Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: SaveFrom.net helper

CRITICAL RISKRemoved from Chrome Web Store

SaveFrom.net helper

ID: lfedlgnabjompjngkpddclhgcmeklana

Could be malicious

Extension Info & Metadata

Status

Removed

Version

8.98

Size

0.92 MB

Rating

4.0/5

Reviews

156

Users

260,333

Type

Extension

Updated

Jul 16, 2020

Publisher Contextual Analysis

Author: SavefromView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

260,333

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Download TikTok, Facebook, VK.com and 40+ sites in one click.

SaveFrom.net helper lets you download video and music from FaceBook.com, Vimeo.com, Daylimotion.com, VK.com, Soundcloud.com and more than 40 others just in one click. ====How to install Savefrom net Extension==== Just click "Install" button in Chrome Internet Store. Savefrom Extension will appear on the extension bar of your browser (look for green arrow icon on the bar). ====Main Features of Savefrom extension for Chrome==== + download music, video and pictures + download all mp3 files from the page + check the audio file bitrate and filesize + save the playlist to the computer (to listen it later via your player). ====How to use Savefrom net helper=== On the page where you watch a video file, the "Download" button appears, and allows you to save video in the quality required. Also instead of the button there could be a green arrow on the video or near audio file. Click it to download the file via Savefrom Google Chrome extension

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High3

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
8.98 Code review	5

Extension Version	Code Review Findings
8.98	5

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js3
includes/alitestStatistics.js1
includes/sovetnik-sf.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	high	js/background.js (line 6589)	This code POSTs an encoded payload (`e.data`) plus custom headers to a remotely supplied endpoint. Elsewhere in the same module, the endpoint base is fetched from an external service and the payload is built from brow…	8.98
2	Network Interception	high	js/background.js (line 7088)	This registers blocking `webRequest` listeners on all main-frame navigations and captures request metadata including the `Referer` header for every site. Monitoring and retaining navigation/redirect/referrer informati…	8.98
3	Remote Code Loading	high	includes/sovetnik-sf.js (line 3889)	This helper creates a `<script>` element with an externally supplied `src` URL and injects it into the page, passing serialized settings in the query string. Loading executable code from a remote server into web pages…	8.98
4	Other	medium	js/background.js (line 10089)	The extension pulls experiment/configuration data from a remote server at runtime. That allows the publisher to alter extension behavior after review without shipping a new CRX, which is especially concerning given th…	8.98
5	Unauthorized Data Collection	medium	includes/alitestStatistics.js (line 628)	On matching AliExpress/Tmall pages, this code scrapes product identifiers and prices from the DOM and sends them in bulk to `https://sa.3205.tools/api/prices/bulk`. That is an undisclosed collection of shopping-page d…	8.98

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

190

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
dailymotion.*	/*	http://dailymotion./
.dailymotion.	/*	http://.dailymotion./*
dailymotion.*	/*	https://dailymotion./
.dailymotion.	/*	https://.dailymotion./*
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
api.aliradar.com	/v2/configs/chrome	https://api.aliradar.com/v2/configs/chrome
momentjs.com	/guides/	http://momentjs.com/guides/#/warnings/define-locale/
momentjs.com	/guides/	http://momentjs.com/guides/#/warnings/add-inverted-param/
momentjs.com	/guides/	http://momentjs.com/guides/#/warnings/js-date/

Showing 1 to 10 of 190 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Событие : Загрузка остановлена Пользователь : DESKTOP-SJK8OAR\HOME Тип пользователя : Активный пользователь Имя программы : chrome.exe Путь к программе : C:\Program Files (x86)\Google\Chrome\Application Компонент : Веб-Антивирус Описание результата : Запрещено Тип : Троянская программа Название : HEUR:Trojan.Script.Generic Точность : Эвристический анализ Степень угрозы : Высокая Тип объекта : Файл Имя объекта : video.js Путь к объекту : https://clients2.googleusercontent.com/crx/blobs/QgAAAC6zw0qH2DJtnXe8Z7rUJP3ez6o5xOdEfRPTFGt3xLavjDzAMIGd1jZt-L9hU3nQdNi-k8V5QG67LDI2F-2KH1i6Ckg_pjcFe4ohYyMt52s2AMZSmuVq2_KuIgbKu_3lmJsFAH2OPHAL8w/extension_8_98_0_0.crx//includes MD5 : 4DBA785F9CA7D8502603EA27585BB500 Причина : Экспертный анализ Дата выпуска баз : Сегодня, 26.12.2020 22:33:00 Событие : Переход остановлен Пользователь : DESKTOP-SJK8OAR\HOME Тип пользователя : Активный пользователь Имя программы : chrome.exe Путь к программе : C:\Program Files (x86)\Google\Chrome\Application Компонент : Веб-Антивирус Описание результата : Запрещено Тип : Вредоносная ссылка Название : https://sf-helper.com/static/ffmpegSignature Точность : Точно Степень угрозы : Высокая Тип объекта : Веб-страница Имя объекта : ffmpegSignature Путь к объекту : https://sf-helper.com/static Причина : Базы Дата выпуска баз : Сегодня, 26.12.2020 22:36:00

ДБ

Дмитрий Булыгин·26 Dec 2020

не скачивает с ok.ru

ТЯ

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

SaveFrom.net helper

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews