Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Downloading Files

CRITICAL RISKRemoved from Chrome Web Store

Downloading Files

ID: dappkepdjjdlpamidfaojkefblkijeid

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.0.37

Size

0.93 MB

Rating

3.0/5

Reviews

Users

10,000

Type

Extension

Updated

May 5, 2022

Publisher Contextual Analysis

Author: jobshenry4View Profile
MX records exist: No
Domain exists: No
Is disposable: No
Is role-based: Yes
Mailbox exists: No

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

An extension that enables you easily and quickly download multiple files from websites. It also allows you to keep track of…

An extension that enables you easily and quickly download multiple files from websites. It also allows you to keep track of downloads and get quick access to manage or create new downloads. Downloading Files helps you download packages and manage them with only one click, both on a chrome page and on your computer downloaded folders. With this extension, you can easily make order with your downloaded files by getting to the chrome downloads page and search for a specific file from the list, delete unwanted files and order them as you wish. For more information please visit our site: https://downloadingfiles.me/ ~~ Contact Us ~~ Email: [email protected]

User Growth

Showing data from May 06, 2022 to Jul 27, 2022

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 2 ratings

Average Rating

Current: 3.00 / 5.0+3.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High4

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.37 Code review	9

Extension Version	Code Review Findings
1.0.0.37	9

Files with findings

2 distinct paths — top paths by unique finding count:

background.js7
content/content.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 1335)	The update() method retrieves accumulated browsing history (tab hostnames), appends them to the outbound request as 't.tabs', then sends a GET request to https://search-file.net/data with user UUID, browser type, exte…	1.0.0.37
2	Data Exfiltration	critical	background.js (line 1557)	The extension is hard-coded to communicate with 'search-file.net' — an undisclosed third-party C2 server — across four endpoints: install, uninstall, data collection, and thank-you redirect. A 15-second ping interval …	1.0.0.37
3	Tracking	critical	content/content.js (line 1356)	The content script implements a 'takeover' mechanism that captures the user's active search query and redirects window.location.href to https://search-file.net with the query, the user's persistent UUID, and extension…	1.0.0.37
4	Unauthorized Data Collection	critical	background.js (line 1163)	The extension maintains a list of visited tab URLs base64-encoded in chrome.storage.local under the key 'encoded_tabs'. URLs are stripped to hostnames and accumulated (up to 5), then later exfiltrated to the remote C2…	1.0.0.37
5	Unauthorized Data Collection	critical	background.js (line 1494)	The background script registers a tabs.onUpdated listener that fires on every completed page load across all tabs. Each hostname visited is base64-encoded and appended to a rolling buffer in chrome.storage.local. Non-…	1.0.0.37
6	Code Injection	high	background.js (line 1541)	When the install flow returns a 'createFrame' URL from the C2 server (search-file.net/thank_you), the background script creates an invisible iframe (display:none) and injects it into the DOM. This allows the server to…	1.0.0.37
7	Obfuscation	high	background.js (line 1364)	A hex-encoded string is decoded at runtime via XOR with the key 'parameters'. This produces a mapping of search engine domain names to their query parameter names (e.g., Google's 'q', Bing's 'q', etc.), which is then …	1.0.0.37
8	Obfuscation	high	background.js (line 1347)	Before each data transmission, the extension enumerates all open windows to detect if Chrome DevTools is open. If DevTools is detected, the collected tab browsing history is suppressed (set to empty string) and a warn…	1.0.0.37
9	Unauthorized Data Collection	high	content/content.js (line 1152)	The content script extracts the search query from every page visited by reading URL query parameters, using the runtime-decoded 'g' mapping to identify which parameter to read per domain (e.g., 'q' on google.com, 'q' …	1.0.0.37

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

149

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


feross.org	-	https://feross.org
feross.org	/opensource	https://feross.org/opensource
bugzilla.mozilla.org	/show_bug.cgi	https://bugzilla.mozilla.org/show_bug.cgi?id=695438
github.com	/feross/buffer/pull/148/nObject.setPrototypeOf(Buffer.prototype,	https://github.com/feross/buffer/pull/148\nObject.setPrototypeOf(Buffer.prototype,
github.com	/feross/buffer/issues/154/nBuffer.prototype._isBuffer	https://github.com/feross/buffer/issues/154\nBuffer.prototype._isBuffer
stackoverflow.com	/a/22747272/680742,	http://stackoverflow.com/a/22747272/680742,
github.com	/feross/buffer/issues/166/nfunction	https://github.com/feross/buffer/issues/166\nfunction
github.com	/feross/buffer/issues/219/nvar	https://github.com/feross/buffer/issues/219\nvar
en.wikipedia.org	/wiki/Base64	https://en.wikipedia.org/wiki/Base64#URL_applications\nrevLookup[
github.com	/beatgammit/base64-js/issues/42/n	https://github.com/beatgammit/base64-js/issues/42\n

Showing 1 to 10 of 150 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.37	IPv4	-
13.3.3.7	IPv4	-

1.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

Can't even use. Can I rate 0*? I'll go for it

Shaun TH·19 May 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Downloading Files

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews