1. A non-transitory computer program storage device, with instructions stored thereon, comprising instructions that when executed cause one or more processors to: detect selection of an icon, the selection utilized to initiate execution of an application associated with the icon; analyze properties of the icon in response to the detection; compare the properties of the icon with a list of properties of known icons to identify a matching icon; determine that the application is malware, responsive to a determination that the application does not contain multiple icons; determine that the icon represents malware responsive to a determination that the icon matches an icon known not to represent malware and the determination that the application is malware.