Security Alert: Confirmed Malware
File Conversion Now New Tab
ID: ocemooeilogfefcknbhnjlofcfnhohcb
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- pdfconverterguru.comView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
File Conversion Now New Tab updates your new tab page to hfileconversionnow.com
Enrich your browsing experience with access to file conversion tools and links to popular websites from your new tab page with the File Conversion Now New Tab. File Conversion Now New Tab will also prompt you daily with access to the most popular file conversion resources as well as personalized weather forecasts to get your day started. You can also use the settings widget at the bottom right of the new tab page to adjust your personal experience. Click "Add To Chrome" above to get started for Free from your browser's new tab. Our extension can be removed at any time.
The extension reads cookies from `hfileconversionnow.com` for values such as `ap`, `source`, `uc`, and `uid`, then also fetches a remote user-class value. This is a form of identifier and attribution harvesting tied to a remote service, and it goes beyond what is necessary for a local new-tab page.
findCValue(value) { this.config.running++; let callback = this.setCVaule; let config = this.config; chrome.cookies.get({ "name": value, "url": "https://hfileconversionnow.com" }, function(cookieValue) { callback(cookieValue, config); return; } );}fetchUC() { this.config.running++; let callback = this.setCVaule; let config = this.config; fetch('https://hp.hfileconversionnow.com/Userclass') .then(function(e) { return e.json(); })This code exfiltrates a persistent user identifier, traffic-source fields, extension ID, and optional page/referrer data to a remote logging endpoint. It also sets a uniquely-parameterized uninstall URL, which is a common tracking technique to attribute removals back to individual users or campaigns.
class Log { constructor(store) { this.store = store; } send(event = '', optional = '', optional2 = '', optional3 = '') { this.store.getTracking(function(e) { fetch( `https://log.hfileconversionnow.com/log?event=${event}&user_id=${e.uid}&source=${e.source}&traffic_source=${e.ap}&subid=${e.uc}&implementation_id=converter_${chrome.runtime.getManifest().version}&subid2=${chrome.runtime.id}&page=${optional}&offer_id=${optional2}&referrer=${optional3}` ) .then(function() { console.log('Success'); }) .catch(function() { console.log('Failure'); }); }); } setExitPage() { this.store.getTracking(function(e) { chrome.runtime.setUninstallURL( `https://hp.hfileconversionnow.com/uninstall?user_id=${e.uid}&source=${e.source}&ap=${e.ap}&uc=${e.uc}&iid=converter_${chrome.runtime.getManifest().version}&cid=${chrome.runtime.id}` ); });This function opens a maximized remote page with tracking parameters including ad provider, source, user class, UID, and extension ID. That is adware-like behavior: it generates periodic promotional windows and ties them to a persistent user profile.
function showDailyFeature(Adprovider, Version, Source, UserClass, UID, today) { chrome.storage.sync.get(function(result) { let datewelcomed = result["datewelcomed"] === undefined ? 0 : result["datewelcomed"]; if (datewelcomed != today.getDate()) { chrome.tabs.query({}, function(tabs) { for (i = 0; i < tabs.length; i++) { if (tabs[i].url.indexOf("-dailyfeature") > -1) { chrome.tabs.remove(tabs[i].id); } } chrome.windows.create({ "url": "https://hp.hfileconversionnow.com/" + "?adprovider=" + Adprovider + "&i_id=" + Version + "&source=" + Source + "-dailyfeature&uc=" + UserClass + "&uid=" + UID + "&cid=" + chrome.runtime .id + "&featureday=" + today.getDate() .toString(), "state": "maximized" }); let userData = {}; userData["datewelcomed"] = today.getDate(); chrome.storage.sync.set(userData); });The new-tab override does not render a local page; it immediately redirects the browser to a remote domain and appends extension identifiers and version metadata. Remote-control of all new-tab content is risky because the extension can change user-facing content server-side without shipping a new package.
function NTLocation(url) { if (typeof(url) !== 'undefined' && url !== '' && url.indexOf('https:') > -1) { let meta = document.createElement('meta'); meta.setAttribute('content', '0; url=' + url + "&i_id=converter_" + chrome.runtime.getManifest() .version + "&") meta.setAttribute('http-equiv', 'refresh') document.head.append(meta) } else { let meta = document.createElement('meta'); meta.setAttribute('content', '0; url=' + FallBack()); meta.setAttribute('http-equiv', 'refresh'); document.head.append(meta); }}} catch (e) { let meta = document.createElement('meta'); meta.setAttribute('content', '0; url=' + FallBack()); meta.setAttribute('http-equiv', 'refresh'); document.head.append(meta);}function FallBack() { return "https://hp.hfileconversionnow.com/?&ap=nocache&cid=" + chrome.runtime.id + "&i_id=converter_" + chrome.runtime .getManifest() .version + "&cid=" + chrome.runtime.id + "&page=newtab&";}The extension watches newly created tabs and selectively reopens them in a resized popup-style window when they originate from a Yahoo results page containing the extension's user ID. This is suspicious browser-manipulation logic commonly associated with search monetization or ad-injection workflows.
//runs on our specific Yahoo Search Results page.chrome.tabs.onCreated.addListener(function(clickedTab) { if (typeof clickedTab.openerTabId !== "undefined" && clickedTab.url == "") { chrome.tabs.get(clickedTab.openerTabId, function(serpTab) { if (serpTab.url.includes("search.yahoo.com/yhs") && (serpTab.url.includes("hspart=pty") || serpTab.url .includes("hspart=adk")) && serpTab.url.includes(_Config.getUserId())) { chrome.windows.getCurrent(function(winSize) { if (typeof clickedTab.pendingUrl === 'undefined' || (typeof clickedTab.pendingUrl !== 'undefined' && clickedTab.pendingUrl.indexOf('chrome://') < 0)) { let widthUsed = Math.ceil(winSize.width * 0.52); let leftUsed = winSize.left + Math.abs(Math.ceil(winSize.width * 0.48)); let heightUsed = Math.ceil(winSize.height); chrome.windows.create({ tabId: clickedTab.id, height: heightUsed, width: widthUsed, top: winSize.top, left: leftUsed, type: 'normal' });By severity
Versions scanned
Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 2.3 | 5 |
| 2.1 | 8 |
Files with findings
8 distinct paths — top paths by unique finding count:
- js/utility.js3
- js/dailyFeature.js2
- js/log.js2
- js/newTab.js2
- js/search.js1
- js/searchHelper.js1
- js/utils/logging.js1
- js/utils/utilities.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.