esc_html Array-Assembly eval Loader Found in PHP

Summary

This WordPress malware research entry documents array-assembled php eval loader evidence observed during one anonymized client investigation. The narrow topic is esc_html Array-Assembly eval Loader Found in PHP: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The structure is consistent with an encoded PHP loader. The original draft labeled it Japanese SEO spam, but the retained artifact alone does not demonstrate language, generated pages, or search-index effects.

Investigation context

Anonymized investigation with a retained PHP screenshot and supplied truncated code sample; the full encoded screenshot is excluded from publication. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

The public entry does not use a screenshot because the retained images either exposed sensitive values, showed a complete encoded payload, or did not add reliable evidence beyond the supplied code.

Confirmed findings

• The variables esc_html_gp and esc_html_ft hold encoded strings and character fragments.
• Three function names are assembled from indexed array values.
• The nested result is passed to eval.

Technical analysis

How benign-looking esc_html names conceal callable assembly

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

$esc_html_gp = ['[encoded fragments redacted]'];
$esc_html_ft = ['u', '4', 'm', /* shortened */];
$fn1 = $esc_html_ft[43] . $esc_html_ft[21] . /* ... */;
eval($fn1($fn2($fn3($esc_html_gp))));

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The structure is consistent with an encoded PHP loader. The original draft labeled it Japanese SEO spam, but the retained artifact alone does not demonstrate language, generated pages, or search-index effects.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

• esc_html_gp
• esc_html_ft
• Nested generated callables passed to eval
• Character-index function-name assembly

Contextual indicators

• eval()
• Encoded string array
• malware.php
• esc_html prefix

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

• The decoded payload was not retained in readable form for this page.
• The evidence does not establish Japanese SEO spam behavior.
• The deployed filesystem path, triggering request, and initial compromise method were not confirmed.

Artifact-specific remediation

• Preserve the original encoded sample privately.
• Remove the injected artifact only after identifying its deployed path.
• Search PHP files for esc_html_gp, esc_html_ft, and the nested call shape.
• Replace affected components with trusted copies.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

• Repeat the identifier search after scheduled tasks run.
• Monitor PHP files for long character arrays and new eval chains.
• Check that the artifact does not reappear in restored components.

Related malware research

Browse the WordPress malware research hub.

• goto-Obfuscated Remote Loader Found in index.php
• TokensDeGuards Payload Verification and eval in index.php
• WP-Security Fake Plugin with an eval Decode Wrapper

Related guides and case studies

• How to recognize obfuscated PHP malware
• WordPress malware removal guide

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.