They contain malicious code to be executed at a later

date

They attempt to hide their presence from both the OS

and the antivirus software

They attach themselves to the application’s

initialization sequence

They contain small bits of HTML code