A method for emulating an execution of a file, wherein the method comprises: generating (201; 221) an image of a file, wherein the generated image is comprised of instructions read from the file; detecting (202; 222) at least one known set of instructions in a portion read from the file, wherein the detected at least one known set of instructions comprises an instruction set of an interpreter library configured to process instructions of the file different from machine instructions; generating an image of a library file of the interpreter library; inserting (203; 223) a break point into a position in the generated image of the file corresponding to a start of the detected at least one known set of instructions from the read portion of the file; and emulating (204; 224) execution of the file, the emulation comprising: emulating execution of instructions from the generated image of the file and from the generated image of the library file wherein the emulation includes, in response to encountering the inserted break point, adding a record to the emulation log indicating emulation of the execution of the known set of instructions, emulating execution of an alternative set of instructions corresponding to the detected at least one known set of instructions, and refraining from emulating execution of the detected at least one known set of instructions, wherein the detected at least one known set of instructions comprises anti-emulation instructions configured to impede the emulation of the execution of the file, and wherein the alternative set of instructions corresponding to the anti-emulation instructions is configured to have the same result of emulating the execution of the at least one known set of instructions and does not impede emulation of execution of the file, and adding corresponding records to an emulation log associated with the emulated execution of the at least one known set of instructions, wherein the emulating of the execution of a file is the imitation of the execution of a file on one device by means of another device or devices of a computer, and wherein the emulating of the execution of an instruction is the imitation of the execution of an instruction on one device by means of another device or devices of a computer. generating (201; 221) an image of a file, wherein the generated image is comprised of instructions read from the file; detecting (202; 222) at least one known set of instructions in a portion read from the file, wherein the detected at least one known set of instructions comprises an instruction set of an interpreter library configured to process instructions of the file different from machine instructions; generating an image of a library file of the interpreter library; inserting (203; 223) a break point into a position in the generated image of the file corresponding to a start of the detected at least one known set of instructions from the read portion of the file; and emulating (204; 224) execution of the file, the emulation comprising: emulating execution of instructions from the generated image of the file and from the generated image of the library file wherein the emulation includes, in response to encountering the inserted break point, adding a record to the emulation log indicating emulation of the execution of the known set of instructions, emulating execution of an alternative set of instructions corresponding to the detected at least one known set of instructions, and refraining from emulating execution of the detected at least one known set of instructions, wherein the detected at least one known set of instructions comprises anti-emulation instructions configured to impede the emulation of the execution of the file, and wherein the alternative set of instructions corresponding to the anti-emulation instructions is configured to have the same result of emulating the execution of the at least one known set of instructions and does not impede emulation of execution of the file, and adding corresponding records to an emulation log associated with the emulated execution of the at least one known set of instructions, wherein the emulating of the execution of a file is the imitation of the execution of a file on one device by means of another device or devices of a computer, and wherein the emulating of the execution of an instruction is the imitation of the execution of an instruction on one device by means of another device or devices of a computer.