1. A method for detecting malicious applications, the method comprising: providing a library of handler functions stored in an isolated environment on a memory accessible by a processor, where the handler functions control an access of one or more applications to protected resources on a computer device; modifying, via the processor, a plurality of functions calls of the one or more applications when loading the one or more applications to be processed by the handler functions, to access the library of handler functions instead of corresponding application program interface (API) functions of the computer device by replacing one or more classes or methods of the one or more applications that perform function calls to the protected resources with one or more function calls to corresponding handler functions contained in the library and storing the modified one or more applications in the isolated environment; receiving, by the handler functions, one of the plurality of function calls from a modified application; analyzing via the processor the received function call for malicious behavior characteristics; performing by the handler functions the received function call to the protected resources upon determining that the received function call contains no malicious behavior characteristics; and preventing the modified application to access the protected resources upon determining that the received function call contains malicious behavior characteristics.