diff options
| author | jvoisin | 2015-05-21 11:28:51 +0200 |
|---|---|---|
| committer | jvoisin | 2015-05-21 11:28:51 +0200 |
| commit | ff6e3ef0259f933a7c61c3816035b9ae42d66d42 (patch) | |
| tree | 0bb986c6bf495100d1c359c9e8483601623d85dd | |
| parent | 74552233edc5eddd2f16232121070b63697e77c3 (diff) | |
Speed up a rule
| -rw-r--r-- | malwares.yara | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/malwares.yara b/malwares.yara index 07c72d9..792c0d2 100644 --- a/malwares.yara +++ b/malwares.yara | |||
| @@ -54,7 +54,7 @@ private rule CloudFlareBypass | |||
| 54 | rule ObfuscatedPhp | 54 | rule ObfuscatedPhp |
| 55 | { | 55 | { |
| 56 | strings: | 56 | strings: |
| 57 | $vars = /\$_{2,}/ // $__ is rarely used in legitimate scripts | 57 | $vars = /\$__*/ // $__ is rarely used in legitimate scripts |
| 58 | $eval = /[;}][\t ]*@?(eval|preg_replace|system|exec)\(/ // ;eval( <- this is dodgy | 58 | $eval = /[;}][\t ]*@?(eval|preg_replace|system|exec)\(/ // ;eval( <- this is dodgy |
| 59 | $align = /(\$\w+=[^;]*)*;\$\w+=@?\$\w+\(/ //b374k | 59 | $align = /(\$\w+=[^;]*)*;\$\w+=@?\$\w+\(/ //b374k |
| 60 | $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec)\(/ | 60 | $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec)\(/ |