diff options
| -rw-r--r-- | php-malware-finder/php.yar | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar index fce5ea3..ba1130e 100644 --- a/php-malware-finder/php.yar +++ b/php-malware-finder/php.yar | |||
| @@ -54,7 +54,6 @@ rule ObfuscatedPhp | |||
| 54 | $too_many_chr = /(chr\([\d]+\)\.){8}/ // concatenation of more than eight `chr()` | 54 | $too_many_chr = /(chr\([\d]+\)\.){8}/ // concatenation of more than eight `chr()` |
| 55 | $concat = /(\$[^\n\r]+\.){5}/ // concatenation of more than 5 words | 55 | $concat = /(\$[^\n\r]+\.){5}/ // concatenation of more than 5 words |
| 56 | $var_as_func = /\$_(GET|POST|COOKIE|REQUEST)\s*\[[^\]]+\]\s*\(/ | 56 | $var_as_func = /\$_(GET|POST|COOKIE|REQUEST)\s*\[[^\]]+\]\s*\(/ |
| 57 | $gif = /^GIF89/ | ||
| 58 | condition: | 57 | condition: |
| 59 | any of them and not IsWhitelisted | 58 | any of them and not IsWhitelisted |
| 60 | } | 59 | } |
