Suspicious 91% chrome 1,000 installs Download

Aston Martin F1 Cars Wallpapers New Tab Gameograf 3.5.0

Remote HTML injection, data deletion

“Refresh your Chrome with Aston Martin F1 Cars Wallpapers – stunning HD new tab backgrounds for racing enthusiasts. Aston Martin F1 Cars Wa…”

Gameograf new-tab and search takeover manifestGameograf new-tab page fronting user searches

Evidence

Chrome new tab page override manifest.json · lines 1–29
1{
2"update_url": "https://clients2.google.com/service/update2/crx",
3
4 "author": "Gameograf",
5 "manifest_version": 3,
6 "name": "__MSG_appName__",
7 "default_locale": "en",
8 "version": "3.5.0",
9 "description": "__MSG_appDesc__",
10 "chrome_url_overrides": {
11 "newtab": "index.html"
12 },
13 "background": {
14 "service_worker": "/js/bg.js"
15 },
16
17 "permissions": [
18 "search"
19 ],
⋯10 lines
Gameograf promotional host URL script.js · lines 2–22
⋯6 lines
8];
9// api.gameograf
10fetch("https://api.gameograf.com/js/shortcuts.json")
11 .then(response => response.json())
12 .then(data => {
13 // Güncel veriyi kullan
14 shortcut_data = data;
15
16 // Güncel veriyi localStorage'a kaydet (istersen)
17 localStorage.setItem("shortcuts", JSON.stringify(data));
18
19 createShortcuts();
20 })
21 .catch(error => {
22 console.error("Shortcuts could not be loaded from …
Reads browser storage with getItem script.js · lines 24–30
24:54… aki eski veriyi kullan
25 const stored_links = JSON.parse(localStorage.getItem("shortcuts"));
26 shortcut_data = stored_links !== null ? stored_links : [];
27
28 createShortcuts();
29 });
30let …
Module scope assigns zero-argument call script.js · lines 53–64
53:18… le = true;
54 bg_mode_toggle.show();
55 $("#alert").hide();
56}
57
58let img = getImage();
59// let vid = getVideo();
60
⋯4 lines
Searches via the user's configured engine script.js · lines 81–111
81:20… ch
82 search_input.keyup((e) => {
83 if (e.keyCode === 13) {
84 search_trigger.click();
85 }
86 });
87 search_trigger.click(() => {
88 const searchQuery = search_input.val();
89 if (searchQuery != "") {
90 chrome.search.query({ text: searchQuery }, function(results) {
91 if (results && results.length > 0) {
92 window.location.href = results[0].url;
93 }
94 });
⋯7 lines
102
103 // Handle the background mode
104 bg_mode_toggle.click(() => {
105 if (bg_mode == "img") {
106 bg_mode = "vid";
⋯5 lines

Showing the top 5 files — 5 more files (21 regions) not shown.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.