Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Saving Files

CRITICAL RISKRemoved from Chrome Web Store

Saving Files

ID: efppklondgabgcjblaffdbdgbdjnfkcn

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.3.6

Size

0.16 MB

Rating

3.0/5

Reviews

Users

20,000

Type

Extension

Updated

Jan 27, 2023

Publisher Contextual Analysis

Author: anniewelch976View Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

20,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Saving Files is a new file downloader extension with ability to automatically load all files (images, audio, video, other assets)…

Saving Files is a new file downloader extension with ability to automatically load all files (images, audio, video, other assets) from a webpage. This extension has some useful functions that will make you life easier. When clicking on the extension’s icon on the tool bar- you’ll have a button that will provide an option to open a page with all your downloads and have the ability to manage all your downloads with various categories. Clicking the second button will provide you the opportunity to download the files exist on the specific website you using at the moment. You will get tabs sorted by files categories such as Images, Videos, Document and Other file types. It’s not the end- then you’ll have the option to download chosen file or download them all! We wish you to have a great experience with our extension and leave us a 5 stars review!

User Growth

Showing data from Apr 01, 2024 to May 16, 2024

Versions

No change in user count

Compared to 2 months ago

1 version released in this period

Rating Count

Total: 2 ratings

Average Rating

Current: 3.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium0

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.3.6 Code review	8

Extension Version	Code Review Findings
1.3.6	8

Files with findings

2 distinct paths — top paths by unique finding count:

background.js4
content.js4

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	content.js (line 1875)	The content script (injected at document_start into every https:/// and http:/// page) exfiltrates the visited page's full URL (`r.href`) and the parsed search query (`Z`) to the remote endpoint base `e = "https:/…	1.3.6
2	Data Exfiltration	critical	content.js (line 2251)	Second exfiltration call site: extracts the value of an arbitrary URL query parameter (`ae`) from the current page's location.search and ships it together with the full URL and user id to floriddes.com. The parameter …	1.3.6
3	Remote Code Loading	critical	background.js (line 738)	On every chrome.tabs.onActivated event the service worker beacons to a hard-coded remote endpoint at floriddes.com/apiv2/, sending serialized key=value pairs (including the user identifier `i` from chrome.storage.sync…	1.3.6
4	Remote Code Loading	critical	content.js (line 404)	Custom hex+XOR decryption routine that takes the user-id `l` (from chrome.storage.sync) as the key and the server-supplied blob `aFd` (`D`, fetched from floriddes.com and stored in chrome.storage.local) as ciphertext,…	1.3.6
5	Obfuscation	high	content.js (line 122)	The network sender resolves the function to invoke (e.g., `fetch`/`navigator.sendBeacon`/`Image`) by walking an array of property names against `window` rather than referencing it literally, then invokes it via `.call…	1.3.6
6	Obfuscation	high	background.js (line 3)	Both background.js (1902 lines) and content.js (2340 lines) are padded with thousands of identical dead-code blocks gated by `if (Date.now() < Math.random())` (always false since Math.random() < 1 ≤ Date.now()), wrapp…	1.3.6
7	Tracking	high	background.js (line 1761)	The extension binds the user's persistent identifier (`a`, the `Add` value from chrome.storage.local) to install and uninstall pings sent to floriddes.com. Combined with the per-tab beacon, this builds a long-lived pe…	1.3.6
8	Other	low	background.js (line 1882)	This is the only code that actually corresponds to the extension's stated purpose ('Saving Files') — accepting a list of URLs from a message and downloading them. It is dwarfed by the surrounding tracking/exfiltration…	1.3.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


floriddes.com	/apiv2/	https://floriddes.com/apiv2/?
floriddes.com	/apiv2/uninstall	https://floriddes.com/apiv2/uninstall
floriddes.com	/apiv2/thanks	https://floriddes.com/apiv2/thanks
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	https:///
*	/*	http:///
floriddes.com	-	https://floriddes.com
reactjs.org	/link/react-polyfills	https://reactjs.org/link/react-polyfills
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


4.4.9.9	IPv4	-

3.0 out of 5 · 2 most recent reviews

Text reviews

Positive

Negative

I also don't see any problems, like mentioned below. Made my life more easy. Thx

Igor Zakolodyazhnyi·14 Dec 2022

As a security engineer, I can say that this extension bears all the signs of an illegitimate extension used for data harvesting and or malware deployment and control. Avoid it. It is from the same malicious outfit which made "Video Downloader for Web," which was removed from the Chrome Store.

C Smith·21 Nov 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Saving Files

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews