An apparatus for detecting a malicious app. The apparatus may include a collector to collect a mobile app, a static analyzer to extract basic information from the collected mobile app, analyze the basic information of the extracted mobile app, and generate a call flow graph (CFG) of the mobile app, a dynamic analyzer to execute the collected mobile app, expand the CFG of the mobile app, generated by the static analyzer, to a dynamic action-based CFG, and determine a similarity between the expanded CFG and a flow graph that performs a malicious action, and a malicious app determiner to determine whether the collected mobile app is malicious by analyzing the basic information, the CFG, the call flow graph, and the similarity.