From b6cb29fb89e3ab1af1d45bf86a65672c76ecc4e3 Mon Sep 17 00:00:00 2001
From: Malin <malin@cenusa.me>
Date: Sun, 12 Feb 2017 11:04:38 +0100
Subject: [PATCH] Update 'malware4.pl'

---
 malware4.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/malware4.pl b/malware4.pl
index d2579fb..c79ec2c 100644
--- a/malware4.pl
+++ b/malware4.pl
@@ -60,7 +60,7 @@ my @regexen = (
 	qr/<\?php\s+\$ua\s+\=\s+\$\_SERVER\[\'HTTP\_USER\_AGENT\'\]\;\s+if\s+\(preg\_match\(\'\/facebook\/si\'\,\$ua\)\)\s+\{.+?<\/noframes>\s+<\/html>\'\;\s+\}\s+\?>/is, 
     qr/<\?php\s+session\_start\(\)\;.+?\.php\_uname\(\)\..+?<\/form>/is,
 	qr/\'\;if\(\s+\$\_POST\[\'\_upl\'\].+?<\/form>/is,
-
+	qr/<\?php\s+if\(\!empty\(\$\_FILES\[\'message\'\]\[\'name\'\]\).+?<\/body>\s+<\/html>\'\;\/\/([0-9]{1,20})/is,
     
 );
 my @base64_decodes = (