
Here's how it works: Once an application is uploaded, the service immediately starts analyzing it for known malware, spyware and trojans. It also looks for behaviors that indicate an application might be misbehaving, and compares it against previously analyzed apps to detect possible red flags. Google actually run every application on it's cloud infrastructure and simulate how it will run on an Android device to look for hidden, malicious behavior. Google also analyze new developer accounts to help prevent malicious and repeat-offending developers from coming back.
Source: Google Mobile blog