VirusTotal’s cheat sheet covers examples of real-life cases ... Androguard tool for looking inside the packages, including code strings, manifest entities, and certificate signatures.