1. An apparatus for inspecting a non-PE file, the apparatus comprising: a data loading unit configured to load candidate malicious address information related to a malicious code of the non-PE file; a program link unit configured to acquire normal address range information of a module being loaded on a memory when an application program adapted for the non-PE file is executed and set up a candidate malicious address corresponding to the candidate malicious address information to be a breakpoint of the application program; and a malicious code determination unit configured to determine whether a next execution address is within the normal address range information when there occurs an event derived from the breakpoint.