Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new pattern

Browse Source
This commit is contained in:
Palma Solutions LTD
2018-04-28 13:16:22 +02:00
parent 25b34c14c5
commit ae4503c488
2 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
malware5.pl
View File

@@ -335,6 +335,8 @@ my @regexen = (
qr/<\?php\s+\$([A-z0-9]{1,20}).+?strtoupper.+?isset\(.+?eval\(.+?\[\'([A-z0-9]{1,20})\'\].+?\?>/is, qr/<\?php\s+\$([A-z0-9]{1,20}).+?strtoupper.+?isset\(.+?eval\(.+?\[\'([A-z0-9]{1,20})\'\].+?\?>/is,
qr/<\?php\s+\$.+?\'gzu\'.+?array\(.+?eval\(.+?\?>/is, qr/<\?php\s+\$.+?\'gzu\'.+?array\(.+?eval\(.+?\?>/is,
qr/<\?php\s+\$.+?\'bas\'.+?array\(.+?eval\(.+?\?>/is, qr/<\?php\s+\$.+?\'bas\'.+?array\(.+?eval\(.+?\?>/is,
qr/<\?php\s+\@eval\(base64\_decode\(([A-z0-9]{20,})\)\)\;\?>/is,
); );

1
malwaresh.pl
View File

@@ -816,6 +816,7 @@ my @regexen = (
qr/<\?php\s+\$([A-z0-9]{1,20}).+?strtoupper.+?isset\(.+?eval\(.+?\[\'([A-z0-9]{1,20})\'\].+?\?>/is, qr/<\?php\s+\$([A-z0-9]{1,20}).+?strtoupper.+?isset\(.+?eval\(.+?\[\'([A-z0-9]{1,20})\'\].+?\?>/is,
qr/<\?php\s+\$.+?\'gzu\'.+?array\(.+?eval\(.+?\?>/is, qr/<\?php\s+\$.+?\'gzu\'.+?array\(.+?eval\(.+?\?>/is,
qr/<\?php\s+\$.+?\'bas\'.+?array\(.+?eval\(.+?\?>/is, qr/<\?php\s+\$.+?\'bas\'.+?array\(.+?eval\(.+?\?>/is,
qr/<\?php\s+\@eval\(base64\_decode\(([A-z0-9]{20,})\)\)\;\?>/is,
); );