menu-queue-bit.php and the Compact Extension Vox Identity

Summary

This entry examines menu-queue-bit.php, a 93.18 KiB file observed directly under wp-content/mu-plugins. Its header names the plugin Compact Extension Vox. Immediately after an ABSPATH guard, the visible code defines a large global array of escaped values.

The screenshots and supplied excerpt support identifying a specific obfuscated MU-plugin artifact. They do not expose the decoded payload, so this page does not assign redirects, account creation, command execution, or any other payload outcome to the file.

Investigation context

The file was retained during one anonymized WordPress investigation. Because WordPress loads top-level PHP files in the must-use plugin directory without the ordinary Plugins-screen activation flow, the location is operationally important. That WordPress behavior is confirmed; a specific request or page execution of this sample was not logged in the supplied evidence.

The broad obfuscated PHP malware guide explains common decoding patterns. This research entry instead records the exact filename, claimed plugin identity, path, size, guard, and escaped string-table structure.

Observed artifact

The file-manager screenshot shows menu-queue-bit.php alongside two hosting-related MU-plugin files. The neighboring files are visible only for directory context and are not classified by this investigation.

The code editor connects that path to the Compact Extension Vox identity and the escaped data structure. The screenshot shows only the beginning of the file.

Confirmed findings

• menu-queue-bit.php was present as a top-level file in wp-content/mu-plugins.
• The file manager displayed a size of 93.18 KiB.
• The file header declares Plugin Name: Compact Extension Vox.
• An ABSPATH check exits when the file is outside the expected WordPress context.
• The next visible statement assigns a large collection of escaped values to $GLOBALS['_ofdyhs'].

Why this MU-plugin location matters

WordPress automatically includes top-level PHP files from wp-content/mu-plugins. Unlike an ordinary plugin, a file in this location does not need to be activated through the standard Plugins screen. This makes the path a valuable forensic fact, but the path is not malicious by itself; legitimate hosts and developers also use MU-plugins.

Here, the stronger signal is the combined evidence: an unfamiliar plugin identity, a distinctive filename, a large file, and an escaped string table beginning immediately after the guard.

Technical analysis of the escaped string table

The visible array consists of many \xNN-style byte escapes stored in a global variable. Such a table can defer readable function names or data until later code transforms it. The screenshot does not show the transformation routines or decoded result, and the public analysis does not attempt to rebuild them.

Redacted defensive excerpt

plugin identity = "Compact Extension Vox"

if WordPress bootstrap constant is absent:
    stop

global escaped_values = [
    "<large escaped value omitted>",
    "<additional values omitted>"
]

remaining decoding and behavior: not present in the retained public excerpt

The full escaped table remains outside the public page.

Analyst assessment

The artifact is consistent with a concealed loader or backdoor component because substantial logic or data is hidden behind an escaped global table in an automatically loaded location. That classification is based on the combined structure and investigation context.

The evidence is not sufficient to name the concealed capability. It would be inaccurate to state that this file caused a redirect, restored another file, created a user, contacted a server, or received commands without the decoded logic or supporting logs.

Indicators of compromise

Higher-confidence indicators

• menu-queue-bit.php
• Compact Extension Vox
• $GLOBALS['_ofdyhs']
• A large \xNN-escaped string array beginning immediately after the plugin header and ABSPATH guard
• The combined path wp-content/mu-plugins/menu-queue-bit.php

Contextual indicators

• wp-content/mu-plugins
• A top-level PHP file in the MU-plugin directory
• ABSPATH checks
• Escaped strings in PHP

All four contextual patterns can occur in legitimate WordPress code. Investigators should pivot on the distinctive filename, identity, global variable, and full structural combination.

What this evidence does not establish

• The decoded payload and its capability were not retained in publishable evidence.
• The screenshots do not demonstrate that a specific request executed the file.
• No direct relationship to other artifacts from the same site was established.
• No restoration or reinfection mechanism was confirmed.
• The initial compromise route, vulnerable component, affected version, and duration were not identified.
• The relative date shown by the file manager is not used as a reliable observation or creation date.

Artifact-specific remediation

Preserve the file and relevant filesystem metadata before removal when evidence retention is required. Verify the site’s approved MU-plugin inventory with its developer or host. If menu-queue-bit.php is unauthorized, remove it from service and retain the original only in isolated evidence storage.

Search for Compact Extension Vox, menu-queue-bit.php, and _ofdyhs across the account. Review other top-level MU-plugin files and compare hosting-provided helpers with trusted copies. Then inspect ordinary plugins, themes, scheduled tasks, administrator accounts, and database options for independent persistence rather than assuming it exists.

Recurrence verification

• Monitor wp-content/mu-plugins for recreation of menu-queue-bit.php.
• Search again for the plugin identity and global-variable name after scheduled tasks and normal traffic.
• Verify that the site’s approved MU-plugins still load correctly after removal.
• Investigate any reappearance as evidence of a separate writer or restoration mechanism.

Related malware research

• WP Security Helper plugin concealment
• Recurring wk directories and hex-fragment PHP loader
• HTTP-header-gated PHP loader

Methodology and privacy note

This analysis is limited to two screenshots and a structural excerpt retained from one anonymized investigation. The first screenshot was deterministically cropped to remove a hosting account identifier; the unedited original was moved outside the public asset tree. No encoded data was executed, repaired, or reconstructed.