From 477a1ee9253ca1ad031bcd921207a85861bc651b Mon Sep 17 00:00:00 2001
From: Julien (jvoisin) Voisin
Date: Thu, 25 Feb 2016 18:30:06 +0100
Subject: Add a `concat` rule

This aims to catch things like:

```php
<?php
$a = $p800['y6dfe'][9].$p800['y6dfe'][70].$p800['y6dfe'][48];$p800[$p800['y6dfe'][55].$p800['y6dfe'][8].$p800['y6dfe'][30].$p800['y6dfe'][9];
---
 php-malware-finder/malwares.yara | 1 +
 1 file changed, 1 insertion(+)

diff --git a/php-malware-finder/malwares.yara b/php-malware-finder/malwares.yara
index bfc4d7a..64c327b 100644
--- a/php-malware-finder/malwares.yara
+++ b/php-malware-finder/malwares.yara
@@ -64,6 +64,7 @@ rule ObfuscatedPhp
         $c99_launcher = /;\$\w+\(\$\w+(,\s?\$\w+)+\);/  // http://bartblaze.blogspot.fr/2015/03/c99shell-not-dead.html
         $variable_variable = /\${\$[0-9a-zA-z]+}/
         $too_many_chr = /(chr\([\d]+\)\.){2,}?/
+        $concat = /(\$[^\n\r]+\.){5,}?/
 condition:
         any of them and not IsWhitelisted
 }
-- 
cgit v1.3