Yes you shoot malware itself.

You don't shoot a site that links to a site that links to a site that links to malware.

You don't label a website as malware for spamming.