From ab8b36d5fa5c143beeead0fb8447e1c9b46cfcd3 Mon Sep 17 00:00:00 2001
From: Palma Solutions LTD <malin@cenusa.me>
Date: Sun, 15 Apr 2018 13:06:10 +0200
Subject: [PATCH] new pattern

---
 malware5.pl | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/malware5.pl b/malware5.pl
index e572c66..d4ea73e 100644
--- a/malware5.pl
+++ b/malware5.pl
@@ -207,6 +207,8 @@ my @regexen = (
     qr/<\?php\s+eval\(\"\\n\\\$([A-z0-9]{1,20})\s+\=\s+intval\(\_\_LINE\_\_\)\s+\*\s+337\;\"\)\;.+?eval\s+\(gzinflate\(base64\_decode\(\$\w\)\)\)\;/is,
     qr/<\?php\s+\$([A-z0-9]{1,20})\=\$\_POST\[\'([A-z0-9]{1,20})\'\]\;if\(\$([A-z0-9]{1,20})\!\=\'\'\)\{\$([A-z0-9]{1,20})\=base64\_decode\(\$\_POST\[\'([A-z0-9]{1,20})\'\]\)\;\@eval\(\"\\\$([A-z0-9]{1,20})\=\$([A-z0-9]{1,20})\;\"\)\;\}/is,
     qr/<\?php\s+if\s+\(isset\(\$\_POST\[.+?\$email\s+\=\s+\@base64\_decode\(.+?\$return\s+jk\_\_\_\(\$url\)\;\s+\}\s+\}\s+\}/is,
+    qr/<\?php\s+\/\*Details.+?\$auth\_pass\s+\=.+?\$\_\_\=s\(base64\_decode\(.+?\$\_\=create\_function\(\"\"\,\@gzuncompress\(\$\_\_\)\)\;\$\_\(\)\;\?>/is,
+    
 
 
 );