1. A method of identifying whether a first application is malicious, the method comprising: detecting the first application being presented for installation on a processing system; scanning, via a static analysis implemented by a processor of the processing system, the first application to determine whether a user interface layout of the first application is suspiciously similar to a user interface layout of a second application installed on the processing system, wherein scanning the first application comprises determining a total number of possible user interface layouts of the first application; responsive to the static analysis being indeterminate as to whether the first application is suspiciously similar to the user interface layout of the second application, when the first application is executed, performing a runtime analysis of the first application to identify each user interface layout implemented by the first application, and determining whether each user interface layout implemented by the first application is suspiciously similar to a user interface layout of the second application; and responsive to the runtime analysis indicating that a total number of the first application user interface layouts detected by the runtime analysis equals the total number of possible user interface layouts determined by the static analysis, and that each of the first application user interface layouts is not suspiciously similar to the user interface layout of the second application installed on the processing system, identifying the first application as being safe.