Hash sets
SHA-256 hash sets shipped in the signed feed: known-bad hashes trigger a malicious verdict, allow sets mark verified WordPress core files as clean.
Shelltrap ships two kinds of hash data in every signed generation:
- Known-bad hashes (
hashes/*.hsb): exact SHA-256 matches of confirmed malware. A match produces a malicious verdict with confidence 100. - Allow sets (
allow/*.sha256): SHA-256 hashes of verified files, currently the WordPress core files of supported releases downloaded from wordpress.org and hashed by Panomity. A match suppresses heuristic signals for that file; signature and ClamAV hits still take precedence.
Hashes are data, not works; the allow sets are published under the MIT license by Panomity GmbH.
Reporting a false positive
A wrongly matched hash, or a missing version in an allow set, goes to falsepositive@shelltrap.com with the finding ID, the rule name, the SHA-256 and the file itself, sent from the email address registered in your client area . The answer usually arrives within an hour from sentinel@shelltrap.com . Note that a known-bad hash match is never released automatically: those cases are routed to a human on purpose. The full procedure .