Add some more dodgy functions

1 files changed, 7 insertions, 1 deletions

diff --git a/malwares.yara b/malwares.yara
index 0f4a95f..02d7127 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -108,7 +108,7 @@ rule DodgyPhp
         $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/
         $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir)['"]\)/
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
-        $pr = /preg_replace\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
+        $pr = /(preg_replace(_callback)?|mb_ereg_replace|preg_filter)\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
         $include = /include\([^\.]+\.(png|jpg|gif|bmp)/  // Clever includes
         $htaccess = "SetHandler application/x-httpd-php"
         $udp_dos = /sockopen\s*\(['"]udp:\/\//
@@ -148,6 +148,12 @@ rule DangerousPhp
         $ = "show_source" fullword
         $ = "pcntl_exec" fullword
         $ = "array_filter" fullword
+        $ = "call_user_func" fullword
+        $ = "register_shutdown_function" fullword
+        $ = "register_tick_function" fullword
+        $ = /ob_start\s*\(\s*['"]/  //ob_start('assert'); echo $_REQUEST['pass']; ob_end_flush();
+        $ = "mb_ereg_replace_callback" fullword
+        $ = "preg_replace_callback" fullword
 
         $whitelist = /escapeshellcmd|escapeshellarg/