Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: File Conversion Now New Tab

CRITICAL RISKRemoved from Chrome Web Store

File Conversion Now New Tab

ID: ocemooeilogfefcknbhnjlofcfnhohcb

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

2.3

Size

0.01 MB

Rating

2.2/5

Reviews

Users

468,713

Type

Extension

Updated

Sep 11, 2021

Publisher Contextual Analysis

Author: pdfconverterguru.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

468,713

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

File Conversion Now New Tab updates your new tab page to hfileconversionnow.com

Enrich your browsing experience with access to file conversion tools and links to popular websites from your new tab page with the File Conversion Now New Tab. File Conversion Now New Tab will also prompt you daily with access to the most popular file conversion resources as well as personalized weather forecasts to get your day started. You can also use the settings widget at the bottom right of the new tab page to adjust your personal experience. Click "Add To Chrome" above to get started for Free from your browser's new tab. Our extension can be removed at any time.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High7

Medium3

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.3 Code review	5
2.1 Code review	8

Extension Version	Code Review Findings
2.3	5
2.1	8

Files with findings

8 distinct paths — top paths by unique finding count:

js/utility.js3
js/dailyFeature.js2
js/log.js2
js/newTab.js2
js/search.js1
js/searchHelper.js1
js/utils/logging.js1
js/utils/utilities.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Tracking	critical	js/log.js (line 5)	Every lifecycle event (install, update, sync, daily feature check) fires an HTTP beacon to a remote logging server at log.hfileconversionnow.com, transmitting: a persistent unique user ID, traffic source, affiliate ad…	2.1
2	Tracking	critical	js/dailyFeature.js (line 1)	The extension sets an alarm firing every 120 minutes (every 2 hours) that, once per day, forcibly opens a new maximized browser window to the operator's website with the user's full tracking profile (UID, user class, …	2.1
3	Unauthorized Data Collection	critical	js/search.js (line 2)	The extension monitors every newly created tab and checks whether its opener tab is a Yahoo Search page containing specific affiliate partner codes ('hspart=pty' or 'hspart=adk') AND the stored user ID embedded in the…	2.1
4	Data Exfiltration	high	js/utils/logging.js (line 1)	This code exfiltrates a persistent user identifier, traffic-source fields, extension ID, and optional page/referrer data to a remote logging endpoint. It also sets a uniquely-parameterized uninstall URL, which is a co…	2.3
5	Other	high	js/utility.js (line 65)	On install, the extension enumerates all currently open tabs using chrome.tabs.query and silently closes any tab whose URL contains the extension ID and the string 'webstore' — i.e., the Chrome Web Store page for this…	2.1
6	Remote Code Loading	high	js/utility.js (line 24)	On install, the extension contacts a remote server endpoint to fetch a server-assigned user classification code ('uc'). This response is stored in synced storage and injected into every subsequent request URL as a 'su…	2.1
7	Tracking	high	js/dailyFeature.js (line 1)	This function opens a maximized remote page with tracking parameters including ad provider, source, user class, UID, and extension ID. That is adware-like behavior: it generates periodic promotional windows and ties t…	2.3
8	Tracking	high	js/newTab.js (line 24)	Every new tab is immediately redirected to the operator's website (hp.hfileconversionnow.com) via a meta-refresh, with the extension version and tracking parameters appended. The URL stored in synced storage already c…	2.1
9	Unauthorized Data Collection	high	js/utils/utilities.js (line 12)	The extension reads cookies from `hfileconversionnow.com` for values such as `ap`, `source`, `uc`, and `uid`, then also fetches a remote user-class value. This is a form of identifier and attribution harvesting tied t…	2.3
10	Unauthorized Data Collection	high	js/utility.js (line 12)	On install, the extension uses the 'cookies' permission to read specific affiliate tracking cookies ('qs', 'ap', 'ntp') from hfileconversionnow.com and stores them persistently in synced Chrome storage. These values —…	2.1
11	Data Exfiltration	medium	js/log.js (line 16)	On install and update, the extension registers an uninstall URL that transmits the user's full tracking profile (user_id, source, affiliate provider, user class, extension version and ID) to the operator's server when…	2.1
12	Other	medium	js/newTab.js (line 26)	The new-tab override does not render a local page; it immediately redirects the browser to a remote domain and appends extension identifiers and version metadata. Remote-control of all new-tab content is risky because…	2.3
13	Other	medium	js/searchHelper.js (line 1)	The extension watches newly created tabs and selectively reopens them in a resized popup-style window when they originate from a Yahoo results page containing the extension's user ID. This is suspicious browser-manipu…	2.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


hp.hfileconversionnow.com	-	https://hp.hfileconversionnow.com/
hp.hfileconversionnow.com	-	https://hp.hfileconversionnow.com/?&ap=nocache&cid=
log.hfileconversionnow.com	/log	https://log.hfileconversionnow.com/log?event=${event}&user_id=${e.uid}&source=${e.source}&traffic_source=${e.ap}&subid=${e.uc}&implementation_id=converter_${chrome.runtime.getManifest(
hp.hfileconversionnow.com	/uninstall	https://hp.hfileconversionnow.com/uninstall?user_id=${e.uid}&source=${e.source}&ap=${e.ap}&uc=${e.uc}&iid=converter_${chrome.runtime.getManifest(
hfileconversionnow.com	-	https://hfileconversionnow.com
hp.hfileconversionnow.com	/Userclass	https://hp.hfileconversionnow.com/Userclass
hp.hfileconversionnow.com	-	https://hp.hfileconversionnow.com/?page=newtab
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.3 out of 5 · 8 most recent reviews

Text reviews

Positive

Negative

I would not even have awarded one star, but could not review unless I rated. I HATE THIS APP! I have tried numerous ways to rid me of this frustration that I received trying to download a free offer. If I had known that I would have never went to get that offer.

Pamela Moore·22 Sept 2020

good going

manoj dhebar·8 Aug 2020

Changes everything and randomly opens tabs plus every time I try to open google chrome or a new tab, this comes up.Do not buy.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

File Conversion Now New Tab

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews