Open-source atomic malware analysis

Analyze another

rankoak-connect 1.3.6

ZIP
Verdict: HOSTILE
Mal-ecule
O₁₀(C₁₁As₄Ca₂Co₃DyEr₃ILaPS₃)H₆(Cm₄CrDb₆FOsPo)Md(Pa₂)
Size 12.6 KB download
First seen 119 days ago
Analyzed 119 days ago
Ecosystem wordpress
Source wordpress.org

Objectives

suspicious severity, 90% confident.
command-and-control/backdoor/webshell Single-file admin shell metrics
notable severity, 85% confident.
anti-static/obfuscation/eval Trailing IIFE closure indicating auto-execution
notable severity, 78% confident.
command-and-control/trigger Module-top-level IIFE (runs on import)
baseline severity, 80% confident.
anti-static/obfuscation/code-metrics Sequential identifiers (a, b, c,
component severity, 100% confident.
anti-static/obfuscation JavaScript or TypeScript source file extension
component severity, 99% confident.
command-and-control/channel Regex component marker
component severity, 100% confident.
command-and-control/dropper .js extension
component severity, 95% confident.
evasion/masquerade Filename has .js extension
component severity, 95% confident.
evasion/self-delete Regex component marker

Micro-behaviors

suspicious severity, 96% confident.
communications/http/request WordPress unauthenticated REST route
notable severity, 70% confident.
crypto/hash MD5 hash computation
notable severity, 100% confident.
data/db WordPress update_option function symbol
notable severity, 80% confident.
fs/read Self-reference via __FILE__
notable severity, 92% confident.
os/clipboard Browser clipboard write API
baseline severity, 80% confident.
communications Hardcoded loopback IPv4 address
component severity, 100% confident.
process/create Regex component marker

Metadata

baseline severity, 100% confident.
lang/encoded JavaScript file basename
baseline severity, 90% confident.
library WordPress core API context
baseline severity, 100% confident.
package HISTORY documentation reference
baseline severity, 85% confident.
package::terser-output Terser/UglifyJS minified output markers

20 of 39 traits shown

Identity

SHA-256 7260ea9f9599b4e9d53c896562da579e4b42a3c2882b63dead3af4ac7f0e2f9f
Canonical SHA-256 0ab6d9f3ee39acd488613bab15bbaf7ed58130c568d98c242c0bd99968076ac0
Filename rankoak-connect-1.3.6.zip
Package rankoak-connect
Version 1.3.6
PURL pkg:wordpress/[email protected]

Origin

Source harvest
Feed wordpress.org
Ecosystem wordpress
Domain wordpress.org

Timeline

First seen 4 May 2026 22:29 UTC
Last analyzed 4 May 2026 23:46 UTC
Last updated 4 May 2026 23:46 UTC

Labeling

Label unknown
Label source harvest
Traits version 27ac5