Method and equipment for detecting malicious files

The embodiment of the invention discloses a method and equipment for detecting malicious files. The method for detecting malicious files includes the following steps that obtaining a file to be detected; if the file is parsed to include a reference tag, attribute value included in the reference tag will be matched with a preset malicious files judgment model, and if the match succeeds, the file is confirmed to be a malicious file or is suspected to be a malicious file. The embodiment of the invention is beneficial for improving flexibility, accuracy and project feasibility of the malicious files detection.