I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them.
Everything else on the server matches my git repo, so I'm pretty confident nothing else has been changed. I can't find any mention in the Apache logs of either file being called since they were created. Does that mean it's safe to assume they have never been run?