Update 'malware4.pl'

2017-03-25 19:54:52 +01:00
parent d3ec1d2051
commit e0c6955b40
1 changed files with 1 additions and 0 deletions
--- a/malware4.pl
+++ b/malware4.pl
@@ -77,6 +77,7 @@ my @regexen = (
    qr/<\?php\s+\$\{.+?\)\{if\(is\_uploaded\_file\(.+?\)\;\s+\?>/is,
    qr/<\?php\s+eval\(.+?x3B\"\)\;\s+\?>/is,
    qr/<\?php\s+\/\*\*\s+WordPress.+?eval\(gz.+?\$x([A-z0-9]{1,10})\s+\,\"([0-9]{1,5})\"\)\;/is,
+    qr/<\?php\s+\$noc\s+=\s+\".+?\$noc\[([0-9]{1,3})\]\.\$noc\[([0-9]{1,3})\]\.\$noc\[([0-9]{1,3})\]\.\$noc\[([0-9]{1,3})\].+?\$noc\[([0-9]{1,3})\]\.\$([A-z0-9]{1,10})\;\@\$([A-z0-9]{1,10})\(\$([A-z0-9]{1,10})\)\;\?>/is,
    
 );
 my @base64_decodes = (