1. A method for determining, by a security application, whether an examined process code is a malware, comprising the steps of: a. detecting whenever said examined process code performs invocations; b. detecting a call site being a site within said examined process code, from which said invocations have been launched; c. analyzing one or more pieces of code in a surrounding area of said site and/or in branches related to said site; and d. comparing at least a part of the properties of the analyzed pieces of code with a predefined software code patterns and determining whether said examined process code corresponds to one of said predefined software code patterns; and e. classifying said examined process code according to results of the comparing.