I would say that most AV systems will look at the first 32 bits of code on a document to see if it matches a known virus signature and if not then they will apply some form of heuristics.
...