Add a rule to detect some obfuscated samples

Thanks to @Doeurf for the sample

1 files changed, 1 insertions, 0 deletions

diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
index ba1130e..cdb91c2 100644
--- a/php-malware-finder/php.yar
+++ b/php-malware-finder/php.yar
@@ -54,6 +54,7 @@ rule ObfuscatedPhp
         $too_many_chr = /(chr\([\d]+\)\.){8}/  // concatenation of more than eight `chr()`
         $concat = /(\$[^\n\r]+\.){5}/  // concatenation of more than 5 words
         $var_as_func = /\$_(GET|POST|COOKIE|REQUEST)\s*\[[^\]]+\]\s*\(/
+        $comment = /\/\*([^*]|\*[^\/])*\*\/\s*\(/  // eval /* comment */ (php_code)
 condition:
         any of them and not IsWhitelisted
 }