Method and device for detecting malicious file

The invention discloses a method and a device for detecting a malicious file. One specific embodiment of the method comprises the following steps of obtaining a URL (Uniform Resource Locator) for downloading a to-be-detected file; matching character strings included in the URL of the to-be-detected file and character strings in a preset model; and determining whether the to-be-detected file is the malicious file based on a longest character string matched in a preset model by the URL of the to-be-detected file. According to the embodiment, the efficiency for detecting the malicious file can be improved.