Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · assets/img
065bce536c87df63…
932.8 KB
PNG · assets/img
8133ff2d91bac9c1…
203.2 KB
PNG · assets/img
8d718fb10a975d77…
199.0 KB
PHP · includes/sms/libphonenumber
4a89263e818cdcd1…
174.1 KB
JPG · assets/img
ad871bb10c839871…
157.9 KB
JS · assets/js
1fc6a1b92bc43eb2…
153.0 KB
JPG · assets/img
21b67c74dfb9222a…
150.1 KB
JPG · assets/img
25ef43300203c6af…
150.0 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization3
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.