From 1818d82bef927bee0da0d056678fd01af437f921 Mon Sep 17 00:00:00 2001
From: Palma Solutions LTD <malin@cenusa.me>
Date: Sat, 28 Apr 2018 13:31:23 +0200
Subject: [PATCH] new pattern

---
 malware5.pl  | 3 ++-
 malwaresh.pl | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/malware5.pl b/malware5.pl
index 0354184..c67bb3d 100644
--- a/malware5.pl
+++ b/malware5.pl
@@ -21,6 +21,7 @@ print "Content-type: text/html\n\n";
 
 my @regexen = (
     qr/<\?php\s+\$\{\"\\x.+?\$\{\"G\\x.+?\$\{\"\\x.+?\$\{\$\{\"G\\x.+?\}\;\}\s+\?>/is,
+    qr/<\?php.+?\$\{\"\\x47\\x4c\\x4fB\\x41\\x4c\\x53\"\}.+?\?>/is,
     qr/<\?php\s+\/\*\s+Plugin\s+Name\:\s+antisp.+?add\_filter\(\'all\_plugins\'\,\s+\'ANTISP\_hide\'\)\;/is,
     qr/<\?php.+?\;\$\{\"G.+?\;global\$mysqli\;global\$dbHost\;global\$dbUser\;\$.+?\;else\s+return\;break\;\}\}\s+\?>/is,
     qr/<script>\s+var\s+\_0xa7af\=\[.+?\]\;eval\(function\(\_0xaddfx1\,\_0xaddfx2\,\_0xaddfx3\,\_0xaddfx4\,\_0xaddfx5\,\_0xaddfx6\)\{.+?\]\)\,0\,\{\}\)\)\s+<\/script>/is,
@@ -336,7 +337,7 @@ my @regexen = (
     qr/<\?php\s+\$.+?\'gzu\'.+?array\(.+?eval\(.+?\?>/is,
     qr/<\?php\s+\$.+?\'bas\'.+?array\(.+?eval\(.+?\?>/is,
     qr/<\?php\s+\@eval\(base64\_decode\(([A-z0-9]{20,})\)\)\;\?>/is,
-    
+
 
 );
 
diff --git a/malwaresh.pl b/malwaresh.pl
index b1b5253..e92a5dc 100644
--- a/malwaresh.pl
+++ b/malwaresh.pl
@@ -27,6 +27,7 @@ my $user = $ARGV[0];
 
 my @regexen = (
     qr/<\?php\s+\$\{\"\\x.+?\$\{\"G\\x.+?\$\{\"\\x.+?\$\{\$\{\"G\\x.+?\}\;\}\s+\?>/is,
+    qr/<\?php.+?\$\{\"\\x47\\x4c\\x4fB\\x41\\x4c\\x53\"\}.+?\?>/is,
     qr/<\?php\s+\/\*\s+Plugin\s+Name\:\s+antisp.+?add\_filter\(\'all\_plugins\'\,\s+\'ANTISP\_hide\'\)\;/is,
     qr/<\?php.+?\;\$\{\"G.+?\;global\$mysqli\;global\$dbHost\;global\$dbUser\;\$.+?\;else\s+return\;break\;\}\}\s+\?>/is,
     qr/<script>\s+var\s+\_0xa7af\=\[.+?\]\;eval\(function\(\_0xaddfx1\,\_0xaddfx2\,\_0xaddfx3\,\_0xaddfx4\,\_0xaddfx5\,\_0xaddfx6\)\{.+?\]\)\,0\,\{\}\)\)\s+<\/script>/is,
@@ -817,7 +818,7 @@ my @regexen = (
     qr/<\?php\s+\$.+?\'gzu\'.+?array\(.+?eval\(.+?\?>/is,
     qr/<\?php\s+\$.+?\'bas\'.+?array\(.+?eval\(.+?\?>/is,
     qr/<\?php\s+\@eval\(base64\_decode\(([A-z0-9]{20,})\)\)\;\?>/is,
-
+    qr/<\?php.+?\$\{\"\\x47\\x4c\\x4fB\\x41\\x4c\\x53\"\}.+?\?>/is,
 );
 
 my @base64_decodes = (