Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

corrected pattern

Browse Source
This commit is contained in:
Palma Solutions LTD
2018-05-10 15:01:32 +02:00
parent c60cbe2bb2
commit 43b3245f4e
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
malware5.pl
View File

@@ -499,7 +499,7 @@ my @regexen = (
qr/\/\/\s+([A-z0-9]{20,})\s+echo\s+base64\_decode\(.+?\)\;\s+\/\/([A-z0-9]{20,})/is,
qr/<\?php.+?GLOBAL\s+\$wehaveitagain\;.+?\/\/\}\}([A-z0-9]{20,})\s+\?>/is,
qr/<html>.+?print\s+\"<h1>\#p\@\$c\@\#<\/h1>\\n\"\;.+?touch\/\*\;\*\/\(\$filename\,\s+\$time\)\;.+?<\/html>/is,
qr/<script\s+type\=\"text\/javascript\">var\s+a\=\"\'([A-z0-9]{20,})\'.+?clen\;clen\=a\.length\;for\(i\=0\;i<clen\;i\+\+\)\{b\+\=String\.fromCharCode\(a\.charCodeAt\(i\)\^2\)\}c\=unescape\(b\)\;document\.write\(c\)\;<\/script>/is,
qr/<script\s+type\=\"text\/javascript\">var\s+a\=\"\'([A-z0-9]{1,20})\'.+?clen\;clen\=a\.length\;for\(i\=0\;i<clen\;i\+\+\)\{b\+\=String\.fromCharCode\(a\.charCodeAt\(i\)\^2\)\}c\=unescape\(b\)\;document\.write\(c\)\;<\/script>/is,
);

4
malwaresh.pl
View File

@@ -982,8 +982,8 @@ my @regexen = (
qr/\/\/\s+([A-z0-9]{20,})\s+echo\s+base64\_decode\(.+?\)\;\s+\/\/([A-z0-9]{20,})/is,
qr/<\?php.+?GLOBAL\s+\$wehaveitagain\;.+?\/\/\}\}([A-z0-9]{20,})\s+\?>/is,
qr/<html>.+?print\s+\"<h1>\#p\@\$c\@\#<\/h1>\\n\"\;.+?touch\/\*\;\*\/\(\$filename\,\s+\$time\)\;.+?<\/html>/is,
qr/<script\s+type\=\"text\/javascript\">var\s+a\=\"\'([A-z0-9]{20,})\'.+?clen\;clen\=a\.length\;for\(i\=0\;i<clen\;i\+\+\)\{b\+\=String\.fromCharCode\(a\.charCodeAt\(i\)\^2\)\}c\=unescape\(b\)\;document\.write\(c\)\;<\/script>/is,
qr/<script\s+type\=\"text\/javascript\">var\s+a\=\"\'([A-z0-9]{1,20})\'.+?clen\;clen\=a\.length\;for\(i\=0\;i<clen\;i\+\+\)\{b\+\=String\.fromCharCode\(a\.charCodeAt\(i\)\^2\)\}c\=unescape\(b\)\;document\.write\(c\)\;<\/script>/is,
);
my @base64_decodes = (