Recurring wk Directories with a Hex-Fragment PHP Loader

Summary

This entry records directories named wk observed in four WordPress content paths and a supplied index.php sample built around the distinctive class nigwqgqwtqwtqwt. The sample stores code as a long list of hexadecimal fragments, reconstructs decoder names indirectly, and passes the reconstructed layer to eval().

The screenshots establish that same-named directories existed in multiple locations. They do not show their contents or prove that each contained the supplied sample. The relationship is retained investigation context and is stated with that limitation.

Investigation context

During one anonymized investigation, wk directories were documented directly under wp-content and within mu-plugins, themes, and uploads. A code screenshot and retained sample documented an encoded PHP file named index.php.

The broad obfuscated PHP malware guide explains general pattern recognition. This page focuses on the recurring directory name, the distinctive class and method, and the pipe-separated hex-fragment loader structure.

Observed wk directory pattern

The first screenshot shows wk directly under wp-content. A directory name this short is not definitive evidence, so the finding is meaningful primarily when correlated with the other paths and code sample.

The same name also appears under mu-plugins. Two sibling PHP filenames are visible, but their contents are not supplied here and they are not classified by this page.

Separate views record wk under both themes and uploads.

Confirmed findings

• Screenshots show wk directories under wp-content, wp-content/mu-plugins, wp-content/themes, and wp-content/uploads.
• The supplied PHP sample declares class nigwqgqwtqwtqwt and method nigwqgqwtqwtqwti.
• A long string contains many pipe-separated hexadecimal fragments.
• The visible code constructs function names indirectly, including a base64-decoding operation.
• The reconstructed layer is supplied to eval().

Technical analysis of the hex-fragment PHP loader

The code divides a long encoded program into many hexadecimal pieces separated by |. This makes common readable strings less obvious in the original file. A second layer dynamically reconstructs decoder-related function names and then evaluates the resulting content.

Redacted defensive excerpt

class distinctive_random_name:
    encoded_fragments = "<pipe-separated hexadecimal data omitted>"

    decoded_layer = reconstruct_with_indirect_decoder_names(encoded_fragments)
    evaluate(decoded_layer)  # payload omitted

No encoded fragments, callable-construction details, request parameters, or payload implementation are reproduced publicly.

Relationship between the observed artifacts

The directory screenshots and PHP sample were retained as part of the same investigation record. That supports examining them together, but it does not prove that identical copies existed in all four directories. A defensible recurrence hunt should compare file contents, class names, and code structure rather than treating the name wk as sufficient.

Analyst assessment

The code structure is consistent with an obfuscated PHP loader because it hides a substantial program behind hexadecimal fragments and runtime reconstruction before evaluation. That finding does not require executing or decoding the payload.

The repeated directory name may represent distributed copies or staging locations, but the screenshots do not establish copying, automatic restoration, or execution from each path. Those remain hypotheses to test with file hashes, content comparison, timestamps from reliable records, and logs.

Indicators of compromise

Higher-confidence indicators

• Class nigwqgqwtqwtqwt
• Method nigwqgqwtqwtqwti
• A long pipe-separated hexadecimal fragment string
• Indirect decoder-name construction followed by eval()
• The combined recurrence of wk directories across several WordPress content paths during one investigation

Contextual indicators

• Directory name wk
• Filename index.php
• wp-content/uploads
• wp-content/themes
• wp-content/mu-plugins
• eval() or base64 decoding

None of these contextual values establishes infection alone. Use the class, method, fragment format, and surrounding control flow for confirmation.

What this evidence does not establish

• Directory listings do not reveal the files inside the four wk folders.
• The evidence does not prove that the supplied index.php existed in every observed directory.
• The encoded payload was not decoded, so its specific capabilities are not claimed.
• The screenshots do not prove execution or a recreation chain.
• The excluded permissions image shows a 0555 directory setting but does not connect that setting to this artifact or prove who changed it.
• No initial access method, vulnerable component, affected version, duration, or client outcome was confirmed.

Artifact-specific remediation

Preserve each wk directory and its metadata before changing it. Inventory contents and compare files by cryptographic hash in the private investigation record. Search for the distinctive class, method, and pipe-separated fragment structure across the hosting account.

Remove confirmed unauthorized standalone files and replace modified legitimate components with trusted copies. Review executable files under uploads, top-level MU-plugins, scheduled tasks, administrator accounts, and database options for independently confirmed persistence. The file-types guide provides broader hunting context.

Recurrence verification

• Monitor all four documented paths for recreation of wk.
• Repeat the class, method, and structural code search after normal traffic and scheduled events.
• Compare any returning file with the preserved evidence rather than relying only on its path.
• Confirm that legitimate plugins, themes, uploads, and MU-plugins continue to function after removal.

Related malware research

• Compact Extension Vox MU-plugin artifact
• wp-config.php XOR temporary-file loader
• HTTP-header-gated PHP loader

Methodology and privacy note

This analysis uses five privacy-reviewed screenshots and one supplied encoded PHP sample from an anonymized investigation. A sixth permissions screenshot was excluded because it does not establish causation. The encoded payload remains private and was neither decoded nor executed during this work.