From 03f0b16780ce563e4d9a9aaf928ba1e3f4e218ef Mon Sep 17 00:00:00 2001
From: Malin <malin@cenusa.me>
Date: Sun, 15 Jan 2017 13:22:45 +0100
Subject: [PATCH] Update 'malware4.pl'

---
 malware4.pl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/malware4.pl b/malware4.pl
index a2bb3fb..da6d5a3 100644
--- a/malware4.pl
+++ b/malware4.pl
@@ -40,6 +40,7 @@ my @regexen = (
     qr/\*\/\s+eval\(base64\_decode\(\"aWY.+?\=\"\)\)\;\s+\/\*/is,
     qr/\*\/include\s+\/\*/is,
     qr/\*\/\".+?\.co.+?php\"\;\/\*/is,
+    qr/<\?\s+\$([A-z0-9]{1,3})\[1\]\=\"([A-z0-9]{1,20})\.html\"\;\$([A-z0-9]{1,3})\[1\]\=.+?file\_put\_contents\(\$fileaddr\,gzuncompress\(base64\_decode\(\$([A-z0-9]{1,3})\[\$([A-z0-9]{1,3})\]\)\)\)\;\}\s+unlink\(\$scr\.\"\.php\"\)\;\s+\?>/is,
     
     );
 my @base64_decodes = (