From 2c32f3105415c4e4ef4f17c6f1829b0a6c499d47 Mon Sep 17 00:00:00 2001 From: Palma Solutions LTD Date: Fri, 12 Jan 2018 12:57:55 +0100 Subject: [PATCH] fixed pattern --- malware4.pl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/malware4.pl b/malware4.pl index 0a35933..da95061 100644 --- a/malware4.pl +++ b/malware4.pl @@ -258,8 +258,8 @@ my @regexen = ( qr/<\?php\s+\@error\_reporting\(0\)\;.+?function\s+Send\(\)\{.+?\$replyto\=check\_gmail\(\$replyto\)\;.+?return\s+\$result\.\'\@gmail\.com\'\;\s+\}\s+\?>/is, qr/\"\s+\.\s+base64\_decode\(\"\'\.\$wp\_code\.\'\"\)\)\;\s+\?>\'\;\s+\$wp\_dec\_file\s+\=\s+base64\_decode\(\$wp\_code\)\;.+?\/\/print\s+PLATFORM\;\s+\/\/print\_r\(\$all\_dirs\)\;\s+\?>/is, qr/<\?php\s+class\s+ControllerProductDesign\s+\{.+?\$this\->muf\=\$this\->dispatch\(\'GIF89alxWam9FZlRWYvxGc19VZ29Wb\'\)\;.+?\$model\->\_continue\(\'done\'\)\;\s+\}/is, - qr/<\?php\s+eval\(\"\?>\"\s+\.\s+base64\_decode\(\".+?\"\)\)\;\s+\?>\s+<\?php\s+\/\*a\,b\,c\,d\,e\,f\,g\,h\,i\,j\,ka\,b\,c\,d\,e\,f\,g\,h\,i\,j\,ka\,b\,c\,d\,e\,f\,g\,h\,i\,j\,k\*\/\s+\?>/is, - + qr/<\?php\s+eval\(\"\?>\"\s+\.\s+base64\_decode\(\".+?\"\)\)\;\s+\?>\s+<\?php\s+\/\*a\,b\,c.+?\*\/\s+\?>/is, + );