in my experience it's more often because it contains the string "wallet.dat" these days.