Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Ice Dodo Remastered

CRITICAL RISKRemoved from Chrome Web Store

Ice Dodo Remastered

ID: popgkoojfccchdfkpbmfjhoonipbinoa

Could be malicious

Extension Info & Metadata

Status

Removed

Version

35.6

Size

20.66 MB

Rating

2.8/5

Reviews

176

Users

60,994

Type

Extension

Updated

Aug 11, 2020

Publisher Contextual Analysis

Author: OnionFistView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

234,010

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Play easily by clicking the little icon at the top right corner of your browser.

Exciting 3D popup game, with 40+ playable maps. The game also works offline, and is more fun than chrome dino game. Bring the character to the finish using only two controls, left and right. Be aware, don't fall off the platform, then you have to restart!

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High0

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
35.6 Code review	4

Extension Version	Code Review Findings
35.6	4

Files with findings

1 distinct path — top paths by unique finding count:

emscript.js4

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	emscript.js (line 2381)	Based on command type received from the C2 server, the extension either opens a new browser window (`py`/`px`), creates a new tab (`t1`), or silently redirects the user's current active tab to an arbitrary server-spec…	35.6
2	Data Exfiltration	critical	emscript.js (line 2153)	On install, the background script sends a beacon to the hardcoded C2 server `nodemanage.com` containing OS, CPU architecture, browser platform, a hardcoded tracking UUID, and a reason code. The payload is JSON-seriali…	35.6
3	Remote Code Loading	critical	emscript.js (line 2299)	The extension POSTs browsing URL and title to the C2 `/cmps` endpoint and receives a list of campaign instructions — including trigger type, timing thresholds, and focus-mode controls — from the remote server. The ser…	35.6
4	Tracking	critical	emscript.js (line 706)	The persistent background script hooks `chrome.runtime.onInstalled`, `chrome.runtime.onStartup`, and `chrome.tabs.onUpdated` to collect every tab's URL and title as the user browses. When timing thresholds (received f…	35.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
www.nodemanage.com	-	https://www.nodemanage.com
platform.linkedin.com	-	http://platform.linkedin.com
www.babylonjs.com	/hand.minified-1.2.js	http://www.babylonjs.com/hand.minified-1.2.js
www.babylonjs.com	/cannon.js	http://www.babylonjs.com/cannon.js
www.babylonjs.com	/oimo.js	http://www.babylonjs.com/oimo.js
www.babylonjs.com	/babylon.js	http://www.babylonjs.com/babylon.js
i346.photobucket.com	/albums/p430/seojoony/ice_packed_zpsxtozaj2c.png	http://i346.photobucket.com/albums/p430/seojoony/ice_packed_zpsxtozaj2c.png
www.babylonjs-playground.com	/textures/grass.jpg	http://www.babylonjs-playground.com/textures/grass.jpg

Showing 1 to 10 of 50 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

awesome! don't like the RNG in cloud though.

Eitan BEN-ARI·24 Aug 2020

It's good but it has a script which runs in the background which seems to open random newtabs of random articles. Please remove the background script

James M·23 Jul 2020

This is a great game! I play it whenever I'm bored, and it's a great time-killer. I've beaten all the levels except for "Up up and away". That level has a bug--whenever I die, I don't see the restart button and I have to close the extension and go back in. Otherwise I love this! Oh, and why was that first 2018 map disabled? I really wanna try it :) "Dear everyone, I promise that I will make 3 NEW MAPS by 2020 July 7th. Stay safe! Jason" *Insert sad violin music here* He didn't make them :,(

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Ice Dodo Remastered

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version4

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews