A method for determining a malign or non-malign behavior of an executable file, characterized in that the method is performed in a file-execution device comprising a real environment, wherein the method comprises the steps of: - receiving (S2-1a) from a distribution point comprising an emulated environment: - a first behavior profile (P1) of the executable file, the first behavior profile (P1) comprising a first observable execution trace of the executable file from the emulated environment, - the executable file, and - a signature of the first behavior profile; - installing (S2-1e) at the file-execution device , the executable file, under a prerequisite that the received signature of the first behavior profile is verified as correct; - linking (S2-1f) the first behavior profile (P1) to the executable file; - generating (S2-1) in the file-execution device , a second behavior profile (P2) of the executable file, the second behavior profile (P2) comprising a second observable execution trace of the executable file from the real environment of the file-execution device ; and - comparing (S2-2) the first and second observable execution traces so as to determine the malign or non-malign behavior of the executable file, wherein if the comparing step (S2-2) yields deviations between the first and second observable execution traces, the method further comprises: - ceasing execution (S2-1g) of the executable file, - querying (S2-1h) a user of the file-execution device whether the ceased execution is to be resumed, and - updating (S2-1i) the second behavior profile (P2) based on the result of the query. - receiving (S2-1a) from a distribution point comprising an emulated environment: - a first behavior profile (P1) of the executable file, the first behavior profile (P1) comprising a first observable execution trace of the executable file from the emulated environment, - the executable file, and - a signature of the first behavior profile; - a first behavior profile (P1) of the executable file, the first behavior profile (P1) comprising a first observable execution trace of the executable file from the emulated environment, - the executable file, and - a signature of the first behavior profile; - installing (S2-1e) at the file-execution device , the executable file, under a prerequisite that the received signature of the first behavior profile is verified as correct; - linking (S2-1f) the first behavior profile (P1) to the executable file; - generating (S2-1) in the file-execution device , a second behavior profile (P2) of the executable file, the second behavior profile (P2) comprising a second observable execution trace of the executable file from the real environment of the file-execution device ; and - comparing (S2-2) the first and second observable execution traces so as to determine the malign or non-malign behavior of the executable file, wherein if the comparing step (S2-2) yields deviations between the first and second observable execution traces, the method further comprises: - ceasing execution (S2-1g) of the executable file, - querying (S2-1h) a user of the file-execution device whether the ceased execution is to be resumed, and - updating (S2-1i) the second behavior profile (P2) based on the result of the query. - ceasing execution (S2-1g) of the executable file, - querying (S2-1h) a user of the file-execution device whether the ceased execution is to be resumed, and - updating (S2-1i) the second behavior profile (P2) based on the result of the query. <EOS>