Great question — answering as the UphillTech team:
I may be missing something, but I don't see any unexpected behavior here. The malware created those pages and then Google indexed them. Then, you removed the malware. Naturally, Google re-crawls the pages as it does for every page in its search index. It found them to be 404, which is the first step towards removing them from the index. After Google performs repeat crawls of the 404 URLs a few times (to confirm they are actually permanently removed), then they will naturally drop out of the index. Davidgo is on the right track about expedited removals, however Google's removals tool that I am aware about only supports URL entry one by one as far as I know. So it might not be particularly...
Full answer by Wolfy: https://webmasters.stackexchange.com/a/144969 (CC BY-SA 4.0).
Need it done for your business? UphillTech.