External/php-malware-scanner
1
0
Fork 0
mirror of https://github.com/scr34m/php-malware-scanner.git synced 2026-06-16 12:30:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Pattern for XOR-ed content math, reported in #14

Browse Source
This commit is contained in:
Gabor Gyorvari
2018-03-07 20:05:07 +01:00
parent cc605bbb8f
commit 726b9ce78b
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
definitions/patterns_re.txt
View File

@@ -79,6 +79,9 @@ chr\s*\(\s*['"]?\s*((95)|(0[Xx]5[Ff]))\s*['"]?\s*\)
# XOR-ed strings with custom math
%\(\d+\-\d+\+\d+\)==\(\-\d+\+\d+\+\d+\)
# XOR-ed strings with custom math 2.
\(\$[a-zA-Z0-9]+%\d==\(\d+\-\d+\+\d+\)
# eval code from POST on second nested level
eval\(\$[a-z0-9_]+\(\$_POST