1. A method for identifying malicious software in an executable file, comprising: disassembling the executable file into one or more instructions; locating in the one or more instructions a first instruction that calls a second instruction, wherein the second instruction immediately follows the first instruction; and identifying the first instruction and the second instruction as the malicious software.