Yes, it can be more difficult than adding a string (and definitelly not from the very start - e.g. all the exe files look mostly the same in the beginning

) There are many polymorphic viruses having every instance different from its "parent" - so it's necessary to add a special piece of code to detect these...