Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PSD · PSD
1416ac1169b3e12f…
1.42 MB
PSD · PSD
c43dfd8348cbd86e…
869.4 KB
PSD · PSD
be267bff32fae13a…
701.1 KB
PSD · PSD
f589152f3eb03a28…
671.6 KB
JS · Main_HTML/160x600/gwd_preview_160x600
96cfc10372b9df6c…
499.4 KB
JS · Main_HTML/180x150/gwd_preview_180x150
96cfc10372b9df6c…
499.4 KB
JS · Main_HTML/300x250/gwd_preview_300x250
96cfc10372b9df6c…
499.4 KB
JS · Main_HTML/300x600/gwd_preview_300x600
96cfc10372b9df6c…
499.4 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
atob
Decodes base64 in the browser
Obfuscation6
Referenced hosts
12 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.