Tracked campaign: Gameograf / Ovkas wallpaper adware

Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →

Also reported by raw.githubusercontent.com

Chrome Web Store

Nissan r34 in the neon japan city at rainy night

3f19133f-2c09-53ba-aac1-6dfba9687cd4 | v1.0.15
41/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
5 days ago
Version
v1.0.15
Artifact
SHA256 156…E9B
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

19 detail rows

YARA Rule Matches

9 rules
SeverityRuleHitsFilesMetadata
LOWpostinstall crypto operations 3
img/bg.mp4jquery-3.7.1.min.js_metadata/verified_contents.json
-
LOWpostinstall file manipulation 3
script.jsstyle.cssjquery-3.7.1.min.js
-
LOWpostinstall obfuscation 2
img/bg.mp4jquery-3.7.1.min.js
-
LOWpostinstall network communication 3
index.htmlimg/bg.mp4jquery-3.7.1.min.js
-
LOWpostinstall system command 2
img/bg.mp4jquery-3.7.1.min.js
-
LOWpostinstall file download 1
img/bg.mp4
-
LOWSQLInjection 2
script.jsjquery-3.7.1.min.js
-
LOWNoUseWeakRandom 2
script.jsjquery-3.7.1.min.js
-
LOWLocalStorageShouldNotBeUsed 1
script.js
-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

130 total

Loading network indicators

IoC detail rows are loaded outside the initial page render.

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

39
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
28
Portfolio

11 evidence rows available.

Finding Categories

130
IoC Indicators

YARA Rules Matched

9 rules(19 hits)
postinstall crypto operations postinstall file manipulation postinstall obfuscation postinstall network communication postinstall system command postinstall file download SQLInjection NoUseWeakRandom LocalStorageShouldNotBeUsed

Requested Permissions

1 permission
search
Low

Security Analysis Summary

Security Analysis Overview

Nissan r34 in the neon japan city at rainy night is a Chrome Web Store extension published by [email protected]. Version 1.0.15 has been analyzed by the Risky Plugins security platform, receiving a risk score of 41.34/100 (MEDIUM risk) based on 149 security findings.

Risk Assessment

This extension presents moderate security risk. Several findings were detected that may warrant attention. Users should carefully review the permissions and findings before installation.

Findings Breakdown

  • Medium: 130 finding(s)
  • Low: 19 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

  • Malware Detection: YARA rule matching against 2,400+ malware signatures
  • Secret Detection: Scanning for exposed API keys, tokens, and credentials
  • Static Analysis: Code-level security analysis for common vulnerability patterns
  • Network Analysis: Detection of suspicious network communications and endpoints
  • Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

Nissan r34 in the neon japan city at rainy night is published by [email protected] on the Chrome Web Store marketplace.

Recommendation

Exercise caution with this extension. Review the detailed findings and ensure the requested permissions align with the extension's stated functionality before installation.

About This Extension

Nissan r34 in the neon japan city at rainy night New Tab - Transform your browser with a stunning HD live wallpaper. Each new tab opens with a cinematic looped animation, perfect for fans of this theme. Extension Features 🎞 Nissan r34 in the neon japan city at rainy night Video – Dynamic HD looped live wallpaper. Affiliate Policy Notice This extension opens a new tab at https://dekuy.com. Some links on our website including Amazon links may contain affiliate tracking. If you purchase through these links, Dekuy.com may earn a small commission, helping us maintain and improve our free extensions.

Frequently Asked Questions