Sung Jinwoo Statue of God Live Wallpaper

AI Security Review

Evidence context: threat category unknown malware; evidence quality moderate.

The extension 'Sung Jinwoo Statue of God Live Wallpaper' presents a mixed threat profile. The developer is identified only as '[email protected]', a generic Gmail address with no organizational attribution, and the extension has 0 users, indicating it is either newly published or extremely obscure.

The primary concern is the 457 IoC findings, all classified as medium severity. Specific domains detected include 't.pg', 'w.ml', '0.pg', 'uu0uq.kw', 'l.sy', 'a.sa', 'k.bd', 'xk.by', '2.th', 'rq.ca', and 'w-dyh.cx'. These domains exhibit classic command-and-control infrastructure patterns: single-character or very short subdomains combined with unusual country-code TLDs (.pg, .ml, .sy, .sa, .bd, .by). This pattern differs significantly from known false-positive sources like IPv6 fragments (::, ::b), loopback addresses (127.0.0.1), or CDN domains (googleapis.com, gstatic.com).

However, several mitigating factors exist. The findings summary shows 0 malware signatures, 0 obfuscation findings, and 0 network findings. The 16 code-smell findings are low severity and likely represent benign patterns. The absence of obfuscation and malware signatures suggests this may not be actively malicious code, or the malicious component has not been detected by static analysis.

The strongest counterargument to a malicious verdict is the lack of malware signatures and obfuscation. A skeptic would argue these IoCs could stem from bundled third-party libraries, ad networks, or analytics services that the extension legitimately integrates. Without runtime analysis confirming whether these domains are actively contacted, the evidence remains inconclusive. The extension's stated purpose (anime live wallpaper) does not inherently require C2-style domain communication, but legitimate extensions can include third-party dependencies with questionable domain lists.

Runtime analysis is required to determine if these domains are actively contacted during extension operation, which would confirm malicious intent.

Key Reasons

• 457 IoC findings with C2-style domain patterns (single-char subdomains, unusual TLDs)
• Developer uses generic Gmail address with no organizational identity
• Zero malware signatures and zero obfuscation findings
• Extension has 0 users with no social proof
• No network findings to confirm active domain communication

False Positive Considerations

• Bundled third-party dependencies may contain embedded domain lists
• Code-smell findings (16 total) are low severity and expected noise

Reviewed 2026-04-27; recommended action: runtime analysis; model confidence 65%.