A method for testing a computer program application in a server computer, the method comprising: receiving, from a client device, a test request requesting the server computer to test suspicious behaviour associated with the computer program application; acquiring the computer program application on the basis of the test request; applying at least one test routine to the computer program application and testing for suspicious behaviour associated with the computer program application; creating a test report specifying at least some features of the suspicious behaviour, if any found during the at least one test routine; and communicating the test report to the client device, characterized by the method further comprising in the server computer: storing a library database comprising for each library (712, 718) reference strings (714, 720) that distinguish the library from other libraries, the library database further storing known suspicious features of libraries; searching a computer program code of the computer program application for the reference strings; determining the libraries comprised in the computer program application on the basis of the reference strings found in the computer program code of the computer program application; cross-referencing the library database with the libraries comprised in the computer program application and determining whether or not the computer program application comprises suspicious features; and inserting at least some of the determined suspicious features into the test report, if any has been found. receiving, from a client device, a test request requesting the server computer to test suspicious behaviour associated with the computer program application; acquiring the computer program application on the basis of the test request; applying at least one test routine to the computer program application and testing for suspicious behaviour associated with the computer program application; creating a test report specifying at least some features of the suspicious behaviour, if any found during the at least one test routine; and communicating the test report to the client device, characterized by the method further comprising in the server computer: storing a library database comprising for each library (712, 718) reference strings (714, 720) that distinguish the library from other libraries, the library database further storing known suspicious features of libraries; searching a computer program code of the computer program application for the reference strings; determining the libraries comprised in the computer program application on the basis of the reference strings found in the computer program code of the computer program application; cross-referencing the library database with the libraries comprised in the computer program application and determining whether or not the computer program application comprises suspicious features; and inserting at least some of the determined suspicious features into the test report, if any has been found. storing a library database comprising for each library (712, 718) reference strings (714, 720) that distinguish the library from other libraries, the library database further storing known suspicious features of libraries; searching a computer program code of the computer program application for the reference strings; determining the libraries comprised in the computer program application on the basis of the reference strings found in the computer program code of the computer program application; cross-referencing the library database with the libraries comprised in the computer program application and determining whether or not the computer program application comprises suspicious features; and inserting at least some of the determined suspicious features into the test report, if any has been found.