1. A method for on-demand detecting a malware, adapted for estimating whether an application has vulnerabilities or malicious behaviors, and the method comprising: receiving the application; decompiling the application, to generate a compiled code related to the application; creating multiple compilation paths according to the compiled code and an association analysis, wherein the compilation paths correspond to multiple instruction paths of the application, respectively; predicting a risk level and a test time of each of the compilation paths which has vulnerabilities or malicious behaviors, and classifying the compilation paths as multiple test items correspondingly; receiving a detection command, to select at least one of the test items and a detectable time; and selecting the corresponding compilation paths according to selection of the test items and the detectable time, to execute the instruction paths corresponding to the selected compilation paths, and to generate a detection result indicating whether the application has the vulnerabilities or the malicious behaviors; wherein each of the compilation paths has at least one element instruction, at least one program code instruction, or combination thereof, and during prediction of the risk level and the test time of each of the compilation paths which has the vulnerabilities or the malicious behaviors, risk data of the element instruction and risk data of the program code instruction are used for prediction to correspondingly generate an element risk value and an element execution time of the element instruction of each of the compilation paths, and to generate a program code risk value and a program code execution time of the program code instruction, so as to predict the risk level and the test time of each of the compilation paths which has the vulnerabilities or the malicious behaviors.