Support

It couldn't tell you it's compromised (i.e. have a non-zero threat score) because the code in that file doesn't use any suspicious patterns. It's some very standard PHP code, just like what you'd normally see on regular PHP software. Pattern-wise, there's a big base64-encoded block but this is still not a tell-tale sign of a hacked file. This kind of Base64 encoded blocks can be found in legitimate software, including our own PHP File Change Scanner.

However, you've missed how Admin Tools already told you very loud and clear that something's going wrong: the file was marked as Modified. That's the entire point of PHP File Change Scanner. That's why we call it a PHP file change scanner, not a PHP file hacked file scanner. The intention is to give you a heads up "hey, these executable PHP files were modified, added or deleted since the last time you ran me, you sure this ain't a hack?". Please do remember that the Threat Score is there only as an additional indicator. There is no such thing as a foolproof algorithmic scanner of source code. Even a well trained, resourceful (by nature – unlike machines we have creativity) human developer could overlook this kind of compromised files.

Bottom line: When the PHP File Change Scanner reports a file as Added or Modified you must question whether this change is expected. If not, review the file manually. Do NOT blindly trust the threat score, it's only yet another indicator.