Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Super Easy Auto Refresh

CRITICAL RISKRemoved from Chrome Web Store

Super Easy Auto Refresh

ID: globgafddkdlnalejlkcpaefakkhkdoa

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.3.6

Size

0.70 MB

Rating

4.8/5

Reviews

1,576

Users

516,292

Type

Extension

Updated

Aug 21, 2020

Publisher Contextual Analysis

Author: Super Easy Auto RefreshView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

516,292

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Automatically reload and refresh web pages in simplest way.

Super Easy Auto Refresh is the most user friendly auto refresh and auto reload website extension on the chrome web store market. Super Easy Auto Refresh helps you auto refresh and auto reload any pages and website with selected time interval in just one single click. No setup required. Just try it out and you will know! Key features: - Shows real-time countdown timer on extension icon - Can bypass local cache (Ctrl+F5) and perform hard reload when refresh or reload the page and website - Right-click context menu to quickly start to auto refresh and reload current page and website - Remember your auto refresh and auto reload settings and will automatically start to refresh when Chrome first start up

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High2

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.3.6 Code review	7

Extension Version	Code Review Findings
1.3.6	7

Files with findings

2 distinct paths — top paths by unique finding count:

background.build.js6
_locales/en/messages.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	background.build.js (line 865)	This is the core C2 receiver. It decodes the locale-assembled payload (double-atob JSON), then registers a webRequest.onHeadersReceived listener on ALL HTTP/HTTPS traffic. When any HTTP response arrives, the handler s…	1.3.6
2	Network Interception	critical	background.build.js (line 827)	The diff() function uses the decoded C2 config to register webRequest listeners that intercept and modify outgoing HTTP requests. For matching URLs, it rewrites query parameters using the 'some()' (add/replace param) …	1.3.6
3	Obfuscation	critical	_locales/en/messages.json (line 71)	Every locale file contains two anomalous keys — 'locales' and 'key' — whose 'message' values are very long base64-encoded strings that bear no relation to translations. These two fields together form a steganographica…	1.3.6
4	Obfuscation	critical	background.build.js (line 793)	The config() function reads ALL locale files using chrome.runtime.getPackageDirectoryEntry, sorts them alphabetically, applies a selection filter (charCodeAt(0) % 5 !== 0) to choose specific locale files, then concate…	1.3.6
5	Remote Code Loading	critical	background.build.js (line 901)	After receiving C2 configuration, this code extracts URL lists from the decoded config ('ht' field) and programmatically injects DOM elements (likely iframes or script tags via document.createElement/appendChild, obfu…	1.3.6
6	Network Interception	high	background.build.js (line 156)	The 'reponse' (sic) function — deliberately misspelled to evade keyword detection — intercepts tab update events via the obfuscated 'valu' accessor and modifies tab URLs by rewriting them. It checks URL patterns again…	1.3.6
7	Obfuscation	high	background.build.js (line 111)	These obfuscated utility functions implement a double-base64 decode pipeline. 'base' wraps atob(), 'star' applies a function recursively N times (default 1), and 'pay(obs, base, JSON)' evaluates to JSON.parse(atob(ato…	1.3.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

105

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


*	/*	http:///
*	/*	https:///
lodash.com	-	https://lodash.com/
js.foundation	-	https://js.foundation/
lodash.com	/license	https://lodash.com/license
underscorejs.org	/LICENSE	http://underscorejs.org/LICENSE
npms.io	/search	https://npms.io/search?q=ponyfill.
ecma-international.org	/ecma-262/7.0/	http://ecma-international.org/ecma-262/7.0/#sec-patterns
ecma-international.org	/ecma-262/7.0/	http://ecma-international.org/ecma-262/7.0/#sec-template-literal-lexical-components
en.wikipedia.org	/wiki/Combining_Diacritical_Marks	https://en.wikipedia.org/wiki/Combining_Diacritical_Marks

Showing 1 to 10 of 110 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Excelente! Simples, objetivo e prático. Até então, nada a reclamar

Diógenes Almeida·7 Oct 2020

Very easy to operate

HASSAN TOYYIB·7 Oct 2020

love it

Abu Side·5 Oct 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Super Easy Auto Refresh

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews