Excessive permissions (SMS access), unofficial download links, or unusually small file sizes.