1. A computer-implemented method for detecting malicious code in a host file, the method comprising the steps of: emulating the host file in a virtual machine having a virtual memory; tracking access of the virtual memory by the host file; and detecting potential malicious code responsive to an access of the virtual memory within a non-normal address range.