I found you need to move the hyphen to the end of your capture group.
[\w\.-]
instead of:
[\w-\.]
The full line would be:
<malware\sname=\"(?<malware_name>[\w\.-]{1,30})\"\s*(sid=\"(?<malware_sid>\d*)")?\s*(stype=\"(?<malware_stype>[\w-]{1,30})\")?
... View more