PHP Footer Loader Fetching Remote Hidden-Link Markup

Summary

This research entry documents a PHP loader observed in an active WordPress theme’s footer.php. The supplied code requests a hard-coded remote endpoint, tries several PHP retrieval methods, and prints a successful response before the closing page markup. A retained browser screenshot shows that the endpoint returned a hidden <div> containing a large set of outbound links.

The evidence supports a narrow finding: this footer code could insert remotely supplied markup into rendered pages. It does not identify how the theme file was modified or which component, if any, was originally vulnerable.

Investigation context

This behavior was observed during one anonymized WordPress investigation. The visible symptom was spam-link markup associated with rendered pages. The investigation then connected that symptom to a remote response and to a PHP block inside the active theme footer.

The broader article on hidden links malware and remote-fetch footer injection covers detection and cleanup in more depth. This page is limited to the code and screenshot evidence for this specific loader.

Observed remote response

The retained endpoint response begins with a hidden container and continues with numerous outbound anchors. Several visible anchors use gambling or promotional terms. This supports an analyst assessment that the remote content was intended for link injection, although the screenshot alone does not establish how search engines or visitors received it on every request.

Confirmed findings

• The supplied footer.php code contains a hard-coded reference to nawalaku[.]my[.]id/bl/.
• The code first checks whether URL-aware file access is available.
• It contains a cURL branch and a stream-context branch as retrieval alternatives.
• A successful response is passed to an output statement in the footer.
• The retained endpoint screenshot shows hidden-link markup at the referenced path.

Technical analysis of the PHP footer loader

The loader is small and uses ordinary PHP networking functions. That makes individual function names weak indicators on their own. The more useful signature is the combination of one hard-coded endpoint, multiple retrieval fallbacks, and immediate output of the returned value from a theme footer.

Retrieval and output flow

The supplied code shows this defensive control-flow summary:

Redacted defensive excerpt

remote_endpoint = "hxxps://nawalaku[.]my[.]id/bl/"
response = try_stream_read(remote_endpoint)

if response is empty:
    response = try_curl_request(remote_endpoint)

if response is still empty:
    response = try_stream_context_request(remote_endpoint)

if a response was received:
    print response in the page footer

This excerpt is intentionally non-operational. Request options and implementation details that are not needed for defensive identification have been removed.

Analyst assessment

The combination of the hidden remote response and the footer output path is consistent with remote SEO-link injection. Keeping the link list on a remote host would let the response change without another edit to the WordPress theme. That is an analyst assessment based on the visible control flow and retained response; the evidence does not establish the operator, campaign, or duration.

Screenshot evidence: secondary corroboration

The scanner screenshot records a spam-link finding associated with the investigated site. Client-identifying values in the retained derivative are irreversibly redacted. The scanner label is not used to infer the PHP behavior; it only corroborates that spam-link output was observed during the incident.

Indicators of compromise

Higher-confidence indicators

• Defanged endpoint: nawalaku[.]my[.]id/bl/
• A theme-footer block that combines the endpoint with several retrieval fallbacks and immediate output
• The structural sequence represented by echo fetch($url) in the supplied sample

Contextual indicators

• Modified footer.php
• file_get_contents() used with a URL
• curl_init() and a stream context in theme code

Those filenames and PHP functions also have legitimate uses. They become meaningful here because they occur together with the distinctive endpoint and output flow.

What this evidence does not establish

• The initial compromise method was not confirmed.
• No vulnerable plugin, theme, or affected version was identified.
• The evidence does not show whether the endpoint returned identical content to every visitor.
• The scanner screenshot does not prove which PHP branch executed.
• No attribution, prevalence, or number of affected sites can be derived from this investigation.

Artifact-specific remediation

Preserve the affected footer and relevant logs before modification when incident reconstruction matters. Replace the compromised theme file—or preferably the full theme—with a verified clean copy from the trusted source. Search the site for the defanged endpoint and the distinctive fallback/output structure, including inactive themes and cached copies.

Then inspect other persistence locations, review administrator and hosting access, rotate credentials relevant to the confirmed exposure, and verify rendered source after cleanup. The WordPress malware removal guide provides the broader cleanup process; this research entry is not a substitute for a full-site investigation.

Recurrence verification

• Recheck the active footer and other theme copies after several normal page requests.
• Search for the endpoint and structural signature across the account.
• Inspect rendered HTML for unexpected hidden outbound anchors.
• Review outbound-request and access logs when available.
• Confirm that clean theme files remain unchanged after scheduled tasks and administrator activity.

Related malware research

• HTTP-header-gated PHP loader
• wp-config.php XOR temporary-file loader

Methodology and privacy note

This page is based on screenshots and code retained from one anonymized client investigation. Identifying client values are not published. Confirmed findings are limited to the supplied files and visible screenshots; interpretations are labeled as analyst assessment. The complete sample remains outside the public page, and the excerpt above was reduced to a defensive control-flow description.