Comment by bholzer

It redirects to a couple different PHP pages as well, so there could have been more malicious code there