new patterns

scan.py

@@ -231,6 +231,7 @@ scoring = {
   'PHISHING':                 (10, u'Phishing patterns'),
   'MD5':                      (20, u'md5 strings used in malware'),
   'SOCIALS':                  (50, u'Email addresses, links and social networking'),
+  'EITES':                    (50, u'Eitest'),
 }
 
 
@@ -529,7 +530,8 @@ def is_hacked(filename):
             or 'https://www.colourbox.com/preview/11775720-hacker-boy-icon.jpg' in l \
             or 'https://image.prntscr.com/image/dQ_-z9pTRL6tA2kqbnXH6A.jp' in l:
             score.append(('SOCIALS', ''))
-
+        if "<?php $[a-z].* = '" and "$[a-z].*=explode(chr(([0-9].*[-+][0-9].*))" and "$[a-z].*=([0-9].*[-+][0-9].*)" and "if (!function_exists('[a-z].*'))" in l:
+            score.append(('EITEST', ''))
         previous_line = l
 
     if line_num < 20: