<?php

function filterStr($hex) {
    $str = "?php\n";
    $str .= hex2bin($hex); // decode hex payload
    return $str . "?";
}

function randomGifFile() {
    return sys_get_temp_dir() . "/" . "secret-php-gif-script"; // found and created file destination in temp directory
}

// Exits if no parameters sent
//if (!isset($_GET["id"]) || !isset($_POST["ftp"])) {
//    die; // if neither paramter found, exit
//}

$a = array(1 => "userName");
$b =& $a[1];
$c = $a; // how does $c change $a?
$c["1"] = "6563686f282764656f6266757363617465642729"; // safe mimic payload, just echoes 'deobfuscated'


$fileName = randomGifFile() . ".gif";
file_put_contents($fileName, "" . "<" . filterStr($a[1]) . ">");

if (file_exists($fileName)) {
    require_once $fileName; // executes decoded payload if file found
}

@unlink($fileName); // delete payload
?>