xdiff.php XOR Temporary-File Loader Research

Artifact class Request-gated temporary-file PHP loader

Evidence confidence High

Risk assessment Critical

Start with the problem you are seeing

Could this match the problem on your WordPress site?

This entry is for owners or developers who find unfamiliar xdiff-based patching code during a WordPress file review. The structure is unusual and security-relevant, but no triggering request or patched output was retained.

Observed in this investigation

The supplied PHP artifact used xdiff_string_patch with nonstandard embedded data in a WordPress context.

Possible warning signs

The public website may show no obvious symptom until a matching code path runs.
A scanner or manual source review may be the first indication of the artifact.

These signs are investigation leads, not proof of this artifact by themselves.

Questions this research can help answer

Why is xdiff_string_patch used in my WordPress PHP files?
Does unusual patching code prove that a WordPress vulnerability was exploited?

Evidence boundary: The code pattern is confirmed; no vulnerable component, affected version, or exploitation path was identified.

Seeing one of these signs on your site?

I can investigate the files, database records, users, and server evidence, explain what is confirmed, and help plan a safe cleanup.

Ask me to investigate your site See how my malware cleanup works

Research focus: Forensic analysis of xdiff.php code that decoded request data, searched writable temporary paths, included a staged file, and deleted it.

Summary

This WordPress malware research entry documents request-gated temporary-file php loader evidence observed during one anonymized client investigation. The narrow topic is xdiff.php XOR Loader Using Writable Temporary Directories: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The behavior is a transient PHP loader: request-supplied code can be staged outside the webroot, executed through include, and removed. The separate sadtab_chpw.php command backdoor was supplied in the same draft, but their direct relationship was not confirmed.

Investigation context

Anonymized investigation with two code screenshots and supplied sources for xdiff.php and a separate command backdoor; no screenshot is published for code-safety reasons. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

The public entry does not use a screenshot because the retained images either exposed sensitive values, showed a complete encoded payload, or did not add reliable evidence beyond the supplied code.

Confirmed findings

xdiff.php checks for a POST field.
It hex-decodes request input and XOR-transforms each byte.
It iterates through configured and conventional temporary directories.
It writes .data_chunk, includes the file, unlinks it, and exits.

Technical analysis

How the loader selects and cleans a temporary path

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

$paths = ['/var/tmp', ini_get('upload_tmp_dir'), '/dev/shm', sys_get_temp_dir(), '/tmp'];
$decoded = xor_bytes(hex2bin($_POST['[REDACTED]']), 36);
// choose a writable path
file_put_contents($tempFile, $decoded);
include $tempFile;
unlink($tempFile);

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

xdiff.php
.data_chunk
Writable-path loop followed by include and unlink
Hex decode plus XOR 36

Contextual indicators

/tmp
/dev/shm
file_put_contents()
include()

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

No triggering request or executed payload was retained.
The exact deployed plugin path was not confirmed.
The relationship to sadtab_chpw.php was not established.
The initial compromise method and vulnerable component were not identified.

Artifact-specific remediation

Preserve xdiff.php and relevant request logs privately.
Remove the loader and search every writable path for related temporary artifacts.
Search for .data_chunk and the writable-directory array.
Rotate credentials and review other access paths after containment.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

Confirm xdiff.php and .data_chunk do not return.
Monitor temporary directories and web paths for short-lived PHP files.
Review logs for repeated requests to the observed filename.

Browse the WordPress malware research hub.

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.

xdiff.php XOR Loader Using Writable Temporary Directories