1. A method performed on a computer for detecting whether a file includes malware, the method comprising: extracting static information of at least two predetermined items in the file; creating a genetic map for the file by alternating the extracted information into a previously set format; comparing the created genetic map with a previously stored malware genetic map to obtain a similarity between the created genetic map and the previously stored malware genetic map; determining that the file includes malware when the similarity is higher than a reference value relating to the malware: comparing the created genetic map with previously stored whitelist genetic map for a whitelist file to obtain another similarity between the created genetic map and the whitelist genetic map; and deferring said determining when said another similarity between the created genetic map and the whitelist genetic map is higher than another reference value related to the whitelist file.