Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Convert File For Me

CRITICAL RISKRemoved from Chrome Web Store

Convert File For Me

ID: coabcickddoceakpmpbicdloekglmhal

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

2.3001

Size

0.31 MB

Rating

0.0/5

Reviews

Users

27,444

Type

Extension

Updated

Mar 18, 2023

Publisher Contextual Analysis

Trusted

Author: https://www.convertfileforme.comView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

27,444

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Convert File For Me

ConvertFileForMe is the simplest and most convenient way to convert files quickly and easily! With just one click, you can convert: - Images - PDFs - Documents - Videos - Music - E-books - Archives Select the file you want to convert and click the "Convert Files" button, and the extension will immediately convert the file to the desired format. Get ConvertFileForMe extension - It's simple, fast, and safe!

User Growth

Showing data from May 03, 2023 to Jul 02, 2023

Versions

+499.34%(+22,865 users)

Compared to 2 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High4

Medium1

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.3001 Code review	11

Extension Version	Code Review Findings
2.3001	11

Files with findings

3 distinct paths — top paths by unique finding count:

background.js9
popup.html1
uid.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 16573)	The extension dynamically injects scripts and CSS into arbitrary host pages (chrome.tabs.executeScript / chrome.tabs.insertCSS over <all_urls> via the http:/// and https:/// host_permissions) to render modals and …	2.3001
2	Data Exfiltration	critical	background.js (line 10884)	Browsing-history exfiltration: every tracked event is JSON-stringified, base64-encoded with btoa(), and POSTed (or sent via sendBeacon for stealth/persistence-on-unload) to the hard-coded tracking endpoint https://www…	2.3001
3	Privilege Escalation	critical	background.js (line 13329)	Implements server-driven tab navigation/popunder behavior: takes a clickUrl/clickUrlWN supplied by the remote config server and opens it in a tab via guess_locales (which calls chrome.tabs.update / chrome.tabs.create …	2.3001
4	Remote Code Loading	critical	background.js (line 12049)	The extension polls bigwig.convertfileforme.com/candidate every 'configurationPollFrequency' interval, posting uid/ticket/version/cwsId, and parses the JSON response into a config that drives runtime ad behavior (PUSH…	2.3001
5	Unauthorized Data Collection	critical	background.js (line 19037)	Constructs the tracking payload that captures the full URL of the current page, the HTTP referrer, a stable userId, and timezone offset for fingerprinting. This object is the body that faces_bind() base64-encodes and …	2.3001
6	Data Exfiltration	high	background.js (line 2802)	On install/startup the extension POSTs uid + install ticket + installEvent to the suspiciously-named endpoint https://www.convertfileforme.com/treasonous/xraytherapy (referred to as cookiesDataUrl, declared at line 69…	2.3001
7	Obfuscation	high	background.js (line 19580)	The wire protocol uses field-name obfuscation: meaningful keys (clickUrl, impressionUrl, pageLocation, pageReferrer, userId, etc.) are remapped on the wire to nonsense token sequences ('orache.quaPint.oof.oprah', 'jer…	2.3001
8	Tracking	high	uid.js (line 1)	The uid.js content script is injected at document_start into every http(s) page (matches https:/// and http:///, all_frames:true per manifest.json) and exposes the extension's persistent per-user UID to any web pa…	2.3001
9	Tracking	high	background.js (line 6878)	Hard-coded operator endpoints used for ad-injection orchestration (bigwig.convertfileforme.com/candidate and /yanked), browsing-history tracking (/nextdoor), uninstall telemetry (/cnvflsfm/log_deactivate), and device …	2.3001
10	Obfuscation	medium	background.js (line 2784)	Throughout background.js (hundreds of occurrences) the bundle is interleaved with dead-code 'if' guards keyed on undefined globals (vendor_joiners_header, percent_handler_face, sub_event_widget, etc.) wrapping random …	2.3001
11	Obfuscation	low	popup.html (line 1)	popup.html has been mechanically mangled (every '<' tag delimiter is split onto its own line) so that the file is invalid HTML to a casual eye / line-based scanners but still parsed leniently by Chrome. This is consis…	2.3001

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fonts.gstatic.com	-	https://fonts.gstatic.com
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Roboto:wght@300&display=swap
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	https:///
*	/*	http:///
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.convertfileforme.com	/injure	https://www.convertfileforme.com/injure?isotope=
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Open+Sans&display=swap
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Poppins&display=swap
www.convertfileforme.com	-	https://www.convertfileforme.com

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Convert File For Me

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating