mirror of
https://github.com/scr34m/php-malware-scanner.git
synced 2026-06-16 12:30:35 +00:00
18 lines
937 B
Plaintext
18 lines
937 B
Plaintext
eval\/\*[a-z0-9]+\*\/
|
|
eval\([a-z0-9]{4,}\(\$[a-z0-9]{4,}, \$[0-9a-z]{4,}\)\);
|
|
(chr\(\d+\)\.){4,}
|
|
(chr\(\d+\^\d+\)\.){4,}
|
|
(\$[a-z0-9]{3,}\[\d+\]\.){4,}
|
|
chr\(\d+\)\.""\.""\.""\.""\.""
|
|
\$GLOBALS\[\$GLOBALS['[a-z0-9]{4,}'\]\[\d+\]\.\$GLOBALS\['[a-z-0-9]{4,}'\]\[\d+\].
|
|
\$GLOBALS\['[a-z0-9]{5,}'\] = \$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.
|
|
eval\([a-z0-9_]+\(base64_decode\(
|
|
\$[a-z]{3,}=\$[a-z]{3,}\("",\$[a-z]{3,}\);\$[a-z]{3,}\(\);
|
|
{\s*eval\s*\(\s*\$
|
|
Googlebot['"]{0,1}\s*\)\){echo\s+file_get_contents
|
|
eVaL\(\s*trim\(\s*baSe64_deCoDe\(
|
|
if\s*\(\s*mail\s*\(\s*\$mails\[\$i\]\s*,\s*\$tema\s*,\s*base64_encode\s*\(\s*\$text
|
|
fwrite\s*\(\s*\$fh\s*,\s*stripslashes\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUEST)\[
|
|
echo\s+file_get_contents\s*\(\s*base64_url_decode\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUEST)
|
|
chr\s*\(\s*101\s*\)\s*\.\s*chr\s*\(\s*118\s*\)\s*\.\s*chr\s*\(\s*97\s*\)\s*\.\s*chr\s*\(\s*108\s*\)
|