The present disclosure relates to a method for analyzing a malicious code by an electronic device, the method comprising the steps of: receiving an executable file; before the received executable file is installed, analyzing the executable file so as to collect suspected malicious code data from the executable file; normalizing the collected suspected malicious code data and analyzing the same on the basis of a probability model algorithm, so as to make a determination on the suspected malicious code data; and outputting the result of the determination.