Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 水牛日历

CRITICAL RISKRemoved from Chrome Web Store

水牛日历

ID: kbdlmdaekjocngipaonfkajnjpkncbib

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

2.1.11

Size

0.25 MB

Rating

4.0/5

Reviews

Users

176,380

Type

Extension

Updated

Oct 18, 2020

Publisher Contextual Analysis

Trusted

Author: sani laxView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: Yes
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

456,557

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

基于传统黄历增加了日程记录、24节气、班休、国际节日等功能

水牛日历基于传统黄历、日程记录等日历功能上提供班休等个性化生活提醒服务，致力于成为用户的智能生活提醒助手

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical6

High4

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.1.11 Code review	11

Extension Version	Code Review Findings
2.1.11	11

Files with findings

2 distinct paths — top paths by unique finding count:

js/bg.js10
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/bg.js (line 157)	Every time a URL is redirected, the function `r(e)` is called with the original URL (`h: e`) and a persistent UUID (`i: l()`). This data, along with extension version and session counters, is exfiltrated to the remote…	2.1.11
2	Network Interception	critical	js/bg.js (line 263)	The extension registers a blocking webRequest listener on ALL URLs. The handler function `m` implements complex URL matching against a remotely-fetched configuration object `s`, enabling the extension to intercept and…	2.1.11
3	Network Interception	critical	js/bg.js (line 63)	This function iterates over the remotely-fetched redirect ruleset `s` and pattern-matches the current tab URL against domain entries. When matched it either rewrites query parameters silently or redirects to an attack…	2.1.11
4	Network Interception	critical	js/bg.js (line 193)	The extension installs a blocking `webRequest.onBeforeRequest` handler on `<all_urls>` and can return `redirectUrl` for top-level page loads. The redirect destination is driven by data in the mutable `s` object rather…	2.1.11
5	Obfuscation	critical	js/bg.js (line 177)	The C2 server URL `http://www.xiangyang8.com/web/xylog.lg` is assembled at runtime by concatenating fragments and using a helper function `i()` that repeats characters (e.g. `i('t',2)` → `'tt'`, `i('8',3)` → `'888'`).…	2.1.11
6	Remote Code Loading	critical	js/bg.js (line 338)	The server response is triple-Base64-decoded and parsed as JSON into the variable `s`, which becomes the live redirect-rule configuration governing which URLs get hijacked. This is a classic remote code configuration …	2.1.11
7	Obfuscation	high	js/bg.js (line 505)	A triple-Base64-encoded string `d` is hardcoded as a seed/default payload. The runtime loads and decodes the server response into `s` (the live redirect table), but `d` serves as a fallback or integrity check token. E…	2.1.11
8	Other	high	js/bg.js (line 323)	This code fetches a remotely supplied payload from `http://www.xianyang888.com/web/xylog.lg`, decodes it three times, parses it as JSON, and stores it into the global rule object `s`. Because the interception logic la…	2.1.11
9	Tracking	high	js/bg.js (line 457)	This function generates a UUID v4-format persistent identifier. It is stored in the `bulo` configuration object in `chrome.storage.local` (field `c`) and included in every outbound telemetry call as parameter `i`. Thi…	2.1.11
10	Tracking	high	js/bg.js (line 157)	This function transmits each intercepted URL (`h: e`) together with the extension version, a generated identifier (`i: l()`), timestamps, and other metadata to a remote server assembled as `http://www.xianyang888.com/…	2.1.11
11	Unauthorized Data Collection	medium	manifest.json (line 16)	The extension injects jQuery into every page on the internet (`<all_urls>`). While jQuery itself is benign, combining this content-script presence with the background's `webRequestBlocking` listener and remote redirec…	2.1.11

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.gd.gov.cn	-	http://www.gd.gov.cn/
gd.gov.cn	-	http://gd.gov.cn/
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

怎么不更新了？

Jin Y·6 Mar 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

水牛日历

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews