What is polymorphic malware infecting WordPress?

Polymorphic malware (polymorphic malware) that infects WordPress will be described.

What is polymorphic malware?

In a nutshell, polymorphic malware is malware that has the same content but differs only in the appearance of its code, such that the obfuscation and code randomization methods differ from file to file.

The reason why this type of malware has become so prevalent in recent years is that, although the malicious functions themselves are the same, the code is different, making it difficult to detect patterns and allowing it to slip past malware detection plug-ins and other inspections.

As an example, let us look at the following two pieces of malware code.

?php $Vxql = 'Sy1LzNFQKyzNL7G2V0svsYYw9dKrSvOS83MLilKLizXSqzLz0nISS1K ... The code continues

?php $xiHfy = 'Sy1LzNFQKyzNL7G2V0svsYYw9dKrSvOS83MLilKLizXSqzLz0nISS1K ... The code continues

In this example, you can see that only the first $Vxql part is different.

You can see that the malware detection software can only detect one of them, even if it tries to detect it with the detection pattern “?php $Vxql = ‘Sy1LzNFQKyzNL7G”.

Although the two malware codes above share a common part, Sy1LzNFQKyzNL7G2V0svsY, advanced polymorphic malware can be quite different in almost the entire code. In addition, such code may use the domain of the site as a seed for randomizing malware, making it extremely difficult to detect malware code that differs from site to site.

How to detect polymorphic malware?

Unlike PC viruses, polymorphic malware is born from the fact that the PHP scripting language in which WordPress is built does not require compilation (conversion to machine language) and has various obfuscation methods that can be automatically executed on the server. It is malware.

There are three possible methodologies for detecting this type of malware

1 Detection by examining the differences from a set of legitimate files
2 Detection by using a larger number of patterns
3 Detection by using regular expressions and using only external shapes

Using a regular expression, for example

?php $Vxql = 'Sy1LzNFQKyzNL7G2V0svsYYw9dKrSvOS83MLilKLizXSqzLz0nISS1K ... The code continues

Malware such as the following can be detected in the form of abstract regular expressions such as

/\?php $[a-z]{4,5} = '^\S{1000}/i

PHP followed by $, followed by a 4- or 5-letter alphabet followed by = ‘, followed by a string of at least 1000 characters, not including spaces. This is a regular expression meaning

However, methodologies 1, 2, and 3 are more difficult, and the plug-ins that detect malware with regular expressions may not have the latest patterns registered, so detection may be limited.