Abstract: Properties of using various assembler commands, as well as their combined application, have been investigated in order to prepare a final determination as to whether they belong to a known program. Conclusions on the effect of the ratio used in the creation of unified signatures on result of identifications are presented.