From decoded.php, for context:
/**
* ===WORDPRESS PHARMA HACK ANALYSIS===========================================
* ============================================================================
*
* Patrick Adair [ patrick AT ionpublications DOT com ]
*
* For the uninitiated, there's been a rather-nasty hack making its way across
* a number of prominent websites hosted with Wordpress called the "pharma
* hack"; named so because it hijacks your search results in Google, et al. to
* show obviously-spoofed results for Viagra and other generic medications
* that we see spammed all the time across the internet.
*
* As you, the reader, can rightly imagine, Wordpress blog owners were scared
* out of their minds and worked quickly to remove the hacks from their sites,
* finding the necessary codes sometimes hidden deep inside of their plugins
* and striking only when search engines and automated crawlers of any kind
* hit the site.
*
* On the 24th of November, 2010, we noticed that one of our sites, Science
* and Supermodels [ http://www.scienceandsupermodels.com ] was hit by the
* hack, and after a few times of playing cat-and-mouse with it (delete the
* injected code only to have it re-appear in the same place 30 minutes later),
* we were able to remove it entirely and all was well.
*
* But I had an interesting idea. To my knowledge, at the time of this writing,
* all of the accumulated knowledge on this hack was simply removal techniques
* for non-technical users (which, admittedly, is most of Wordpress' userbase
* so far as I can tell - the consequences of making it so gorramn easy to
* install). I decided that it would make an interesting project to break apart
* and analyze the injected code to try and figure out what it was doing, and
* see if any good can come of that.
*
* Fast forward to 24 hours ago (December 20, 2010), and I've finally cleared
* up enough time to start meaningfully decoding and rewriting this script, and
* I hope that something useful will come of this - perhaps a security company
* can pick up on the groundwork I've laid here and figure out how to actually
* stop the bastards doing this.
*
* What follows is a SIGNIFICANTLY re-written version of the script, edited for
* clarity and also to test my programming chops - the original was compressed,
* encoded in base64, and even then written in an absolutely incomprehensible
* fashion.
*
* I've tried to include as much information as I can - since the control
* servers are still active for this hack (at least at the time of this
* writing), I was able to get pretty accurate debugging and data on what its
* delivery method was, and those will all be included in my Mercurial repo
* along with this file.
*
* Also, this is based off of only the version of the hack that our site got -
* it remains entirely possible that other mutations of the hack exist and I
* would be curious to see what they look like / do. If you have other samples
* of the code, please email them to me and I would love to see.
*
* So without further ado, I present the Wordpress Pharma Hack:
*
*/
