Benign chrome 3,000 installs Download

Snoopy Christmas Wallpaper 1.0.7

Legitimate wallpaper extension

“Celebrate the holiday season with this Snoopy Christmas Wallpaper! Featuring Snoopy, the beloved beagle, dressed in his festive holiday gea…”

Owhit promotional new-tab potentially unwanted extensionReferences the toString conversion method

Evidence

Sets a browser extension uninstall URL bg.js · lines 1–9
1chrome.runtime.onInstalled.addListener(function (details) {
2 if (details.reason === "install") {
3 chrome.tabs.create({ url: "https://owhit.com/snoopy-christmas-wallpaper" });
4 }
5});
6
7if (chrome.runtime.setUninstallURL) {
8 chrome.runtime.setUninstallURL("https://owhit.com/uninstall");
9}
References an AI chat web app host script.js · lines 20–24
20:56… 6V24L19.1 0h-3.523l-3.31 6.003L9.064 0H5.398z"/>
21 </svg>`,
22
23 'chatgpt.com': `<svg viewBox="0 0 24 24" class="site-svg-icon">
24 <path fill="currentColor" d="M22.2819 9.8211a5.9847 5.9847 0 0 0-.5157-4.9108 6.0462 6.0462 0 0 0-6.5098-2.9A6.0651 6.0651 0 0 0 4.9807 4.1818a5.9847 5.9847 0 0 0-3.9977 2.9 6.0462 6.0462 0 0 0 .7427 7.0966 5.98 5.98 0 0 0 .511 4.9107 6.051 6.051 0 0 0 6.5146 2.9001A5.9847 5.9847 0 0 0 13.2599 24a6.0557 6.0557 0 0 0 5.7718-4.2058 5.9894 5.9894 0 0 0 3.9977-2.9001 6.0557 6.0557 0 0 0-.7475-7.0729zm-9.022 12.6081a4.4755 4.4755 0 0 1-2.8764-1.0408l.1419-.0804 4.7783-2.7582a.7948.7948 0 0 0 .3927-.6813v-6.7369l2.02 1.1686a.071.071 0 0 1 .038.052v5.5826a4.504 4.504 0 0 1-4.4945 4.4944zm-9.6607-4.1254a4 …
HTTP URL string literal script.js · lines 28–62
⋯4 lines
32 {
33 name: "Custom Cursor",
34 url: "https://chromewebstore.google.com/detail/neon-cursor-custom-cursor/minbmmlkjhipjhkokdnginijechpojaa",
35 },
36 {
37 name: "Youtube",
38 url: "https://www.youtube.com",
39 },
40 {
41 name: "Chatgpt",
42 url: "https://chatgpt.com",
43 },
44 {
45 name: "Instagram",
46 url: "https://www.instagram.com",
47 },
48 {
49 name: "X",
50 url: "https://x.com",
51 },
52 {
53 name: "Netflix",
54 url: "https://www.netflix.com",
55 },
56];
57
58let stored_links = JSON.parse(localStorage.getItem("shortcuts"));
59let shortcut_data = stored_links !== null ? stored_links : links;
60let remove_link_button;
61let create_shortcut;
62
Owhit promotional host URL popup.js · lines 1–27
1document.getElementById("uninstall-link").addEventListener("click", (event) => {
2 event.preventDefault();
3 if (confirm("Are you sure you want to remove this extension?")) {
4 chrome.management.uninstallSelf({ showConfirmDialog: false }, () => {
5 alert("The extension was removed successfully.");
6 });
7 }
8});
9document.getElementById("rate-us").addEventListener("click", function() {
10
11 let extensionId = chrome.runtime.id;
12 let url = `https://chrome.google.com/webstore/detail/${extensionId}/reviews`;
13
14 window.open(url, "_blank");
15});
16
17
18document.getElementById("more-extensions").addEventListener("click", function() {
19
20 window.open("https://chromewebstore.google.com/detail/neon-cursor-custom-cursor/minbmmlkjhipjhkokdnginijechpojaa", "_blank");
21});
22
23
24document.getElementById("privacy-policy").addEventListener("click", function() {
25
26 window.open("https://owhit.com/privacy-policy", "_blank");
27});
Chrome new tab page override manifest.json · lines 1–21
1{
2 "author": "Owhit",
3 "background": {
4 "service_worker": "/js/bg.js"
5 },
6 "chrome_url_overrides": {
7 "newtab": "index.html"
8 },
9 "default_locale": "en",
10 "description": "__MSG_appDesc__",
11 "icons": {
12 "128": "img/128.png",
13 "16": "img/128.png",
14 "48": "img/128.png"
15 },
16 "manifest_version": 3,
17 "name": "__MSG_appName__",
18 "permissions": [ "search" ],
19 "update_url": "https://clients2.google.com/service/update2/crx",
20 "version": "1.0.7"
21}

Showing the top 5 files — 3 more files (12 regions) not shown.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.