External/php-malware-scanner
1
0
Fork 0
mirror of https://github.com/scr34m/php-malware-scanner.git synced 2026-06-16 12:30:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

extending patterns from 3rd samples source

Browse Source
This commit is contained in:
Gabor Gyorvari
2016-05-05 07:42:39 +02:00
parent 7e06f846ae
commit 5783ead57a
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
scan.php
View File

@@ -149,11 +149,14 @@ class MalwareScanner
'=\'base\'.(32*2).\'_de\'.\'code\'', '=\'base\'.(32*2).\'_de\'.\'code\'',
'"base64_decode"', '"base64_decode"',
'YmFzZTY0X2RlY29kZ', // base64_decode 'YmFzZTY0X2RlY29kZ', // base64_decode
/* 'eval', 'eval(', */ /* 'eval', 'eval(', */
'eval("?>',
'ev\x61l', 'ev\x61l',
'\x65\166\x61\154\x28' /* dec/hex issue? */, '\x65\166\x61\154\x28' /* dec/hex issue? */,
'\x65\x76\x61\x6C' /* case, dec/hex issue? */, '\x65\x76\x61\x6C' /* case, dec/hex issue? */,
'ZXZhbCg', // eval 'ZXZhbCg', // eval
'eval(base64_decode(', 'eval(base64_decode(',
'\x47\x4c\x4f\x42\x41LS', // GLOBALS '\x47\x4c\x4f\x42\x41LS', // GLOBALS
'SFRUUF9VU0VSX0FHRU5U', // HTTP_USER_AGENT 'SFRUUF9VU0VSX0FHRU5U', // HTTP_USER_AGENT
@@ -161,8 +164,11 @@ class MalwareScanner
'${${', // ${${"\x47\x4c\x4f\x42... '${${', // ${${"\x47\x4c\x4f\x42...
'file_get_contents(\'http://codepad.org', 'file_get_contents(\'http://codepad.org',
'PHPJiaMi', 'PHPJiaMi',
'@include($_GET[',
'system($_GET[',
/* too open? */ /* too open? */
// 'gzinflate(base64_decode(',
'md5($_GET[', // md5($_GET["ms-load"]) 'md5($_GET[', // md5($_GET["ms-load"])
); );
foreach ($patterns as $toSearch) { foreach ($patterns as $toSearch) {