Website attack via PHP, data stored inside a .gif?

My website recently got compromised and it looks like they somehow uploaded a PHP file which was then executed to create directories etc. I'v shut all services down until I can understand this a bit more.

I decrypted the PHP file and can see this part: $out = file_get_contents("info.gif");

I have the gif file, how can I examine the code/data inside this? Any help would be grateful.

Thanks.