From e7cf5b145d56b74674c2503127ff86d24ba1948a Mon Sep 17 00:00:00 2001
From: Malin <malin@cenusa.me>
Date: Sun, 25 Sep 2016 09:49:53 +0200
Subject: [PATCH] Update 'malware3.pl'

---
 malware3.pl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/malware3.pl b/malware3.pl
index c98a75a..5666462 100644
--- a/malware3.pl
+++ b/malware3.pl
@@ -23,6 +23,7 @@ my @regexen = (
     qr/<\?php\s+function\s+([A-z0-9]{1,10})\(\$([A-z0-9]{1,10})\,\s+\$([A-z0-9]{1,10})\)\{\$([A-z0-9]{1,10})\s+\=\s+\'\'\;\s+for\(\$([A-z]{1,2})\=0\;\s+\$([A-z]{1,2})\s+\<\s+strlen\(\$([A-z0-9]{1,10})\)\;\s+\$([A-z]{1,2})\+\+\)\{\$([A-z0-9]{1,10})\s+\.\=\s+isset\(\$([A-z0-9]{1,10})\[\$([A-z0-9]{1,10})\[\$([A-z]{1,2})\]\]\)\s+\?\s+\$([A-z0-9]{1,10})\[\$([A-z0-9]{1,10})\[\$([A-z]{1,2})\]\]\s+\:\s+\$([A-z0-9]{1,10})\[\$([A-z]{1,2})\]\;\}\s+\$([A-z0-9]{1,10})\=\"base64\_decode\"\;return\s+\$([A-z0-9]{1,10})\(\$([A-z0-9]{1,10})\)\;\}.+?\$([A-z]{1,2})\s+\=\s+\Array\(.+?eval\(([A-z0-9]{1,10})\(\$([A-z]{1,2})\,\s+\$([A-z]{1,2})\)\)\;\?>/is,
     qr/<\?php\s+\$([A-z0-9]{1,10})\=\'aWYoaXNzZXQoJF9SRVFVRVNUWydjb2NvJ10pICYmICRfUkVRVUVTVFsnY29jbyddIT0nJyl7ZXZhbCgkX1JFUVVFU1RbJ2NvY28nXSk7ZXhpdCgpO30\=\'\;eval\(base64\_decode\(\$([A-z0-9]{1,10})\)\)\;exit\(\)\;\s+\?>/is,
     qr/<script.+?G91825.+?<\/script>/is,
+    qr/<script>var\s+a\=\'\'\;setTimeout.+?getCookie\(\"\_\_cfgoid\"\)\&\&\(setCookie\(\"\_\_cfgoid.+?\)\)\)\;<\/script>/is,
     qr/<\?php.+?\@ini\_set\(\'display\_errors\'\,\'off\'\).+?\@ini\_set\(\'upload\_max\_filesize\'\,\'1000000\'\)\;.+?\$http\_report\s+\=\s+strtolower.+?<\/script><\/noindex><\/nofollow>\'\;\}\s+\?>/is,
     qr/<\?php\s+error\_reporting\(0\)\;ini\_set\(\"display\_errors\"\,\s+0\)\;include\_once\(sys\_get\_temp\_dir\(\)\.\"\/SESS\_([A-z0-9]{1,32})\"\)\;\s+\?>/is,
     qr/<\?php\s+error\_reporting\(0\)\;.+?define\(\'VERSION\'\,\s+1\.0\)\;.+?define\(\'TIMEOUT\'\,\s+30\)\;.+?static\s+function\s+\_\(\$key\)\{\s+return\s+self\:\:\$loca\[\$key\]\[self\:\:\$lang\]\;\s+\}\s+\}/is,