From 39d91348fcddd1ac75e63a147f5e3f38f769c64e Mon Sep 17 00:00:00 2001
From: Malin <malin@cenusa.me>
Date: Fri, 10 Feb 2017 21:12:16 +0100
Subject: [PATCH] Update 'malware4.pl'

---
 malware4.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/malware4.pl b/malware4.pl
index 2d5ec89..d2579fb 100644
--- a/malware4.pl
+++ b/malware4.pl
@@ -59,7 +59,7 @@ my @regexen = (
     qr/<\?php\s+\$GLOBALS\[\'\_([0-9]{1,20})\_\'\]\=Array\(base64\_decode\(.+?return\s+base64\_decode\(\$a\[\$i\]\)\;\}.+?\$GLOBALS\[\'\_([0-9]{1,20})\_\'\]\[.+?\s+exit\(\)\;\Z/is,
 	qr/<\?php\s+\$ua\s+\=\s+\$\_SERVER\[\'HTTP\_USER\_AGENT\'\]\;\s+if\s+\(preg\_match\(\'\/facebook\/si\'\,\$ua\)\)\s+\{.+?<\/noframes>\s+<\/html>\'\;\s+\}\s+\?>/is, 
     qr/<\?php\s+session\_start\(\)\;.+?\.php\_uname\(\)\..+?<\/form>/is,
-
+	qr/\'\;if\(\s+\$\_POST\[\'\_upl\'\].+?<\/form>/is,
 
     
 );