Dragon Ball Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Extension Overview

"Dragon Ball Live Wallpaper" (version 4.4.3) is a Chrome extension published to a personal Gmail account ([email protected]) with 23 users. The extension claims to provide anime wallpapers featuring Dragon Ball content.

Findings Analysis

The evidence bundle contains 706 total findings, with 689 classified as IoC detections and 17 as code-smell findings. Critically, there are zero malware signatures, zero network findings, and zero obfuscation findings. All IoC detections come from the XIOC-DOMAIN rule set, extracting domains like ҹs.pf, z.pl, d.io, p.sj, m9.sh, v.ac, 1.si, m.jp, ڼ.es, 7.az, c.sx, and d.pe from extracted_from_files.

These domains exhibit characteristics worth noting: several use short URL service TLDs (.io, .sh, .sj), while others contain non-ASCII characters (ҹ, ڼ) that could indicate homoglyph obfuscation. However, the XIOC extractor is a documented source of false positives, and domain extraction from static files does not confirm actual network activity. The absence of network findings means no actual traffic to these domains was observed during analysis.

Why This Is Likely a False Positive

The finding profile matches known false-positive patterns: high IoC volume (689 findings) driven by static domain extraction, with no corroborating evidence from malware signatures, network activity, or obfuscation detection. Code-smell findings (17 total) are classified as low severity and represent generic patterns that fire on almost any non-trivial JavaScript. The scoring system is known to inflate risk scores based on IoC count alone, which should not drive verdicts.

Counterargument

A skeptic could argue that the non-ASCII domain characters (ҹs.pf, ڼ.es) and short URL services indicate intentional obfuscation or malicious redirects. However, without malware signatures, actual network traffic to these domains, or obfuscation findings in the code itself, there is no evidence of malicious intent. The domains could be embedded in bundled assets, third-party libraries, or false-positive extraction artifacts. If these domains were actively used for malicious purposes, network findings would have been detected.

Recommendation

Monitor the extension for future updates or changes in behavior. The current evidence does not support immediate action.

Key Reasons

• 689 IoC findings from XIOC extractor with no malware signatures
• Zero network findings despite domain detections
• Zero obfuscation findings in code
• Finding profile matches known false-positive patterns
• Suspicious domains but no evidence of actual malicious behavior

False Positive Considerations

• XIOC domain extraction false positives
• IoC volume inflation without corroborating evidence
• No malware signatures detected
• No network activity detected

Reviewed 2026-04-28; recommended action: monitor; model confidence 72%.