Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · includes
fbbda5385f24da55…
56.2 KB
JS · includes/mbt/assets/js
4d8482be4e00a0bf…
34.6 KB
JS · assets/js
c908e5a08740d2d9…
31.1 KB
PHP · includes
441630d577bb9411…
30.8 KB
PHP · classes
626bd8bbf61b16f6…
26.9 KB
CSS · assets/css
9b667edbc6c4065c…
24.2 KB
JS · assets/js
6d76200338d53381…
21.2 KB
PHP · classes
c8ab69843d4eb1ec…
19.3 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request6
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation2
Referenced hosts
14 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.