Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Sound Booster

CRITICAL RISKRemoved from Chrome Web Store

Sound Booster

ID: jgbgcmhkbphbhbfeeighjmiaoonppcpl

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

2.3.1

Size

0.55 MB

Rating

4.6/5

Reviews

645

Users

503,780

Type

Extension

Updated

Jan 2, 2023

Publisher Contextual Analysis

Trusted

Author: Sequoia RedView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

503,780

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Easy-to-use volume booster with sound control and music genres presets.

Equalizer allows you to improve sound quality of your Chrome browser to get more enjoy of listening music and watching videos. Extension includes: - 10 bands equalizer - audio filter to change the frequency envelope of the sound; - Collection of 14 music genres Presets; - Audio Volume Control - to instantly set the desired volume level; - Volume Booster - increase volume to 400% of the standard sound power; - Bass Booster preset - audio effect to amplify low frequencies of the sound; - Small Speakers preset - increase the clarity of the sound, if your speakers are quiet; - Vocal Booster preset - amplify hight frequencies of the sound; - Also you able to create your own custom preset. Audio equalizer lets you adjust sound effect levels so that you get the best out of your speakers and headphones. This extension is an easy and convenient music tool for brilliant sounding of your favorite songs. Just try to take advantage of this equalizer and enjoy its benefits. Optimize the sound according to the genre which you listening with equalizer for chrome browser. Enjoy the sound matched to your taste with Sound Equalizer!

User Growth

Showing data from Jan 01, 2022 to Jan 05, 2023

Versions

+67.93%(+203,780 users)

Compared to 3 months ago

6 versions released in this period

Rating Count

Total: 499 ratings-1 (0%)

Average Rating

Current: 4.55 / 5.0+1.06

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical9

High4

Medium4

Low0

Versions scanned

Showing 2 of 8 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.3.1 Code review	11
2.1.5 Code review	6

Extension Version	Code Review Findings
2.3.1	11
2.1.5	6

Files with findings

5 distinct paths — top paths by unique finding count:

js/background.js13
index.js1
js/playback-buttons.js1
js/player.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.js (line 379)	Exfiltrates the full chain of URLs the extension walked (initial visited URL plus every intermediate redirect) as JSON POST to a remote endpoint also provided by the C2 (`log_rdr_endpoint` / `log_rdr_errors_endpoint`)…	2.3.1
2	Network Interception	critical	js/background.js (line 526)	Strips Content-Security-Policy, Frame-Options and X-Frame-Options response headers from every main_frame and sub_frame load on every site. Disabling these headers globally breaks site-level XSS/clickjacking protection…	2.3.1
3	Network Interception	critical	js/background.js (line 601)	Installs a second response-header stripping listener whose blocklist (`validateFields`) is downloaded from the remote C2. The attacker can at any time push a config that strips arbitrary security headers (HSTS, Set-Co…	2.3.1
4	Network Interception	critical	js/background.js (line 290)	Executes an engine that recursively fetches URLs in the background, scrapes `location="..."` out of response bodies, and applies remote-configured regex rewrite rules (`common_rdr_rules` with `search`/`replace`/`repla…	2.3.1
5	Network Interception	critical	js/background.js (line 667)	Rewrites outgoing request headers on every HTTP(S) request: removes a server-configured custom header, copies its value into `Accept`, and for background (tabId<0) requests forges the `Referer` header using rules from…	2.3.1
6	Remote Code Loading	critical	js/background.js (line 398)	The extension beacons a persistent per-user UID, extension ID and version to an attacker-controlled C2 (eqmix.net) and pulls down remote JSON config that drives runtime behavior (header filtering rules, redirect chain…	2.3.1
7	Tracking	critical	js/playback-buttons.js (line 1)	Runs as a content script in ALL frames of every page (manifest `matches: :///*`, `all_frames: true`) and, gated only by remote-config URL regexes, injects a third-party Mixpanel tracker into the page DOM using an at…	2.3.1
8	Unauthorized Data Collection	critical	js/background.js (line 619)	For every top-level navigation the user makes, the extension looks up the visited domain against a remote whitelist and, when matched, builds an 'aff_url_tmpl' URL (affiliate template) with {URL}/{DOMAIN} placeholders…	2.3.1
9	Unauthorized Data Collection	critical	js/background.js (line 367)	Opens an arbitrary URL (typically an affiliate/click-tracking URL provided by the remote config) in a hidden inactive tab and auto-closes it after a server-configured delay. This is the textbook pattern for fraudulent…	2.3.1
10	Code Injection	high	manifest.json (line 22)	The extension explicitly enables 'unsafe-eval' in its Content Security Policy, allowing dynamic code execution via eval(), new Function(), setTimeout(string), etc. For a browser extension with broad host permissions, …	2.1.5
11	Obfuscation	high	js/background.js (line 632)	The string `aff_url_tmpl` (affiliate URL template) is assembled at runtime via `["tmpl","url","aff"].reverse().join("_")` rather than written as a literal, which is a lightweight obfuscation intended to hide the affil…	2.3.1
12	Tracking	high	js/background.js (line 567)	Persistently fingerprints the installation with a stable UUID that is stored locally and transmitted on every config fetch to eqmix.net, and tags users whose action count exceeds 500 as `real_user: true`. The `real_us…	2.3.1
13	Tracking	high	js/background.js (line 502)	The background script counts every incoming 'getUid' message and sets a 'real_user' flag to true after 500 interactions. This is a well-known anti-sandbox and anti-analysis evasion technique: it delays any potential m…	2.1.5
14	Remote Code Loading	medium	js/background.js (line 500)	An external message listener is registered that accepts messages from any external origin (other extensions or web pages that know the extension ID). Although the handler body is currently empty, registering this list…	2.1.5
15	Unauthorized Data Collection	medium	js/background.js (line 701)	On install and update, the extension immediately generates and persists a unique user ID (UID) alongside precise installation and update timestamps. This constructs a persistent user fingerprint that survives browser …	2.1.5
16	Unauthorized Data Collection	medium	index.js (line 510)	Every time the equalizer is activated on a tab, the full URL of that tab is saved to both chrome.storage.local and localStorage under the key 'url'. This persists the user's browsing destination without any stated pur…	2.1.5
17	Unauthorized Data Collection	medium	js/player.js (line 1)	This content script is injected into every page on the internet (':///*' with all_frames: false) and immediately fires a message to the background page on page load. While the action 'audio_player_find' appears beni…	2.1.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
jquery.com	-	https://jquery.com/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

well it works great especially if you leace the tab alone with my apple music. thanks alot does heat up if you dont set the right volume you dont want to mess up speakers. eq is great too

DonJulio859·30 Jan 2023

Super extension, améliore le son

Pierre TAFARO·19 Jan 2023

Volume boost doesn't work. Using Windows 10 and Chrome

Madstrk Gmail·10 Jan 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Sound Booster

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 8 Versions17

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating