security.stackexchange.com/questions/136966/php-malware-on-server-but-helpless-in-identifying-the-malicious-code

(I haven't gone over the code, I'm speculating because your description fits the modus of some malware I've seen in the past.) It's probably a ...

gist.github.com/ejfox/22140128e2883260ce255eee49094b7e

Nov 16, 2017 ... curl_setopt($ch, CURLOPT_URL, "http://www.ask.com/web?q=$query_pars_2 &qsrc=11&adt=1&o=0&l=dir&page=$pagge");. curl_setopt($ch ...