AI Security Analysis: Dehelper

Analysis generated: 2025-12-11T21:03:19+13:00
Model: gemini-3-pro-preview

Quick Facts

AI Analysis

Executive Summary

Do not install or immediately remove this extension. The "Dehelper" extension presents a CRITICAL security risk (Risk Score: 100/100). The analysis detected multiple high-severity indicators suggesting the extension attempts to break out of the browser sandbox to modify the host operating system. Specifically, the code contains signatures for registry modification, system command execution, and persistence mechanisms—behaviors typical of malware or highly invasive "helper" applications, not standard browser extensions. The publisher is unverified, further reducing trust.

Threat Assessment

The security posture of this extension is extremely poor. The findings indicate that "Dehelper" is not merely a passive browser plugin but likely acts as a bridge to execute code on the underlying operating system.

• System Integrity Violation: The most alarming findings are the postinstall_registry_modification and postinstall_system_command signatures. Browser extensions should operate within a strict sandbox. These findings suggest the extension is either bundling a native executable (Native Messaging Host) or utilizing exploits to modify Windows Registry keys and execute shell commands.
• Persistence Mechanisms: The presence of postinstall_persistence_mechanism indicates the software attempts to ensure it remains running or restarts automatically upon system reboot, a common trait of malware and spyware.
• Obfuscation: The detection of postinstall_obfuscation suggests the developer has intentionally hidden the logic of these scripts, making manual auditing difficult and hiding potential malicious intent.
• Unverified Origin: The developer "欧路软件" (likely referring to Eudic, a dictionary software company) is unverified in this context. This could be a legitimate but invasive tool from them, or a malicious impersonator repackaging their software with malware.

Risk Justification

The 100/100 Critical risk score is fully justified and potentially conservative given the specific nature of the findings:

1. Sandbox Escape Indicators: Standard extensions do not trigger YARA rules for registry modification or system commands. This indicates a fundamental breach of the browser's security model.
2. Malware-Like Behavior: The combination of persistence, obfuscation, and file manipulation matches the behavioral profile of Trojan downloaders or spyware.
3. High Volume of IOCs: With over 4,600 findings, the codebase is riddled with suspicious patterns, far exceeding the norm for a utility extension.
4. Zero Trust: The Trust Score is 0/100, and the publisher is unverified, providing no identity assurance to counterbalance the technical risks.

Key Findings

• Registry Modification (postinstall_registry_modification): The code contains instructions to alter the Windows Registry. This is often used to change system settings, disable security features, or establish persistence.
• System Command Execution (postinstall_system_command): The extension contains capabilities to run commands directly on the host OS shell, posing a risk of arbitrary code execution.
• Persistence Mechanisms (postinstall_persistence_mechanism): Evidence that the software attempts to install startup items or services to ensure it runs continuously without user initiation.
• File Manipulation & Downloads (postinstall_file_manipulation, postinstall_file_download): The extension appears capable of downloading and modifying files on the local disk, potentially dropping additional payloads.
• Obfuscation (postinstall_obfuscation): Critical logic within the extension is obscured, preventing easy analysis of exactly what commands are being executed.

Recommendations

1. Immediate Removal: Uninstall the "Dehelper" extension from Firefox immediately.
2. System Scan: Run a full endpoint protection/antivirus scan on the host machine. The findings suggest this extension may have dropped files or modified system settings outside the browser.
3. Check Startup Items: Inspect the operating system's startup items (Task Manager > Startup on Windows, or Login Items on macOS) for suspicious entries related to "Dehelper" or "Eudic."
4. Credential Rotation: Although "Exposed Secrets" was false, the high level of system access implies a risk of keylogging or data exfiltration. Rotate passwords for sensitive accounts accessed while this extension was active.
5. Block at Network Level: If this is an enterprise environment, block the extension UUID (633677cb-07c3-571c-8d0b-6e1774477d4a) via group policy.

Mitigation Strategies

There is no safe way to use this extension in its current state.

• If this tool is absolutely required for business operations: The organization must contact the vendor ("欧路软件") to obtain a verified, signed version of the software and a technical explanation for why the extension requires registry access and system command capabilities.
• Isolation: If it must be analyzed or used, it should only be installed in a disposable, non-persistent Virtual Machine (VM) with no access to production networks or sensitive data.

Confidence Assessment

Confidence Level: 80%

• Supporting Factors: The YARA rules triggered are specific and high-fidelity (postinstall rules are rarely triggered by benign browser-only code). The combination of specific behaviors (Registry + Network + Persistence) creates a strong fingerprint.
• Limiting Factors: The analysis notes "unknown_file" for the location of these matches. It is possible these findings come from a bundled binary (helper app) rather than the JavaScript itself. While this is still a security risk, it distinguishes between "the extension is malware" and "the extension installs invasive software." Regardless, the risk to the user remains Critical.

Disclaimer

This analysis was generated by an AI model and should be reviewed by security professionals. The findings are based on automated security scanning and may include false positives. Always verify critical findings manually before taking action.