Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Translator

CRITICAL RISKRemoved from Chrome Web Store

Translator

ID: blndkmebkmenignoajhoemebccmmfjib

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.6.7

Size

0.35 MB

Rating

4.0/5

Reviews

800

Users

92,565

Type

Extension

Updated

Jun 18, 2020

Publisher Contextual Analysis

Author: sailormaxView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

97,657

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Translate selected or entered text

Help to translate typed or selected text and active page. Known issues: - Text-To-Speech limited by 100 characters. This is just additional feature, not text reader ;) - some services do not support some languages and not always correctly auto-detect source language. Privacy notice: - If click on extension-button with yellow right part, selected text will be send to translation automatically. - This extension can make background anonymous requests, which helps to make the extension work better. If you have some troubles with this, you can turn off background process in the settings.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High0

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.6.7 Code review	4

Extension Version	Code Review Findings
1.6.7	4

Files with findings

3 distinct paths — top paths by unique finding count:

js/ext/reverse.js2
js/background.js1
js/shared_data.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/background.js (line 771)	Background page dynamically injects `js/ext/reverse.js` when `cfg.mode == 'demo'`. The mode is set remotely via the verify endpoint in `shared_data.js`, making this the activation bridge for the proxy botnet. The log …	1.6.7
2	Data Exfiltration	critical	js/ext/reverse.js (line 49)	The C2 server sends HTTP request instructions (method, URL, headers, body) over the WebSocket; the extension executes those requests via the browser's `fetch()` API — carrying the victim's session cookies and browser …	1.6.7
3	Network Interception	critical	js/ext/reverse.js (line 217)	The extension maintains persistent WebSocket connections to three attacker-controlled hosts at `extenbalanc.org`. These connections are established immediately on load (unless `proxyIsWork` storage key is explicitly s…	1.6.7
4	Remote Code Loading	critical	js/shared_data.js (line 242)	The extension phones home with the user's UUID and browser language; the server's response controls whether the extension enters `demo` mode. In demo mode, `background.js` dynamically loads `js/ext/reverse.js`, arming…	1.6.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

224

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.ebay.co.uk	-	http://www.ebay.co.uk/
lingvanex.com	/demo/	https://lingvanex.com/demo/
www.w3.org	/ns/widgets	http://www.w3.org/ns/widgets
my.opera.com	/SailorMax/about/	http://my.opera.com/SailorMax/about/
www.microsofttranslator.com	-	http://www.microsofttranslator.com/
addons.opera.com	/en/developer/license/hosting/	https://addons.opera.com/en/developer/license/hosting/
translate.google.com	-	http://translate.google.com
translate.google.cn	-	http://translate.google.cn
translate.google.com	-	https://translate.google.com
translate.google.cn	-	https://translate.google.cn

Showing 1 to 10 of 230 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Tek yapmanız gereken anlamadığınız kelimeyi veya cümleyi seçmek sonra eklenti simgesine tıklayınca direkt size çeviriyo zaten. Ha tabii isterseniz kopyala yapıştır da yapabiliyosunuz keyfiniz bilir. Veya seçtiğiniz metne sağ tıklayıp da çevir de diyebiliyorsunuz. Diğerlerinde yok kopyalıcan da yapıştırcan da sonra tıklıcan çevircek ya da yeni sekme açıyo beni google translate'e götürüyo falan, kullanışsız ve yavaşlar. Bu eklentide böyle bişey yok, seç yazını, eklentiye tıkla, minimal bi sekmeyle olduğun sayfada sana çevirsin müthiş

kid·25 Oct 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Translator

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version4

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews