Remove a duplicate rule, and make another more generic

1 files changed, 1 insertions, 2 deletions

diff --git a/malwares.yara b/malwares.yara
index 25ba196..d56ce7d 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -105,10 +105,9 @@ rule DodgyPhp
         $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/
         $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir)['"]\)/
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
-        $pr = /preg_replace\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
+        $pr = /preg_replace\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
         $include = /include\([^\.]+\.(png|jpg|gif|bmp)/  // Clever includes
         $htaccess = "SetHandler application/x-httpd-php"
-        $obvious_preg = /['"]\/\.\*\/e["']/ fullword  // "/.*/e" <- this is suspicious
         $udp_dos = /sockopen\s*\(['"]udp:\/\//
 
     condition: