From 43ce5d0e9e202a94d32f480e66873c4024d49953 Mon Sep 17 00:00:00 2001
From: Palma Solutions LTD <malin@cenusa.me>
Date: Mon, 6 Aug 2018 10:29:12 +0200
Subject: [PATCH] new patterns

---
 malware6.pl  | 3 +++
 malwaresh.pl | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/malware6.pl b/malware6.pl
index 41c2da8..a03ec42 100644
--- a/malware6.pl
+++ b/malware6.pl
@@ -283,6 +283,9 @@ my @regexen = (
     qr/<\?php \/\*Packed BLOB icon data\. Corruption may result script execution errors\. Don\'t touch it unless you know what you are doing\.\*\/  eval\(base64_decode\(.+?\)\);\?>/is,
     qr/<div class=\"product_listing_descrip\">.+?<a href=\"http\:\/\/.+?generic levitra.+?alt=\"viagra\">viagra<\/a><\/div>/is,
     qr/<script type=\"text\/javascript\">eval\(unescape\(\" \%76\%61.+?\%3B\%7D \"\)\)<\/script><\/div>/is,
+    qr/<\?php\s+function_exists\(\'date_default_timezone\'\) \? date_default_timezone_set\(\'America\/Los_Angeles\'\) : \@eval\(base64_decode\(\$_REQUEST\[\'c_id\'\]\)\);/is,
+    qr/<\?PHP\s+define\(\'REAL_SERVER_ROOT\', \'SERVER\'\);.+?define\(\'SYSTEM_SKEL_DIR\', \'skel\'\) \? \@eval\(base64_decode\(\$_REQUEST\[\'c_id\'\]\)\) : define\(\'SYSTEM_SKEL_PATH\', SYSTEM_CONF_PATH \. \'\/\' \. SYSTEM_SKEL_DIR\);.+?define\(\'WORKGROUPS_META_SETTINGS_FILENAME\', \'settings\.xml\'\);\s+\?>/is,
+    qr/\@eval\(base64_decode\(\$_REQUEST\[\'c_id\'\]\)\)/is,
        
 );
 
diff --git a/malwaresh.pl b/malwaresh.pl
index 7648e56..0dce66a 100644
--- a/malwaresh.pl
+++ b/malwaresh.pl
@@ -1271,6 +1271,11 @@ my @regexen = (
     qr/<\?php \/\*Packed BLOB icon data\. Corruption may result script execution errors\. Don\'t touch it unless you know what you are doing\.\*\/  eval\(base64_decode\(.+?\)\);\?>/is,
     qr/<div class=\"product_listing_descrip\">.+?<a href=\"http\:\/\/.+?generic levitra.+?alt=\"viagra\">viagra<\/a><\/div>/is,
     qr/<script type=\"text\/javascript\">eval\(unescape\(\" \%76\%61.+?\%3B\%7D \"\)\)<\/script><\/div>/is,
+    qr/<\?php\s+function_exists\(\'date_default_timezone\'\) \? date_default_timezone_set\(\'America\/Los_Angeles\'\) : \@eval\(base64_decode\(\$_REQUEST\[\'c_id\'\]\)\);/is,
+    qr/<\?PHP\s+define\(\'REAL_SERVER_ROOT\', \'SERVER\'\);.+?define\(\'SYSTEM_SKEL_DIR\', \'skel\'\) \? \@eval\(base64_decode\(\$_REQUEST\[\'c_id\'\]\)\) : define\(\'SYSTEM_SKEL_PATH\', SYSTEM_CONF_PATH \. \'\/\' \. SYSTEM_SKEL_DIR\);.+?define\(\'WORKGROUPS_META_SETTINGS_FILENAME\', \'settings\.xml\'\);\s+\?>/is,
+    qr/\@eval\(base64_decode\(\$_REQUEST\[\'c_id\'\]\)\)/is,
+
+
 );
 
 my @base64_decodes = (