It redirects to a couple different PHP pages as well, so there could have been more malicious code there