Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: QQ天气

CRITICAL RISKRemoved from Chrome Web Store

QQ天气

ID: jldlpapkegmnolfgpmmalkhlahjdchkk

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

2.0.2

Size

1.01 MB

Rating

0.0/5

Reviews

Users

352,538

Type

Extension

Updated

Jan 29, 2023

Publisher Contextual Analysis

Author: wx.fuqiangView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

352,538

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

浏览器中查看天气预报的最佳方式

浏览器中查看天气预报的最佳方式，支持全球所有城市，支持多语言

User Growth

Showing data from Jan 30, 2023 to Aug 03, 2023

Versions

+35253700%(+352,537 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High4

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.2 Code review	9

Extension Version	Code Review Findings
2.0.2	9

Files with findings

4 distinct paths — top paths by unique finding count:

uv3/background.js6
ct.bundle.js1
manifest.json1
scriptMain.bundle.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	ct.bundle.js (line 1)	The content script targets only Chinese-language users (navigator.language.match('^zh')) and injects scriptMain.bundle.js into every webpage's DOM via document.body.appendChild. It then establishes a bidirectional pos…	2.0.2
2	Code Injection	critical	scriptMain.bundle.js (line 1)	This code (at the end of scriptMain.bundle.js, injected into every webpage) retrieves the remotely-fetched 'mt' payload from background storage via the postMessage bridge and RC4-decrypts it using the extension name a…	2.0.2
3	Privilege Escalation	critical	uv3/background.js (line 19)	The background message handler exposes a generic Chrome API proxy (case 'chrome') that resolves any dot-separated API path and calls it with caller-supplied parameters — allowing page-injected code to invoke any Chrom…	2.0.2
4	Remote Code Loading	critical	uv3/background.js (line 19)	The extension hardcodes a primary C2 server (https://utq.vvipquan.com) with obfuscated paths for fetching redirect rules (rulePath/rulePath2), a 'money API' endpoint (mnyApi: /pmcnox/zomqdg.htm) for monetization/affil…	2.0.2
5	Remote Code Loading	critical	uv3/background.js (line 19)	On every startup the background fetches a cache-busted URL ({assetsServer}/mt?_timestamp) from the remote C2 server and stores the raw response as 'mt' in local storage. The 'mt' payload is an RC4-encrypted binary blo…	2.0.2
6	Obfuscation	high	uv3/background.js (line 19)	The extension implements a full RC4 cipher and uses it to encrypt outbound tracking requests before sending to the C2 server. Parameters include a persistent user ID (uid), client class (cl), timestamp, and an MD5-sig…	2.0.2
7	Privilege Escalation	high	manifest.json (line 1)	The manifest exposes all extension resources (resources: ['/*']) to all websites (matches: ['<all_urls>']), enabling any webpage to load scriptMain.bundle.js and other extension assets. Combined with the content scrip…	2.0.2
8	Tracking	high	uv3/background.js (line 19)	The extension implements a tracking beacon system that fires GIF pixel requests to jrServer (https://utq.vvipquan.com) on background startup (bgTj) and on page visits (pageTj) with encrypted user identifiers. The util…	2.0.2
9	Unauthorized Data Collection	high	uv3/background.js (line 19)	On initialization the background script generates or retrieves a persistent unique user identifier (uid) stored in chrome.storage.local. The stored user configuration is RC4-encrypted (key from config field 'cen': '19…	2.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fontawesome.com	-	https://fontawesome.com
fontawesome.com	/license/free	https://fontawesome.com/license/free
daneden.me	/animate	http://daneden.me/animate
opensource.org	/licenses/MIT	http://opensource.org/licenses/MIT
utq.vvipquan.com	/qqt	https://utq.vvipquan.com/qqt
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/

Showing 1 to 10 of 50 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.0	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

QQ天气

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating