Report

Version: 0.14.0
Scan date: 2024-06-13 01:51:29
Files analyzed: 2223 | Files infected: 33

/custdata01/diamond1133/public_html/wp-content/plugins/seo-by-rank-math/assets/vendor/powerwords/de.php

Size: 11.64 kB Created: 2024-06-01 07:04:13 Modified: 2024-06-01 07:04:13 Dangers: 2
DescriptionMatch

Function strrev eval_strrev Line: 1 Dangerous

Encoded Function `eval`

[https://www.php.net/eval]

<?php lave

Sign d30fc49e Line: 1 Dangerous

Malware Signature (hash: d30fc49e)

<?php backdoor

/custdata01/diamond1133/public_html/wp-content/plugins/seo-by-rank-math/assets/vendor/powerwords/en.php

Size: 11.80 kB Created: 2024-06-01 07:04:13 Modified: 2024-06-01 07:04:13 Dangers: 3
DescriptionMatch

Function strrev eval_strrev Line: 1 Dangerous

Encoded Function `eval`

[https://www.php.net/eval]

<?php lave

Sign 11413268 Line: 1 Dangerous

Malware Signature (hash: 11413268)

<?php exploit

Sign d30fc49e Line: 1 Dangerous

Malware Signature (hash: d30fc49e)

<?php backdoor

/custdata01/diamond1133/public_html/wp-content/plugins/seo-by-rank-math/includes/admin/importers/class-detector.php

Size: 5.00 kB Created: 2024-06-01 07:04:13 Modified: 2024-06-01 07:04:13 Dangers: 2
DescriptionMatch

Exploit nano Line: 169 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

<?php $plugin['class']( $plugin['file'] )

Exploit nano Line: 87 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

<?php $importer['class']( $importer['file'] )

/custdata01/diamond1133/public_html/wp-content/plugins/seo-by-rank-math/includes/admin/wizard/views/compatibility.php

Size: 7.98 kB Created: 2024-06-01 07:04:13 Modified: 2024-06-01 07:04:13 Dangers: 1
DescriptionMatch

Sign f9dc0a55 Line: 27 Dangerous

Malware Signature (hash: f9dc0a55)

<?php 'base64_decode'

/custdata01/diamond1133/public_html/wp-content/plugins/seo-by-rank-math/includes/modules/schema/snippets/class-singular.php

Size: 2.98 kB Created: 2024-06-01 07:04:13 Modified: 2024-06-01 07:04:13 Dangers: 1
DescriptionMatch

Exploit nano Line: 136 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

<?php $data[ $schema ]()

/custdata01/diamond1133/public_html/wp-content/plugins/seo-by-rank-math/includes/modules/seo-analysis/seo-analysis-tests.php

Size: 21.77 kB Created: 2024-06-01 07:04:13 Modified: 2024-06-01 07:04:13 Dangers: 1
DescriptionMatch

Sign 11413268 Line: 35 Dangerous

Malware Signature (hash: 11413268)

<?php exploit

/custdata01/diamond1133/public_html/wp-content/plugins/link-whisper-premium/core/Wpil/ClickTracker.php

Size: 33.53 kB Created: 2023-06-21 15:48:31 Modified: 2023-06-21 15:48:31 Dangers: 1
DescriptionMatch

Exploit execution Line: 258 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

<?php base64_decode($_POST['url'])

/custdata01/diamond1133/public_html/wp-content/plugins/link-whisper-premium/core/Wpil/Error.php

Size: 58.21 kB Created: 2023-06-21 15:48:31 Modified: 2023-06-21 15:48:31 Dangers: 1
DescriptionMatch

Exploit execution Line: 770 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

<?php base64_decode($_POST['anchor'])

/custdata01/diamond1133/public_html/wp-content/plugins/link-whisper-premium/core/Wpil/Export.php

Size: 38.47 kB Created: 2023-06-21 15:48:31 Modified: 2023-06-21 15:48:31 Dangers: 1
DescriptionMatch

Exploit execution2 Line: 719 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

<?php array_filter(array_map(function($id){ return (int) $id; }, $_POST['keyword_ids'])

/custdata01/diamond1133/public_html/wp-content/plugins/link-whisper-premium/core/Wpil/Settings.php

Size: 132.18 kB Created: 2023-06-21 15:48:31 Modified: 2023-06-21 15:48:31 Dangers: 1
DescriptionMatch

Exploit execution Line: 808 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

<?php base64_decode($_POST['ignore_words'])

/custdata01/diamond1133/public_html/wp-content/plugins/link-whisper-premium/core/Wpil/SiteConnector.php

Size: 75.05 kB Created: 2023-06-21 15:48:31 Modified: 2023-06-21 15:48:31 Dangers: 1
DescriptionMatch

Exploit execution Line: 229 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

<?php base64_decode($_POST['data'])

/custdata01/diamond1133/public_html/wp-content/plugins/link-whisper-premium/templates/wpil_settings_v2.php

Size: 196.09 kB Created: 2023-06-21 15:48:31 Modified: 2023-06-21 15:48:31 Dangers: 2
DescriptionMatch

Sign f9dc0a55 Line: 177 Dangerous

Malware Signature (hash: f9dc0a55)

<?php 'base64_decode'

Sign f9dc0a55 Line: 180 Dangerous

Malware Signature (hash: f9dc0a55)

<?php "base64_decode"

/custdata01/diamond1133/public_html/wp-content/plugins/link-whisper-premium/vendor/phpoffice/phpspreadsheet/src/PhpSpreadsheet/Helper/Html.php

Size: 25.65 kB Created: 2023-06-21 15:48:31 Modified: 2023-06-21 15:48:31 Dangers: 1
DescriptionMatch

Function strrev eval_strrev Line: 275 Dangerous

Encoded Function `eval`

[https://www.php.net/eval]

<?php lave

/custdata01/diamond1133/public_html/wp-content/plugins/yet-another-stars-rating/vendor/freemius/wordpress-sdk/includes/sdk/FreemiusBase.php

Size: 7.85 kB Created: 2024-05-29 07:06:28 Modified: 2024-05-29 07:06:28 Dangers: 1
DescriptionMatch

Sign f9dc0a55 Dangerous

Malware Signature (hash: f9dc0a55)

<?php 'base64_decode'

/custdata01/diamond1133/public_html/wp-content/plugins/yet-another-stars-rating/vendor/freemius/wordpress-sdk/includes/class-freemius.php

Size: 968.04 kB Created: 2024-05-29 07:06:28 Modified: 2024-05-29 07:06:28 Dangers: 1
DescriptionMatch

Sign f9dc0a55 Dangerous

Malware Signature (hash: f9dc0a55)

<?php 'base64_decode'

/custdata01/diamond1133/public_html/wp-content/plugins/yet-another-stars-rating/vendor/freemius/wordpress-sdk/templates/account.php

Size: 63.80 kB Created: 2024-05-29 07:06:28 Modified: 2024-05-29 07:06:28 Dangers: 1
DescriptionMatch

Sign 7830f7a6 Line: 126 Dangerous

Malware Signature (hash: 7830f7a6)

<?php nc-l

/custdata01/diamond1133/public_html/wp-content/plugins/wp-file-manager/lib/php/elFinder.class.php

Size: 182.51 kB Created: 2024-06-07 07:32:43 Modified: 2024-06-07 07:32:43 Warns: 3 Dangers: 1
DescriptionMatch

Function exec Warning

Potentially dangerous function `exec`

[https://www.php.net/exec]

<?php exec($cmd, $args) { set_error_handler('elFinder::phpErrorHandler', E_WARNING | E_NOTICE | E_USER_WARNING | E_USER_NOTICE); self::$currentArgs = $args; if (!$this->loaded) { return array('error' => $this->error(self::ERROR_CONF, self::ERROR_CONF_NO_VOL)); } if ($this->session_expires()) { return array('error' => $this->error(self::ERROR_SESSION_EXPIRES)); } if (!$this->commandExists($cmd)) { return array('error' => $this->error(self::ERROR_UNKNOWN_CMD)); } $args['reqid'] = preg_replace('[^0-9a-fA...

Function proc_close Warning

Potentially dangerous function `proc_close`

[https://www.php.net/proc_close]

<?php proc_close($process); } else { $return_var = -1; } return $return_var; } protected static function getCmdOfBind($cmd) { list($ret) = explode('.', $cmd); return trim($ret); } protected static function addSubToBindName($cmd, $sub) { return $cmd . '.' . trim($sub); } public static function rmFileInDisconnected($file) { (connection_aborted() || connection_status() !== CONNECTION_NORMAL) && is_file($file) && unlink($file); } public static function onShutdown() { self::$abortCheckFile = null; if (!emp...

Function proc_open Warning

Potentially dangerous function `proc_open`

[https://www.php.net/proc_open]

<?php proc_open($command, $descriptorspec, $pipes, $cwd, null); if (is_resource($process)) { stream_set_blocking($pipes[1], 0); stream_set_blocking($pipes[2], 0); fclose($pipes[0]); $tmpout = ''; $tmperr = ''; while (feof($pipes[1]) === false || feof($pipes[2]) === false) { elFinder::extendTimeLimit(); $read = array($pipes[1], $pipes[2]); $write = null; $except = null; $ret = stream_select($read, $write, $except, 1); if ($ret === false) { break; } else if ($ret === 0) { continue; } else { foreach ($re...

Function strrev exec_strrev Line: 5256 Dangerous

Encoded Function `exec`

[https://www.php.net/exec]

<?php cExe

/custdata01/diamond1133/public_html/wp-content/plugins/wp-file-manager/lib/php/elFinderVolumeDriver.class.php

Size: 256.00 kB Created: 2024-06-07 07:32:43 Modified: 2024-06-07 07:32:43 Warns: 1 Dangers: 1
DescriptionMatch

Function exec Warning

Potentially dangerous function `exec`

[https://www.php.net/exec]

<?php exec('rd /S /Q ' . escapeshellarg($dir), $o, $r); } else { exec('del /F /Q ' . escapeshellarg($dir), $o, $r); } } else { exec('rm -rf ' . escapeshellarg($dir), $o, $r); } if ($r === 0) { return true; } } if (!is_link($dir) && is_dir($dir)) { chmod($dir, 0777); if ($handle = opendir($dir)) { while (false !== ($file = readdir($handle))) { if ($file === '.' || $file === '..') { continue; } elFinder::extendTimeLimit(30); $path = $dir . DIRECTORY_SEPARATOR . $file; if (!is_link($dir) && is_dir($path)...

Function strrev exec_strrev Line: 885 Dangerous

Encoded Function `exec`

[https://www.php.net/exec]

<?php cExe

/custdata01/diamond1133/public_html/wp-content/plugins/wp-file-manager/lib/php/elFinderVolumeLocalFileSystem.class.php

Size: 47.24 kB Created: 2024-06-07 07:32:43 Modified: 2024-06-07 07:32:43 Warns: 1 Dangers: 1
DescriptionMatch

Function posix_getpwuid Warning

Potentially dangerous function `posix_getpwuid`

[https://www.php.net/posix_getpwuid]

<?php posix_getpwuid($uid); $stat['owner'] = $names['uid'][$uid] = $pwuid['name']; } else { $stat['owner'] = $names['uid'][$uid] = $uid; } } if ($gid) { if (isset($names['gid'][$gid])) { $stat['group'] = $names['gid'][$gid]; } else if (is_callable('posix_getgrgid')) { $grgid = posix_getgrgid($gid); $stat['group'] = $names['gid'][$gid] = $grgid['name']; } else { $stat['group'] = $names['gid'][$gid] = $gid; } } return $stat; } protected function _subdirs($path) { $dirs = false; if (is_dir($path) && is_r...

Function strrev exec_strrev Line: 304 Dangerous

Encoded Function `exec`

[https://www.php.net/exec]

<?php cExe

/custdata01/diamond1133/public_html/wp-content/plugins/wp-file-manager/file_folder_manager.php

Size: 85.09 kB Created: 2024-06-07 07:32:43 Modified: 2024-06-07 07:32:43 Dangers: 1
DescriptionMatch

Sign 471b95ee Line: 1389 Dangerous

Malware Signature (hash: 471b95ee)

<?php suhosin

/custdata01/diamond1133/public_html/wp-content/themes/Divi/includes/builder/feature/display-conditions/DisplayConditions.php

Size: 19.49 kB Created: 2024-03-08 04:45:14 Modified: 2024-03-08 04:45:14 Dangers: 2
DescriptionMatch

Exploit execution Line: 370 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

<?php base64_decode( $_COOKIE['divi_post_visit'] )

Exploit execution Line: 462 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

<?php base64_decode( $_COOKIE['divi_module_views'] )

/custdata01/diamond1133/public_html/wp-content/themes/Divi/includes/builder/module/field/display-conditions/NumberOfViews.php

Size: 2.41 kB Created: 2024-03-08 04:45:13 Modified: 2024-03-08 04:45:13 Dangers: 1
DescriptionMatch

Exploit execution Line: 39 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

<?php base64_decode( $_COOKIE['divi_module_views'] )

/custdata01/diamond1133/public_html/wp-content/themes/Divi/includes/builder/module/field/display-conditions/PageVisit.php

Size: 1.96 kB Created: 2024-03-08 04:45:13 Modified: 2024-03-08 04:45:13 Dangers: 1
DescriptionMatch

Exploit execution Line: 43 Dangerous

RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP

[https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html]

<?php base64_decode( $_COOKIE['divi_post_visit'] )

/custdata01/diamond1133/public_html/wp-content/themes/Divi/includes/builder/class-et-builder-element.php

Size: 895.14 kB Created: 2024-03-08 04:45:13 Modified: 2024-03-08 04:45:13 Warns: 3
DescriptionMatch

Exploit double_var2 Line: 1331 Warning

Double var technique is usually used for the obfuscation of malicious code

<?php ${$name}

Exploit double_var2 Line: 1345 Warning

Double var technique is usually used for the obfuscation of malicious code

<?php ${$new_prop}

Exploit double_var2 Line: 1414 Warning

Double var technique is usually used for the obfuscation of malicious code

<?php ${$replacement}

/custdata01/diamond1133/public_html/wp-content/themes/Divi/includes/builder/class-et-builder-module-shortcode-manager.php

Size: 20.94 kB Created: 2024-03-08 04:45:14 Modified: 2024-03-08 04:45:14 Dangers: 1
DescriptionMatch

Exploit nano Line: 710 Dangerous

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient

[https://github.com/s0md3v/nano]

<?php $module['classname']()

/custdata01/diamond1133/public_html/wp-content/wflogs/rules.php

Size: 662.78 kB Created: 2024-06-10 07:07:17 Modified: 2024-06-12 07:10:04 Dangers: 1
DescriptionMatch

Sign d30fc49e Line: 1401 Dangerous

Malware Signature (hash: d30fc49e)

<?php backdoor

/custdata01/diamond1133/public_html/wp-content/wflogs/config-transient.php

Size: 1.46 MB Created: 2024-06-10 07:07:23 Modified: 2024-06-12 07:10:04 Warns: 2 Dangers: 3
DescriptionMatch

Exploit base64_long Line: 6 Warning

Long Base64 encoded text is usually used for the obfuscation of malicious code

<?php "X5iE4ehqpiAXx352hUPL6iOk7eZfpELUCq5R7RTPBukCGEdkp2F/Rj9H6uWpOEoDU0FFTcnG44fOFAW2SgNDbPWITYZRBFVQfxIuESVjPdyIOELmxRqdpGR4bLAe+3DZhNl7JGSRI103sLk0HZNjBitoN4vdttkMcnNs1fpegtBCHS9cMvVZ+niwn52SdemnFYeb8zO6HViBAzhrILmy9QCS1xewzRWu9LHZbj/yTGvugOWvZPWQ06mEOry2dGHBdvSD3CxUg2ansIjQumCRPQeI4AY/bIAy6bc4F+tpUV0JUiCJXD5NrRd2/TczOWwygqe9huepVd368SIVJ4A5lg=="

Exploit base64_long Warning

Long Base64 encoded text is usually used for the obfuscation of malicious code

<?php "YVdTfAoQJRtedhwYHm5/cgsOAlEBYCpccFgccAh5AzIHSRMoFCAUBxgBIGE7BydhKBwgDzQRJWA5Tg8ZEz08YhZXM3xyQwoscXIsGzoCZwMLe0FCSx4qDU9tWHAIfwNMegI8B18IagcSASBrIGk0ATUMXQ9KKwpgRzAPaxNDGGJmKUF8dHN3L3IDHGY6fBMDeQ5YBTseKnMDbVhwdg0DQHoCPHktCGYHEmsgZyAXRn9LDFEPNGQlHjlODxlhPWZ0ZlczfHhzdyxyDxwYSAJtA3UOJk47HioNcW1UcHYNfTJ6Djx5FTEUeWwBUhleF0p/NX4vcQsWW2A5Qg9nID1mHGZbMwIKDQkvAHFiGEQCE3ELcCZCO2BYcw9tWHAIfwNMegI8B18Iaj9sfyAZUhdKf0sML300aCUeOTB9GW09ZhxmWzMCM3N3UQIPLyoALHlrCCMIEAVNBA0BEyZwcCU3B1V/BjIdMRQHDzIMeAwjGEoHNhxxRGh...

Function strrev exec_strrev Line: 6 Dangerous

Encoded Function `exec`

[https://www.php.net/exec]

<?php CEXE

Sign 407651f7 Line: 6 Dangerous

Malware Signature (hash: 407651f7)

<?php wAREz

Sign de12c454 Line: 6 Dangerous

Malware Signature (hash: de12c454)

<?php VjAg

/custdata01/diamond1133/tmp/pma_template_compiles_diamond1133/twig/58/580db7a92c5de940daabdbd94495366b0870da753f4f17b950ec461205eebc2d.php

Size: 3.79 kB Created: 2023-03-15 05:00:44 Modified: 2023-03-15 05:00:44 Dangers: 1
DescriptionMatch

Function strrev eval_strrev Line: 61 Dangerous

Encoded Function `eval`

[https://www.php.net/eval]

<?php lave

/custdata01/diamond1133/tmp/pma_template_compiles_diamond1133/twig/fe/fea6f73cdf041f39f4fea0666ce2b96528e8cfcf1b2a4fb97f9987c8120dae20.php

Size: 5.44 kB Created: 2023-03-15 05:00:44 Modified: 2023-03-15 05:00:44 Dangers: 1
DescriptionMatch

Function strrev eval_strrev Line: 112 Dangerous

Encoded Function `eval`

[https://www.php.net/eval]

<?php lave

/custdata01/diamond1133/tmp/pma_template_compiles_diamond1133/twig/31/31bf8f3c09df090abfd38b455588b2ee5c06a43f12f9c32487f659cf032c83ef.php

Size: 9.75 kB Created: 2023-03-15 05:00:44 Modified: 2023-03-15 05:00:44 Dangers: 1
DescriptionMatch

Function strrev eval_strrev Line: 172 Dangerous

Encoded Function `eval`

[https://www.php.net/eval]

<?php lave

/custdata01/diamond1133/tmp/pma_template_compiles_diamond1133/twig/67/6716d844a7bb25d1606d939b83aadf889e5a35a31bab9454c9569335b19541f7.php

Size: 8.52 kB Created: 2023-03-15 05:00:44 Modified: 2023-03-15 05:00:44 Dangers: 1
DescriptionMatch

Function strrev eval_strrev Line: 137 Dangerous

Encoded Function `eval`

[https://www.php.net/eval]

<?php lave

/custdata01/diamond1133/tmp/pma_template_compiles_diamond1133/twig/eb/ebad70c3711a96854395e345192e3618a35739360804f28b54d23d4b49eca4b0.php

Size: 22.80 kB Created: 2023-03-15 05:00:51 Modified: 2023-03-15 05:00:51 Dangers: 1
DescriptionMatch

Function strrev eval_strrev Line: 65 Dangerous

Encoded Function `eval`

[https://www.php.net/eval]

<?php lave

/custdata01/diamond1133/tmp/pma_template_compiles_diamond1133/twig/cc/ccb726244b12924b146fd2ecb99d5c0d41d0dce15d84681f00c0aab5af9d43a6.php

Size: 11.32 kB Created: 2023-03-15 05:00:51 Modified: 2023-03-15 05:00:51 Dangers: 1
DescriptionMatch

Function strrev eval_strrev Line: 47 Dangerous

Encoded Function `eval`

[https://www.php.net/eval]

<?php lave