From 4b5c3a018259afa8f1700e29a08119367385e15b Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Tue, 28 Jul 2015 17:42:17 +0200
Subject: Add `pack` to the list

---
 malwares.yara | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/malwares.yara b/malwares.yara
index 1263b39..b376307 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -100,7 +100,7 @@ rule DodgyPhp
 {
     strings:
         $vars = /\$___+/ // $__ is rarely used in legitimate scripts
-        $execution = /(eval|assert|passthru|exec|system|win_shell_execute) *\((base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|\\?\$_(GET|REQUEST|POST))/
+        $execution = /(eval|assert|passthru|exec|system|win_shell_execute) *\( *(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
         $double_encoding = /(base64_decode\s*\(\s*){2}/
         $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/
         $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
-- 
cgit v1.3