Tracked campaign: Gameograf / Ovkas wallpaper adware

Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →

Also reported by raw.githubusercontent.com

Chrome Web Store

Custom Doodle: GIFs for Google

2cdace34-6e82-598b-a12d-420a058622b5 | v1.4.2
51/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
6 days ago
Version
v1.4.2
Artifact
SHA256 C41…056
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

31 detail rows

YARA Rule Matches

7 rules
SeverityRuleHitsFilesMetadata
LOWpostinstall file download 3
background.jsgiphy.jstenor.js
-
LOWpostinstall crypto operations 1
_metadata/verified_contents.json
-
LOWpostinstall system command 2
_metadata/verified_contents.jsonpopup.css
-
LOWpostinstall file manipulation 12
google.js_locales/pt_BR/messages.jsongiphy.js +9 more
-
LOWpostinstall network communication 5
popup.jsbackground.jstenor.js +2 more
-
LOWpostinstall environment access 3
tenor.jsgoogle.jsgiphy.js
-
LOWpostinstall obfuscation 4
background.jspopup.htmlpopup.js +1 more
-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

386 total

Loading network indicators

IoC detail rows are loaded outside the initial page render.

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

35
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
41
Portfolio

12 evidence rows available.

Finding Categories

1
Network
386
IoC Indicators

YARA Rules Matched

7 rules(30 hits)
postinstall file download postinstall crypto operations postinstall system command postinstall file manipulation postinstall network communication postinstall environment access postinstall obfuscation

Requested Permissions

8 permissions
storage
Low
unlimitedStorage
Low
https://*.duckduckgo.com/*
Low
https://*.giphy.com/*
Low
https://*.tenor.com/*
Low
https://*.yahoo.com/*
Low
https://duckduckgo.com/*
Low
https://yahoo.com/*
Low

Security Analysis Summary

Security Analysis Overview

Custom Doodle: GIFs for Google is a Chrome Web Store extension published by [email protected]. Version 1.4.2 has been analyzed by the Risky Plugins security platform, receiving a risk score of 51.41/100 (MEDIUM risk) based on 417 security findings.

Risk Assessment

This extension presents moderate security risk. Several findings were detected that may warrant attention. Users should carefully review the permissions and findings before installation.

Findings Breakdown

  • Medium: 387 finding(s)
  • Low: 30 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

  • Malware Detection: YARA rule matching against 2,400+ malware signatures
  • Secret Detection: Scanning for exposed API keys, tokens, and credentials
  • Static Analysis: Code-level security analysis for common vulnerability patterns
  • Network Analysis: Detection of suspicious network communications and endpoints
  • Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

Custom Doodle: GIFs for Google is published by [email protected] on the Chrome Web Store marketplace.

Recommendation

Exercise caution with this extension. Review the detailed findings and ensure the requested permissions align with the extension's stated functionality before installation.

About This Extension

Custom Doodle – Personalize Your Google Homepage Make your Google homepage more personal with your favorite animated GIFs! Custom Doodle lets you personalize your Google homepage by replacing the standard Google logo with an animated GIF of your choice. Discover GIFs on GIPHY and Tenor, select your favorites, and give your homepage a unique look. Whether you enjoy funny animations, anime, gaming, cars, sports, or other creative GIFs, Custom Doodle helps you personalize your Google homepage to match your style. ✨ FEATURES 🎨 Personalized Google Doodles Replace the standard Google homepage logo with your favorite animated GIF. Give your homepage a personal touch with animations you enjoy. 🔍 Discover GIFs on GIPHY and Tenor Explore GIPHY and Tenor to find animated GIFs. On supported GIF pages, use the Add Doodle button to add your selected animation to Custom Doodle. 📏 Adjustable Doodle Size Customize the display size of your Doodle from 40 to 300 pixels. Choose a size that works best for your homepage. 🕘 Recent Doodles Keep your five most recently selected GIFs for quick access. Switch between your recent selections without having to find the same GIF again. ⚡ Simple On and Off Controls Enable or disable your custom Doodle whenever you want. Return to the original Google logo by turning the feature off. 🌐 Search Engine Test Shortcuts Open Google, Yahoo, or DuckDuckGo directly from the extension's test section. These buttons let you visit the selected website for testing. The test buttons do not change your browser's default search engine. They are shortcuts for opening the corresponding websites. 🌍 Multilingual Interface The extension uses your browser's language settings to select a supported interface language. If your browser uses an unsupported language, English is used as the default. 🚀 HOW TO USE Install Custom Doodle in Chrome. Visit GIPHY or Tenor and find an animated GIF you like. Click Add Doodle on a supported GIF page. Open the Custom Doodle extension. Adjust the Doodle size to your preference. Visit the Google homepage to see your personalized Doodle. Use the extension's controls to switch between your five recent GIFs or disable the custom Doodle whenever you want. 🌟 DISCOVER MORE WITH GAMEOGRAF Looking for more interesting content and new experiences? Visit Gameograf.com to discover more content, explore creative ideas, and find other interesting things to enjoy. When you install this extension, a Gameograf webpage may open in a new tab. This provides a convenient way to discover additional content on our website. ℹ️ IMPORTANT INFORMATION Custom Doodle is designed to personalize the appearance of the Google homepage. It does not replace Google's search functionality or change your browser's default search engine. The search engine test buttons simply open the corresponding websites. The Doodle replacement feature is designed for Google, and compatibility with other search engines is not guaranteed. The extension requires access to supported webpages to provide its Doodle functionality. The availability of the Add Doodle button may vary depending on the page. When the extension is uninstalled, Chrome may also open the Gameograf website. Make your Google homepage your own with Custom Doodle!

Frequently Asked Questions