Report

Version: 0.14.0
Scan date: 2024-06-13 01:01:22
Files analyzed: 489 | Files infected: 27

/custdata01/autobodysf/public_html/wp-admin/includes/class-pclzip.php

Size: 191.03 kB Created: 2016-06-10 01:19:42 Modified: 2017-03-25 00:08:53 Dangers: 5
DescriptionMatch

Exploit nano Line: 2622 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

<?php $p_options[PCLZIP_CB_PRE_ADD](PCLZIP_CB_PRE_ADD, $v_local_header)

Exploit nano Line: 2775 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

<?php $p_options[PCLZIP_CB_POST_ADD](PCLZIP_CB_POST_ADD, $v_local_header)

Exploit nano Line: 3697 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

<?php $p_options[PCLZIP_CB_PRE_EXTRACT](PCLZIP_CB_PRE_EXTRACT, $v_local_header)

Exploit nano Line: 3943 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

<?php $p_options[PCLZIP_CB_POST_EXTRACT](PCLZIP_CB_POST_EXTRACT, $v_local_header)

Sign 963e968a Line: 5672 Dangerous

Malware Signature (hash: 963e968a)

<?php php_uname()

/custdata01/autobodysf/public_html/wp-admin/includes/class-wp-filesystem-direct.php

Size: 9.34 kB Created: 2016-06-10 01:19:42 Modified: 2017-03-25 00:08:53 Warns: 1
DescriptionMatch

Function posix_getpwuid Warning

Potentially dangerous function `posix_getpwuid`

[https://www.php.net/posix_getpwuid]

<?php posix_getpwuid($owneruid); return $ownerarray['name']; } function getchmod($file) { return substr(decoct(@fileperms($file)),3); } function group($file) { $gid = @filegroup($file); if ( ! $gid ) return false; if ( ! function_exists('posix_getgrgid') ) return $gid; $grouparray = posix_getgrgid($gid); return $grouparray['name']; } function copy($source, $destination, $overwrite = false, $mode = false) { if ( ! $overwrite && $this->exists($destination) ) return false; $rtval = copy($source, $destina...

/custdata01/autobodysf/public_html/wp-admin/includes/class-wp-filesystem-ssh2.php

Size: 11.17 kB Created: 2016-06-10 01:19:42 Modified: 2017-03-25 00:08:53 Warns: 1
DescriptionMatch

Function posix_getpwuid Warning

Potentially dangerous function `posix_getpwuid`

[https://www.php.net/posix_getpwuid]

<?php posix_getpwuid($owneruid); return $ownerarray['name']; } function getchmod($file) { return substr(decoct(@fileperms( 'ssh2.sftp://' . $this->sftp_link . '/' . ltrim($file, '/') )),3); } function group($file) { $gid = @filegroup('ssh2.sftp://' . $this->sftp_link . '/' . ltrim($file, '/')); if ( ! $gid ) return false; if ( ! function_exists('posix_getgrgid') ) return $gid; $grouparray = posix_getgrgid($gid); return $grouparray['name']; } function copy($source, $destination, $overwrite = false, $mo...

/custdata01/autobodysf/public_html/wp-admin/includes/file.php

Size: 41.33 kB Created: 2016-06-10 01:19:44 Modified: 2017-03-25 00:08:53 Dangers: 1
DescriptionMatch

Exploit nano Line: 228 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

<?php $overrides['upload_error_handler'](&$file, $message )

/custdata01/autobodysf/public_html/wp-admin/includes/import.php

Size: 2.41 kB Created: 2016-06-10 01:19:44 Modified: 2017-03-25 00:08:53 Warns: 1
DescriptionMatch

Function create_function Warning

Potentially dangerous function `create_function`

[https://www.php.net/create_function]

<?php create_function('$a, $b', 'return strcmp($a[0], $b[0]);')); return $wp_importers; } function register_importer( $id, $name, $description, $callback ) { global $wp_importers; if ( is_wp_error( $callback ) ) return $callback; $wp_importers[$id] = array ( $name, $description, $callback ); } function wp_import_cleanup( $id ) { wp_delete_attachment( $id ); } function wp_import_handle_upload() { if ( !isset($_FILES['import']) ) { $file['error'] = __( 'File is empty. Please upload something more substa...

/custdata01/autobodysf/public_html/wp-admin/includes/media.php

Size: 67.94 kB Created: 2016-06-10 01:19:44 Modified: 2017-03-25 00:08:53 Warns: 1
DescriptionMatch

Function create_function Warning

Potentially dangerous function `create_function`

[https://www.php.net/create_function]

<?php create_function( '$a', "return 'LIMIT $start, 10';" ) ); list($post_mime_types, $avail_post_mime_types) = wp_edit_attachments_query(); ?>

<form id="filter" action="" method="get">
<input type="hidden" name="type" value="<?php echo esc_attr( $type ); ?>" />
<input type="hidden" name="tab" value="<?php echo esc_attr( $tab ); ?>" />
<input type="hidden" name="post_id" value="<?php echo (int) $post_id; ?>" />
<input type="hidden" name="post_mime_type" value="<?php echo isset( $_GET['post_mime_type'...

/custdata01/autobodysf/public_html/wp-admin/includes/menu.php

Size: 6.16 kB Created: 2016-06-10 01:19:44 Modified: 2017-03-25 00:08:53 Warns: 1
DescriptionMatch

Exploit double_var2 Line: 51 Warning

Double var technique is usually used for the obfuscation of malicious code

<?php ${$sub_loop}

/custdata01/autobodysf/public_html/wp-admin/includes/ms.php

Size: 27.96 kB Created: 2016-06-10 01:19:45 Modified: 2017-03-25 00:08:53 Dangers: 1
DescriptionMatch

Function str_rot13 eval_str_rot13 Line: 475 Dangerous

Encoded Function `eval`

[https://www.php.net/eval]

<?php riny

/custdata01/autobodysf/public_html/wp-admin/js/revisions-js.php

Size: 3.09 kB Created: 2016-06-10 01:19:49 Modified: 2017-03-25 00:08:54 Warns: 1
DescriptionMatch

Function eval Warning

Potentially dangerous function `eval`

[https://www.php.net/eval]

<?php eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\\\b'+e(c)+'\\\\b','g'),k[c]);return p}('6(4(){2 e=6(\\'#Q\\').v();2 i=\\'\\\\\\',.R/=\\\\\\\\S-;T"<>U?+|V:W[]X{}\\'.u(\\'\\');2 o=\\'Y[]\\\\\\\\Z;\\\\\\'10,./11{}|12:"13<>?-=14+\\'.u(\\'\\');2 5=4(s){r=\\'\\'...

/custdata01/autobodysf/public_html/wp-admin/press-this.php

Size: 25.67 kB Created: 2016-06-10 01:19:26 Modified: 2017-03-25 00:08:53 Warns: 1
DescriptionMatch

Function eval Warning

Potentially dangerous function `eval`

[https://www.php.net/eval]

<?php eval(
            jQuery.ajax({
                type: "GET",
                url: "<?php echo esc_url($_SERVER['PHP_SELF']); ?>",
                cache : false,
                async : false,
                data: "ajax=photo_images&u=<?php echo urlencode($url); ?>",
                dataType : "script"
            }).responseText
        );
        if(my_src.length == 0) {
            var my_src = eval(
                jQuery.ajax({
                    type: "GET",
                    url: "<?php echo esc_url($_SERVER['PHP_SELF']); ?>",
                    cache : false,
                    async : false,
                    data: "ajax=photo_images&u=<?php echo urlencode($url); ?>",
                    ...

/custdata01/autobodysf/public_html/wp-admin/import.php

Size: 6.13 kB Created: 2016-06-10 01:19:23 Modified: 2017-03-25 00:08:53 Warns: 1
DescriptionMatch

Function create_function Warning

Potentially dangerous function `create_function`

[https://www.php.net/create_function]

<?php create_function('$a, $b', 'return strcmp($a[0], $b[0]);')); ?>
<table class="widefat importers" cellspacing="0">

<?php
 $style = ''; foreach ($importers as $id => $data) { $style = ('class="alternate"' == $style || 'class="alternate active"' == $style) ? '' : 'alternate'; $action = ''; if ( 'install' == $data[2] ) { $plugin_slug = $id . '-importer'; if ( file_exists( WP_PLUGIN_DIR . '/' . $plugin_slug ) ) { $plugins = get_plugins( '/' . $plugin_slug ); if ( !empty($plugins) ) { $keys = array_ke...

/custdata01/autobodysf/public_html/wp-content/plugins/simple-tags/inc/class.widgets.php

Size: 11.76 kB Created: 2016-06-10 01:20:16 Modified: 2017-03-25 00:08:55 Warns: 2
DescriptionMatch

Exploit double_var2 Line: 92 Warning

Double var technique is usually used for the obfuscation of malicious code

<?php ${$field}

Function create_function Warning

Potentially dangerous function `create_function`

[https://www.php.net/create_function]

<?php create_function('', 'return register_widget("SimpleTags_Widget");') ); class SimpleTags_Widget extends WP_Widget { function SimpleTags_Widget() { $this->WP_Widget( 'simpletags', __( 'Tag Cloud (Simple Tags)', 'simpletags' ), array( 'classname' => 'widget-simpletags', 'description' => __( 'Your most used tags in cloud format with dynamic color and many options', 'simpletags' ) ) ); } function _get_current_taxonomy($instance) { if ( !empty($instance['taxonomy']) && taxonomy_exists($instance['taxon...

/custdata01/autobodysf/public_html/wp-includes/Text/Diff/Engine/native.php

Size: 15.47 kB Created: 2016-06-10 01:21:20 Modified: 2017-03-25 00:08:57 Warns: 1
DescriptionMatch

Function assert Warning

Potentially dangerous function `assert`

[https://www.php.net/assert]

<?php assert($yi < $n_to || $this->xchanged[$xi]); assert($xi < $n_from || $this->ychanged[$yi]); $copy = array(); while ($xi < $n_from && $yi < $n_to && !$this->xchanged[$xi] && !$this->ychanged[$yi]) { $copy[] = $from_lines[$xi++]; ++$yi; } if ($copy) { $edits[] = &new Text_Diff_Op_copy($copy); } $delete = array(); while ($xi < $n_from && $this->xchanged[$xi]) { $delete[] = $from_lines[$xi++]; } $add = array(); while ($yi < $n_to && $this->ychanged[$yi]) { $add[] = $to_lines[$yi++]; } if ($delete &&...

/custdata01/autobodysf/public_html/wp-includes/Text/Diff/Engine/shell.php

Size: 5.05 kB Created: 2016-06-10 01:21:20 Modified: 2017-03-25 00:08:57 Warns: 2
DescriptionMatch

Function assert Warning

Potentially dangerous function `assert`

[https://www.php.net/assert]

<?php assert('$match[1] - $from_line_no == $match[4] - $to_line_no'); array_push($edits, new Text_Diff_Op_copy( $this->_getLines($from_lines, $from_line_no, $match[1] - 1), $this->_getLines($to_lines, $to_line_no, $match[4] - 1))); } switch ($match[3]) { case 'd': array_push($edits, new Text_Diff_Op_delete( $this->_getLines($from_lines, $from_line_no, $match[2]))); $to_line_no++; break; case 'c': array_push($edits, new Text_Diff_Op_change( $this->_getLines($from_lines, $from_line_no, $match[2]), $this...

Function shell_exec Warning

Potentially dangerous function `shell_exec`

[https://www.php.net/shell_exec]

<?php shell_exec($this->_diffCommand . ' ' . $from_file . ' ' . $to_file); unlink($from_file); unlink($to_file); if (is_null($diff)) { return array(new Text_Diff_Op_copy($from_lines)); } $from_line_no = 1; $to_line_no = 1; $edits = array(); preg_match_all('#^(\d+)(?:,(\d+))?([adc])(\d+)(?:,(\d+))?$#m', $diff, $matches, PREG_SET_ORDER); foreach ($matches as $match) { if (!isset($match[5])) { $match[5] = false; } if ($match[3] == 'a') { $from_line_no--; } if ($match[3] == 'd') { $to_line_no--; } if ($fr...

/custdata01/autobodysf/public_html/wp-includes/Text/Diff.php

Size: 11.66 kB Created: 2016-06-10 01:21:05 Modified: 2017-03-25 00:08:57 Warns: 1
DescriptionMatch

Function assert Warning

Potentially dangerous function `assert`

[https://www.php.net/assert]

<?php assert(count($from_lines) == count($mapped_from_lines)); assert(count($to_lines) == count($mapped_to_lines)); parent::Text_Diff($mapped_from_lines, $mapped_to_lines); $xi = $yi = 0; for ($i = 0; $i < count($this->_edits); $i++) { $orig = &$this->_edits[$i]->orig; if (is_array($orig)) { $orig = array_slice($from_lines, $xi, count($orig)); $xi += count($orig); } $final = &$this->_edits[$i]->final; if (is_array($final)) { $final = array_slice($to_lines, $yi, count($final)); $yi += count($final); } ...

/custdata01/autobodysf/public_html/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpellShell.php

Size: 2.78 kB Created: 2016-06-10 01:21:29 Modified: 2017-03-25 00:08:58 Warns: 1 Dangers: 1
DescriptionMatch

Function shell_exec Warning

Potentially dangerous function `shell_exec`

[https://www.php.net/shell_exec]

<?php shell_exec($cmd); @unlink($this->_tmpfile); $returnData = array(); $dataArr = preg_split("/[\r\n]/", $data, -1, PREG_SPLIT_NO_EMPTY); foreach ($dataArr as $dstr) { $matches = array(); if ($dstr[0] == "@") continue; preg_match("/(\&|#) ([^ ]+) .*/i", $dstr, $matches); if (!empty($matches[2])) $returnData[] = utf8_encode(trim($matches[2])); } return $returnData; } function &getSuggestions($lang, $word) { $cmd = $this->_getCMD($lang); if (function_exists("mb_convert_encoding")) $word = mb_convert_e...

Sign 963e968a Line: 110 Dangerous

Malware Signature (hash: 963e968a)

<?php php_uname()

/custdata01/autobodysf/public_html/wp-includes/js/tinymce/plugins/spellchecker/rpc.php

Size: 2.82 kB Created: 2016-06-10 01:21:23 Modified: 2017-03-25 00:08:58 Dangers: 1
DescriptionMatch

Exploit nano Line: 97 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

<?php $config['general.engine']($config)

/custdata01/autobodysf/public_html/wp-includes/pomo/mo.php

Size: 7.10 kB Created: 2016-06-10 01:21:05 Modified: 2017-03-25 00:08:58 Warns: 1
DescriptionMatch

Function create_function Warning

Potentially dangerous function `create_function`

[https://www.php.net/create_function]

<?php create_function('$e', 'return !empty($e->translations);')); ksort($entries); $magic = 0x950412de; $revision = 0; $total = count($entries) + 1; $originals_lenghts_addr = 28; $translations_lenghts_addr = $originals_lenghts_addr + 8 * $total; $size_of_hash = 0; $hash_addr = $translations_lenghts_addr + 8 * $total; $current_addr = $hash_addr; fwrite($fh, pack('V*', $magic, $revision, $total, $originals_lenghts_addr, $translations_lenghts_addr, $size_of_hash, $hash_addr)); fseek($fh, $originals_lengh...

/custdata01/autobodysf/public_html/wp-includes/pomo/po.php

Size: 11.04 kB Created: 2016-06-10 01:21:05 Modified: 2017-03-25 00:08:58 Warns: 1
DescriptionMatch

Function create_function Warning

Potentially dangerous function `create_function`

[https://www.php.net/create_function]

<?php create_function('$x', "return $php_with.\$x;"), $lines)); if ("\n" == substr($string, -1)) $res .= "\n"; return $res; } function comment_block($text, $char=' ') { $text = wordwrap($text, PO_MAX_LINE_LEN - 3); return PO::prepend_each_line($text, "#$char "); } function export_entry(&$entry) { if (is_null($entry->singular)) return false; $po = array(); if (!empty($entry->translator_comments)) $po[] = PO::comment_block($entry->translator_comments); if (!empty($entry->extracted_comments)) $po[] = PO:...

/custdata01/autobodysf/public_html/wp-includes/pomo/translations.php

Size: 7.36 kB Created: 2016-06-10 01:21:05 Modified: 2017-03-25 00:08:58 Warns: 1
DescriptionMatch

Function create_function Warning

Potentially dangerous function `create_function`

[https://www.php.net/create_function]

<?php create_function('$n', $func_body); } function parenthesize_plural_exression($expression) { $expression .= ';'; $res = ''; $depth = 0; for ($i = 0; $i < strlen($expression); ++$i) { $char = $expression[$i]; switch ($char) { case '?': $res .= ' ? ('; $depth++; break; case ':': $res .= ') : ('; break; case ';': $res .= str_repeat(')', $depth) . ';'; $depth= 0; break; default: $res .= $char; } } return rtrim($res, ';'); } function make_headers($translation) { $headers = array(); $translation = str_r...

/custdata01/autobodysf/public_html/wp-includes/atomlib.php

Size: 10.67 kB Created: 2016-06-10 01:20:52 Modified: 2017-03-25 00:08:57 Warns: 1
DescriptionMatch

Function create_function Warning

Potentially dangerous function `create_function`

[https://www.php.net/create_function]

<?php create_function('$k,$v', 'return "$k=\"$v\"";'); $this->map_xmlns_func = create_function('$p,$n', '$xd = "xmlns"; if(strlen($n[0])>0) $xd .= ":{$n[0]}"; return "{$xd}=\"{$n[1]}\"";'); } function _p($msg) { if($this->debug) { print str_repeat(" ", $this->depth * $this->indent) . $msg ."\n"; } } function error_handler($log_level, $log_text, $error_file, $error_line) { $this->error = $log_text; } function parse() { set_error_handler(array(&$this, 'error_handler')); array_unshift($this->ns_contexts,...

/custdata01/autobodysf/public_html/wp-includes/category-template.php

Size: 37.17 kB Created: 2016-06-10 01:20:52 Modified: 2017-03-25 00:08:57 Warns: 1
DescriptionMatch

Function create_function Warning

Potentially dangerous function `create_function`

[https://www.php.net/create_function]

<?php create_function('$count', $body); } $args = wp_parse_args( $args, $defaults ); extract( $args ); if ( empty( $tags ) ) return; $tags_sorted = apply_filters( 'tag_cloud_sort', $tags, $args ); if ( $tags_sorted != $tags ) { $tags = $tags_sorted; unset($tags_sorted); } else { if ( 'RAND' == $order ) { shuffle($tags); } else { if ( 'name' == $orderby ) uasort( $tags, '_wp_object_name_sort_cb' ); else uasort( $tags, '_wp_object_count_sort_cb' ); if ( 'DESC' == $order ) $tags = array_reverse( $tags, t...

/custdata01/autobodysf/public_html/wp-includes/pluggable.php

Size: 58.21 kB Created: 2016-06-10 01:20:58 Modified: 2017-03-25 00:08:57 Dangers: 1
DescriptionMatch

Sign 11413268 Line: 792 Dangerous

Malware Signature (hash: 11413268)

<?php exploit

/custdata01/autobodysf/public_html/wp-includes/class-simplepie.php

Size: 379.07 kB Created: 2016-06-10 01:20:53 Modified: 2017-03-25 00:08:57 Warns: 1
DescriptionMatch

Exploit concat_vars_with_spaces Line: 13261 Warning

Concatenation of vars technique is usually used for the obfuscation of malicious code

<?php $day . $fws . $month . $fws . $year . $fws .

/custdata01/autobodysf/public_html/wp-includes/class-snoopy.php

Size: 36.89 kB Created: 2016-06-10 01:20:53 Modified: 2017-03-25 00:08:57 Warns: 1
DescriptionMatch

Function exec Warning

Potentially dangerous function `exec`

[https://www.php.net/exec]

<?php exec($this->curl_path." -k -D \"$headerfile\"".$cmdline_params." \"".escapeshellcmd($URI)."\"",$results,$return); if($return) { $this->error = "Error: cURL could not retrieve the document, error $return."; return false; } $results = implode("\r\n",$results); $result_headers = file("$headerfile"); $this->_redirectaddr = false; unset($this->headers); for($currentHeader = 0; $currentHeader < count($result_headers); $currentHeader++) { if(preg_match("/^(Location: |URI: )/i",$result_headers[$currentH...

/custdata01/autobodysf/public_html/wp-includes/functions.php

Size: 144.66 kB Created: 2016-06-10 01:20:56 Modified: 2017-03-25 00:08:57 Warns: 1
DescriptionMatch

Exploit double_var2 Line: 4473 Warning

Double var technique is usually used for the obfuscation of malicious code

<?php ${$field}

/custdata01/autobodysf/public_html/wp-includes/kses.php

Size: 40.23 kB Created: 2016-06-10 01:20:56 Modified: 2017-03-25 00:08:57 Dangers: 1
DescriptionMatch

Sign 1414e381 Line: 732 Dangerous

Malware Signature (hash: 1414e381)

<?php $mode = 0;
    $attrname = '';
    $uris = array('xmlns', 'profile', 'href', 'src', 'cite', 'classid', 'codebase', 'data', 'usemap', 'longdesc',