From d3ec1d2051c7d071216fe89c1a2fa4850a297166 Mon Sep 17 00:00:00 2001
From: Malin <malin@cenusa.me>
Date: Mon, 20 Mar 2017 10:01:13 +0100
Subject: [PATCH] Update 'malware4.pl'

---
 malware4.pl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/malware4.pl b/malware4.pl
index 1dba7d1..95b2bec 100644
--- a/malware4.pl
+++ b/malware4.pl
@@ -75,8 +75,8 @@ my @regexen = (
     qr/<\?php.+?\$auth_pass.+?\$color.+?\$default_action\s+\=\s+\'FilesMan\'\;.+?\)\;\?>/is,
     qr/<\?php\s+\$\{.+?\,NULL\)\;\@ini\_set\(\"log\_.+?\;return\s+sh\_decrypt\_phase\(sh\_decrypt\_phase\(\$\{\$\{.+?\=>\@phpversion\(\)\,.+?\]\)\;\}exit\(\)\;\}/is,
     qr/<\?php\s+\$\{.+?\)\{if\(is\_uploaded\_file\(.+?\)\;\s+\?>/is,
-    
-    
+    qr/<\?php\s+eval\(.+?x3B\"\)\;\s+\?>/is,
+    qr/<\?php\s+\/\*\*\s+WordPress.+?eval\(gz.+?\$x([A-z0-9]{1,10})\s+\,\"([0-9]{1,5})\"\)\;/is,
     
 );
 my @base64_decodes = (