\x09-\x0d are no-rintable chars, but aren't malicious.

This close #44, thanks to @DrTyrell for spotting this issue ♥

1 files changed, 1 insertions, 1 deletions

diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
index c3e115a..9b7cf2d 100644
--- a/php-malware-finder/php.yar
+++ b/php-malware-finder/php.yar
@@ -41,7 +41,7 @@ rule NonPrintableChars
                 so we have to use atoms (https://gist.github.com/Neo23x0/e3d4e316d7441d9143c7)
                 to get an acceptable speed.
                 */
-                $non_printables = /(function|return|base64_decode).{,256}[^\x20-\x7E]{3}/
+                $non_printables = /(function|return|base64_decode).{,256}[^\x09-\x0d\x20-\x7E]{3}/
 
         condition:
         (any of them) and not IsWhitelisted