mirror of
https://github.com/scr34m/php-malware-scanner.git
synced 2026-06-16 12:30:35 +00:00
Added Experimental Patterns
Removed anyresults.net from the base64 pattern strings. Added base64 patterns for $_POST $_GET $_REQUEST $_COOKIE extract and GLOBALS
This commit is contained in:
@@ -132,10 +132,35 @@ Y3NsYXNoZX
|
||||
NzbGFzaGVz
|
||||
jc2xhc2hlc
|
||||
|
||||
# "anyresults.net" in base64 ... this one may be too specific ?
|
||||
YW55cmVzdWx0cy5uZX
|
||||
FueXJlc3VsdHMubmV0
|
||||
hbnlyZXN1bHRzLm5ld
|
||||
# "extract" in base64
|
||||
ZXh0cmFjd
|
||||
V4dHJhY3
|
||||
leHRyYWN0
|
||||
|
||||
# "$_GET" in base64
|
||||
JF9HRV
|
||||
RfR0VU
|
||||
kX0dFV
|
||||
|
||||
# "$_POST" in base64
|
||||
JF9QT1NU
|
||||
RfUE9TV
|
||||
kX1BPU1
|
||||
|
||||
# "$_COOKIE" in base64
|
||||
JF9DT09LSU
|
||||
RfQ09PS0lF
|
||||
kX0NPT0tJR
|
||||
|
||||
# "$_REQUEST" in base64
|
||||
JF9SRVFVRVNU
|
||||
RfUkVRVUVTV
|
||||
kX1JFUVVFU1
|
||||
|
||||
# "GLOBALS" in base64
|
||||
R0xPQkFMU
|
||||
dMT0JBTF
|
||||
HTE9CQUxT
|
||||
|
||||
# Obfuscation related code
|
||||
eval("?>
|
||||
|
||||
Reference in New Issue
Block a user