External/php-malware-scanner
1
0
Fork 0
mirror of https://github.com/scr34m/php-malware-scanner.git synced 2026-06-16 12:30:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Sample update

Browse Source
This commit is contained in:
Gabor Gyorvari
2023-05-14 08:45:20 +02:00
parent aec0f56af5
commit 70edc4210d
2 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
definitions/patterns_re.txt
View File

@@ -141,7 +141,7 @@ explode\('\|\x01\|\x03\|\x03', gzinflate\(
\$[a-z]11 \^ [a-z]8\(\$[a-z]6, \$[a-z]14, \$[a-z]6\[13\]\(\$[a-z]11\)\)\)\);
# eval function return and concat
eval\([A-Za-z]{5,}\(\) \. '
eval\([A-Za-z0-9]{5,}\(\) \. '
# eval function return, parameter is a hex string
eval\([A-Za-z0-9]{5,}\(\"[A-Z0-9]{16,}
@@ -150,4 +150,7 @@ eval\([A-Za-z0-9]{5,}\(\"[A-Z0-9]{16,}
\$[a-zA-Z0-9]{6,}\('\x78\x9C\xAD\x90\x41\x0E
# obfuscated code return with error suppression
return @\$[a-z]{2}\d+\[\d+\]\(\$[a-z]{2}\d+\[\d+\],
return @\$[a-z]{2}\d+\[\d+\]\(\$[a-z]{2}\d+\[\d+\],
# htaccess alternating
[a-z]{1}\([a-z]{1}\(\$[a-z]{2}\.'\/\.htaccess'\)