php-malware-scanner/definitions/patterns_re.txt

#eval /* */
eval\/\*[a-z0-9]+\*\/

#
eval\([a-z0-9]{4,}\(\$[a-z0-9]{4,}, \$[0-9a-z]{4,}\)\);

#
(chr\(\d+\^\d+\)\.){4,}

#
(\$[a-z0-9]{3,}\[\d+\]\.){4,}

#
chr\(\d+\)\.""\.""\.""\.""\.""

# escaped commands pl.: "eval(base64_decode(" equal "\145\166\141\154\050\142\141\163\145\066\064\137\144\145\143\157\144\145\050"
(\\[0-9]{3}){6,}

#
\$GLOBALS\[\$GLOBALS['[a-z0-9]{4,}'\]\[\d+\]\.\$GLOBALS\['[a-z-0-9]{4,}'\]\[\d+\].

#
\$GLOBALS\['[a-z0-9]{5,}'\] = \$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.

#
eval\([a-z0-9_]+\(base64_decode\(

#
\$[a-z]{3,}=\$[a-z]{3,}\("",\$[a-z]{3,}\);\$[a-z]{3,}\(\);

#
{\s*eval\s*\(\s*\$

#
Googlebot['"]{0,1}\s*\)\){echo\s+file_get_contents

#execute base64 code
eVaL\(\s*trim\(\s*baSe64_deCoDe\(

#
if\s*\(\s*mail\s*\(\s*\$mails\[\$i\]\s*,\s*\$tema\s*,\s*base64_encode\s*\(\s*\$text

# Write HTTP Request to File
fwrite\s*\(\s*\$fh\s*,\s*stripslashes\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUEST)\[

# Download Remote Code
echo\s+file_get_contents\s*\(\s*base64_url_decode\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUEST)

# 'eval' in ascii chr() chars
chr\s*\(\s*101\s*\)\s*\.\s*chr\s*\(\s*118\s*\)\s*\.\s*chr\s*\(\s*97\s*\)\s*\.\s*chr\s*\(\s*108\s*\)

#
(\$OOO_O_000_\{\d+\}.){3,}

#Detects the '_' character encoded in a string like "\x5F".  '_' is present in many functions that malware would want to hide.
# '_' as "\x5f"
\\[Xx](5[Ff])

#Detects the '_' character placed inside a call to the 'chr()' function
# '_' as 'chr(95)' or 'chr(0x5f)'
chr\s*\(\s*['"]?\s*((95)|(0[Xx]5[Ff]))\s*['"]?\s*\)

#Detects generic base64 strings longer than 260 characters enclosed in quotes ending with 0-3 '=' chars.
#260 was a threshold chosen because strings of 256 characters are common enough.  Might increase later to reduce false positives.
#Long base64 quoted string.
['"][A-Za-z0-9+\/]{260,}={0,3}['"]

#Detects long single lines contained within PHP tags.
#We can increase from 1100 later if we need to.
#Long single line of PHP.
^.*<\?php.{1100,}\?>.*$

#Escaped path characters: \x2fho\x6de/\x69mp\x75ls\x69oq\x65/w\x77w. or \x2fhome\x2fimpu\x6csioq\x65/www\x2emusc
(\\x[0-9abcdef]{2}[a-z0-9.-\/]{1,4}){4,}

#Malware inffected files sometimes marked with comments like /*87cda*/ to avoid infect again
\/\*[a-z0-9]{5}\*\/

# XOR-ed strings with custom math
%\(\d+\-\d+\+\d+\)==\(\-\d+\+\d+\+\d+\)

# XOR-ed strings with custom math 2.
\(\$[a-zA-Z0-9]+%\d==\(\d+\-\d+\+\d+\)

# eval code from POST on second nested level
eval\(\$[a-z0-9_]+\(\$_POST

# characted concated with chr() alteast 3 times
("[a-z0-9]+"\.chr\(\d+\)\.){3,}

# nested function call used variables
\$[a-z]+\(\$[a-z0-9]+\(

# GLOBALS inject with escaped content
\$GLOBALS;\$\{"\\x

# web shells host type extraction RE
php_uname\(["'asrvm]+\)

# XOR decode POST-ed payload
(\^\s*\$\w+\[\$\w+\s*%\s*strlen\(\$\w+\)\]\s*){2,}

# uncommon function name underscore with many numbers
function\s+_[0-9]{8,}\(

# escaped include with error hiding
@include ".*?(\\x[0-9a-f]{2,}.*?){2,}.*?";

# create_function is dangerous as like eval() see http://php.net/manual/en/function.create-function.php
create_function\s*\(\s*['"]{2}