1. A method for determining whether a collection of data not expected to include executable code is suspected of containing malicious executable code, the method comprising: identifying at least one candidate opcode in the collection of data; disassembling the collection of data to obtain a sequence of possible instructions comprising an initial instruction and at least one subsequent instruction, wherein the initial instruction comprises the candidate opcode; analyzing a control flow of the sequence of possible instructions; recording a location for at least one of the possible instructions in the sequence; determining whether the sequence of possible instructions comprises an execution loop by determining whether the control flow of the sequence of possible instructions returns to the location for the at least one of the possible instructions; and determining whether the collection of data is suspected of containing malicious executable code based, at least in part, on the determination of whether the sequence of possible instructions comprises an execution loop.