From 296db40c8a9437c12b6f18c4744e06e34e8541fa Mon Sep 17 00:00:00 2001 From: nichogenius Date: Fri, 28 Jul 2017 02:38:08 -0600 Subject: [PATCH] Added http://www.fopo.com.ar/ http://www.fopo.com.ar/ is a free online php obfuscator that apparently leaves comments in the code which we should be looking for. --- patterns_raw.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/patterns_raw.txt b/patterns_raw.txt index e1cc2a9..468476b 100644 --- a/patterns_raw.txt +++ b/patterns_raw.txt @@ -122,6 +122,8 @@ eval(base64_decode( $data = base64_decode(" edoced_46esab base=base64_encode +# fopo.com.ar - free online php obfuscator. It conveniently leaves comments in the code. +http://www.fopo.com.ar/ #Malware/Attack specific strings/fingerprints/signatures