From 06af8f15e46299a6bea00be8d86abcf290e41be4 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Thu, 9 Jul 2015 14:05:20 +0200
Subject: Add whitelist for wordpress 3.2.1

---
 malwares.yara | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/malwares.yara b/malwares.yara
index fe2c623..206acf0 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -25,7 +25,13 @@ private rule IsWhitelisted
 
         /* Wordpress 3.5.1 */
         hash.sha1(0, filesize)  == "833281b4d1113180e4d1ca026f5e85a680d52662" or // wp-includes/class-phpmailer.php
-        hash.sha1(0, filesize)  == "b4e4b88f2be38ed9c3147b77c2f3a7f929caba2c"  // wp-admin/includes/menu.php
+        hash.sha1(0, filesize)  == "b4e4b88f2be38ed9c3147b77c2f3a7f929caba2c" or // wp-admin/includes/menu.php
+
+        /* Wordpress 3.2.1 */
+        hash.sha1(0, filesize)  == "b4f53b8c360f9e47cc63047305a0ce2e3ff6a251" or // wp-includes/functions.php
+        hash.sha1(0, filesize)  == "ac8298df16a560c80fb213ef3f51f90df8ef5292" or // wp-includes/class-phpmailer.php
+        hash.sha1(0, filesize)  == "232e4705e3aa28269c4d5e4a4a700bb7a2d06f24" // wp-admin/includes/menu.php
+
 }
 
 global private rule IsPhp
-- 
cgit v1.3