Malware/How to detect an executable's nature?

From CSRRT-LU

An executable can be

• straightforward in other words it contains the instructions that are executed
• compressed, the executable is decompressed at start time and finally the decompressed code is executed
• encrypted, the code is decrypted and finally executed.

Some conclusion on the code's nature can been drawn regarding

• Malware/entropy
• Malware/frequency analysis

The executable can be examined as a whole or only some sections.