From f5f1969d008e97bb03d90954429347ad7e6ad74a Mon Sep 17 00:00:00 2001 From: Palma Solutions LTD Date: Thu, 10 May 2018 20:31:10 +0200 Subject: [PATCH] new patterns --- malware5.pl | 2 +- malwaresh.pl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/malware5.pl b/malware5.pl index 87dec40..9dd12f4 100644 --- a/malware5.pl +++ b/malware5.pl @@ -499,7 +499,7 @@ my @regexen = ( qr/\/\/\s+([A-z0-9]{20,})\s+echo\s+base64\_decode\(.+?\)\;\s+\/\/([A-z0-9]{20,})/is, qr/<\?php.+?GLOBAL\s+\$wehaveitagain\;.+?\/\/\}\}([A-z0-9]{20,})\s+\?>/is, qr/.+?print\s+\"

\#p\@\$c\@\#<\/h1>\\n\"\;.+?touch\/\*\;\*\/\(\$filename\,\s+\$time\)\;.+?<\/html>/is, - qr/var\s+a\=\"\'([A-z0-9]{1,20})\'.+?clen\;clen\=a\.length\;for\(i\=0\;i/is, + qr/var\s+a\=\"\'([A-z0-9]{1,20})\'.+?clen\;clen\=a\.length\;for\(i\=0\;i/is, ); diff --git a/malwaresh.pl b/malwaresh.pl index 3a3a2b3..2eb92b2 100644 --- a/malwaresh.pl +++ b/malwaresh.pl @@ -982,7 +982,7 @@ my @regexen = ( qr/\/\/\s+([A-z0-9]{20,})\s+echo\s+base64\_decode\(.+?\)\;\s+\/\/([A-z0-9]{20,})/is, qr/<\?php.+?GLOBAL\s+\$wehaveitagain\;.+?\/\/\}\}([A-z0-9]{20,})\s+\?>/is, qr/.+?print\s+\"

\#p\@\$c\@\#<\/h1>\\n\"\;.+?touch\/\*\;\*\/\(\$filename\,\s+\$time\)\;.+?<\/html>/is, - qr/var\s+a\=\"\'([A-z0-9]{1,20})\'.+?clen\;clen\=a\.length\;for\(i\=0\;i/is, + qr/var\s+a\=\"\'([A-z0-9]{1,20})\'.+?clen\;clen\=a\.length\;for\(i\=0\;i/is, );