diff options
| -rw-r--r-- | php-malware-finder/php.yar | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar index c3e115a..9b7cf2d 100644 --- a/php-malware-finder/php.yar +++ b/php-malware-finder/php.yar | |||
| @@ -41,7 +41,7 @@ rule NonPrintableChars | |||
| 41 | so we have to use atoms (https://gist.github.com/Neo23x0/e3d4e316d7441d9143c7) | 41 | so we have to use atoms (https://gist.github.com/Neo23x0/e3d4e316d7441d9143c7) |
| 42 | to get an acceptable speed. | 42 | to get an acceptable speed. |
| 43 | */ | 43 | */ |
| 44 | $non_printables = /(function|return|base64_decode).{,256}[^\x20-\x7E]{3}/ | 44 | $non_printables = /(function|return|base64_decode).{,256}[^\x09-\x0d\x20-\x7E]{3}/ |
| 45 | 45 | ||
| 46 | condition: | 46 | condition: |
| 47 | (any of them) and not IsWhitelisted | 47 | (any of them) and not IsWhitelisted |