Nick & Judy Relax - Zootopia Live Wallpaper

AI Security Review

Evidence context: threat category unknown malware; evidence quality weak.

The extension 'Nick & Judy Relax - Zootopia Live Wallpaper' (version 14.4.1) presents several unusual characteristics that prevent a confident benign or malicious verdict.

The most notable finding is the completely anonymous publisher — the developer name is a Gmail address ([email protected]) with no associated developer identity or published extensions. The extension has zero users listed, suggesting it is either very new or has been quietly deprecated. No description is provided beyond the store listing copy about Zootopia live wallpapers.

The 378 IoC findings are all single-label domains across obscure TLDs: ր.bm (Armenian TLD using Cyrillic-like script), л.et (Cyrillic character in .et), jag.iq, s.jm, js.gw, w.mz, t.jp, d.np, y.pt, t.fr, ƙo.mh, e.ki. This pattern — dozens of single-character or two-character hostnames across many country-code TLDs — is structurally consistent with domain generation algorithms (DGA) used by malware, or with DNS-based tracking/pixel networks, rather than with blocklist-based filtering. This is not a pattern seen in ad blockers or legitimate extensions. Two domains use non-Latin scripts (ր.bm and л.et with Cyrillic л, plus ƙo.mh with a Latin extended character), which adds to the suspicion.

However, critical counter-evidence is absent: there are zero malware signatures, zero obfuscation findings, zero network findings, and no code-smell findings. The IoCs were all extracted generically ('extracted_from_files'), and the XIOC extractor is known to produce false positives on minified JavaScript with bundled dependencies. Without knowing what file produced these domains or whether any code actually connects to them, we cannot distinguish between hard-coded malicious endpoints, ad/tracking configuration bundled from open-source code, or artifact noise from shared library infrastructure.

The strongest counterargument for a benign verdict is that the 378-domain IoC volume and diverse TLOW distribution could result from bundled ad-serving or wallpaper-fetching configurations in a low-quality but non-malicious extension. Live wallpaper extensions commonly bundle large domain lists for image hosting, ad networks, and analytics across many regional providers. The absence of any malware signature after scanning all extracted files weighs against active malicious code.

However, the anonymous publisher, zero-user count, non-standard character domains, and lack of any code-level findings to explain the domain list create sufficient uncertainty to warrant follow-up. A runtime analysis or manual review of the actual network requests the code makes would resolve these questions.

Key Reasons

• 378 IoC findings to single-label domains across obscure country-code TLDs, inconsistent with legitimate ad-block or wallpaper extension patterns
• Anonymous publisher (Gmail-only) with zero users and no developer identity
• Multiple IoCs use non-Latin Unicode characters (Cyrillic л, Armenian ʁ, Latin extended ƙ) suggestive of typosquatting or homograph abuse
• No code-level findings (malware, obfuscation, network) to confirm or refute malicious domain connections
• All IoCs extracted from generic 'extracted_from_files' with no source file attribution

False Positive Considerations

• XIOC extractor generates false positives on minified or bundled JavaScript from shared libraries
• Live wallpaper extensions may legitimately bundle large regional domain lists for image hosting and ad networks

Reviewed 2026-06-02; recommended action: runtime analysis; model confidence 55%.