If you start looking at the payload--
so here you can see, on the right-hand screenshot,
we are actually on the device.
And we can see we're in /private/var/containers/Bundle/
and we go down to that app.
On the left, we're looking at the payload directory.
This is when you Right-Click, and you
say Show Package Contents.
When you're in these package contents, what
I wish I could tell you is, I would go straight to data
and look at level0.
I don't know what to tell you to do because, again, we
haven't had legitimate Malware on an iPhone to look at.
If you look at the Malware samples on ISO B,
there are some .ipa files, but some of them are things like
Pokemon Go or apps that just ask for excessive amounts
of permission so you have something to compare.
If you get to the point where you have legitimate .ipa files,
you have a full file system extraction with Malware,
I recommend that you open it, and you look at the package
contents, and compare it to a known app--
so Facebook or something else.
Like Facebook has a lot of permissions.
Anything that is Google-related probably
has a lot of permissions.
So compare those, and see if any of the files
jump out as abnormal to you.