It just blocks everything which comes from an external domain.

So in most cases it will also block malware, because malware authors seem to wait to use a 2-stage system.

They let different hacked websites point to one where the malware will be downloaded from.