From 03b2490c82692a2a5e6916d3f5a00b9bb39e3125 Mon Sep 17 00:00:00 2001
From: Palma Solutions LTD <malin@cenusa.me>
Date: Sun, 17 Jun 2018 07:58:28 +0200
Subject: [PATCH] new patterns

---
 malware6.pl  | 1 +
 malwaresh.pl | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/malware6.pl b/malware6.pl
index 663402c..8546f7f 100644
--- a/malware6.pl
+++ b/malware6.pl
@@ -219,6 +219,7 @@ my @regexen = (
     qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?\$([A-z0-9_]{1,20})\)\)die;eval\(\$([A-z0-9_]{1,20})\(\/\*([A-z0-9_]{1,20})\'\..+?\(([A-z0-9_]{1,20})\)\';/is,
     qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?if\(!\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\),\$([A-z0-9_]{1,20})\)\)eval\(\$([A-z0-9_]{1,20})\(\$.+?\(([A-z0-9_]{1,20});([A-z0-9_]{1,20}),([A-z0-9_]{1,20})\';/is,
     qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?\)eval\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\);.+?([A-z0-9_]{1,20})\';/is,
+    qr/<\?php \/\* WARNING: This file is protected by copyright law\. To reverse engineer or decode this file is strictly prohibited\. \*\/\s+\$\w=\"([A-z0-9]{20,}).+?\";eval\(base64_decode\(\".+?\"\)\);return;\?>/is,
 
 
 
diff --git a/malwaresh.pl b/malwaresh.pl
index d11cfca..b917e59 100644
--- a/malwaresh.pl
+++ b/malwaresh.pl
@@ -1206,7 +1206,8 @@ my @regexen = (
     qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?\$([A-z0-9_]{1,20})\)\)die;eval\(\$([A-z0-9_]{1,20})\(\/\*([A-z0-9_]{1,20})\'\..+?\(([A-z0-9_]{1,20})\)\';/is,
     qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?if\(!\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\),\$([A-z0-9_]{1,20})\)\)eval\(\$([A-z0-9_]{1,20})\(\$.+?\(([A-z0-9_]{1,20});([A-z0-9_]{1,20}),([A-z0-9_]{1,20})\';/is,
     qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?\)eval\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\);.+?([A-z0-9_]{1,20})\';/is,
-
+    qr/<\?php \/\* WARNING: This file is protected by copyright law\. To reverse engineer or decode this file is strictly prohibited\. \*\/\s+\$\w=\"([A-z0-9]{20,}).+?\";eval\(base64_decode\(\".+?\"\)\);return;\?>/is,
+    
 );
 
 my @base64_decodes = (