48DESIGN

{
    "slug": "corona-test-results",
    "pattern": "decode_write_dropper",
    "kind": "builtin",
    "version": "1.11.6",
    "hit_count": 1,
    "first_hit": {
        "file": "corona-test-results-admin-settings.php",
        "line": 1198,
        "snippet": "define( \\'CTR_ENCRYPTION_KEY\\', base64_decode( \\'' . base64_encode( DataEncryption::getRandomKey() ) . '\\' ) );';"
    },
    "explanation": "a runtime decode primitive (`gzuncompress`/`gzinflate`/`gzdecode`/`base64_decode`) feeds a filesystem write (`fwrite`/`file_put_contents`) which is then `include`d/`require`d as a variable path \u2014 the textbook dropper shape: ship an encoded payload as data, decode it to disk at activation/admin-init, and execute it. The siteguarding burner `wp-plugin-management` (audit #43) used exactly this: `fwrite($fp, gzuncompress($c)); include($filename);` in its `register_activation_hook` to plant `siteguarding_tools.php`. Near-zero FP because legit caching writes decoded data but never `include`s a computed path it just wrote."
}