A method for a deobfuscation apparatus that deobfuscates a malicious program obfuscated using an obfuscation technique, and the deobfuscation method comprises executing the malicious program to identify and extract memory information containing a trampoline code used in the obfuscation technique, executing the trampoline code based on the memory information to classify a type of obfuscation technique of the malicious program, and deobfuscating the malicious program according to the classified obfuscation technique and generating a deobfuscation program. According to the constitution, the techniques for obfuscating OEP and IAT can be deobfuscated.