Update 'malware4.pl'

2017-03-20 10:01:13 +01:00
parent 9a8f5f0ed5
commit d3ec1d2051
1 changed files with 2 additions and 2 deletions
--- a/malware4.pl
+++ b/malware4.pl
@@ -75,8 +75,8 @@ my @regexen = (
    qr/<\?php.+?\$auth_pass.+?\$color.+?\$default_action\s+\=\s+\'FilesMan\'\;.+?\)\;\?>/is,
    qr/<\?php\s+\$\{.+?\,NULL\)\;\@ini\_set\(\"log\_.+?\;return\s+sh\_decrypt\_phase\(sh\_decrypt\_phase\(\$\{\$\{.+?\=>\@phpversion\(\)\,.+?\]\)\;\}exit\(\)\;\}/is,
    qr/<\?php\s+\$\{.+?\)\{if\(is\_uploaded\_file\(.+?\)\;\s+\?>/is,
-    
-    
+    qr/<\?php\s+eval\(.+?x3B\"\)\;\s+\?>/is,
+    qr/<\?php\s+\/\*\*\s+WordPress.+?eval\(gz.+?\$x([A-z0-9]{1,10})\s+\,\"([0-9]{1,5})\"\)\;/is,
    
 );
 my @base64_decodes = (