Abstract: A system and method for analyzing a patch file determine the similarity between a patch file of an application program and an existing file in terms of an operation pattern and a file type and also determine whether risky behavior is performed by the patch file, thereby detecting a file disguised as a patch file. The system for analyzing a patch file includes: a program analysis module configured to collect setup information configured in an application program and generate the collected information as reference information; a reference information database (DB) configured to store the reference information; a patch file analysis module configured to generate setup information configured in a patch file of the application program as patch information by analyzing the patch file; and a comparison module configured to search for reference information and compare the patch information with the reference information.