1 files changed, 3 insertions, 1 deletions

diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
index cd31593..c7af3f2 100644
--- a/php-malware-finder/php.yar
+++ b/php-malware-finder/php.yar
@@ -37,9 +37,11 @@ rule HiddenInAFile
 {
     strings:
         $gif = {47 49 46 38 ?? 61} // GIF8[version]a
+        $png = {89 50 4E 47 0D 0a 1a 0a} // \X89png\X0D\X0A\X1A\X0A
+        $jpeg = {FF D8 FF E0 ?? ?? 4A 46 49 46 } // https://raw.githubusercontent.com/corkami/pics/master/JPG.png
 
     condition:
-        $gif at 0
+        $gif at 0 or $png at 0 or $jpeg at 0
 }
 
 rule PasswordProtection