1. A method for detecting malicious applications, the method comprising: providing a library of handler unctions stored in an isolated environment on a memory accessible by processor, wherein the handler functions control access of one or more applications to protected resources on a computer device; modifying via the processor the one or more applications to access the library of handler functions instead of corresponding application program interface (API) functions of the computer device, and storing the one or more applications the isolated environment; receiving by the handler functions stored on the memory API function calls from a modified application; analyzing via the processor the received API function calls for malicious behavior characteristics; when the API function calls analyzed by the processor do not exhibit malicious behavior characteristics, performing by the handler functions the API function calls to the protected resources; and when the API function calls analyzed by the processor exhibit malicious behavior characteristics, performing one or more actions preventing access of the modified application to the protected resources.