A deep dive into obfuscated PHP malware reveals a multi-class backdoor using XOR/Base64 decoding, remote command execution, and SEO spam generation. By unpacking its structure, we uncover hidden C2 communication, template injection, and keyword-driven sitemap abuse.