Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 电影VIP

CRITICAL RISKRemoved from Chrome Web Store

电影VIP

ID: ipielliclaogmnnmipmpdabmgpjnfpgf

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.0.0.2

Size

0.66 MB

Rating

2.6/5

Reviews

Users

249,788

Type

Extension

Updated

Dec 9, 2020

Publisher Contextual Analysis

Author: mmovievipView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

249,865

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

全网VIP视频免费破解去广告、全网音乐直接下载、百度网盘直接下载、知乎视频下载等多合一版。长期更新，放心使用。

更多网站不断添加中，我们也会支持用户自己编辑脚本使用

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High2

Medium0

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.0 Code review	3

Extension Version	Code Review Findings
1.0.0.0	3

Files with findings

1 distinct path — top paths by unique finding count:

background/index.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	background/index.js (line 17856)	This obfuscated background routine fetches JavaScript-like payloads from remote `assetsServ` endpoints and executes them with `eval.bind(window)(...)`. It also stores prior payloads in `chrome.storage.local` (`mb` and…	1.0.0.0
2	Network Interception	high	background/index.js (line 16810)	The extension reads cookies for arbitrary target URLs with `browser.cookies.getAll(...)` and injects them into outgoing requests as a raw `Cookie` header. In an extension with `<all_urls>` and `webRequest` privileges,…	1.0.0.0
3	Tracking	high	background/index.js (line 17654)	This hidden telemetry routine prepares requests to an obfuscated remote server (`jrServer`) and includes the current page URL, document referrer, a timestamp, and a derived `__checkcode` MD5 over stored identifiers su…	1.0.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
violentmonkey.github.io	/api/gm/	https://violentmonkey.github.io/api/gm/#gm_xmlhttprequest
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
codemirror.net	/doc/manual.html	https://codemirror.net/doc/manual.html#config\
github.com	/codemirror/CodeMirror/tree/master/theme/	https://github.com/codemirror/CodeMirror/tree/master/theme\
codemirror.net	/doc/manual.html	https://codemirror.net/doc/manual.html#config
violentmonkey.github.io	/auth_dropbox.html	https://violentmonkey.github.io/auth_dropbox.html
api.dropboxapi.com	/2/users/get_current_account	https://api.dropboxapi.com/2/users/get_current_account

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.2	IPv4	-
1.3.132.0	IPv4	-
1.101.3.4	IPv4	-

2.6 out of 5 · 5 most recent reviews

Text reviews

Positive

Negative

不可用

두

두정일·11 Feb 2021

不��用

두

두��일·11 Feb 2021

Installs on its own. Did not give ANY permissions. Hides in the background of extensions(not on extensions toolbar) by default. Always running. Has read and capture access on ALL websites visited. This is 100% malware and should be banned from the Chrome Web Store.

C Zar

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

电影VIP

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions3

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews