This happened to me, too! The file was timestamped 3/18. My wp-content folder was already set at permission 755, so I don’t know how the hacker got in there. I was running wp-cache and deactivated it. I also deleted the “1” folder, but I wonder if the hacker will come back?