From 37a094093d2b1fd2522e2b487ec28512aed0b28c Mon Sep 17 00:00:00 2001
From: Palma Solutions LTD <malin@cenusa.me>
Date: Mon, 31 Jul 2017 10:59:58 +0200
Subject: [PATCH] two new patterns

---
 malware4.pl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/malware4.pl b/malware4.pl
index 947e961..a954385 100644
--- a/malware4.pl
+++ b/malware4.pl
@@ -161,8 +161,8 @@ my @regexen = (
     qr/<\?php\s+\@session\_start\(\)\;.+?\/\/PASSWORD\s+CONFIGURATION.+?\=strrev\(\'edoced\_46esab\'\)\;\$s\=gzinflate\(\$.+?\)\;create\_function\(\'\'\,\"\}\$s\/\/\"\)\;\s+\?>/is,
     qr/<\?php\s+\$([A-z0-9]{1,20}).+?implode\(array\_map\(.+?\-1\;\s+\?>/is,
     qr/<\!DOCTYPE\s+HTML\s+PUBLIC.+?Hacked\s+By\s+Dr\.Shap7\-Nine.+?<\/html>/is,
-
-
+    qr/<\?php\s+\/\/([A-z0-9]{1,20})\s+\$\{.+?\}\=\=\=\"\"\|\|strrpos\(\$\{\$.+?\}\;exit\(\)\;\}\}\}\s+\/\/([A-z0-9]{1,20})\s+\?>/is,
+    qr/<\!DOCTYPE.+?<h1>Index\s+of\s+\/<\/h1>.+?<\/html>/is,