLea+fyzm9CMPY8KIQVx0\nYjG9uucAaASTdBkafSQSp5WbdvPXOeVMml3Oqs1V5GZncf6xAyju1Y1n3lvDnlqNYJLUpSGpIgni\n7sxZu42/zlnPix+sZ/PumpjtVJhPUomGpIokiJkxsqQv37n0eN75+rkttivfVs3M1VtVXkPSivoU\nRA5BTiSLQX3yKN8WuwP6M4+8TUG3bE476jDOOrqQM48u5KiifM01LSlLSUHkEN11YSn3PDeP6tr6\npnV5ORG++clj6dMjl7eWb+Kt5ZW8srACgIG9u3Pm0YV8bHghZxxVSFFBN0Cd1ZIalBREDlFbI5g+\nedJAANZsrmLa8kqmL9/EKwsr+PPMdQCUFRdQ3Ksbb3+4hZrwUpNmkZNkUUezSBLUNzgL1m9n2rJN\nTF++ibc/jD01eZ+8HB655hSOLMqnf0G3Vi876UxDWqPRRyJpZNjdf6et/4k9ciMMK8xnWGE+Rxbm\nM6won2GFPRlWmM/UxRtjXsLSsFhpFG9S0OUjkRRweAud1QN6deMnnx3Byk27WLFpNysqdzN33XYm\nz9tAdGmmLIPmpZqqa+v54T8WM37E4XF3bOtsQ3SmIJICJs0ub9df+nvr6lm7pYoVlbtZuWk39760\nuMV99+yWzZB+PRjSN4+Sfj0Y0q9H+JzH4L496B6W+WhvDJJedKYgkkba6qxurlt2hKP7F3B0/wIA\nnv7X6phnGr3zspkwYhBrt1azYtNu3lhaeUCp8P4F3Sjp14MF63fslxAgeWcbOmNJHp0piHQB8f6V\n7+5U7trL2i1VrN1SzZotVcHy1ireWbGlxf1nZxm98nLonZfT9Bw8sqOWc1j80Q6eeXctNVGJp3tO\nFvd++kQ+PWpwh/4s8exHyWkfdTSLZJhD/QV25n2vxTzb6NU9m2tPP4Lt1bVsr64Ln2vZET5vr66l\nPo65J/JzI/Tolk2P3Ag9chufIwe8/sP7a9m5p+6A9xf2zOXJ608lLzdCXk6E7jlB++45ESJZ+5/F\ndERi6WrJKSWSgpldBPwciABPuPt9zbZbuP0SoAr4nLvPam2fSgoiiXGwvwTdnd019WyvruWs+15r\ncRTVDWcNo6qmjqqaenbvrae6Nliu2ltPVW1d8FxTf8AlrHjkZmeRFyaJvJwIa7ZUURcjUeXlRBg/\n4nByIlnBI9vIDZezI/uWcyJZ/GjKYrZV1R6wj8Pyc3noqlFkR4xIlpGd1fictf/riPHKwo/438mL\n9yuW2D0ni/+dcCKfHjUorktyHZWckp4UzCwCLAXOB9YB7wNXuvvCqDaXALcQJIWxwM/dfWxr+1VS\nEEmcRJ1ttKc44Bn3/ZP12/YcsL6wZy4/uvykIHHU1LOnNkggjYlkT82+13+bu6HF/fcv6EZtfQN1\n9U5NfQM19Q0k64JJJMuIWJBEIllGlkF2JIssMyJZkJ2VxUc79sQ8E2tvwcVU6GgeAyx39xVhQH8A\nxgMLo9qMB572IDO9Y2Z9zGygu7f8LyoiCTNh5KBDumbeUsmPuy4sjXsfX72wrIWyIcdxTtmAuPYx\ne037klN9g1MbJojaugbqGpxLH3qLih17D2hb2DOXB68cSX2DNz3q9nsOEk59g3N3eFd6LF8+dzj1\nDQ3UN0CDO3X1ToPv209Dg1Pv3nTne3PrW6i3dagSmRQGAWujXq8jOBtoq80gYL+kYGYTgYkAJSUl\nHR6oiHSM9o6iStQ+2pucgr/UI03DcwHuufjYFpPTGUcVxhXHL15b3mJyuuP8Y+Lax78+3BxzHy1N\nJXuo0mJIqrs/BjwGweWjJIcjIq041LONjthHuianRO2jPRKZFMqBIVGvB4fr2ttGRKTdlJwOTiI7\nmrMJOprPJfhF/z5wlbsviGrzSeBm9nU0P+juY1rbrzqaRUTaL+kdze5eZ2Y3A1MIhqQ+5e4LzOzG\ncPujwGSChLCcYEjq5xMVj4iItC2hfQruPpngF3/0ukejlh24KZExiIhI/DRHs4iINFFSEBGRJkoK\nIiLSJO2j0hosAAAHdUlEQVQK4plZJbA62XG0oRDYlOwg4qA4O166xKo4O1Y6xHmEuxe11SjtkkI6\nMLMZ8Qz9SjbF2fHSJVbF2bHSJc546PKRiIg0UVIQEZEmSgqJ8ViyA4iT4ux46RKr4uxY6RJnm9Sn\nICIiTXSmICIiTZQURESkiZLCQTKzIWY21cwWmtkCM7s1RptxZrbdzOaEj28lKdZVZjYvjOGAErMW\neNDMlpvZXDMblYQYS6OO0xwz22FmtzVrk7TjaWZPmdlGM5sfta6fmb1iZsvC574tvPciM1sSHt+7\nkxDn/Wa2OPy3fd7M+rTw3la/J50Q53fMrDzq3/eSFt6b7OP5x6gYV5nZnBbe22nHs0O5ux4H8QAG\nAqPC5QKCMuHHNWszDvhbCsS6CihsZfslwEuAAacB7yY53gjwEcHNNilxPIGPA6OA+VHrfgTcHS7f\nDfywhZ/lQ+BIIBf4oPn3pBPivADIDpd/GCvOeL4nnRDnd4A74/huJPV4Ntv+E+BbyT6eHfnQmcJB\ncvcN7j4rXN4JLCKYSjQdNc2V7e7vAH3MbGAS4zkX+NDdU+bOdXd/E9jSbPV44Lfh8m+BCTHe2jRX\nubvXAI1zlXdanO7+srvXhS/fIZjMKqlaOJ7xSPrxbGRmBvw78PtEfX4yKCl0ADMbCowE3o2x+Yzw\ntP0lMzu+UwPbx4FXzWxmON91cy3NlZ0sV9Dyf7RUOJ6NBrh743ziHwGxZpVPtWP7HwRnhbG09T3p\nDLeE/75PtXA5LpWO58eACndf1sL2VDie7aakcIjMrCfwF+A2d9/RbPMsoMTdTwJ+AUzq7PhCZ7n7\nCOBi4CYz+3iS4miTmeUClwJ/irE5VY7nATy4XpDS47vN7BtAHfBMC02S/T15hOCy0AhgA8GlmVR2\nJa2fJST7eB4UJYVDYGY5BAnhGXd/rvl2d9/h7rvC5clAjpkVdnKYuHt5+LwReJ7gFDxaKs2VfTEw\ny90rmm9IleMZpaLxMlv4vDFGm5Q4tmb2OeBTwNVhAjtAHN+ThHL3Cnevd/cG4PEWPj9Vjmc2cBnw\nx5baJPt4HiwlhYMUXk98Eljk7g+00KY4bIeZjSE43ps7L0ows3wzK2hcJuh0nN+s2QvAdeEopNOA\n7VGXRTpbi399pcLxbOYF4Ppw+XrgrzHavA8MN7Nh4VnQFeH7Oo2ZXQR8FbjU3ataaBPP9yShmvVj\nfbqFz0/68QydByx293WxNqbC8Txoye7pTtcHcBbB5YK5wJzwcQlwI3Bj2OZmYAHBCIl3gDOSEOeR\n4ed/EMbyjXB9dJwGPEwwqmMeMDpJxzSf4Jd876h1KXE8CRLVBqCW4Dr2DcBhwD+BZcCrQL+w7eHA\n5Kj3XkIwOu3DxuPfyXEuJ7gO3/g9fbR5nC19Tzo5zt+F37+5BL/oB6bi8QzX/6bxexnVNmnHsyMf\nKnMhIiJNdPlIRESaKCmIiEgTJQUREWmipCAiIk2UFEREpImSgqQ0M3Mz+0nU6zvN7DsdtO/fmNnl\nHbGvNj7ns2a2yMymJjIuMxtqZle1P0KRfZQUJNXtBS5L8p3LBwjvaI3XDcB/ufsnEhVPaCjQrqTQ\nzp9DMoCSgqS6OoL5b29vvqH5X9Rmtit8Hmdmb5jZX81shZndZ2ZXm9l7YX37o6J2c56ZzTCzpWb2\nqfD9EQvmIHg/LM72haj9TjOzF4CFMeK5Mtz/fDP7YbjuWwQ3Oj5pZvfHeM/Xwvd8YGb3xdi+qjEh\nmtloM3s9XD47qqb/7PDu2fuAj4Xrbj/Yn0Mym/5KkHTwMDDXzH7UjvecDBxLUPZ4BfCEu4+xYDKk\nW4DGCXyGEtSkOQqYamZHA9cRlPo41cy6AdPN7OWw/SjgBHdfGf1hZnY4wVwFpwBbgZfNbIK7f8/M\nziGYJ2BGs/dcTFD2eay7V5lZv3b8fHcCN7n79LAo4x6COR3udPfG5DaxvT+HiM4UJOV5UH32aeDL\n7Xjb+x7MebGXoBxC4y/DeQSJoNGz7t7gQfnjFUAZQZ2a6yyYUetdgnIWw8P277Xwi/RU4HV3r/Rg\n7oJnCCZoac15wK89rEfk7u2ZX2A68ICZfRno4/vmS4h2MD+HZDidKUi6+BlB6exfR62rI/zDxsyy\nCGbiarQ3arkh6nUD+3/vm9d5cYJaULe4+5ToDWY2Dth9cOEftKafEejeuNLd7zOzvxPUAZpuZhfG\neG8q/RySJnSmIGkh/Cv6WYJO20arCC7XQDAHQ85B7PqzZpYV9jMcCSwBpgBftKA0OmZ2TFjpsjXv\nAWebWaGZRQiqvb7RxnteAT5vZj3Cz4l1+WgV+37GzzSuNLOj3H2eu/+QoHJoGbCTYGrYRgfzc0iG\nU1KQdPITIHoU0uMEv4g/AE7n4P76XUPwC/0lgqqXe4AnCDpgZ1kwYfuvaOOs2oNS43cDUwkqY850\n91iltKPf8w+CaqAzwks8d8Zo9l3g5xZM/F4ftf62sEN7LkEFz5cIqovWh53Wtx/MzyGiKqkiItJE\nZwoiItJESUFERJooKYiISBMlBRERaaKkICIiTZQURESkiZKCiIg0+f+1rU9+DgSgrgAAAABJRU5E\nrkJggg==\n",
      "text/plain": [
       "<matplotlib.figure.Figure at 0x1a0a406590>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "# 利用肘方法确定簇的最佳数量\n",
    "from sklearn.cluster import KMeans\n",
    "\n",
    "distortions = []\n",
    "for i in range(1, 20):\n",
    "    km = KMeans(n_clusters=i,\n",
    "               init='k-means++',\n",
    "               n_init=10,\n",
    "               max_iter=300,\n",
    "               random_state=0)\n",
    "    km.fit(X)\n",
    "    distortions.append(km.inertia_)\n",
    "\n",
    "plt.plot(range(1, 20), distortions, marker='o')\n",
    "plt.xlabel('Number of cluster')\n",
    "plt.ylabel('Distortion')\n",
    "plt.show()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "km = KMeans(n_clusters=17,\n",
    "            init='k-means++',\n",
    "            n_init=10,\n",
    "            max_iter=300,\n",
    "            random_state=0)\n",
    "y_km = km.fit_predict(X)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>sha1</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>10</td>\n",
       "      <td>0076ba5e006bec2db02f3f4825e7b45ccea30725</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>3</td>\n",
       "      <td>0076f712bc357ff5417925f05ed38716d7af1206</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>1</td>\n",
       "      <td>00773d477ced03f424e82e7427e60fef4da7737b</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>15</td>\n",
       "      <td>0091a1826dddd4b2df59545523196554ab17a680</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>10</td>\n",
       "      <td>01077633fb23dd47b639520eb9e0f9ed5675b69d</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   id                                      sha1\n",
       "0  10  0076ba5e006bec2db02f3f4825e7b45ccea30725\n",
       "1   3  0076f712bc357ff5417925f05ed38716d7af1206\n",
       "2   1  00773d477ced03f424e82e7427e60fef4da7737b\n",
       "3  15  0091a1826dddd4b2df59545523196554ab17a680\n",
       "4  10  01077633fb23dd47b639520eb9e0f9ed5675b69d"
      ]
     },
     "execution_count": 34,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df_yk = pd.DataFrame(y_km)\n",
    "df_fn = pd.DataFrame(np.array(fnlist))\n",
    "\n",
    "all = pd.concat([df_yk, df_fn], axis=1)\n",
    "all.columns = ['id', 'sha1']\n",
    "all.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>sha1</th>\n",
       "      <th>vname</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>0076f712bc357ff5417925f05ed38716d7af1206</td>\n",
       "      <td>Win.Trojan.OnlineGames-356</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>00773d477ced03f424e82e7427e60fef4da7737b</td>\n",
       "      <td>Win.Packer.VbPack-0-6334882-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>0091a1826dddd4b2df59545523196554ab17a680</td>\n",
       "      <td>Win.Spyware.80656-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>01077633fb23dd47b639520eb9e0f9ed5675b69d</td>\n",
       "      <td>Win.Packer.VBCrypt-5731517-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>0155e7783b36f6a64c2f88f43410a436bf81d931</td>\n",
       "      <td>Win.Trojan.Sality-1045</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                       sha1                          vname\n",
       "0  0076f712bc357ff5417925f05ed38716d7af1206     Win.Trojan.OnlineGames-356\n",
       "1  00773d477ced03f424e82e7427e60fef4da7737b  Win.Packer.VbPack-0-6334882-0\n",
       "2  0091a1826dddd4b2df59545523196554ab17a680            Win.Spyware.80656-1\n",
       "3  01077633fb23dd47b639520eb9e0f9ed5675b69d   Win.Packer.VBCrypt-5731517-0\n",
       "4  0155e7783b36f6a64c2f88f43410a436bf81d931         Win.Trojan.Sality-1045"
      ]
     },
     "execution_count": 36,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "clamav = pd.read_csv('data/bad-clamav/bad-clamav.txt', sep='\\t', header=[-1])\n",
    "clamav.columns = ['sha1', 'vname']\n",
    "clamav.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>sha1</th>\n",
       "      <th>vname</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>891</th>\n",
       "      <td>0</td>\n",
       "      <td>eba4178f4ecd8468f8530dbe65fc065795a39650</td>\n",
       "      <td>Win.Trojan.IRCBot-122</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>221</th>\n",
       "      <td>0</td>\n",
       "      <td>47c0a8b3b77306557dc3c3cd11f3f517a6835323</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>586</th>\n",
       "      <td>0</td>\n",
       "      <td>b26e55842cc21cf491d231b274b9e257dc2413ef</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>675</th>\n",
       "      <td>0</td>\n",
       "      <td>c499b429bd837e431fec66093ed83882334a5d6d</td>\n",
       "      <td>Win.Worm.Agent-400120</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>732</th>\n",
       "      <td>0</td>\n",
       "      <td>cefc8fb49c6a46c6414d5775ad65922f24f83483</td>\n",
       "      <td>Win.Trojan.Agent-1356380</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>694</th>\n",
       "      <td>0</td>\n",
       "      <td>c88655e49b60b695ef888c7ae281cd404329dbe9</td>\n",
       "      <td>Win.Trojan.Delf-1526</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>467</th>\n",
       "      <td>0</td>\n",
       "      <td>9546f07f70cae58d3747242f8002062671fad594</td>\n",
       "      <td>Win.Worm.Agent-400120</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>730</th>\n",
       "      <td>0</td>\n",
       "      <td>ce985607d91f08c22995b6577bee15ef616ee5ac</td>\n",
       "      <td>Win.Trojan.Agent-1117603</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>943</th>\n",
       "      <td>0</td>\n",
       "      <td>f69fd1cd626bbd0836e67abe29be1354bb48ca60</td>\n",
       "      <td>Win.Trojan.Alman-6</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>60</th>\n",
       "      <td>0</td>\n",
       "      <td>14f0cd6548a566244a2b690f046c0d3f30d1d00c</td>\n",
       "      <td>Win.Worm.Allaple-226</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>697</th>\n",
       "      <td>0</td>\n",
       "      <td>c8ddc2cffcd0982a7d27ede223a4eb8f908476c5</td>\n",
       "      <td>Win.Adware.Dealply-5865861-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>948</th>\n",
       "      <td>0</td>\n",
       "      <td>f6dbb3f736ed2da78e32f7bc36d983daf10f76f0</td>\n",
       "      <td>Win.Trojan.Philis-85</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>480</th>\n",
       "      <td>0</td>\n",
       "      <td>98ad84b093bcc3b55499ce9f7272f09c7584905e</td>\n",
       "      <td>Win.Malware.Agent-6395331-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>849</th>\n",
       "      <td>0</td>\n",
       "      <td>e5305d2e2c1a5e8f856135222b94f1a506ea9025</td>\n",
       "      <td>Win.Spyware.16289-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>847</th>\n",
       "      <td>0</td>\n",
       "      <td>e4e3fab6db4b18c75665b2e874a3309442faf2da</td>\n",
       "      <td>Win.Worm.Allaple-316</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>846</th>\n",
       "      <td>0</td>\n",
       "      <td>e492f1a8a094a60873b60a2c7d9fed6f99b6e8f5</td>\n",
       "      <td>Win.Trojan.Banker-31143</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>52</th>\n",
       "      <td>0</td>\n",
       "      <td>1385fe004c2302560ab05aa7f6185fd8e0374354</td>\n",
       "      <td>Win.Trojan.Banker-15521</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>617</th>\n",
       "      <td>0</td>\n",
       "      <td>b6c07813bebad4da39bab54025b3468784df6f31</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>777</th>\n",
       "      <td>0</td>\n",
       "      <td>d937f057b6be21453e7aa0ca95d3e4d4f7a63196</td>\n",
       "      <td>Win.Trojan.Hupigon-49443</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>247</th>\n",
       "      <td>0</td>\n",
       "      <td>53092213714072a2aab1d5963f8395d47e455774</td>\n",
       "      <td>Win.Trojan.IRCBot-122</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>688</th>\n",
       "      <td>0</td>\n",
       "      <td>c83b0e8389f487e2ceb7543a95f6326107d0ce0e</td>\n",
       "      <td>Win.Trojan.Delf-1526</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>254</th>\n",
       "      <td>0</td>\n",
       "      <td>53da7b820f2308d1883b84372e9a25998146ca72</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>171</th>\n",
       "      <td>0</td>\n",
       "      <td>373a57e0c905987a65856c4463f71397c409e4e4</td>\n",
       "      <td>Win.Trojan.Agent-35891</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>927</th>\n",
       "      <td>0</td>\n",
       "      <td>f34283f3288f3192baa4fde71188b8487a7fc2ea</td>\n",
       "      <td>Legacy.Trojan.Agent-1388589</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>457</th>\n",
       "      <td>0</td>\n",
       "      <td>943bfbc4abc7946f1e882d83b44f2eab0d7eb8d9</td>\n",
       "      <td>Win.Trojan.Mahato-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>676</th>\n",
       "      <td>0</td>\n",
       "      <td>c4f806551934dc2a594e3bf13e9413fa1c19cfd7</td>\n",
       "      <td>Win.Trojan.Philis-88</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>756</th>\n",
       "      <td>0</td>\n",
       "      <td>d431751ad91a99b6ef9b26512a709e75e0fe038b</td>\n",
       "      <td>Win.Trojan.Hupigon-37131</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>595</th>\n",
       "      <td>0</td>\n",
       "      <td>b3804ad8311ab1554fcd773a39942acbe1455b1f</td>\n",
       "      <td>Win.Trojan.Cosmu-391</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>680</th>\n",
       "      <td>0</td>\n",
       "      <td>c67b7034bf50d9ded214e00e8f57909725842c32</td>\n",
       "      <td>Win.Adware.Dealply-6246742-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>454</th>\n",
       "      <td>0</td>\n",
       "      <td>9362c1c152b41b45abd292fb915c856f169602aa</td>\n",
       "      <td>Win.Worm.Brontok-88</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>111</th>\n",
       "      <td>16</td>\n",
       "      <td>24d8ef9084939efa933b6293376197b0a173f96e</td>\n",
       "      <td>Win.Trojan.Madangel-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>788</th>\n",
       "      <td>16</td>\n",
       "      <td>db4f66751d6d275024a2ec5006eb7c711fc05599</td>\n",
       "      <td>Win.Worm.Kido-238</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>659</th>\n",
       "      <td>16</td>\n",
       "      <td>c09a01880368cb60e767fd0b95ce19f90d719c7f</td>\n",
       "      <td>Win.Virus.Sality-1067</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>911</th>\n",
       "      <td>16</td>\n",
       "      <td>efd6030f6cad2d7e79faa6c026975274d3dd4d2d</td>\n",
       "      <td>Win.Trojan.Parite-1044</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>749</th>\n",
       "      <td>16</td>\n",
       "      <td>d2ba33625bd8ea0edd6c35dd04fafa150f7457a7</td>\n",
       "      <td>Win.Dropper.Agent-35454</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>412</th>\n",
       "      <td>16</td>\n",
       "      <td>83cbf08e35181fec7a1122bdd78d214b159e6e5a</td>\n",
       "      <td>Win.Virus.Sality-1067</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>73</th>\n",
       "      <td>16</td>\n",
       "      <td>17439265a4b3430a995a6b6dc3d1d43af8a16cbc</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>156</th>\n",
       "      <td>16</td>\n",
       "      <td>340b70de93091b1593261299a8ff265a4956b2bc</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>415</th>\n",
       "      <td>16</td>\n",
       "      <td>848b509e19a37f23266112ecd90ef711983b5a8e</td>\n",
       "      <td>Win.Worm.Brontok-88</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>63</th>\n",
       "      <td>16</td>\n",
       "      <td>15c82b0a249499616566ea38c4fd2d7e52345272</td>\n",
       "      <td>Win.Worm.Kido-360</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>923</th>\n",
       "      <td>16</td>\n",
       "      <td>f28f4a3a96513e3660ae5b51b367cfa4d57aeafa</td>\n",
       "      <td>Win.Worm.Autorun-313</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>427</th>\n",
       "      <td>16</td>\n",
       "      <td>8646836fc5efac006bc536ca2644ff73ff6fbf2b</td>\n",
       "      <td>Win.Dropper.Agent-35454</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>388</th>\n",
       "      <td>16</td>\n",
       "      <td>79c2155dffa9debfd7e51f2c6e4241001b7d2218</td>\n",
       "      <td>Win.Trojan.Agent-35863</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>638</th>\n",
       "      <td>16</td>\n",
       "      <td>bbad717f84e44b4ada543e900a731cbe50bb3f49</td>\n",
       "      <td>Win.Trojan.Alman-6</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>630</th>\n",
       "      <td>16</td>\n",
       "      <td>b95069ebbe209ab624bfe229cfab1d3f68cd1281</td>\n",
       "      <td>Win.Packer.VBCrypt-5731517-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>259</th>\n",
       "      <td>16</td>\n",
       "      <td>5542586bb931cb41cc739c2dd10081d73fcd593a</td>\n",
       "      <td>Win.Dropper.Agent-35454</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>950</th>\n",
       "      <td>16</td>\n",
       "      <td>f7600902bea07a247b9aa702c0ecd7ab31d3640a</td>\n",
       "      <td>Win.Trojan.Virut-263</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>444</th>\n",
       "      <td>16</td>\n",
       "      <td>905d6d75cae4145813b33f6a479ae0cf27563b31</td>\n",
       "      <td>Win.Trojan.Zloyfly-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>672</th>\n",
       "      <td>16</td>\n",
       "      <td>c4302fc219809563e11244f0deb27b46387965b5</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>447</th>\n",
       "      <td>16</td>\n",
       "      <td>9122cb479359553b601d9a2043820670a2ea11d1</td>\n",
       "      <td>Win.Worm.Autorun-313</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>382</th>\n",
       "      <td>16</td>\n",
       "      <td>783552705bc4ce61391224fd24e0e42099e1ebe8</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>458</th>\n",
       "      <td>16</td>\n",
       "      <td>9449b39159b646680fe32057e8cdcf967aaea1b1</td>\n",
       "      <td>Win.Worm.Autorun-313</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>916</th>\n",
       "      <td>16</td>\n",
       "      <td>f14a12ebc0c817ca700ed0c23b18581359091058</td>\n",
       "      <td>Win.Worm.Rays-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>615</th>\n",
       "      <td>16</td>\n",
       "      <td>b68c1d4955d9336b359f1ba47d260cd9c8e647e5</td>\n",
       "      <td>Win.Worm.Brontok-88</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>381</th>\n",
       "      <td>16</td>\n",
       "      <td>782884ef1ad99969bf306d9d734791c9cc9231fd</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>264</th>\n",
       "      <td>16</td>\n",
       "      <td>56a6e4410cb5a3964d4c537745d9327906362278</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>296</th>\n",
       "      <td>16</td>\n",
       "      <td>6323a84a57b266d53cae2b1798d3f4602e2dc7a9</td>\n",
       "      <td>Win.Trojan.Virut-263</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>151</th>\n",
       "      <td>16</td>\n",
       "      <td>333c78f761ab17ed24fea0022da0f9430b146af1</td>\n",
       "      <td>Win.Trojan.Keygen-92</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>953</th>\n",
       "      <td>16</td>\n",
       "      <td>f7be0057a1070afc5912f237fca7adf4fbc57b56</td>\n",
       "      <td>Win.Worm.Downadup-75</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>839</th>\n",
       "      <td>16</td>\n",
       "      <td>e2ca1e0b2389b4b60748e6db881dd1a37b14895d</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>999 rows × 3 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "     id                                      sha1  \\\n",
       "891   0  eba4178f4ecd8468f8530dbe65fc065795a39650   \n",
       "221   0  47c0a8b3b77306557dc3c3cd11f3f517a6835323   \n",
       "586   0  b26e55842cc21cf491d231b274b9e257dc2413ef   \n",
       "675   0  c499b429bd837e431fec66093ed83882334a5d6d   \n",
       "732   0  cefc8fb49c6a46c6414d5775ad65922f24f83483   \n",
       "694   0  c88655e49b60b695ef888c7ae281cd404329dbe9   \n",
       "467   0  9546f07f70cae58d3747242f8002062671fad594   \n",
       "730   0  ce985607d91f08c22995b6577bee15ef616ee5ac   \n",
       "943   0  f69fd1cd626bbd0836e67abe29be1354bb48ca60   \n",
       "60    0  14f0cd6548a566244a2b690f046c0d3f30d1d00c   \n",
       "697   0  c8ddc2cffcd0982a7d27ede223a4eb8f908476c5   \n",
       "948   0  f6dbb3f736ed2da78e32f7bc36d983daf10f76f0   \n",
       "480   0  98ad84b093bcc3b55499ce9f7272f09c7584905e   \n",
       "849   0  e5305d2e2c1a5e8f856135222b94f1a506ea9025   \n",
       "847   0  e4e3fab6db4b18c75665b2e874a3309442faf2da   \n",
       "846   0  e492f1a8a094a60873b60a2c7d9fed6f99b6e8f5   \n",
       "52    0  1385fe004c2302560ab05aa7f6185fd8e0374354   \n",
       "617   0  b6c07813bebad4da39bab54025b3468784df6f31   \n",
       "777   0  d937f057b6be21453e7aa0ca95d3e4d4f7a63196   \n",
       "247   0  53092213714072a2aab1d5963f8395d47e455774   \n",
       "688   0  c83b0e8389f487e2ceb7543a95f6326107d0ce0e   \n",
       "254   0  53da7b820f2308d1883b84372e9a25998146ca72   \n",
       "171   0  373a57e0c905987a65856c4463f71397c409e4e4   \n",
       "927   0  f34283f3288f3192baa4fde71188b8487a7fc2ea   \n",
       "457   0  943bfbc4abc7946f1e882d83b44f2eab0d7eb8d9   \n",
       "676   0  c4f806551934dc2a594e3bf13e9413fa1c19cfd7   \n",
       "756   0  d431751ad91a99b6ef9b26512a709e75e0fe038b   \n",
       "595   0  b3804ad8311ab1554fcd773a39942acbe1455b1f   \n",
       "680   0  c67b7034bf50d9ded214e00e8f57909725842c32   \n",
       "454   0  9362c1c152b41b45abd292fb915c856f169602aa   \n",
       "..   ..                                       ...   \n",
       "111  16  24d8ef9084939efa933b6293376197b0a173f96e   \n",
       "788  16  db4f66751d6d275024a2ec5006eb7c711fc05599   \n",
       "659  16  c09a01880368cb60e767fd0b95ce19f90d719c7f   \n",
       "911  16  efd6030f6cad2d7e79faa6c026975274d3dd4d2d   \n",
       "749  16  d2ba33625bd8ea0edd6c35dd04fafa150f7457a7   \n",
       "412  16  83cbf08e35181fec7a1122bdd78d214b159e6e5a   \n",
       "73   16  17439265a4b3430a995a6b6dc3d1d43af8a16cbc   \n",
       "156  16  340b70de93091b1593261299a8ff265a4956b2bc   \n",
       "415  16  848b509e19a37f23266112ecd90ef711983b5a8e   \n",
       "63   16  15c82b0a249499616566ea38c4fd2d7e52345272   \n",
       "923  16  f28f4a3a96513e3660ae5b51b367cfa4d57aeafa   \n",
       "427  16  8646836fc5efac006bc536ca2644ff73ff6fbf2b   \n",
       "388  16  79c2155dffa9debfd7e51f2c6e4241001b7d2218   \n",
       "638  16  bbad717f84e44b4ada543e900a731cbe50bb3f49   \n",
       "630  16  b95069ebbe209ab624bfe229cfab1d3f68cd1281   \n",
       "259  16  5542586bb931cb41cc739c2dd10081d73fcd593a   \n",
       "950  16  f7600902bea07a247b9aa702c0ecd7ab31d3640a   \n",
       "444  16  905d6d75cae4145813b33f6a479ae0cf27563b31   \n",
       "672  16  c4302fc219809563e11244f0deb27b46387965b5   \n",
       "447  16  9122cb479359553b601d9a2043820670a2ea11d1   \n",
       "382  16  783552705bc4ce61391224fd24e0e42099e1ebe8   \n",
       "458  16  9449b39159b646680fe32057e8cdcf967aaea1b1   \n",
       "916  16  f14a12ebc0c817ca700ed0c23b18581359091058   \n",
       "615  16  b68c1d4955d9336b359f1ba47d260cd9c8e647e5   \n",
       "381  16  782884ef1ad99969bf306d9d734791c9cc9231fd   \n",
       "264  16  56a6e4410cb5a3964d4c537745d9327906362278   \n",
       "296  16  6323a84a57b266d53cae2b1798d3f4602e2dc7a9   \n",
       "151  16  333c78f761ab17ed24fea0022da0f9430b146af1   \n",
       "953  16  f7be0057a1070afc5912f237fca7adf4fbc57b56   \n",
       "839  16  e2ca1e0b2389b4b60748e6db881dd1a37b14895d   \n",
       "\n",
       "                            vname  \n",
       "891         Win.Trojan.IRCBot-122  \n",
       "221       Heuristics.W32.Parite.B  \n",
       "586       Heuristics.W32.Parite.B  \n",
       "675         Win.Worm.Agent-400120  \n",
       "732      Win.Trojan.Agent-1356380  \n",
       "694          Win.Trojan.Delf-1526  \n",
       "467         Win.Worm.Agent-400120  \n",
       "730      Win.Trojan.Agent-1117603  \n",
       "943            Win.Trojan.Alman-6  \n",
       "60           Win.Worm.Allaple-226  \n",
       "697  Win.Adware.Dealply-5865861-0  \n",
       "948          Win.Trojan.Philis-85  \n",
       "480   Win.Malware.Agent-6395331-0  \n",
       "849           Win.Spyware.16289-1  \n",
       "847          Win.Worm.Allaple-316  \n",
       "846       Win.Trojan.Banker-31143  \n",
       "52        Win.Trojan.Banker-15521  \n",
       "617       Heuristics.W32.Parite.B  \n",
       "777      Win.Trojan.Hupigon-49443  \n",
       "247         Win.Trojan.IRCBot-122  \n",
       "688          Win.Trojan.Delf-1526  \n",
       "254       Heuristics.W32.Parite.B  \n",
       "171        Win.Trojan.Agent-35891  \n",
       "927   Legacy.Trojan.Agent-1388589  \n",
       "457           Win.Trojan.Mahato-1  \n",
       "676          Win.Trojan.Philis-88  \n",
       "756      Win.Trojan.Hupigon-37131  \n",
       "595          Win.Trojan.Cosmu-391  \n",
       "680  Win.Adware.Dealply-6246742-0  \n",
       "454           Win.Worm.Brontok-88  \n",
       "..                            ...  \n",
       "111         Win.Trojan.Madangel-1  \n",
       "788             Win.Worm.Kido-238  \n",
       "659         Win.Virus.Sality-1067  \n",
       "911        Win.Trojan.Parite-1044  \n",
       "749       Win.Dropper.Agent-35454  \n",
       "412         Win.Virus.Sality-1067  \n",
       "73        Heuristics.W32.Parite.B  \n",
       "156       Heuristics.W32.Parite.B  \n",
       "415           Win.Worm.Brontok-88  \n",
       "63              Win.Worm.Kido-360  \n",
       "923          Win.Worm.Autorun-313  \n",
       "427       Win.Dropper.Agent-35454  \n",
       "388        Win.Trojan.Agent-35863  \n",
       "638            Win.Trojan.Alman-6  \n",
       "630  Win.Packer.VBCrypt-5731517-0  \n",
       "259       Win.Dropper.Agent-35454  \n",
       "950          Win.Trojan.Virut-263  \n",
       "444          Win.Trojan.Zloyfly-1  \n",
       "672              Win.Worm.Tenga-2  \n",
       "447          Win.Worm.Autorun-313  \n",
       "382       Heuristics.W32.Parite.B  \n",
       "458          Win.Worm.Autorun-313  \n",
       "916               Win.Worm.Rays-1  \n",
       "615           Win.Worm.Brontok-88  \n",
       "381              Win.Worm.Tenga-2  \n",
       "264       Heuristics.W32.Parite.B  \n",
       "296          Win.Trojan.Virut-263  \n",
       "151          Win.Trojan.Keygen-92  \n",
       "953          Win.Worm.Downadup-75  \n",
       "839       Heuristics.W32.Parite.B  \n",
       "\n",
       "[999 rows x 3 columns]"
      ]
     },
     "execution_count": 37,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "vircl = pd.merge(all, clamav)\n",
    "vircl.sort_values(by=['id'])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "platform = []\n",
    "classes  = []\n",
    "other    = []\n",
    "\n",
    "for i in range(0, vircl['vname'].shape[0]):\n",
    "    str = vircl['vname'][i]\n",
    "    sp = str.split('.', 5)\n",
    "    if len(sp) == 3:\n",
    "        p, c, o = str.split('.', 3)\n",
    "    elif len(sp) == 4:\n",
    "        h, p, c, o = str.split('.', 4)\n",
    "    elif len(sp) == 5:\n",
    "        h, p, c, o, d = str.split('.', 5)\n",
    "    platform.append(p)\n",
    "    classes.append(c)\n",
    "    other.append(o)\n",
    "    \n",
    "df_platform = pd.DataFrame(np.array(platform))\n",
    "df_platform.columns = ['platform']\n",
    "df_classes  = pd.DataFrame(np.array(classes))\n",
    "df_classes.columns  = ['classes']\n",
    "df_other    = pd.DataFrame(np.array(other))\n",
    "df_other.columns    = ['other']"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "virall = pd.concat([vircl, df_platform, df_classes, df_other], axis=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>sha1</th>\n",
       "      <th>vname</th>\n",
       "      <th>platform</th>\n",
       "      <th>classes</th>\n",
       "      <th>other</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>663</th>\n",
       "      <td>10</td>\n",
       "      <td>c1dd76941ebe042428e7651091575f7a0a955190</td>\n",
       "      <td>Win.Adware.Agent-1153194</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Agent-1153194</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>585</th>\n",
       "      <td>10</td>\n",
       "      <td>b2492b568886d7d984fff1a82a12818ea65ef914</td>\n",
       "      <td>Win.Adware.Agent-1173005</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Agent-1173005</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>108</th>\n",
       "      <td>10</td>\n",
       "      <td>2415e12bec40f570952f5a3a37921897ff4060b7</td>\n",
       "      <td>Win.Adware.Agent-1383450</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Agent-1383450</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>682</th>\n",
       "      <td>0</td>\n",
       "      <td>c6de49b7c941a9910933bcac15945003e3b6931a</td>\n",
       "      <td>Win.Adware.Agent-361412</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Agent-361412</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>288</th>\n",
       "      <td>2</td>\n",
       "      <td>6181a0bed2183f1cc771e948385766096dfda960</td>\n",
       "      <td>Win.Adware.Agent-887467</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Agent-887467</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>319</th>\n",
       "      <td>2</td>\n",
       "      <td>66a99c935554e027f1953619485fece2bb218d36</td>\n",
       "      <td>Win.Adware.Agent-887467</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Agent-887467</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>733</th>\n",
       "      <td>2</td>\n",
       "      <td>cf085b528f7416911661e553627c6163272558d7</td>\n",
       "      <td>Win.Adware.Agent-887467</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Agent-887467</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>587</th>\n",
       "      <td>1</td>\n",
       "      <td>b2705c4c01635560d275477df05f86a58ac06bf1</td>\n",
       "      <td>Win.Adware.Amonetize-1360</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Amonetize-1360</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>193</th>\n",
       "      <td>10</td>\n",
       "      <td>415251e5d27878b029e3deb352356b6b8de20e70</td>\n",
       "      <td>Win.Adware.Amonetize-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Amonetize-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>699</th>\n",
       "      <td>10</td>\n",
       "      <td>c907f5f720fdf3125d88f44b361379ae8bbcad4c</td>\n",
       "      <td>Win.Adware.Amonetize-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Amonetize-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>543</th>\n",
       "      <td>1</td>\n",
       "      <td>ac0c00b1ccbcd23179b05f0f115287434d3b0c96</td>\n",
       "      <td>Win.Adware.Browsefox-42699</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Browsefox-42699</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>859</th>\n",
       "      <td>1</td>\n",
       "      <td>e69abc47b958424b6f69aae763ecb806e9bcb94b</td>\n",
       "      <td>Win.Adware.Browsefox-42725</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Browsefox-42725</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>228</th>\n",
       "      <td>3</td>\n",
       "      <td>48522df27be17bcbda8df6c3ae3952b574016021</td>\n",
       "      <td>Win.Adware.Cpush-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Cpush-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>697</th>\n",
       "      <td>0</td>\n",
       "      <td>c8ddc2cffcd0982a7d27ede223a4eb8f908476c5</td>\n",
       "      <td>Win.Adware.Dealply-5865861-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Dealply-5865861-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>666</th>\n",
       "      <td>0</td>\n",
       "      <td>c2e6378fb8dd79f9badf6ad1967638dd2701cdf3</td>\n",
       "      <td>Win.Adware.Dealply-6202291-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Dealply-6202291-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>992</th>\n",
       "      <td>0</td>\n",
       "      <td>fe7f2994873f567060d472fe866fa1d2e46431d6</td>\n",
       "      <td>Win.Adware.Dealply-6244916-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Dealply-6244916-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>680</th>\n",
       "      <td>0</td>\n",
       "      <td>c67b7034bf50d9ded214e00e8f57909725842c32</td>\n",
       "      <td>Win.Adware.Dealply-6246742-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Dealply-6246742-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>864</th>\n",
       "      <td>3</td>\n",
       "      <td>e7d49afddd58c5fdfe292771d59533c855e2ab51</td>\n",
       "      <td>Win.Adware.Downware-26</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Downware-26</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>392</th>\n",
       "      <td>10</td>\n",
       "      <td>79f178d15e2e6f66eeb8b638c96185735c09382b</td>\n",
       "      <td>Win.Adware.Downware-305</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Downware-305</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>399</th>\n",
       "      <td>3</td>\n",
       "      <td>8146216b92b26eac3b5b691df943fd84a43be3ce</td>\n",
       "      <td>Win.Adware.Imloader-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Imloader-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>321</th>\n",
       "      <td>0</td>\n",
       "      <td>67167544d5b3e5dddae0e887518781f68736ac39</td>\n",
       "      <td>Win.Adware.Installcore-177</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Installcore-177</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>805</th>\n",
       "      <td>0</td>\n",
       "      <td>dd52275afc360df7714edb294fc296d9eb67c8a9</td>\n",
       "      <td>Win.Adware.Installcore-516</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Installcore-516</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>10</td>\n",
       "      <td>018ab1f4961f12122f9b9a4d546d6bb6f120fb54</td>\n",
       "      <td>Win.Adware.Mplug-2401</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Mplug-2401</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>668</th>\n",
       "      <td>10</td>\n",
       "      <td>c2fb1e4204a2e78f47a8a7eb24e2d2a71d319c22</td>\n",
       "      <td>Win.Adware.Mplug-2444</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Mplug-2444</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>757</th>\n",
       "      <td>1</td>\n",
       "      <td>d463ed524d9fc42700820dc8354c467d70f7031d</td>\n",
       "      <td>Win.Adware.Netfilter-186</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Netfilter-186</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>115</th>\n",
       "      <td>10</td>\n",
       "      <td>25809adcadfd629b3db39933134b03df33b2ee19</td>\n",
       "      <td>Win.Adware.Netfilter-186</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Netfilter-186</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>333</th>\n",
       "      <td>1</td>\n",
       "      <td>701ab7f4f44c7d381eddaac92a7f0aa21d5da4f5</td>\n",
       "      <td>Win.Adware.Netfilter-190</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Netfilter-190</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>449</th>\n",
       "      <td>1</td>\n",
       "      <td>922f430527ce44bff152d9417bb43befebce2c7f</td>\n",
       "      <td>Win.Adware.Netfilter-190</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Netfilter-190</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>770</th>\n",
       "      <td>1</td>\n",
       "      <td>d7ad49bc1734c7c722ea7eef0be6437d87a91204</td>\n",
       "      <td>Win.Adware.Netfilter-190</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Netfilter-190</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>967</th>\n",
       "      <td>1</td>\n",
       "      <td>faad3b875d9dbd73de3c3a3724bb6c17617961f9</td>\n",
       "      <td>Win.Adware.Netfilter-190</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Netfilter-190</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>112</th>\n",
       "      <td>10</td>\n",
       "      <td>24e0502e5714ff2a3d18267fb2da90b2857beef5</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>173</th>\n",
       "      <td>10</td>\n",
       "      <td>3783169cd2f1f16e3e62486184a00b19f1c2178d</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>188</th>\n",
       "      <td>10</td>\n",
       "      <td>40eb8ca7f3c3182fae2a1b9e0a12d96d4d5d9b6e</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>223</th>\n",
       "      <td>10</td>\n",
       "      <td>480445883ce2c26409bea4b3cd608fddca2e0bdd</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>303</th>\n",
       "      <td>10</td>\n",
       "      <td>63b725a3db49a0b57c0a1707980fcb99356ce500</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>304</th>\n",
       "      <td>10</td>\n",
       "      <td>63bd4fd60df5cd6830020afa711b0ce5f9ae600a</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>360</th>\n",
       "      <td>10</td>\n",
       "      <td>767f4a21c4e3c75c47a9220412922c51f55329c8</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>434</th>\n",
       "      <td>10</td>\n",
       "      <td>87b3e27d09b4a448bc0ce13d06fe70a842ebd423</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>603</th>\n",
       "      <td>10</td>\n",
       "      <td>b461691aea84fba5f534c9396c67714a2cf67483</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>651</th>\n",
       "      <td>10</td>\n",
       "      <td>bde3cc01a6a0fd65615af49e75da2f3716965a80</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>773</th>\n",
       "      <td>10</td>\n",
       "      <td>d7e4cffb9e0c525c866256b3a6d09ab67fdd4ac4</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>907</th>\n",
       "      <td>10</td>\n",
       "      <td>ee7bb61abda377f0d4d02c8cf28d14557c51bd2f</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>957</th>\n",
       "      <td>10</td>\n",
       "      <td>f8d60e944f6650b63be151d9445bc7f3d5c0e7bd</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>381</th>\n",
       "      <td>16</td>\n",
       "      <td>782884ef1ad99969bf306d9d734791c9cc9231fd</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>672</th>\n",
       "      <td>16</td>\n",
       "      <td>c4302fc219809563e11244f0deb27b46387965b5</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>809</th>\n",
       "      <td>10</td>\n",
       "      <td>dda7a785f841d11180766ac1d5e4955d5b99a488</td>\n",
       "      <td>Win.Worm.Tufik-166</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tufik-166</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>385</th>\n",
       "      <td>3</td>\n",
       "      <td>78dbf656082aa3ed41ec3b9fb1a84d4ed25610fe</td>\n",
       "      <td>Win.Worm.VB-1038</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-1038</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>285</th>\n",
       "      <td>4</td>\n",
       "      <td>611b95f04d89e05b35ee6c7955eac5ffb06fa8d4</td>\n",
       "      <td>Win.Worm.VB-3470</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-3470</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>347</th>\n",
       "      <td>0</td>\n",
       "      <td>73c5c819413706cac3be064b59605191f1ef3a47</td>\n",
       "      <td>Win.Worm.VB-759</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-759</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>811</th>\n",
       "      <td>0</td>\n",
       "      <td>dea3677b63857429c2d876f04507e37b44e6cc1f</td>\n",
       "      <td>Win.Worm.VB-759</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-759</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>968</th>\n",
       "      <td>3</td>\n",
       "      <td>fad16883b7c1c63caee5f651fd4d0c290334b0cb</td>\n",
       "      <td>Win.Worm.VB-759</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-759</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>183</th>\n",
       "      <td>4</td>\n",
       "      <td>39f082c4d862a95047eceb4900786e4815d033e4</td>\n",
       "      <td>Win.Worm.VB-759</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-759</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>366</th>\n",
       "      <td>4</td>\n",
       "      <td>76d18d4016d1fa2ff0d6469834321aac154b8c07</td>\n",
       "      <td>Win.Worm.VB-759</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-759</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>684</th>\n",
       "      <td>4</td>\n",
       "      <td>c75d152261c081d56014638fb238713d5b1e9da5</td>\n",
       "      <td>Win.Worm.VB-759</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-759</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>778</th>\n",
       "      <td>4</td>\n",
       "      <td>d9483746b819f4cfab178d75b03810b24148ac1e</td>\n",
       "      <td>Win.Worm.VB-759</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-759</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>226</th>\n",
       "      <td>16</td>\n",
       "      <td>484fd11f52b48c5e14d42769c06be9ee4fb65623</td>\n",
       "      <td>Win.Worm.VB-771</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-771</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>44</th>\n",
       "      <td>3</td>\n",
       "      <td>1122b4970b0eacf69cb681b57662b35ac582b190</td>\n",
       "      <td>Win.Worm.Winko-3</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Winko-3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>541</th>\n",
       "      <td>3</td>\n",
       "      <td>ab78f9c68fa5665f1066f1a30c57dfc7761c9a6c</td>\n",
       "      <td>Win.Worm.Wukill-1</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Wukill-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>816</th>\n",
       "      <td>3</td>\n",
       "      <td>df383cf1ecdedc49c81aba5d825dfc080ff06fb6</td>\n",
       "      <td>Win.Worm.Wukill-1</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Wukill-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>548</th>\n",
       "      <td>3</td>\n",
       "      <td>ac556bcff64320ce74535f8afa9377fb944a9dcb</td>\n",
       "      <td>Win.Worm.Xorer-60</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Xorer-60</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>999 rows × 6 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "     id                                      sha1  \\\n",
       "663  10  c1dd76941ebe042428e7651091575f7a0a955190   \n",
       "585  10  b2492b568886d7d984fff1a82a12818ea65ef914   \n",
       "108  10  2415e12bec40f570952f5a3a37921897ff4060b7   \n",
       "682   0  c6de49b7c941a9910933bcac15945003e3b6931a   \n",
       "288   2  6181a0bed2183f1cc771e948385766096dfda960   \n",
       "319   2  66a99c935554e027f1953619485fece2bb218d36   \n",
       "733   2  cf085b528f7416911661e553627c6163272558d7   \n",
       "587   1  b2705c4c01635560d275477df05f86a58ac06bf1   \n",
       "193  10  415251e5d27878b029e3deb352356b6b8de20e70   \n",
       "699  10  c907f5f720fdf3125d88f44b361379ae8bbcad4c   \n",
       "543   1  ac0c00b1ccbcd23179b05f0f115287434d3b0c96   \n",
       "859   1  e69abc47b958424b6f69aae763ecb806e9bcb94b   \n",
       "228   3  48522df27be17bcbda8df6c3ae3952b574016021   \n",
       "697   0  c8ddc2cffcd0982a7d27ede223a4eb8f908476c5   \n",
       "666   0  c2e6378fb8dd79f9badf6ad1967638dd2701cdf3   \n",
       "992   0  fe7f2994873f567060d472fe866fa1d2e46431d6   \n",
       "680   0  c67b7034bf50d9ded214e00e8f57909725842c32   \n",
       "864   3  e7d49afddd58c5fdfe292771d59533c855e2ab51   \n",
       "392  10  79f178d15e2e6f66eeb8b638c96185735c09382b   \n",
       "399   3  8146216b92b26eac3b5b691df943fd84a43be3ce   \n",
       "321   0  67167544d5b3e5dddae0e887518781f68736ac39   \n",
       "805   0  dd52275afc360df7714edb294fc296d9eb67c8a9   \n",
       "6    10  018ab1f4961f12122f9b9a4d546d6bb6f120fb54   \n",
       "668  10  c2fb1e4204a2e78f47a8a7eb24e2d2a71d319c22   \n",
       "757   1  d463ed524d9fc42700820dc8354c467d70f7031d   \n",
       "115  10  25809adcadfd629b3db39933134b03df33b2ee19   \n",
       "333   1  701ab7f4f44c7d381eddaac92a7f0aa21d5da4f5   \n",
       "449   1  922f430527ce44bff152d9417bb43befebce2c7f   \n",
       "770   1  d7ad49bc1734c7c722ea7eef0be6437d87a91204   \n",
       "967   1  faad3b875d9dbd73de3c3a3724bb6c17617961f9   \n",
       "..   ..                                       ...   \n",
       "112  10  24e0502e5714ff2a3d18267fb2da90b2857beef5   \n",
       "173  10  3783169cd2f1f16e3e62486184a00b19f1c2178d   \n",
       "188  10  40eb8ca7f3c3182fae2a1b9e0a12d96d4d5d9b6e   \n",
       "223  10  480445883ce2c26409bea4b3cd608fddca2e0bdd   \n",
       "303  10  63b725a3db49a0b57c0a1707980fcb99356ce500   \n",
       "304  10  63bd4fd60df5cd6830020afa711b0ce5f9ae600a   \n",
       "360  10  767f4a21c4e3c75c47a9220412922c51f55329c8   \n",
       "434  10  87b3e27d09b4a448bc0ce13d06fe70a842ebd423   \n",
       "603  10  b461691aea84fba5f534c9396c67714a2cf67483   \n",
       "651  10  bde3cc01a6a0fd65615af49e75da2f3716965a80   \n",
       "773  10  d7e4cffb9e0c525c866256b3a6d09ab67fdd4ac4   \n",
       "907  10  ee7bb61abda377f0d4d02c8cf28d14557c51bd2f   \n",
       "957  10  f8d60e944f6650b63be151d9445bc7f3d5c0e7bd   \n",
       "381  16  782884ef1ad99969bf306d9d734791c9cc9231fd   \n",
       "672  16  c4302fc219809563e11244f0deb27b46387965b5   \n",
       "809  10  dda7a785f841d11180766ac1d5e4955d5b99a488   \n",
       "385   3  78dbf656082aa3ed41ec3b9fb1a84d4ed25610fe   \n",
       "285   4  611b95f04d89e05b35ee6c7955eac5ffb06fa8d4   \n",
       "347   0  73c5c819413706cac3be064b59605191f1ef3a47   \n",
       "811   0  dea3677b63857429c2d876f04507e37b44e6cc1f   \n",
       "968   3  fad16883b7c1c63caee5f651fd4d0c290334b0cb   \n",
       "183   4  39f082c4d862a95047eceb4900786e4815d033e4   \n",
       "366   4  76d18d4016d1fa2ff0d6469834321aac154b8c07   \n",
       "684   4  c75d152261c081d56014638fb238713d5b1e9da5   \n",
       "778   4  d9483746b819f4cfab178d75b03810b24148ac1e   \n",
       "226  16  484fd11f52b48c5e14d42769c06be9ee4fb65623   \n",
       "44    3  1122b4970b0eacf69cb681b57662b35ac582b190   \n",
       "541   3  ab78f9c68fa5665f1066f1a30c57dfc7761c9a6c   \n",
       "816   3  df383cf1ecdedc49c81aba5d825dfc080ff06fb6   \n",
       "548   3  ac556bcff64320ce74535f8afa9377fb944a9dcb   \n",
       "\n",
       "                            vname platform classes              other  \n",
       "663      Win.Adware.Agent-1153194      Win  Adware      Agent-1153194  \n",
       "585      Win.Adware.Agent-1173005      Win  Adware      Agent-1173005  \n",
       "108      Win.Adware.Agent-1383450      Win  Adware      Agent-1383450  \n",
       "682       Win.Adware.Agent-361412      Win  Adware       Agent-361412  \n",
       "288       Win.Adware.Agent-887467      Win  Adware       Agent-887467  \n",
       "319       Win.Adware.Agent-887467      Win  Adware       Agent-887467  \n",
       "733       Win.Adware.Agent-887467      Win  Adware       Agent-887467  \n",
       "587     Win.Adware.Amonetize-1360      Win  Adware     Amonetize-1360  \n",
       "193        Win.Adware.Amonetize-2      Win  Adware        Amonetize-2  \n",
       "699        Win.Adware.Amonetize-2      Win  Adware        Amonetize-2  \n",
       "543    Win.Adware.Browsefox-42699      Win  Adware    Browsefox-42699  \n",
       "859    Win.Adware.Browsefox-42725      Win  Adware    Browsefox-42725  \n",
       "228            Win.Adware.Cpush-2      Win  Adware            Cpush-2  \n",
       "697  Win.Adware.Dealply-5865861-0      Win  Adware  Dealply-5865861-0  \n",
       "666  Win.Adware.Dealply-6202291-0      Win  Adware  Dealply-6202291-0  \n",
       "992  Win.Adware.Dealply-6244916-0      Win  Adware  Dealply-6244916-0  \n",
       "680  Win.Adware.Dealply-6246742-0      Win  Adware  Dealply-6246742-0  \n",
       "864        Win.Adware.Downware-26      Win  Adware        Downware-26  \n",
       "392       Win.Adware.Downware-305      Win  Adware       Downware-305  \n",
       "399         Win.Adware.Imloader-2      Win  Adware         Imloader-2  \n",
       "321    Win.Adware.Installcore-177      Win  Adware    Installcore-177  \n",
       "805    Win.Adware.Installcore-516      Win  Adware    Installcore-516  \n",
       "6           Win.Adware.Mplug-2401      Win  Adware         Mplug-2401  \n",
       "668         Win.Adware.Mplug-2444      Win  Adware         Mplug-2444  \n",
       "757      Win.Adware.Netfilter-186      Win  Adware      Netfilter-186  \n",
       "115      Win.Adware.Netfilter-186      Win  Adware      Netfilter-186  \n",
       "333      Win.Adware.Netfilter-190      Win  Adware      Netfilter-190  \n",
       "449      Win.Adware.Netfilter-190      Win  Adware      Netfilter-190  \n",
       "770      Win.Adware.Netfilter-190      Win  Adware      Netfilter-190  \n",
       "967      Win.Adware.Netfilter-190      Win  Adware      Netfilter-190  \n",
       "..                            ...      ...     ...                ...  \n",
       "112              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "173              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "188              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "223              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "303              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "304              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "360              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "434              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "603              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "651              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "773              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "907              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "957              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "381              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "672              Win.Worm.Tenga-2      Win    Worm            Tenga-2  \n",
       "809            Win.Worm.Tufik-166      Win    Worm          Tufik-166  \n",
       "385              Win.Worm.VB-1038      Win    Worm            VB-1038  \n",
       "285              Win.Worm.VB-3470      Win    Worm            VB-3470  \n",
       "347               Win.Worm.VB-759      Win    Worm             VB-759  \n",
       "811               Win.Worm.VB-759      Win    Worm             VB-759  \n",
       "968               Win.Worm.VB-759      Win    Worm             VB-759  \n",
       "183               Win.Worm.VB-759      Win    Worm             VB-759  \n",
       "366               Win.Worm.VB-759      Win    Worm             VB-759  \n",
       "684               Win.Worm.VB-759      Win    Worm             VB-759  \n",
       "778               Win.Worm.VB-759      Win    Worm             VB-759  \n",
       "226               Win.Worm.VB-771      Win    Worm             VB-771  \n",
       "44               Win.Worm.Winko-3      Win    Worm            Winko-3  \n",
       "541             Win.Worm.Wukill-1      Win    Worm           Wukill-1  \n",
       "816             Win.Worm.Wukill-1      Win    Worm           Wukill-1  \n",
       "548             Win.Worm.Xorer-60      Win    Worm           Xorer-60  \n",
       "\n",
       "[999 rows x 6 columns]"
      ]
     },
     "execution_count": 40,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "virsort = virall.sort_values(by=['classes', 'other', 'id'])\n",
    "virsort"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style>\n",
       "    .dataframe thead tr:only-child th {\n",
       "        text-align: right;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: left;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>sha1</th>\n",
       "      <th>vname</th>\n",
       "      <th>platform</th>\n",
       "      <th>classes</th>\n",
       "      <th>other</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>682</th>\n",
       "      <td>0</td>\n",
       "      <td>c6de49b7c941a9910933bcac15945003e3b6931a</td>\n",
       "      <td>Win.Adware.Agent-361412</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Agent-361412</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>697</th>\n",
       "      <td>0</td>\n",
       "      <td>c8ddc2cffcd0982a7d27ede223a4eb8f908476c5</td>\n",
       "      <td>Win.Adware.Dealply-5865861-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Dealply-5865861-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>666</th>\n",
       "      <td>0</td>\n",
       "      <td>c2e6378fb8dd79f9badf6ad1967638dd2701cdf3</td>\n",
       "      <td>Win.Adware.Dealply-6202291-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Dealply-6202291-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>992</th>\n",
       "      <td>0</td>\n",
       "      <td>fe7f2994873f567060d472fe866fa1d2e46431d6</td>\n",
       "      <td>Win.Adware.Dealply-6244916-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Dealply-6244916-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>680</th>\n",
       "      <td>0</td>\n",
       "      <td>c67b7034bf50d9ded214e00e8f57909725842c32</td>\n",
       "      <td>Win.Adware.Dealply-6246742-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Dealply-6246742-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>321</th>\n",
       "      <td>0</td>\n",
       "      <td>67167544d5b3e5dddae0e887518781f68736ac39</td>\n",
       "      <td>Win.Adware.Installcore-177</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Installcore-177</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>805</th>\n",
       "      <td>0</td>\n",
       "      <td>dd52275afc360df7714edb294fc296d9eb67c8a9</td>\n",
       "      <td>Win.Adware.Installcore-516</td>\n",
       "      <td>Win</td>\n",
       "      <td>Adware</td>\n",
       "      <td>Installcore-516</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>480</th>\n",
       "      <td>0</td>\n",
       "      <td>98ad84b093bcc3b55499ce9f7272f09c7584905e</td>\n",
       "      <td>Win.Malware.Agent-6395331-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Malware</td>\n",
       "      <td>Agent-6395331-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>721</th>\n",
       "      <td>0</td>\n",
       "      <td>cc4a1d16bf15211ea64601a27f609684ced37b4d</td>\n",
       "      <td>Win.Malware.Agent-6398038-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Malware</td>\n",
       "      <td>Agent-6398038-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>887</th>\n",
       "      <td>0</td>\n",
       "      <td>eb5b8d2f3502145f7c3c9be842438d7f4595bb49</td>\n",
       "      <td>Win.Malware.Emotet-6397452-0</td>\n",
       "      <td>Win</td>\n",
       "      <td>Malware</td>\n",
       "      <td>Emotet-6397452-0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>221</th>\n",
       "      <td>0</td>\n",
       "      <td>47c0a8b3b77306557dc3c3cd11f3f517a6835323</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "      <td>W32</td>\n",
       "      <td>Parite</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>254</th>\n",
       "      <td>0</td>\n",
       "      <td>53da7b820f2308d1883b84372e9a25998146ca72</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "      <td>W32</td>\n",
       "      <td>Parite</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>586</th>\n",
       "      <td>0</td>\n",
       "      <td>b26e55842cc21cf491d231b274b9e257dc2413ef</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "      <td>W32</td>\n",
       "      <td>Parite</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>617</th>\n",
       "      <td>0</td>\n",
       "      <td>b6c07813bebad4da39bab54025b3468784df6f31</td>\n",
       "      <td>Heuristics.W32.Parite.B</td>\n",
       "      <td>W32</td>\n",
       "      <td>Parite</td>\n",
       "      <td>B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>849</th>\n",
       "      <td>0</td>\n",
       "      <td>e5305d2e2c1a5e8f856135222b94f1a506ea9025</td>\n",
       "      <td>Win.Spyware.16289-1</td>\n",
       "      <td>Win</td>\n",
       "      <td>Spyware</td>\n",
       "      <td>16289-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>370</th>\n",
       "      <td>0</td>\n",
       "      <td>77141863a8a80562fcc0ca726c33b813b0708716</td>\n",
       "      <td>Win.Trojan.Ag-6</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Ag-6</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>0</td>\n",
       "      <td>0614efa32420f5665ad3ce9339e16b9783a642df</td>\n",
       "      <td>Win.Trojan.Agent-1117603</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1117603</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>200</th>\n",
       "      <td>0</td>\n",
       "      <td>42f858512169aa06a21f5f7d2351c62d1c5ad4b5</td>\n",
       "      <td>Win.Trojan.Agent-1117603</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1117603</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>232</th>\n",
       "      <td>0</td>\n",
       "      <td>49106c0e12f8f6961f5ca221b0b82104686fcee3</td>\n",
       "      <td>Win.Trojan.Agent-1117603</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1117603</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>325</th>\n",
       "      <td>0</td>\n",
       "      <td>689125c0d9a0cb7ecab4df779192867822668585</td>\n",
       "      <td>Win.Trojan.Agent-1117603</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1117603</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>730</th>\n",
       "      <td>0</td>\n",
       "      <td>ce985607d91f08c22995b6577bee15ef616ee5ac</td>\n",
       "      <td>Win.Trojan.Agent-1117603</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1117603</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>130</th>\n",
       "      <td>0</td>\n",
       "      <td>27d73c3cba60814dd381b1cc9129a13eecb592e9</td>\n",
       "      <td>Win.Trojan.Agent-1146639</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1146639</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>826</th>\n",
       "      <td>0</td>\n",
       "      <td>e0cecc4930f1b0065b2525352aef02713d77f08f</td>\n",
       "      <td>Win.Trojan.Agent-1146639</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1146639</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>797</th>\n",
       "      <td>0</td>\n",
       "      <td>dbe15034a5310b6f06c07efc8141d053dd87d418</td>\n",
       "      <td>Win.Trojan.Agent-1174370</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1174370</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>742</th>\n",
       "      <td>0</td>\n",
       "      <td>d19ea24bbef018ae14e91b928cdd2d2a4aa4dbae</td>\n",
       "      <td>Win.Trojan.Agent-1349935</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1349935</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>732</th>\n",
       "      <td>0</td>\n",
       "      <td>cefc8fb49c6a46c6414d5775ad65922f24f83483</td>\n",
       "      <td>Win.Trojan.Agent-1356380</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1356380</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>0</td>\n",
       "      <td>028bc90fea56ae2916f6c85ad4a2386c28054be4</td>\n",
       "      <td>Legacy.Trojan.Agent-1388589</td>\n",
       "      <td>Legacy</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1388589</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>927</th>\n",
       "      <td>0</td>\n",
       "      <td>f34283f3288f3192baa4fde71188b8487a7fc2ea</td>\n",
       "      <td>Legacy.Trojan.Agent-1388589</td>\n",
       "      <td>Legacy</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1388589</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>417</th>\n",
       "      <td>0</td>\n",
       "      <td>84fe61acee90134c6bfbd3cecf1fb07bc22c997c</td>\n",
       "      <td>Win.Trojan.Agent-1430718</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-1430718</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>389</th>\n",
       "      <td>0</td>\n",
       "      <td>79cab02048d7b5dfce33f41ea583ef7da495f5d9</td>\n",
       "      <td>Win.Trojan.Agent-35863</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-35863</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>316</th>\n",
       "      <td>16</td>\n",
       "      <td>65d7196a5d2d15ba6ee5fe168dc5b9c018a3db03</td>\n",
       "      <td>Win.Trojan.Agent-36126</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Agent-36126</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>638</th>\n",
       "      <td>16</td>\n",
       "      <td>bbad717f84e44b4ada543e900a731cbe50bb3f49</td>\n",
       "      <td>Win.Trojan.Alman-6</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Alman-6</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>784</th>\n",
       "      <td>16</td>\n",
       "      <td>da5d3ca81fdc7861ed0f3b573bbac0238a178d44</td>\n",
       "      <td>Win.Trojan.Jeefo-3</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Jeefo-3</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>151</th>\n",
       "      <td>16</td>\n",
       "      <td>333c78f761ab17ed24fea0022da0f9430b146af1</td>\n",
       "      <td>Win.Trojan.Keygen-92</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Keygen-92</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>111</th>\n",
       "      <td>16</td>\n",
       "      <td>24d8ef9084939efa933b6293376197b0a173f96e</td>\n",
       "      <td>Win.Trojan.Madangel-1</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Madangel-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>911</th>\n",
       "      <td>16</td>\n",
       "      <td>efd6030f6cad2d7e79faa6c026975274d3dd4d2d</td>\n",
       "      <td>Win.Trojan.Parite-1044</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Parite-1044</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>896</th>\n",
       "      <td>16</td>\n",
       "      <td>ec7a5709f67b5a265b4b5907ff198f33256ccf84</td>\n",
       "      <td>Win.Trojan.Sality-1053</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Sality-1053</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>296</th>\n",
       "      <td>16</td>\n",
       "      <td>6323a84a57b266d53cae2b1798d3f4602e2dc7a9</td>\n",
       "      <td>Win.Trojan.Virut-263</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Virut-263</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>950</th>\n",
       "      <td>16</td>\n",
       "      <td>f7600902bea07a247b9aa702c0ecd7ab31d3640a</td>\n",
       "      <td>Win.Trojan.Virut-263</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Virut-263</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>444</th>\n",
       "      <td>16</td>\n",
       "      <td>905d6d75cae4145813b33f6a479ae0cf27563b31</td>\n",
       "      <td>Win.Trojan.Zloyfly-1</td>\n",
       "      <td>Win</td>\n",
       "      <td>Trojan</td>\n",
       "      <td>Zloyfly-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>412</th>\n",
       "      <td>16</td>\n",
       "      <td>83cbf08e35181fec7a1122bdd78d214b159e6e5a</td>\n",
       "      <td>Win.Virus.Sality-1067</td>\n",
       "      <td>Win</td>\n",
       "      <td>Virus</td>\n",
       "      <td>Sality-1067</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>659</th>\n",
       "      <td>16</td>\n",
       "      <td>c09a01880368cb60e767fd0b95ce19f90d719c7f</td>\n",
       "      <td>Win.Virus.Sality-1067</td>\n",
       "      <td>Win</td>\n",
       "      <td>Virus</td>\n",
       "      <td>Sality-1067</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>985</th>\n",
       "      <td>16</td>\n",
       "      <td>fde8f11cb6f2710576bdb7dfc186082714222605</td>\n",
       "      <td>Win.Virus.Virut-5898123-1</td>\n",
       "      <td>Win</td>\n",
       "      <td>Virus</td>\n",
       "      <td>Virut-5898123-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>447</th>\n",
       "      <td>16</td>\n",
       "      <td>9122cb479359553b601d9a2043820670a2ea11d1</td>\n",
       "      <td>Win.Worm.Autorun-313</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Autorun-313</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>458</th>\n",
       "      <td>16</td>\n",
       "      <td>9449b39159b646680fe32057e8cdcf967aaea1b1</td>\n",
       "      <td>Win.Worm.Autorun-313</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Autorun-313</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>526</th>\n",
       "      <td>16</td>\n",
       "      <td>a78a619a1b388c1eb801096ffceecccea7d59a3b</td>\n",
       "      <td>Win.Worm.Autorun-313</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Autorun-313</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>581</th>\n",
       "      <td>16</td>\n",
       "      <td>b1abe50fe4cc9a7cf49733032dceead4aaf71bd2</td>\n",
       "      <td>Win.Worm.Autorun-313</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Autorun-313</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>690</th>\n",
       "      <td>16</td>\n",
       "      <td>c86766b9bdb1c177a9f40ff29ff266343b495a04</td>\n",
       "      <td>Win.Worm.Autorun-313</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Autorun-313</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>829</th>\n",
       "      <td>16</td>\n",
       "      <td>e0f6ada9ea4e6390fca247649827ab6f47126ebb</td>\n",
       "      <td>Win.Worm.Autorun-313</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Autorun-313</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>923</th>\n",
       "      <td>16</td>\n",
       "      <td>f28f4a3a96513e3660ae5b51b367cfa4d57aeafa</td>\n",
       "      <td>Win.Worm.Autorun-313</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Autorun-313</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>415</th>\n",
       "      <td>16</td>\n",
       "      <td>848b509e19a37f23266112ecd90ef711983b5a8e</td>\n",
       "      <td>Win.Worm.Brontok-88</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Brontok-88</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>615</th>\n",
       "      <td>16</td>\n",
       "      <td>b68c1d4955d9336b359f1ba47d260cd9c8e647e5</td>\n",
       "      <td>Win.Worm.Brontok-88</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Brontok-88</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>953</th>\n",
       "      <td>16</td>\n",
       "      <td>f7be0057a1070afc5912f237fca7adf4fbc57b56</td>\n",
       "      <td>Win.Worm.Downadup-75</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Downadup-75</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>788</th>\n",
       "      <td>16</td>\n",
       "      <td>db4f66751d6d275024a2ec5006eb7c711fc05599</td>\n",
       "      <td>Win.Worm.Kido-238</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Kido-238</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>717</th>\n",
       "      <td>16</td>\n",
       "      <td>cba25c99e76bd2e6036e17d7cc29447125987bcb</td>\n",
       "      <td>Win.Worm.Kido-273</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Kido-273</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>63</th>\n",
       "      <td>16</td>\n",
       "      <td>15c82b0a249499616566ea38c4fd2d7e52345272</td>\n",
       "      <td>Win.Worm.Kido-360</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Kido-360</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>916</th>\n",
       "      <td>16</td>\n",
       "      <td>f14a12ebc0c817ca700ed0c23b18581359091058</td>\n",
       "      <td>Win.Worm.Rays-1</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Rays-1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>381</th>\n",
       "      <td>16</td>\n",
       "      <td>782884ef1ad99969bf306d9d734791c9cc9231fd</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>672</th>\n",
       "      <td>16</td>\n",
       "      <td>c4302fc219809563e11244f0deb27b46387965b5</td>\n",
       "      <td>Win.Worm.Tenga-2</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>Tenga-2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>226</th>\n",
       "      <td>16</td>\n",
       "      <td>484fd11f52b48c5e14d42769c06be9ee4fb65623</td>\n",
       "      <td>Win.Worm.VB-771</td>\n",
       "      <td>Win</td>\n",
       "      <td>Worm</td>\n",
       "      <td>VB-771</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>999 rows × 6 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "     id                                      sha1  \\\n",
       "682   0  c6de49b7c941a9910933bcac15945003e3b6931a   \n",
       "697   0  c8ddc2cffcd0982a7d27ede223a4eb8f908476c5   \n",
       "666   0  c2e6378fb8dd79f9badf6ad1967638dd2701cdf3   \n",
       "992   0  fe7f2994873f567060d472fe866fa1d2e46431d6   \n",
       "680   0  c67b7034bf50d9ded214e00e8f57909725842c32   \n",
       "321   0  67167544d5b3e5dddae0e887518781f68736ac39   \n",
       "805   0  dd52275afc360df7714edb294fc296d9eb67c8a9   \n",
       "480   0  98ad84b093bcc3b55499ce9f7272f09c7584905e   \n",
       "721   0  cc4a1d16bf15211ea64601a27f609684ced37b4d   \n",
       "887   0  eb5b8d2f3502145f7c3c9be842438d7f4595bb49   \n",
       "221   0  47c0a8b3b77306557dc3c3cd11f3f517a6835323   \n",
       "254   0  53da7b820f2308d1883b84372e9a25998146ca72   \n",
       "586   0  b26e55842cc21cf491d231b274b9e257dc2413ef   \n",
       "617   0  b6c07813bebad4da39bab54025b3468784df6f31   \n",
       "849   0  e5305d2e2c1a5e8f856135222b94f1a506ea9025   \n",
       "370   0  77141863a8a80562fcc0ca726c33b813b0708716   \n",
       "25    0  0614efa32420f5665ad3ce9339e16b9783a642df   \n",
       "200   0  42f858512169aa06a21f5f7d2351c62d1c5ad4b5   \n",
       "232   0  49106c0e12f8f6961f5ca221b0b82104686fcee3   \n",
       "325   0  689125c0d9a0cb7ecab4df779192867822668585   \n",
       "730   0  ce985607d91f08c22995b6577bee15ef616ee5ac   \n",
       "130   0  27d73c3cba60814dd381b1cc9129a13eecb592e9   \n",
       "826   0  e0cecc4930f1b0065b2525352aef02713d77f08f   \n",
       "797   0  dbe15034a5310b6f06c07efc8141d053dd87d418   \n",
       "742   0  d19ea24bbef018ae14e91b928cdd2d2a4aa4dbae   \n",
       "732   0  cefc8fb49c6a46c6414d5775ad65922f24f83483   \n",
       "10    0  028bc90fea56ae2916f6c85ad4a2386c28054be4   \n",
       "927   0  f34283f3288f3192baa4fde71188b8487a7fc2ea   \n",
       "417   0  84fe61acee90134c6bfbd3cecf1fb07bc22c997c   \n",
       "389   0  79cab02048d7b5dfce33f41ea583ef7da495f5d9   \n",
       "..   ..                                       ...   \n",
       "316  16  65d7196a5d2d15ba6ee5fe168dc5b9c018a3db03   \n",
       "638  16  bbad717f84e44b4ada543e900a731cbe50bb3f49   \n",
       "784  16  da5d3ca81fdc7861ed0f3b573bbac0238a178d44   \n",
       "151  16  333c78f761ab17ed24fea0022da0f9430b146af1   \n",
       "111  16  24d8ef9084939efa933b6293376197b0a173f96e   \n",
       "911  16  efd6030f6cad2d7e79faa6c026975274d3dd4d2d   \n",
       "896  16  ec7a5709f67b5a265b4b5907ff198f33256ccf84   \n",
       "296  16  6323a84a57b266d53cae2b1798d3f4602e2dc7a9   \n",
       "950  16  f7600902bea07a247b9aa702c0ecd7ab31d3640a   \n",
       "444  16  905d6d75cae4145813b33f6a479ae0cf27563b31   \n",
       "412  16  83cbf08e35181fec7a1122bdd78d214b159e6e5a   \n",
       "659  16  c09a01880368cb60e767fd0b95ce19f90d719c7f   \n",
       "985  16  fde8f11cb6f2710576bdb7dfc186082714222605   \n",
       "447  16  9122cb479359553b601d9a2043820670a2ea11d1   \n",
       "458  16  9449b39159b646680fe32057e8cdcf967aaea1b1   \n",
       "526  16  a78a619a1b388c1eb801096ffceecccea7d59a3b   \n",
       "581  16  b1abe50fe4cc9a7cf49733032dceead4aaf71bd2   \n",
       "690  16  c86766b9bdb1c177a9f40ff29ff266343b495a04   \n",
       "829  16  e0f6ada9ea4e6390fca247649827ab6f47126ebb   \n",
       "923  16  f28f4a3a96513e3660ae5b51b367cfa4d57aeafa   \n",
       "415  16  848b509e19a37f23266112ecd90ef711983b5a8e   \n",
       "615  16  b68c1d4955d9336b359f1ba47d260cd9c8e647e5   \n",
       "953  16  f7be0057a1070afc5912f237fca7adf4fbc57b56   \n",
       "788  16  db4f66751d6d275024a2ec5006eb7c711fc05599   \n",
       "717  16  cba25c99e76bd2e6036e17d7cc29447125987bcb   \n",
       "63   16  15c82b0a249499616566ea38c4fd2d7e52345272   \n",
       "916  16  f14a12ebc0c817ca700ed0c23b18581359091058   \n",
       "381  16  782884ef1ad99969bf306d9d734791c9cc9231fd   \n",
       "672  16  c4302fc219809563e11244f0deb27b46387965b5   \n",
       "226  16  484fd11f52b48c5e14d42769c06be9ee4fb65623   \n",
       "\n",
       "                            vname platform  classes              other  \n",
       "682       Win.Adware.Agent-361412      Win   Adware       Agent-361412  \n",
       "697  Win.Adware.Dealply-5865861-0      Win   Adware  Dealply-5865861-0  \n",
       "666  Win.Adware.Dealply-6202291-0      Win   Adware  Dealply-6202291-0  \n",
       "992  Win.Adware.Dealply-6244916-0      Win   Adware  Dealply-6244916-0  \n",
       "680  Win.Adware.Dealply-6246742-0      Win   Adware  Dealply-6246742-0  \n",
       "321    Win.Adware.Installcore-177      Win   Adware    Installcore-177  \n",
       "805    Win.Adware.Installcore-516      Win   Adware    Installcore-516  \n",
       "480   Win.Malware.Agent-6395331-0      Win  Malware    Agent-6395331-0  \n",
       "721   Win.Malware.Agent-6398038-0      Win  Malware    Agent-6398038-0  \n",
       "887  Win.Malware.Emotet-6397452-0      Win  Malware   Emotet-6397452-0  \n",
       "221       Heuristics.W32.Parite.B      W32   Parite                  B  \n",
       "254       Heuristics.W32.Parite.B      W32   Parite                  B  \n",
       "586       Heuristics.W32.Parite.B      W32   Parite                  B  \n",
       "617       Heuristics.W32.Parite.B      W32   Parite                  B  \n",
       "849           Win.Spyware.16289-1      Win  Spyware            16289-1  \n",
       "370               Win.Trojan.Ag-6      Win   Trojan               Ag-6  \n",
       "25       Win.Trojan.Agent-1117603      Win   Trojan      Agent-1117603  \n",
       "200      Win.Trojan.Agent-1117603      Win   Trojan      Agent-1117603  \n",
       "232      Win.Trojan.Agent-1117603      Win   Trojan      Agent-1117603  \n",
       "325      Win.Trojan.Agent-1117603      Win   Trojan      Agent-1117603  \n",
       "730      Win.Trojan.Agent-1117603      Win   Trojan      Agent-1117603  \n",
       "130      Win.Trojan.Agent-1146639      Win   Trojan      Agent-1146639  \n",
       "826      Win.Trojan.Agent-1146639      Win   Trojan      Agent-1146639  \n",
       "797      Win.Trojan.Agent-1174370      Win   Trojan      Agent-1174370  \n",
       "742      Win.Trojan.Agent-1349935      Win   Trojan      Agent-1349935  \n",
       "732      Win.Trojan.Agent-1356380      Win   Trojan      Agent-1356380  \n",
       "10    Legacy.Trojan.Agent-1388589   Legacy   Trojan      Agent-1388589  \n",
       "927   Legacy.Trojan.Agent-1388589   Legacy   Trojan      Agent-1388589  \n",
       "417      Win.Trojan.Agent-1430718      Win   Trojan      Agent-1430718  \n",
       "389        Win.Trojan.Agent-35863      Win   Trojan        Agent-35863  \n",
       "..                            ...      ...      ...                ...  \n",
       "316        Win.Trojan.Agent-36126      Win   Trojan        Agent-36126  \n",
       "638            Win.Trojan.Alman-6      Win   Trojan            Alman-6  \n",
       "784            Win.Trojan.Jeefo-3      Win   Trojan            Jeefo-3  \n",
       "151          Win.Trojan.Keygen-92      Win   Trojan          Keygen-92  \n",
       "111         Win.Trojan.Madangel-1      Win   Trojan         Madangel-1  \n",
       "911        Win.Trojan.Parite-1044      Win   Trojan        Parite-1044  \n",
       "896        Win.Trojan.Sality-1053      Win   Trojan        Sality-1053  \n",
       "296          Win.Trojan.Virut-263      Win   Trojan          Virut-263  \n",
       "950          Win.Trojan.Virut-263      Win   Trojan          Virut-263  \n",
       "444          Win.Trojan.Zloyfly-1      Win   Trojan          Zloyfly-1  \n",
       "412         Win.Virus.Sality-1067      Win    Virus        Sality-1067  \n",
       "659         Win.Virus.Sality-1067      Win    Virus        Sality-1067  \n",
       "985     Win.Virus.Virut-5898123-1      Win    Virus    Virut-5898123-1  \n",
       "447          Win.Worm.Autorun-313      Win     Worm        Autorun-313  \n",
       "458          Win.Worm.Autorun-313      Win     Worm        Autorun-313  \n",
       "526          Win.Worm.Autorun-313      Win     Worm        Autorun-313  \n",
       "581          Win.Worm.Autorun-313      Win     Worm        Autorun-313  \n",
       "690          Win.Worm.Autorun-313      Win     Worm        Autorun-313  \n",
       "829          Win.Worm.Autorun-313      Win     Worm        Autorun-313  \n",
       "923          Win.Worm.Autorun-313      Win     Worm        Autorun-313  \n",
       "415           Win.Worm.Brontok-88      Win     Worm         Brontok-88  \n",
       "615           Win.Worm.Brontok-88      Win     Worm         Brontok-88  \n",
       "953          Win.Worm.Downadup-75      Win     Worm        Downadup-75  \n",
       "788             Win.Worm.Kido-238      Win     Worm           Kido-238  \n",
       "717             Win.Worm.Kido-273      Win     Worm           Kido-273  \n",
       "63              Win.Worm.Kido-360      Win     Worm           Kido-360  \n",
       "916               Win.Worm.Rays-1      Win     Worm             Rays-1  \n",
       "381              Win.Worm.Tenga-2      Win     Worm            Tenga-2  \n",
       "672              Win.Worm.Tenga-2      Win     Worm            Tenga-2  \n",
       "226               Win.Worm.VB-771      Win     Worm             VB-771  \n",
       "\n",
       "[999 rows x 6 columns]"
      ]
     },
     "execution_count": 41,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "virsort = virall.sort_values(by=['id', 'classes', 'other'])\n",
    "virsort"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 2",
   "language": "python",
   "name": "python2"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 2
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython2",
   "version": "2.7.13"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}