Add a rule to match multiplescomments

1 files changed, 1 insertions, 0 deletions

diff --git a/malwares.yara b/malwares.yara
index 7167708..ee6ea07 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -65,6 +65,7 @@ rule ObfuscatedPhp
         $c99_launcher = /;\$\w+\(\$\w+(,\s?\$\w+)+\);/  // http://bartblaze.blogspot.fr/2015/03/c99shell-not-dead.html
         $strange_arg = /\${\$[0-9a-zA-z]+}/
         $too_many_chr = /(chr\([\d]+\)\.){2,}/
+        $many_comments = /\/\*.{,28}\*\/[^\/]*\/\*/  // Something like as/* */ser/* */t
     condition:
         any of them and not IsWhitelisted
 }