From 9aa3a51d94d9a804d82841d72e13b23a6170743c Mon Sep 17 00:00:00 2001 From: Palma Solutions LTD Date: Fri, 16 Nov 2018 12:53:31 +0100 Subject: [PATCH] new patterns --- malware6.pl | 33 ++++++++++++++++++++++++++++++++- malwaresh.pl | 18 +++++++++++++++++- 2 files changed, 49 insertions(+), 2 deletions(-) diff --git a/malware6.pl b/malware6.pl index 2221b23..34eb640 100644 --- a/malware6.pl +++ b/malware6.pl @@ -338,7 +338,38 @@ my @regexen = ( qr/<\?php \$([A-z0-9_]{1,20}) = array\(.+?array\(\'b\' ,\'a\' ,\'s\' ,\'e\' ,\'6\' ,\'4\' ,\'_\' ,\'d\' ,\'e\' ,\'c\' ,\'o\' ,\'d\' ,\'e\'\); \$([A-z0-9_]{1,20}) = array\(\'gzu\', \'nco\', \'mpr\', \'ess\'\) ;\$.+?\) \) \) \) ; \?>/is, qr/<\?php \$user_agent_to_filter = array\( \"\#Ask\\s\*Jeeves\#i\", \"\#HP\\s\*Web\\s\*PrintSmart\#i\",.+?\$result = curl_exec\(\$ch\);\s+curl_close \(\$ch\);\s+echo \$result;\}\?>/is, qr/