Tracked campaign: Gameograf / Ovkas wallpaper adware

Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →

Also reported by raw.githubusercontent.com

Chrome Web Store

SOLO LEVELING Sung Jin-woo Live Wallpaper

by [email protected] · 40 users
3f4aa129-26d1-5cec-a369-ee27363a8e83 | v1.4.1

Marketplace listing not found

Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.

Not found on Today
43/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
2 months ago
Version
v1.4.1
Artifact
SHA256 558…282
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

17 detail rows

YARA Rule Matches

8 rules
SeverityRuleHitsFilesMetadata
LOWpostinstall crypto operations 2
jquery-3.7.1.min.js_metadata/verified_contents.json
-
LOWpostinstall file manipulation 3
jquery-3.7.1.min.jsstyle.cssscript.js
-
LOWpostinstall obfuscation 1
jquery-3.7.1.min.js
-
LOWpostinstall network communication 3
jquery-3.7.1.min.jsindex.htmlimg/bg.mp4
-
LOWpostinstall system command 3
jquery-3.7.1.min.js_metadata/verified_contents.jsonimg/bg.mp4
-
LOWSQLInjection 2
jquery-3.7.1.min.jsscript.js
-
LOWNoUseWeakRandom 2
jquery-3.7.1.min.jsscript.js
-
LOWLocalStorageShouldNotBeUsed 1
script.js
-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

263 total

Loading network indicators

IoC detail rows are loaded outside the initial page render.

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

39
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
17
Portfolio

12 evidence rows available.

Finding Categories

263
IoC Indicators

YARA Rules Matched

8 rules(17 hits)
postinstall crypto operations postinstall file manipulation postinstall obfuscation postinstall network communication postinstall system command SQLInjection NoUseWeakRandom LocalStorageShouldNotBeUsed

Requested Permissions

1 permission
search
Low

Security Analysis Summary

Security Analysis Overview

SOLO LEVELING Sung Jin-woo Live Wallpaper is a Chrome Web Store extension published by [email protected]. Version 1.4.1 has been analyzed by the Risky Plugins security platform, receiving a risk score of 42.76/100 (MEDIUM risk) based on 280 security findings.

Risk Assessment

This extension presents moderate security risk. Several findings were detected that may warrant attention. Users should carefully review the permissions and findings before installation.

Findings Breakdown

  • Medium: 263 finding(s)
  • Low: 17 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

  • Malware Detection: YARA rule matching against 2,400+ malware signatures
  • Secret Detection: Scanning for exposed API keys, tokens, and credentials
  • Static Analysis: Code-level security analysis for common vulnerability patterns
  • Network Analysis: Detection of suspicious network communications and endpoints
  • Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

SOLO LEVELING Sung Jin-woo Live Wallpaper is published by [email protected] on the Chrome Web Store marketplace. The extension has approximately 40 users.

Recommendation

Exercise caution with this extension. Review the detailed findings and ensure the requested permissions align with the extension's stated functionality before installation.

About This Extension

Immerse yourself in the world of SOLO LEVELING with this live wallpaper extension. Experience the stunning artistry and dynamic landscapes that capture the essence of Jinwoo's epic journey through dungeons and battles. The visuals feature intricate, vibrant colors that bring to life captivating characters and iconic locations from the series. From the breathtaking environments to the detailed aesthetics of powerful foes, every element resonates with fans and enhances the online experience. The seamless blend of action-packed scenes and atmospheric depth ensures that you'll feel the adrenaline rush of each adventure. Every new tab transforms into a canvas of exhilarating art. The live wallpaper adapts beautifully, creating a dynamic backdrop that pulses with energy, making your browsing experience not just functional but visually stunning. Features 🎞 Dynamic HD live wallpapers ✨ Smooth animations and visual effects 🖱️ Shortcut links, date and time on the new tab 🔗 Quick access site shortcuts 🔍 Uses the search engine selected by the user 📌 Includes additional useful extensions Fans of SOLO LEVELING will love the unique designs and engaging visuals available at gameograf.com, which celebrates the artistry of all your favorite series. Google Chrome Affiliate Program Disclosure This extension, when installed, opens the ovkas.com or gameograf.com website in your new tab to provide information about the downloaded extension. It is designed to enhance user experience, offer access to similar extensions, and help users create their own. The extension may contain links to specific services or products per policy. All redirects are designed for user benefit and require consent before any action is taken.

Frequently Asked Questions