Some malware authors add benign code/behavior to their malware just to throw off antiviruses and IDSs which employ machine learning to detect malware. There is a name for this technique (and even a Wikipedia page somewhere) but I can't seem to figure out what it is or find it on Google.
I think the technique is called obfuscation using "dead code insertion" where you add routines that don't perform any function to throw off AV static and dynamic analysis. I read it here Also this wiki leaks paper shows experiments with AV that use techniques of adding functions that dont do anything but bypass AV dynamic analysis
Malware hiding within an app with a benign purpose is typically called a Trojan, after the famous story of the Trojan Horse.