Some malware will store the executable and all configuration encrypted on the disk and will only decrypt in memory with a key downloaded from the internet.

Ofcourse you can still defeat this if you dump the memory or reverse engineer the process to get the key yourself. Makes it a bit harder but still not impossible.