Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Convert Files Online FF

CRITICAL RISKRemoved from Chrome Web Store

Convert Files Online FF

ID: pagfodggkafbalogogdbfmndklknkcbd

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.52001

Size

0.31 MB

Rating

3.7/5

Reviews

Users

30,480

Type

Extension

Updated

Jan 21, 2023

Publisher Contextual Analysis

Trusted

Author: https://www.convertfilesonlinefree.netView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

30,480

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Convert Files Online FF

Do you need to convert your files easily from one format to another without worrying about complicated settings or parameters? ConvertFilesOnlineFF can do it all! With its easy-to-use interface, you can quickly and effortlessly convert: - Documents - Music - Images - Videos - Archives - E-Books - and more! With ConvertFilesOnlineFF, there is no need to file multiple conversions between different programs - everything is assembled in one place for convenience. So whatever file type you need to convert, we've got you covered!

User Growth

Showing data from Feb 19, 2023 to May 12, 2023

Versions

+1.61%(+482 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 3 ratings

Average Rating

Current: 3.67 / 5.0-1.33

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High7

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.52001 Code review	11

Extension Version	Code Review Findings
3.52001	11

Files with findings

3 distinct paths — top paths by unique finding count:

background.js9
manifest.json1
uid.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 10677)	Tracking payload (containing pageLocation, pageReferrer, userId, etc.) is JSON.stringify'd, base64-encoded with `btoa`, then POSTed with Content-Type `application/base64` to convertfilesonlinefree.net/mince — or fired…	3.52001
2	Tracking	critical	uid.js (line 1)	This content script is injected into ALL frames on every http(s) page at document_start. It reads the persistent extension-assigned uid from chrome.storage and exposes it to ANY web page via a `window.postMessage({typ…	3.52001
3	Unauthorized Data Collection	critical	background.js (line 17924)	Builds a tracking payload that includes the user's current page URL (`document.location.href`), the page referrer, a persistent userId, and a timezone offset on every event. Combined with the `trackingUrl` send path, …	3.52001
4	Obfuscation	high	background.js (line 19826)	Field-renaming maps that translate every meaningful tracking field (pageLocation, pageReferrer, userId, extensionId, eventAction, installEvent, ticket) into nonsensical token pairs (`discern.utis`, `mental.enforce.pyl…	3.52001
5	Privilege Escalation	high	manifest.json (line 17)	For an extension whose stated purpose is 'Convert Files Online' the requested scope is wildly excessive: full host access on every http(s) URL, plus a content script (uid.js) at document_start across all frames whose …	3.52001
6	Remote Code Loading	high	background.js (line 19850)	A 'widget' UI is loaded from a remote URL (`https://www.convertfilesonlinefree.net/files/widget/new/index.html`) and rendered inside the page context (the content script floods every page with this overlay). Whatever …	3.52001
7	Remote Code Loading	high	background.js (line 19821)	The remote config response from `mulch.convertfilesonlinefree.net/unrest` returns a `params` field plus controllable knobs like `active`, `widgetActive`, `pushImpressionTimer`, `pushClickTimer`, `taTimer`, `blockList`…	3.52001
8	Tracking	high	background.js (line 15183)	Periodic 'action' beacon to `acttrUrl` (https://mulch.convertfilesonlinefree.net/hassle) carrying userId, ticket, version, an opaque `params` blob and per-session timestamps. Combined with the heartbeat / 'User Activi…	3.52001
9	Unauthorized Data Collection	high	background.js (line 4068)	Hard-coded telemetry/exfiltration command-and-control surface. The extension defines a config endpoint, a tracking endpoint (`/mince`), an action endpoint (`/hassle`), an uninstall-ping endpoint, and a 'cookies data' …	3.52001
10	Unauthorized Data Collection	high	background.js (line 4444)	On install/startup the background worker calls `cookiesDataUrl` (https://www.convertfilesonlinefree.net/zufriedenheit), submitting the `installEvent`, persistent `uid`, and `ticket`, and stores whatever the server ret…	3.52001
11	Obfuscation	medium	background.js (line 4133)	The bundle is padded throughout with thousands of dead-branch guards keyed off undefined globals with nonsense names (e.g. `self.IMPORTED_Web_G`, `window.manager_Target_Ref8`, `localStorage['invoke_Timer_Default']`) w…	3.52001

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	https:///
*	/*	http:///
fonts.gstatic.com	-	https://fonts.gstatic.com
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Roboto:wght@400&display=swap
www.convertfilesonlinefree.net	/recto	https://www.convertfilesonlinefree.net/recto?quakes=
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
fb.me	/use-check-prop-types	http://fb.me/use-check-prop-types
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
mulch.convertfilesonlinefree.net	/unrest	https://mulch.convertfilesonlinefree.net/unrest

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.0 out of 5 · 2 most recent reviews

Text reviews

Positive

Negative

https://www.scamadviser.com/check-website/convertfilesonlinefree.net Seems like a scam.

Benjamin Jimenez (OreoOrezOnYt)·27 Feb 2023

need to convert some file? this is the easiest way to do it, just add the extension, and every time you dowload sum just drag the file and select convert to the wish file ann that it

Lester Alarcon·30 Jan 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Convert Files Online FF

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating