Update 'malware4.pl'

2017-01-15 13:22:45 +01:00
parent d33d1ca1c6
commit 03f0b16780
1 changed files with 1 additions and 0 deletions
--- a/malware4.pl
+++ b/malware4.pl
@@ -40,6 +40,7 @@ my @regexen = (
    qr/\*\/\s+eval\(base64\_decode\(\"aWY.+?\=\"\)\)\;\s+\/\*/is,
    qr/\*\/include\s+\/\*/is,
    qr/\*\/\".+?\.co.+?php\"\;\/\*/is,
+    qr/<\?\s+\$([A-z0-9]{1,3})\[1\]\=\"([A-z0-9]{1,20})\.html\"\;\$([A-z0-9]{1,3})\[1\]\=.+?file\_put\_contents\(\$fileaddr\,gzuncompress\(base64\_decode\(\$([A-z0-9]{1,3})\[\$([A-z0-9]{1,3})\]\)\)\)\;\}\s+unlink\(\$scr\.\"\.php\"\)\;\s+\?>/is,
    
    );
 my @base64_decodes = (