<p>With the continuous escalation of cyberattacks, the forms of malware have become increasingly diverse, posing significant security threats to enterprises, government agencies, and individual users. Malware developers often employ techniques such as packing and obfuscation to evade detection, making traditional detection methods less effective. This study proposes a malware family classification method based on feature fusion and a two-layer classification framework. First, readable characters, bytes, and opcodes are extracted from the malware binary and disassembly files. Frequency and semantic features are extracted from both opcodes and readable characters, followed by frequency fusion and semantic fusion. A Markov image is generated from the byte transfer probability matrix. Next, a two-layer classification framework combining deep learning and traditional machine learning is designed based on the fused features and Markov image. This framework effectively integrates the advantages of different feature dimensions and models. In the first layer, each feature is detected, and in the second layer, the prediction probabilities of each feature are fused. Experimental results show that the proposed method achieves a malware family classification accuracy of 99.4%, outperforming other compared methods. The Macro-F1 score also improves by 1.4% compared to the best method. The approach reduces the impact of malware packing, obfuscation techniques, and data imbalance on classification performance, providing an effective solution for malware classification.</p>