1. A computer-implemented method of detecting whether an executable file poses a heightened risk of malware, comprising: identifying a plurality of symbols in the executable file; comparing the identified symbols to a set of symbols expected to be present in a legitimate executable file; computing a count of ones of the identified symbols that are not within the set of symbols expected to be present; comparing the computed count to a threshold number of symbols; and responsive at least in part to the computed count exceeding the threshold number of symbols, determining that the executable file poses a heightened risk of malware.