From 4b5c3a018259afa8f1700e29a08119367385e15b Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Tue, 28 Jul 2015 17:42:17 +0200
Subject: Add `pack` to the list

---
 malwares.yara | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/malwares.yara b/malwares.yara
index 1263b39..b376307 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -100,7 +100,7 @@ rule DodgyPhp
 {
     strings:
         $vars = /\$___+/ // $__ is rarely used in legitimate scripts
-        $execution = /(eval|assert|passthru|exec|system|win_shell_execute) *\((base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|\\?\$_(GET|REQUEST|POST))/
+        $execution = /(eval|assert|passthru|exec|system|win_shell_execute) *\( *(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
         $double_encoding = /(base64_decode\s*\(\s*){2}/
         $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/
         $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
-- 
cgit v1.3


From d44eb84ad1492f70555c20c49a7f39d8e5b9409f Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Wed, 29 Jul 2015 11:58:22 +0200
Subject: Add some more dodgy functions

---
 malwares.yara | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/malwares.yara b/malwares.yara
index b376307..d2b8362 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -107,7 +107,7 @@ rule DodgyPhp
         $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/
         $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir)['"]\)/
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
-        $pr = /preg_replace\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
+        $pr = /(preg_replace(_callback)?|mb_ereg_replace|preg_filter)\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
         $include = /include\([^\.]+\.(png|jpg|gif|bmp)/  // Clever includes
         $htaccess = "SetHandler application/x-httpd-php"
         $udp_dos = /sockopen\s*\(['"]udp:\/\//
@@ -147,6 +147,12 @@ rule DangerousPhp
         $ = "show_source" fullword
         $ = "pcntl_exec" fullword
         $ = "array_filter" fullword
+        $ = "call_user_func" fullword
+        $ = "register_shutdown_function" fullword
+        $ = "register_tick_function" fullword
+        $ = /ob_start\s*\(\s*['"]/  //ob_start('assert'); echo $_REQUEST['pass']; ob_end_flush();
+        $ = "mb_ereg_replace_callback" fullword
+        $ = "preg_replace_callback" fullword
 
         $whitelist = /escapeshellcmd|escapeshellarg/
 
-- 
cgit v1.3


From bee60884bc2a4738827accdf5e3c89e865b9f453 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Wed, 29 Jul 2015 16:27:30 +0200
Subject: Add some more rules

---
 malwares.yara | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/malwares.yara b/malwares.yara
index d2b8362..c3664f0 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -56,12 +56,11 @@ private rule CloudFlareBypass
 rule ObfuscatedPhp
 {
     strings:
-        $eval = /[;}][\t ]*@?(eval|preg_replace|system|exec)\(/  // ;eval( <- this is dodgy
+        $eval = /[;}][\t ]*@?(eval|preg_replace|system|exec|assert|passthru)\(/  // ;eval( <- this is dodgy
         $align = /(\$\w+=[^;]*)*;\$\w+=@?\$\w+\(/  //b374k
-        $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec)\(/
+        $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec|assert|passthru)\(/
         $weevely3 = /\$\w=\$[a-zA-Z]\('',\$\w\);\$\w\(\);/  // weevely3 launcher
         $c99_launcher = /;\$\w+\(\$\w+(,\s?\$\w+)+\);/  // http://bartblaze.blogspot.fr/2015/03/c99shell-not-dead.html
-        $danone = /\$s20=strtoupper\((\$[0-9A-Za-z]{1,4}\[\d+\]\.){2,9}[^\)]*\);if/
         $strange_arg = /\${\$[0-9a-zA-z]+}/
     condition:
         any of them and not IsWhitelisted
@@ -74,6 +73,7 @@ private rule base64
         $system = "c3lzdGVt"
         $preg_replace = "cHJlZ19yZXBsYWNl"
         $exec = "ZXhlYyg"
+        $base64_decode = "YmFzZTY0X2RlY29kZ"
     condition:
         any of them
 }
@@ -100,8 +100,7 @@ rule DodgyPhp
 {
     strings:
         $vars = /\$___+/ // $__ is rarely used in legitimate scripts
-        $execution = /(eval|assert|passthru|exec|system|win_shell_execute) *\( *(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
-        $double_encoding = /(base64_decode\s*\(\s*){2}/
+        $execution = /(eval|assert|passthru|exec|system|win_shell_execute|base64_decode)\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
         $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/
         $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
         $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/
@@ -150,7 +149,7 @@ rule DangerousPhp
         $ = "call_user_func" fullword
         $ = "register_shutdown_function" fullword
         $ = "register_tick_function" fullword
-        $ = /ob_start\s*\(\s*['"]/  //ob_start('assert'); echo $_REQUEST['pass']; ob_end_flush();
+        $ = /ob_start\s*\(\s*[^\)]/  //ob_start('assert'); echo $_REQUEST['pass']; ob_end_flush();
         $ = "mb_ereg_replace_callback" fullword
         $ = "preg_replace_callback" fullword
 
-- 
cgit v1.3


From 66d9d4db0f092a2abcaa3ffb8e09163928c6a57e Mon Sep 17 00:00:00 2001
From: Julien "shaddai" Reveret
Date: Thu, 8 Oct 2015 17:44:47 +0200
Subject: reorganized git repo

---
 LICENSE                                     | 674 ----------------------------
 Makefile                                    |  18 +
 README.md                                   |  69 ---
 bin/yara                                    | Bin 1109912 -> 0 bytes
 debian/changelog                            |  18 +
 debian/compat                               |   1 +
 debian/control                              |  15 +
 debian/copyright                            |   7 +
 debian/files                                |   1 +
 debian/nbs-phpmalwarefinder.dirs            |   1 +
 debian/nbs-phpmalwarefinder.install         |   2 +
 debian/rules                                |  12 +
 generate_whitelist.py                       |  33 --
 malwares.yara                               | 224 ---------
 package/Makefile                            |  18 -
 package/debian/changelog                    |  18 -
 package/debian/compat                       |   1 -
 package/debian/control                      |  15 -
 package/debian/copyright                    |   7 -
 package/debian/files                        |   1 -
 package/debian/nbs-phpmalwarefinder.dirs    |   1 -
 package/debian/nbs-phpmalwarefinder.install |   2 -
 package/debian/rules                        |  12 -
 php-malware-finder/LICENSE                  | 674 ++++++++++++++++++++++++++++
 php-malware-finder/README.md                |  69 +++
 php-malware-finder/bin/yara                 | Bin 0 -> 1109912 bytes
 php-malware-finder/generate_whitelist.py    |  33 ++
 php-malware-finder/malwares.yara            | 224 +++++++++
 php-malware-finder/phpmalwarefinder         |  70 +++
 php-malware-finder/poc.py                   |  30 ++
 php-malware-finder/whitelist.yara           | 125 ++++++
 phpmalwarefinder                            |  70 ---
 poc.py                                      |  30 --
 whitelist.yara                              | 125 ------
 34 files changed, 1300 insertions(+), 1300 deletions(-)
 delete mode 100644 LICENSE
 create mode 100644 Makefile
 delete mode 100644 README.md
 delete mode 100755 bin/yara
 create mode 100644 debian/changelog
 create mode 100644 debian/compat
 create mode 100644 debian/control
 create mode 100644 debian/copyright
 create mode 100644 debian/files
 create mode 100644 debian/nbs-phpmalwarefinder.dirs
 create mode 100644 debian/nbs-phpmalwarefinder.install
 create mode 100755 debian/rules
 delete mode 100644 generate_whitelist.py
 delete mode 100644 malwares.yara
 delete mode 100644 package/Makefile
 delete mode 100644 package/debian/changelog
 delete mode 100644 package/debian/compat
 delete mode 100644 package/debian/control
 delete mode 100644 package/debian/copyright
 delete mode 100644 package/debian/files
 delete mode 100644 package/debian/nbs-phpmalwarefinder.dirs
 delete mode 100644 package/debian/nbs-phpmalwarefinder.install
 delete mode 100755 package/debian/rules
 create mode 100644 php-malware-finder/LICENSE
 create mode 100644 php-malware-finder/README.md
 create mode 100755 php-malware-finder/bin/yara
 create mode 100644 php-malware-finder/generate_whitelist.py
 create mode 100644 php-malware-finder/malwares.yara
 create mode 100755 php-malware-finder/phpmalwarefinder
 create mode 100644 php-malware-finder/poc.py
 create mode 100644 php-malware-finder/whitelist.yara
 delete mode 100755 phpmalwarefinder
 delete mode 100644 poc.py
 delete mode 100644 whitelist.yara

diff --git a/LICENSE b/LICENSE
deleted file mode 100644
index 94a9ed0..0000000
--- a/LICENSE
+++ /dev/null
@@ -1,674 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..74a305b
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,18 @@
+BUILDDIR=debian/build
+VERSION=1.0
+
+clean:
+	rm -Rf ${BUILDDIR}
+	rm -f debian/*.log
+
+fetch:
+	git clone git@gitlab.nbs-system.com:packages/php-malware-finder.git
+
+extract: fetch
+	mv php-malware-finder ${BUILDDIR}
+
+set_distribution:
+		sed -e "s/##version/`cut -d'.' -f1 < /etc/debian_version`/" -i debian/control debian/changelog
+
+package: clean extract set_distribution
+	debuild -b -us -uc --lintian-opts -X po-debconf
diff --git a/README.md b/README.md
deleted file mode 100644
index 69d4e11..0000000
--- a/README.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# PHP Malware Finder
-
- ```
-  _______  __   __  _______
- |  ___  ||  |_|  ||       |
- | |   | ||       ||    ___|
- | |___| ||       ||   |___   Webshell finder,
- |    ___||       ||    ___|   kiddies hunter,
- |   |    | ||_|| ||   |		website cleaner.
- |___|    |_|   |_||___|
-
-Detect potentially malicious PHP files.
-```
-
-## What does it detect?
-
-PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.
-
-The following list of encoders/obfuscators/webshells are also detected:
-
-* [Best PHP Obfuscator]( http://www.pipsomania.com/best_php_obfuscator.do )
-* [Carbylamine]( https://code.google.com/p/carbylamine/ )
-* [Cipher Design]( http://cipherdesign.co.uk/service/php-obfuscator )
-* [Cyklodev]( http://sysadmin.cyklodev.com/online-php-obfuscator/ )
-* [Joes Web Tools Obfuscator]( http://www.joeswebtools.com/security/php-obfuscator/ )
-* [Php Obfuscator Encode]( http://w3webtools.com/encode-php-online/ )
-* [SpinObf]( http://mohssen.org/SpinObf.php )
-* [Weevely3]( https://github.com/epinna/weevely3 )
-* [atomiku]( http://atomiku.com/online-php-code-obfuscator/ )
-* [cobra obfuscator]( http://obfuscator.uk/example/ )
-* [phpencode]( http://phpencode.org )
-* [webtoolsvn]( http://www.webtoolsvn.com/en-decode/ )
-
-
-## How does it work?
-
-Detection is performed by crawling the filesystem and testing files against a [set]( https://github.com/nbs-system/php-malware-finder/blob/master/malwares.yara )
-of [YARA](https://plusvic.github.io/yara/) rules. Yes, it's that simple!
-
-
-## How to use it?
-
-```
-$ ./phpmalwarefinder -h
-Usage phpmalwarefinder [-cfhw] <file|folder> ...
-	-c  Optional path to a configuration file
-	-f  Fast mode
-	-h  Show this help message
-	-v  Verbose mode
-```
-
-Or if you prefer to use `yara`:
-
-```
-$ yara -r ./malwares.yara /var/www
-```
-
-## Whitelisting
-
-Check the [whitelist.yara]( https://github.com/nbs-system/php-malware-finder/blob/master/whitelist.yara ) file.
-If you're lazy, you can generate whitelists for entire folders with the [generate_whitelist.py]( https://github.com/nbs-system/php-malware-finder/blob/master/generate_whitelist.py ) script.
-
-## Licensing
-
-PHP-malware-finder is [licensed]( https://github.com/nbs-system/php-malware-finder/blob/master/LICENSE ) under the GNU General Public License v3.
-
-The _amazing_ YARA project is licensed under the Apache v2.0 license.
-
-Patches, whitelists or samples are of course more than welcome.
diff --git a/bin/yara b/bin/yara
deleted file mode 100755
index ff48900..0000000
Binary files a/bin/yara and /dev/null differ
diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000..2489d7a
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,18 @@
+nbs-phpmalwarefinder (0.1.1-1~deb##version+nbs20150428) wheezy; urgency=medium
+
+  * new dependecy on util-linux since the script is using ionice
+  * postinst script added to create diff folder
+
+ -- jre <jre@nbs-system.com>  Tue, 28 Apr 2015 15:07:12 +0200
+
+nbs-phpmalwarefinder (0.1.1-1~deb##version+nbs20150414) wheezy; urgency=medium
+
+  * new signature to detect malware in footer and header
+
+ -- jre <jre@nbs-system.com>  Tue, 14 Apr 2015 14:40:05 +0000
+
+nbs-phpmalwarefinder (0.1) UNRELEASED; urgency=medium
+
+  * Initial release.
+
+ -- jvoisin <jvo@nbs-system.com>  Tue, 24 Mar 2015 11:10:36 +0100
diff --git a/debian/compat b/debian/compat
new file mode 100644
index 0000000..7ed6ff8
--- /dev/null
+++ b/debian/compat
@@ -0,0 +1 @@
+5
diff --git a/debian/control b/debian/control
new file mode 100644
index 0000000..de30930
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,15 @@
+Source: nbs-phpmalwarefinder
+Section: utils
+Version: 1:0.1.1-1~deb##version+nbs20150428
+Priority: optional
+Maintainer: Security team <secu@nbs-system.com>
+Build-Depends: debhelper (>= 8)
+Standards-Version: 3.9.5
+Vcs-Git: https://github.com/nbs-system/php-malware-finder
+Vcs-Browser: https://github.com/nbs-system/php-malware-finder
+
+Package: nbs-phpmalwarefinder
+Architecture: any
+Depends: nbs-yara, util-linux
+Description: yara-based php webshell finder
+PhpMalwareFinder is a webshell hunter using yara and signatures.
diff --git a/debian/copyright b/debian/copyright
new file mode 100644
index 0000000..6bec77a
--- /dev/null
+++ b/debian/copyright
@@ -0,0 +1,7 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: phpmalwarefinder
+Source: https://github.com/nbs-system/php-malware-finder
+
+Files: *
+Copyright 2015 Julien (jvoisin) Voisin <jvo@nbs-system.com>
+License: GPLv3
diff --git a/debian/files b/debian/files
new file mode 100644
index 0000000..23f95ef
--- /dev/null
+++ b/debian/files
@@ -0,0 +1 @@
+nbs-phpmalwarefinder_0.1_amd64.deb utils optional
diff --git a/debian/nbs-phpmalwarefinder.dirs b/debian/nbs-phpmalwarefinder.dirs
new file mode 100644
index 0000000..61a8d27
--- /dev/null
+++ b/debian/nbs-phpmalwarefinder.dirs
@@ -0,0 +1 @@
+etc/phpmalwarefinder/
\ No newline at end of file
diff --git a/debian/nbs-phpmalwarefinder.install b/debian/nbs-phpmalwarefinder.install
new file mode 100644
index 0000000..0b9440a
--- /dev/null
+++ b/debian/nbs-phpmalwarefinder.install
@@ -0,0 +1,2 @@
+debian/build/malwares.yara etc/phpmalwarefinder
+debian/build/phpmalwarefinder usr/bin/
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 0000000..bcf500a
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,12 @@
+#!/usr/bin/make -f
+
+BUILDDIR=debian/build
+
+override_dh_auto_clean: #fuck you debian
+
+override_dh_auto_build:
+
+%:
+	dh $@
+
+.PHONY: build
diff --git a/generate_whitelist.py b/generate_whitelist.py
deleted file mode 100644
index 2671fc7..0000000
--- a/generate_whitelist.py
+++ /dev/null
@@ -1,33 +0,0 @@
-import fnmatch
-import hashlib
-import os
-import sys
-
-try:
-    import yara
-except ImportError:
-    print 'Please install python-yara'
-    sys.exit(0)
-
-if len(sys.argv) != 3:
-    print 'Usage: %s name_of_the_rule_and_version folder_to_scan' % sys.argv[0]
-
-rules = yara.compile('./malwares.yara', includes=True, error_on_warning=True)
-
-output_list = list()
-
-for cpt, (root, dirnames, filenames) in enumerate(os.walk(sys.argv[2])):
-    for filename in fnmatch.filter(filenames, '*.ph*'):
-        fname = os.path.join(root, filename)
-        if os.stat(fname).st_size:
-            matches = rules.match(os.path.join(root, filename), fast=True)
-            if matches:
-                matches = matches.pop()  #  only one match, since we're scaning files
-                output_list.append('hash.sha1(0, filename) == %s or // %s' % (hashlib.sha1(fname).hexdigest(), fname))
-
-
-output_rule = 'private rule %s\n{\n\tcondition:\n\t\t/* %s */\n\t\t' % (sys.argv[1].split(' ')[0], sys.argv[1])
-output_list.append(output_list.pop().replace(' or ', '    '))
-output_rule += '\n\t\t'.join(output_list)
-output_rule +='\n}'
-print output_rule
diff --git a/malwares.yara b/malwares.yara
deleted file mode 100644
index c3664f0..0000000
--- a/malwares.yara
+++ /dev/null
@@ -1,224 +0,0 @@
-import "hash"
-include "whitelist.yara"
-
-/*
-    Detect:
-        - phpencode.org
-        - http://www.pipsomania.com/best_php_obfuscator.do
-        - http://atomiku.com/online-php-code-obfuscator/
-        - http://www.webtoolsvn.com/en-decode/
-        - http://obfuscator.uk/example/
-        - http://w3webtools.com/encode-php-online/
-        - http://www.joeswebtools.com/security/php-obfuscator/
-        - https://github.com/epinna/weevely3
-        - http://cipherdesign.co.uk/service/php-obfuscator
-        - http://sysadmin.cyklodev.com/online-php-obfuscator/
-        - http://mohssen.org/SpinObf.php
-        - https://code.google.com/p/carbylamine/
-*/
-
-global private rule IsPhp
-{
-    strings:
-        $php = /<\?[^x]/
-
-    condition:
-        $php and filesize < 5MB
-}
-
-private rule IRC
-{
-    strings:
-        $ = "USER" fullword
-        $ = "PASS" fullword
-        $ = "PRIVMSG" fullword
-        $ = "MODE" fullword
-        $ = "PING" fullword
-        $ = "PONG" fullword
-        $ = "JOIN" fullword
-        $ = "PART" fullword
-
-    condition:
-        5 of them
-}
-
-private rule CloudFlareBypass
-{
-    strings:
-        $ = "chk_jschl"
-        $ = "jschl_vc"
-        $ = "jschl_answer"
-
-    condition:
-        2 of them // Better be safe than sorry
-}
-
-rule ObfuscatedPhp
-{
-    strings:
-        $eval = /[;}][\t ]*@?(eval|preg_replace|system|exec|assert|passthru)\(/  // ;eval( <- this is dodgy
-        $align = /(\$\w+=[^;]*)*;\$\w+=@?\$\w+\(/  //b374k
-        $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec|assert|passthru)\(/
-        $weevely3 = /\$\w=\$[a-zA-Z]\('',\$\w\);\$\w\(\);/  // weevely3 launcher
-        $c99_launcher = /;\$\w+\(\$\w+(,\s?\$\w+)+\);/  // http://bartblaze.blogspot.fr/2015/03/c99shell-not-dead.html
-        $strange_arg = /\${\$[0-9a-zA-z]+}/
-    condition:
-        any of them and not IsWhitelisted
-}
-
-private rule base64
-{
-    strings:
-        $eval = "ZXZhbCg"
-        $system = "c3lzdGVt"
-        $preg_replace = "cHJlZ19yZXBsYWNl"
-        $exec = "ZXhlYyg"
-        $base64_decode = "YmFzZTY0X2RlY29kZ"
-    condition:
-        any of them
-}
-
-private rule hex
-{
-    strings:
-      $eval = "\\x65\\x76\\x61\\x6C\\x28" nocase
-      $exec = "\\x65\\x78\\x65\\x63" nocase
-      $system = "\\x73\\x79\\x73\\x74\\x65\\x6d" nocase
-      $preg_replace = "\\x70\\x72\\x65\\x67\\x5f\\x72\\x65\\x70\\x6c\\x61\\x63\\x65" nocase
-    
-    condition:
-        any of them
-}
-
-rule SuspiciousEncoding
-{
-    condition:
-        base64 or hex
-}
-
-rule DodgyPhp
-{
-    strings:
-        $vars = /\$___+/ // $__ is rarely used in legitimate scripts
-        $execution = /(eval|assert|passthru|exec|system|win_shell_execute|base64_decode)\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
-        $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/
-        $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
-        $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/
-        $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir)['"]\)/
-        $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
-        $pr = /(preg_replace(_callback)?|mb_ereg_replace|preg_filter)\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
-        $include = /include\([^\.]+\.(png|jpg|gif|bmp)/  // Clever includes
-        $htaccess = "SetHandler application/x-httpd-php"
-        $udp_dos = /sockopen\s*\(['"]udp:\/\//
-
-    condition:
-        (any of them or CloudFlareBypass) and not IsWhitelisted
-}
-
-rule DangerousPhp
-{
-    strings:
-        $system = "system" fullword  // localroot bruteforcers have a lot of this
-
-        $ = "exec" fullword
-        $ = "eval" fullword
-        $ = "shell_exec" fullword
-        $ = "passthru" fullword
-        $ = "posix_getuid" fullword
-        $ = "posix_geteuid" fullword
-        $ = "posix_getgid" fullword
-        $ = "phpinfo" fullword
-        $ = "backticks" fullword
-        $ = "proc_open" fullword
-        $ = "win_shell_execute" fullword
-        $ = "win32_create_service" fullword
-        $ = "posix_getpwuid" fullword
-        $ = "shm_open" fullword
-        $ = "assert" fullword
-        $ = "fsockopen" fullword
-        $ = "function_exists" fullword
-        $ = "getmygid" fullword
-        $ = "php_uname" fullword
-        $ = "socket_create(AF_INET, SOCK_STREAM, SOL_TCP)"
-        $ = "fpassthru" fullword
-        $ = "posix_setuid" fullword
-        $ = "xmlrpc_decode" fullword
-        $ = "show_source" fullword
-        $ = "pcntl_exec" fullword
-        $ = "array_filter" fullword
-        $ = "call_user_func" fullword
-        $ = "register_shutdown_function" fullword
-        $ = "register_tick_function" fullword
-        $ = /ob_start\s*\(\s*[^\)]/  //ob_start('assert'); echo $_REQUEST['pass']; ob_end_flush();
-        $ = "mb_ereg_replace_callback" fullword
-        $ = "preg_replace_callback" fullword
-
-        $whitelist = /escapeshellcmd|escapeshellarg/
-
-    condition:
-        not $whitelist and (5 of them or #system > 250) and not IsWhitelisted
-}
-
-rule DodgyStrings
-{
-    strings:
-        $ = "/etc/passwd"
-        $ = "/etc/shadow"
-        $ = "/etc/resolv.conf"
-        $ = "/etc/syslog.conf"
-        $ = "/etc/proftpd.conf"
-        $ = "WinExec"
-        $ = "uname -a" fullword
-        $ = "nc -l" fullword
-        $ = "ls -la" fullword
-        $ = "cmd.exe" fullword nocase
-        $ = "ipconfig" fullword nocase
-        $ = "find . -type f" fullword
-        $ = "defaced" fullword nocase
-        $ = "slowloris" fullword nocase
-        $ = "id_rsa" fullword
-        $ = "backdoor" fullword nocase
-        $ = "webshell" fullword nocase
-        $ = "exploit" fullword nocase
-        $ = "hacking" fullword nocase
-        $ = "/proc/cpuinfo" fullword
-        $ = "/bin/sh" fullword
-        $ = "/bin/bash" fullword
-        $ = "ps -aux" fullword
-        $ = "b374k" fullword
-        $ = /(reverse|web)\s*shell/ nocase
-
-        $vbs = /language\s*=\s*vbscript/ nocase
-        $asp = "scripting.filesystemobject" nocase
-
-    condition:
-        IRC or 2 of them and not IsWhitelisted
-}
-
-rule Websites
-{
-    strings:
-        $ = "milw0rm.com"
-        $ = "exploit-db.com"
-        $ = "1337day.com"
-        $ = "rapid7.com"
-        $ = "shodan.io"
-        $ = "packetstormsecurity"
-        $ = "crackfor" nocase
-        $ = "md5.rednoize"
-        $ = "hashcracking" nocase
-        $ = "darkc0de" nocase
-        $ = "securityfocus" nocase
-        $ = "antichat.ru"
-        $ = "KingDefacer" nocase
-        $ = "md5crack.com"
-        $ = "md5decrypter.com"
-        $ = "hashkiller.com"
-        $ = "hashchecker.com"
-        $ = "www.fopo.com.ar"  /* Free Online Php Obfuscator */
-        $ = "ccteam.ru"
-        $ = "locus7s.com"
-
-    condition:
-        any of them and not IsWhitelisted
-}
diff --git a/package/Makefile b/package/Makefile
deleted file mode 100644
index 74a305b..0000000
--- a/package/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-BUILDDIR=debian/build
-VERSION=1.0
-
-clean:
-	rm -Rf ${BUILDDIR}
-	rm -f debian/*.log
-
-fetch:
-	git clone git@gitlab.nbs-system.com:packages/php-malware-finder.git
-
-extract: fetch
-	mv php-malware-finder ${BUILDDIR}
-
-set_distribution:
-		sed -e "s/##version/`cut -d'.' -f1 < /etc/debian_version`/" -i debian/control debian/changelog
-
-package: clean extract set_distribution
-	debuild -b -us -uc --lintian-opts -X po-debconf
diff --git a/package/debian/changelog b/package/debian/changelog
deleted file mode 100644
index 2489d7a..0000000
--- a/package/debian/changelog
+++ /dev/null
@@ -1,18 +0,0 @@
-nbs-phpmalwarefinder (0.1.1-1~deb##version+nbs20150428) wheezy; urgency=medium
-
-  * new dependecy on util-linux since the script is using ionice
-  * postinst script added to create diff folder
-
- -- jre <jre@nbs-system.com>  Tue, 28 Apr 2015 15:07:12 +0200
-
-nbs-phpmalwarefinder (0.1.1-1~deb##version+nbs20150414) wheezy; urgency=medium
-
-  * new signature to detect malware in footer and header
-
- -- jre <jre@nbs-system.com>  Tue, 14 Apr 2015 14:40:05 +0000
-
-nbs-phpmalwarefinder (0.1) UNRELEASED; urgency=medium
-
-  * Initial release.
-
- -- jvoisin <jvo@nbs-system.com>  Tue, 24 Mar 2015 11:10:36 +0100
diff --git a/package/debian/compat b/package/debian/compat
deleted file mode 100644
index 7ed6ff8..0000000
--- a/package/debian/compat
+++ /dev/null
@@ -1 +0,0 @@
-5
diff --git a/package/debian/control b/package/debian/control
deleted file mode 100644
index de30930..0000000
--- a/package/debian/control
+++ /dev/null
@@ -1,15 +0,0 @@
-Source: nbs-phpmalwarefinder
-Section: utils
-Version: 1:0.1.1-1~deb##version+nbs20150428
-Priority: optional
-Maintainer: Security team <secu@nbs-system.com>
-Build-Depends: debhelper (>= 8)
-Standards-Version: 3.9.5
-Vcs-Git: https://github.com/nbs-system/php-malware-finder
-Vcs-Browser: https://github.com/nbs-system/php-malware-finder
-
-Package: nbs-phpmalwarefinder
-Architecture: any
-Depends: nbs-yara, util-linux
-Description: yara-based php webshell finder
-PhpMalwareFinder is a webshell hunter using yara and signatures.
diff --git a/package/debian/copyright b/package/debian/copyright
deleted file mode 100644
index 6bec77a..0000000
--- a/package/debian/copyright
+++ /dev/null
@@ -1,7 +0,0 @@
-Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: phpmalwarefinder
-Source: https://github.com/nbs-system/php-malware-finder
-
-Files: *
-Copyright 2015 Julien (jvoisin) Voisin <jvo@nbs-system.com>
-License: GPLv3
diff --git a/package/debian/files b/package/debian/files
deleted file mode 100644
index 23f95ef..0000000
--- a/package/debian/files
+++ /dev/null
@@ -1 +0,0 @@
-nbs-phpmalwarefinder_0.1_amd64.deb utils optional
diff --git a/package/debian/nbs-phpmalwarefinder.dirs b/package/debian/nbs-phpmalwarefinder.dirs
deleted file mode 100644
index 61a8d27..0000000
--- a/package/debian/nbs-phpmalwarefinder.dirs
+++ /dev/null
@@ -1 +0,0 @@
-etc/phpmalwarefinder/
\ No newline at end of file
diff --git a/package/debian/nbs-phpmalwarefinder.install b/package/debian/nbs-phpmalwarefinder.install
deleted file mode 100644
index 0b9440a..0000000
--- a/package/debian/nbs-phpmalwarefinder.install
+++ /dev/null
@@ -1,2 +0,0 @@
-debian/build/malwares.yara etc/phpmalwarefinder
-debian/build/phpmalwarefinder usr/bin/
diff --git a/package/debian/rules b/package/debian/rules
deleted file mode 100755
index bcf500a..0000000
--- a/package/debian/rules
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/make -f
-
-BUILDDIR=debian/build
-
-override_dh_auto_clean: #fuck you debian
-
-override_dh_auto_build:
-
-%:
-	dh $@
-
-.PHONY: build
diff --git a/php-malware-finder/LICENSE b/php-malware-finder/LICENSE
new file mode 100644
index 0000000..94a9ed0
--- /dev/null
+++ b/php-malware-finder/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/php-malware-finder/README.md b/php-malware-finder/README.md
new file mode 100644
index 0000000..69d4e11
--- /dev/null
+++ b/php-malware-finder/README.md
@@ -0,0 +1,69 @@
+# PHP Malware Finder
+
+ ```
+  _______  __   __  _______
+ |  ___  ||  |_|  ||       |
+ | |   | ||       ||    ___|
+ | |___| ||       ||   |___   Webshell finder,
+ |    ___||       ||    ___|   kiddies hunter,
+ |   |    | ||_|| ||   |		website cleaner.
+ |___|    |_|   |_||___|
+
+Detect potentially malicious PHP files.
+```
+
+## What does it detect?
+
+PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.
+
+The following list of encoders/obfuscators/webshells are also detected:
+
+* [Best PHP Obfuscator]( http://www.pipsomania.com/best_php_obfuscator.do )
+* [Carbylamine]( https://code.google.com/p/carbylamine/ )
+* [Cipher Design]( http://cipherdesign.co.uk/service/php-obfuscator )
+* [Cyklodev]( http://sysadmin.cyklodev.com/online-php-obfuscator/ )
+* [Joes Web Tools Obfuscator]( http://www.joeswebtools.com/security/php-obfuscator/ )
+* [Php Obfuscator Encode]( http://w3webtools.com/encode-php-online/ )
+* [SpinObf]( http://mohssen.org/SpinObf.php )
+* [Weevely3]( https://github.com/epinna/weevely3 )
+* [atomiku]( http://atomiku.com/online-php-code-obfuscator/ )
+* [cobra obfuscator]( http://obfuscator.uk/example/ )
+* [phpencode]( http://phpencode.org )
+* [webtoolsvn]( http://www.webtoolsvn.com/en-decode/ )
+
+
+## How does it work?
+
+Detection is performed by crawling the filesystem and testing files against a [set]( https://github.com/nbs-system/php-malware-finder/blob/master/malwares.yara )
+of [YARA](https://plusvic.github.io/yara/) rules. Yes, it's that simple!
+
+
+## How to use it?
+
+```
+$ ./phpmalwarefinder -h
+Usage phpmalwarefinder [-cfhw] <file|folder> ...
+	-c  Optional path to a configuration file
+	-f  Fast mode
+	-h  Show this help message
+	-v  Verbose mode
+```
+
+Or if you prefer to use `yara`:
+
+```
+$ yara -r ./malwares.yara /var/www
+```
+
+## Whitelisting
+
+Check the [whitelist.yara]( https://github.com/nbs-system/php-malware-finder/blob/master/whitelist.yara ) file.
+If you're lazy, you can generate whitelists for entire folders with the [generate_whitelist.py]( https://github.com/nbs-system/php-malware-finder/blob/master/generate_whitelist.py ) script.
+
+## Licensing
+
+PHP-malware-finder is [licensed]( https://github.com/nbs-system/php-malware-finder/blob/master/LICENSE ) under the GNU General Public License v3.
+
+The _amazing_ YARA project is licensed under the Apache v2.0 license.
+
+Patches, whitelists or samples are of course more than welcome.
diff --git a/php-malware-finder/bin/yara b/php-malware-finder/bin/yara
new file mode 100755
index 0000000..ff48900
Binary files /dev/null and b/php-malware-finder/bin/yara differ
diff --git a/php-malware-finder/generate_whitelist.py b/php-malware-finder/generate_whitelist.py
new file mode 100644
index 0000000..2671fc7
--- /dev/null
+++ b/php-malware-finder/generate_whitelist.py
@@ -0,0 +1,33 @@
+import fnmatch
+import hashlib
+import os
+import sys
+
+try:
+    import yara
+except ImportError:
+    print 'Please install python-yara'
+    sys.exit(0)
+
+if len(sys.argv) != 3:
+    print 'Usage: %s name_of_the_rule_and_version folder_to_scan' % sys.argv[0]
+
+rules = yara.compile('./malwares.yara', includes=True, error_on_warning=True)
+
+output_list = list()
+
+for cpt, (root, dirnames, filenames) in enumerate(os.walk(sys.argv[2])):
+    for filename in fnmatch.filter(filenames, '*.ph*'):
+        fname = os.path.join(root, filename)
+        if os.stat(fname).st_size:
+            matches = rules.match(os.path.join(root, filename), fast=True)
+            if matches:
+                matches = matches.pop()  #  only one match, since we're scaning files
+                output_list.append('hash.sha1(0, filename) == %s or // %s' % (hashlib.sha1(fname).hexdigest(), fname))
+
+
+output_rule = 'private rule %s\n{\n\tcondition:\n\t\t/* %s */\n\t\t' % (sys.argv[1].split(' ')[0], sys.argv[1])
+output_list.append(output_list.pop().replace(' or ', '    '))
+output_rule += '\n\t\t'.join(output_list)
+output_rule +='\n}'
+print output_rule
diff --git a/php-malware-finder/malwares.yara b/php-malware-finder/malwares.yara
new file mode 100644
index 0000000..c3664f0
--- /dev/null
+++ b/php-malware-finder/malwares.yara
@@ -0,0 +1,224 @@
+import "hash"
+include "whitelist.yara"
+
+/*
+    Detect:
+        - phpencode.org
+        - http://www.pipsomania.com/best_php_obfuscator.do
+        - http://atomiku.com/online-php-code-obfuscator/
+        - http://www.webtoolsvn.com/en-decode/
+        - http://obfuscator.uk/example/
+        - http://w3webtools.com/encode-php-online/
+        - http://www.joeswebtools.com/security/php-obfuscator/
+        - https://github.com/epinna/weevely3
+        - http://cipherdesign.co.uk/service/php-obfuscator
+        - http://sysadmin.cyklodev.com/online-php-obfuscator/
+        - http://mohssen.org/SpinObf.php
+        - https://code.google.com/p/carbylamine/
+*/
+
+global private rule IsPhp
+{
+    strings:
+        $php = /<\?[^x]/
+
+    condition:
+        $php and filesize < 5MB
+}
+
+private rule IRC
+{
+    strings:
+        $ = "USER" fullword
+        $ = "PASS" fullword
+        $ = "PRIVMSG" fullword
+        $ = "MODE" fullword
+        $ = "PING" fullword
+        $ = "PONG" fullword
+        $ = "JOIN" fullword
+        $ = "PART" fullword
+
+    condition:
+        5 of them
+}
+
+private rule CloudFlareBypass
+{
+    strings:
+        $ = "chk_jschl"
+        $ = "jschl_vc"
+        $ = "jschl_answer"
+
+    condition:
+        2 of them // Better be safe than sorry
+}
+
+rule ObfuscatedPhp
+{
+    strings:
+        $eval = /[;}][\t ]*@?(eval|preg_replace|system|exec|assert|passthru)\(/  // ;eval( <- this is dodgy
+        $align = /(\$\w+=[^;]*)*;\$\w+=@?\$\w+\(/  //b374k
+        $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec|assert|passthru)\(/
+        $weevely3 = /\$\w=\$[a-zA-Z]\('',\$\w\);\$\w\(\);/  // weevely3 launcher
+        $c99_launcher = /;\$\w+\(\$\w+(,\s?\$\w+)+\);/  // http://bartblaze.blogspot.fr/2015/03/c99shell-not-dead.html
+        $strange_arg = /\${\$[0-9a-zA-z]+}/
+    condition:
+        any of them and not IsWhitelisted
+}
+
+private rule base64
+{
+    strings:
+        $eval = "ZXZhbCg"
+        $system = "c3lzdGVt"
+        $preg_replace = "cHJlZ19yZXBsYWNl"
+        $exec = "ZXhlYyg"
+        $base64_decode = "YmFzZTY0X2RlY29kZ"
+    condition:
+        any of them
+}
+
+private rule hex
+{
+    strings:
+      $eval = "\\x65\\x76\\x61\\x6C\\x28" nocase
+      $exec = "\\x65\\x78\\x65\\x63" nocase
+      $system = "\\x73\\x79\\x73\\x74\\x65\\x6d" nocase
+      $preg_replace = "\\x70\\x72\\x65\\x67\\x5f\\x72\\x65\\x70\\x6c\\x61\\x63\\x65" nocase
+    
+    condition:
+        any of them
+}
+
+rule SuspiciousEncoding
+{
+    condition:
+        base64 or hex
+}
+
+rule DodgyPhp
+{
+    strings:
+        $vars = /\$___+/ // $__ is rarely used in legitimate scripts
+        $execution = /(eval|assert|passthru|exec|system|win_shell_execute|base64_decode)\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
+        $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/
+        $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
+        $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/
+        $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir)['"]\)/
+        $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
+        $pr = /(preg_replace(_callback)?|mb_ereg_replace|preg_filter)\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
+        $include = /include\([^\.]+\.(png|jpg|gif|bmp)/  // Clever includes
+        $htaccess = "SetHandler application/x-httpd-php"
+        $udp_dos = /sockopen\s*\(['"]udp:\/\//
+
+    condition:
+        (any of them or CloudFlareBypass) and not IsWhitelisted
+}
+
+rule DangerousPhp
+{
+    strings:
+        $system = "system" fullword  // localroot bruteforcers have a lot of this
+
+        $ = "exec" fullword
+        $ = "eval" fullword
+        $ = "shell_exec" fullword
+        $ = "passthru" fullword
+        $ = "posix_getuid" fullword
+        $ = "posix_geteuid" fullword
+        $ = "posix_getgid" fullword
+        $ = "phpinfo" fullword
+        $ = "backticks" fullword
+        $ = "proc_open" fullword
+        $ = "win_shell_execute" fullword
+        $ = "win32_create_service" fullword
+        $ = "posix_getpwuid" fullword
+        $ = "shm_open" fullword
+        $ = "assert" fullword
+        $ = "fsockopen" fullword
+        $ = "function_exists" fullword
+        $ = "getmygid" fullword
+        $ = "php_uname" fullword
+        $ = "socket_create(AF_INET, SOCK_STREAM, SOL_TCP)"
+        $ = "fpassthru" fullword
+        $ = "posix_setuid" fullword
+        $ = "xmlrpc_decode" fullword
+        $ = "show_source" fullword
+        $ = "pcntl_exec" fullword
+        $ = "array_filter" fullword
+        $ = "call_user_func" fullword
+        $ = "register_shutdown_function" fullword
+        $ = "register_tick_function" fullword
+        $ = /ob_start\s*\(\s*[^\)]/  //ob_start('assert'); echo $_REQUEST['pass']; ob_end_flush();
+        $ = "mb_ereg_replace_callback" fullword
+        $ = "preg_replace_callback" fullword
+
+        $whitelist = /escapeshellcmd|escapeshellarg/
+
+    condition:
+        not $whitelist and (5 of them or #system > 250) and not IsWhitelisted
+}
+
+rule DodgyStrings
+{
+    strings:
+        $ = "/etc/passwd"
+        $ = "/etc/shadow"
+        $ = "/etc/resolv.conf"
+        $ = "/etc/syslog.conf"
+        $ = "/etc/proftpd.conf"
+        $ = "WinExec"
+        $ = "uname -a" fullword
+        $ = "nc -l" fullword
+        $ = "ls -la" fullword
+        $ = "cmd.exe" fullword nocase
+        $ = "ipconfig" fullword nocase
+        $ = "find . -type f" fullword
+        $ = "defaced" fullword nocase
+        $ = "slowloris" fullword nocase
+        $ = "id_rsa" fullword
+        $ = "backdoor" fullword nocase
+        $ = "webshell" fullword nocase
+        $ = "exploit" fullword nocase
+        $ = "hacking" fullword nocase
+        $ = "/proc/cpuinfo" fullword
+        $ = "/bin/sh" fullword
+        $ = "/bin/bash" fullword
+        $ = "ps -aux" fullword
+        $ = "b374k" fullword
+        $ = /(reverse|web)\s*shell/ nocase
+
+        $vbs = /language\s*=\s*vbscript/ nocase
+        $asp = "scripting.filesystemobject" nocase
+
+    condition:
+        IRC or 2 of them and not IsWhitelisted
+}
+
+rule Websites
+{
+    strings:
+        $ = "milw0rm.com"
+        $ = "exploit-db.com"
+        $ = "1337day.com"
+        $ = "rapid7.com"
+        $ = "shodan.io"
+        $ = "packetstormsecurity"
+        $ = "crackfor" nocase
+        $ = "md5.rednoize"
+        $ = "hashcracking" nocase
+        $ = "darkc0de" nocase
+        $ = "securityfocus" nocase
+        $ = "antichat.ru"
+        $ = "KingDefacer" nocase
+        $ = "md5crack.com"
+        $ = "md5decrypter.com"
+        $ = "hashkiller.com"
+        $ = "hashchecker.com"
+        $ = "www.fopo.com.ar"  /* Free Online Php Obfuscator */
+        $ = "ccteam.ru"
+        $ = "locus7s.com"
+
+    condition:
+        any of them and not IsWhitelisted
+}
diff --git a/php-malware-finder/phpmalwarefinder b/php-malware-finder/phpmalwarefinder
new file mode 100755
index 0000000..0a85d85
--- /dev/null
+++ b/php-malware-finder/phpmalwarefinder
@@ -0,0 +1,70 @@
+#!/bin/bash
+
+YARA=$(which yara)
+CONFIG_PATH='/etc/phpmalwarefinder/malwares.yara'
+
+if [ ! -f "$YARA" ]
+then
+	YARA='./yara'
+fi
+
+if [ ! -f "$CONFIG_PATH" ]
+then
+	CONFIG_PATH='./malwares.yara'
+fi
+
+show_help() {
+    cat << EOF
+Usage ${0##*/} [-cfhw] <file|folder> ...
+    -c  Optional path to a configuration file
+    -f  Fast mode
+    -h  Show this help message
+    -v  Verbose mode
+EOF
+}
+
+OPTIND=1
+while getopts "c:fhv" opt; do
+    case "$opt" in
+        h)
+            show_help
+            exit 0
+            ;;
+        f)
+            OPTS="${OPTS} -f"
+            ;;
+        c)
+            CONFIG_PATH=${OPTARG}
+            ;;
+        v)
+            OPTS="${OPTS} -s"
+            ;;
+        '?')
+            show_help
+            exit 1
+            ;;
+    esac
+done
+shift "$((OPTIND-1))"
+
+if [ ! -e ${YARA} ]
+then
+    echo "Can't find yara. Did you installed it?"
+    exit 1
+fi
+
+if [ ! -e ${CONFIG_PATH} ]
+then
+    echo "${CONFIG_PATH} doesn't exist. Please give me a valid file."
+    exit 1
+fi
+
+if [ -z $@ ]
+then
+	show_help
+	exit 1
+fi
+
+OPTS="${OPTS} -r ${CONFIG_PATH}"
+
+ionice -c3 $YARA $OPTS $@
diff --git a/php-malware-finder/poc.py b/php-malware-finder/poc.py
new file mode 100644
index 0000000..8fddc5a
--- /dev/null
+++ b/php-malware-finder/poc.py
@@ -0,0 +1,30 @@
+import fnmatch
+import glob
+import os
+import sys
+import time
+
+try:
+    import yara
+except ImportError:
+    print 'Please install python-yara'
+    sys.exit(0)
+
+if len(sys.argv) != 2:
+    print 'Usage: %s folder_to_scan' % sys.argv[0]
+
+rules = yara.compile('malwares.yara')
+
+for cpt, (root, dirnames, filenames) in enumerate(os.walk(sys.argv[1])):
+    for filename in fnmatch.filter(filenames, '*.ph*'):
+        if not cpt % 1000:
+            time.sleep(3)
+        fname = os.path.join(root, filename)
+        if os.stat(fname).st_size:
+            matches = rules.match(os.path.join(root, filename), fast=True)
+            if matches:
+                matches = matches.pop()  #  only one match, since we're scaning files
+                print str(matches) + fname
+                print '\n'.join(hex(m[0]) + ':' + m[1] + ': ' + m[2] for m in matches.strings)
+
+
diff --git a/php-malware-finder/whitelist.yara b/php-malware-finder/whitelist.yara
new file mode 100644
index 0000000..cadb7ab
--- /dev/null
+++ b/php-malware-finder/whitelist.yara
@@ -0,0 +1,125 @@
+/*
+    Careful; those rules are pretty heavy on computation,
+    since the sha1sum my be recomputed for every since test;
+    please make sure that you're calling them after every other ones.
+*/
+private rule Wordpress : Blog
+{
+    condition:
+        /* Wordpress 3.5.1 */
+        hash.sha1(0, filesize)  == "833281b4d1113180e4d1ca026f5e85a680d52662" or // wp-includes/class-phpmailer.php
+        hash.sha1(0, filesize)  == "b4e4b88f2be38ed9c3147b77c2f3a7f929caba2c" or // wp-admin/includes/menu.php
+
+        /* Wordpress 3.2.1 */
+        hash.sha1(0, filesize)  == "b4f53b8c360f9e47cc63047305a0ce2e3ff6a251" or // wp-includes/functions.php
+        hash.sha1(0, filesize)  == "ac8298df16a560c80fb213ef3f51f90df8ef5292" or // wp-includes/class-phpmailer.php
+        hash.sha1(0, filesize)  == "232e4705e3aa28269c4d5e4a4a700bb7a2d06f24" // wp-admin/includes/menu.php
+}
+
+private rule Prestashop : ECommerce
+{
+    condition:
+        /* Prestashop 1.6.1.0 */
+        hash.sha1(0, filesize)  == "544cd822e2195ac162c9f0387031709042a72cfd" or // tools/htmlpurifier/HTMLPurifier.standalone.php
+        hash.sha1(0, filesize)  == "bb8c0d735809b9412265729906016329f3e681ff" or // classes/webservice/WebserviceOutputJSON.php
+        hash.sha1(0, filesize)  == "15da986fccdc7104f9d4e8c344f332db5ae9a32b" // classes/Tools.php
+}
+
+private rule Magento : ECommerce
+{
+    condition:
+        /* Magento 1.9.2.0 */
+        hash.sha1(0, filesize)  == "4fa9deecb5a49b0d5b1f88a8730ce20a262386f7" or // lib/Zend/Session.php
+        hash.sha1(0, filesize)  == "f214646051f5376475d06ef50fe1e5634285ba1b" or // app/code/core/Mage/Adminhtml/Model/Url.php
+
+        /* Magento 1.7.0.2 */
+        hash.sha1(0, filesize)  == "f46cf6fd47e60e77089d94cca5b89d19458987ca" or // lib/Zend/Session.php
+        hash.sha1(0, filesize)  == "ffb3e46c87e173b1960e50f771954ebb1efda66e" or // lib/Zend/Ldap/Converter.php
+        hash.sha1(0, filesize)  == "7faa31f0ee66f32a92b5fd516eb65ff4a3603156" or // lib/PEAR/SOAP/WSDL.php
+        hash.sha1(0, filesize)  == "539de72a2a424d86483f461a9e38ee42df158f26" or // app/code/core/Mage/Adminhtml/Model/Url.php
+        hash.sha1(0, filesize)  == "6b3f32e50343b70138ce4adb73045782b3edd851" or // lib/phpseclib/Net/SSH1.php
+
+        /* Magento 1.4.1.1 */
+        hash.sha1(0, filesize)  == "0b74f4b259c63c01c74fb5913c3ada87296107c8" or // lib/Zend/Session.php
+        hash.sha1(0, filesize)  == "951a4639e49c6b2ad8adeb38481e2290297c8e70" or // lib/Zend/Ldap/Converter.php
+        hash.sha1(0, filesize)  == "44ba7a5b685f4a52113559f366aaf6e9a22ae21e"  // app/code/core/Mage/Adminhtml/Model/Url.php
+}
+
+private rule Drupal : Blog
+{
+    condition:
+        /* Drupal 7.38 */
+        hash.sha1(0, filesize) == "ad7587ce735352b6a55526005c05c280e9d41822" or // modules/system/system.admin.inc
+        hash.sha1(0, filesize) == "dfa67a40daeb9c1dd28f3fab00097852243258ed" or // modules/system/system.module
+
+        /* Drupal 7.15 */
+        hash.sha1(0, filesize)  == "23cc0e2c6eebe94fe189e258a3658b40b0005891" or // modules/simpletest/tests/upgrade/drupal-6.bare.database.php
+        hash.sha1(0, filesize)  == "8cb36d865b951378c3266dca7d5173a303e8dcff" or // modules/simpletest/tests/upgrade/drupal-6.filled.database.php
+        hash.sha1(0, filesize)  == "6c9c01bef14f8f64ef0af408f7ed764791531cc6" or // modules/system/system.module
+        hash.sha1(0, filesize)  == "ad03ed890400cf319f713ee0b4b6a62a5710f580" // modules/system/system.admin.inc
+}
+
+private rule Roundcube
+{
+    condition:
+        /* Roundcube 1.1.2 */
+        hash.sha1(0, filesize) == "afab52649172b46f64301f41371d346297046af2" or // program/lib/Roundcube/rcube_utils.php
+        hash.sha1(0, filesize) == "e6b81834e081cc2bd38fce787c5088e63d933953" or // program/include/rcmail_output_html.php
+        hash.sha1(0, filesize) == "7783e9fad144ca5292630d459bd86ec5ea5894fc" or // vendor/pear-pear.php.net/Net_LDAP2/Net/LDAP2/Util.php
+
+        /* Roundcube 1.0.6 */
+        hash.sha1(0, filesize) == "76d55f05f2070f471ba977b5b0f690c91fa8cdab" or // program/lib/Roundcube/rcube_utils.php
+        hash.sha1(0, filesize) == "c68319e3e1adcd3e22cf2338bc79f12fd54f6d4a" // program/include/rcmail_output_html.php
+}
+
+private rule Concrete5
+{
+    condition:
+        /* concrete5 7.4.2 */
+        hash.sha1(0, filesize) == "927bbd60554ae0789d4688738b4ae945195a3c1c" or // concrete/vendor/oyejorge/less.php/lib/Less/Tree/Dimension.php
+        hash.sha1(0, filesize) == "67f07022dae5fa39e8a37c09d67cbcb833e10d1f" or // concrete/vendor/oyejorge/less.php/lib/Less/Tree/Unit.php
+        hash.sha1(0, filesize) == "e1dcbc7b05e8ba6cba392f8fd44a3564fcad3666" // concrete/vendor/doctrine/inflector/lib/Doctrine/Common/Inflector/Inflector.php
+}
+
+private rule Dotclear : Blog
+{
+    condition:
+        /* dotclear 2.7.5 */
+        hash.sha1(0, filesize) == "192126b08c40c5ca086b5e4d7433e982f708baf3" or // inc/public/class.dc.template.php
+        hash.sha1(0, filesize) == "51e6810ccd3773e2bd453e97ccf16059551bae08" or // inc/libs/clearbricks/common/lib.date.php
+        hash.sha1(0, filesize) == "4172e35e7c9ce35de9f56fb8dfebe8d453f0dee4" or // inc/libs/clearbricks/template/class.template.php
+        hash.sha1(0, filesize) == "cf65db6ae55486f51370f87c4653aaed56903ccc" // inc/core/class.dc.modules.php
+}
+
+private rule Owncloud
+{
+    condition:
+        /* ownCloud 8.1.0 */
+        hash.sha1(0, filesize) == "a58489a3d8401295bb09cfbad09486f605625658" or // 3rdparty/phpseclib/phpseclib/phpseclib/Net/SSH1.php
+        hash.sha1(0, filesize) == "463627a4064dc05e93e6f9fc5605d4c8a4e09200" or // 3rdparty/jeremeamia/SuperClosure/src/SerializableClosure.php
+        hash.sha1(0, filesize) == "5346cb6817a75c26a6aad86e0b4ffb1d5145caa5" or // 3rdparty/symfony/process/Symfony/Component/Process/Process.php
+        hash.sha1(0, filesize) == "c8a6d4292448c7996e0092e6bfd38f90c34df090" or // core/doc/admin/_images/oc_admin_app_page.png
+        hash.sha1(0, filesize) == "acc7af31d4067c336937719b9a9ad7ac8497561e" // core/doc/admin/_sources/configuration_server/performance_tuning.txt
+}
+
+private rule Phpmyadmin
+{
+    condition:
+        /* phpmyadmin 4.4.11 */
+        hash.sha1(0, filesize) == "52afd26f6d38e76d7d92b96809f98e526e45c021" or // libraries/DatabaseInterface.class.php
+        hash.sha1(0, filesize) == "398507962b9dd89b0352f2ea9c648152fe932475" // libraries/DBQbe.class.php
+}
+
+private rule IsWhitelisted
+{
+    condition:
+        Wordpress or
+        Prestashop or
+        Magento or
+        Drupal or
+        Roundcube or
+        Concrete5 or
+        Dotclear or
+        Owncloud or
+        Phpmyadmin
+}
diff --git a/phpmalwarefinder b/phpmalwarefinder
deleted file mode 100755
index 0a85d85..0000000
--- a/phpmalwarefinder
+++ /dev/null
@@ -1,70 +0,0 @@
-#!/bin/bash
-
-YARA=$(which yara)
-CONFIG_PATH='/etc/phpmalwarefinder/malwares.yara'
-
-if [ ! -f "$YARA" ]
-then
-	YARA='./yara'
-fi
-
-if [ ! -f "$CONFIG_PATH" ]
-then
-	CONFIG_PATH='./malwares.yara'
-fi
-
-show_help() {
-    cat << EOF
-Usage ${0##*/} [-cfhw] <file|folder> ...
-    -c  Optional path to a configuration file
-    -f  Fast mode
-    -h  Show this help message
-    -v  Verbose mode
-EOF
-}
-
-OPTIND=1
-while getopts "c:fhv" opt; do
-    case "$opt" in
-        h)
-            show_help
-            exit 0
-            ;;
-        f)
-            OPTS="${OPTS} -f"
-            ;;
-        c)
-            CONFIG_PATH=${OPTARG}
-            ;;
-        v)
-            OPTS="${OPTS} -s"
-            ;;
-        '?')
-            show_help
-            exit 1
-            ;;
-    esac
-done
-shift "$((OPTIND-1))"
-
-if [ ! -e ${YARA} ]
-then
-    echo "Can't find yara. Did you installed it?"
-    exit 1
-fi
-
-if [ ! -e ${CONFIG_PATH} ]
-then
-    echo "${CONFIG_PATH} doesn't exist. Please give me a valid file."
-    exit 1
-fi
-
-if [ -z $@ ]
-then
-	show_help
-	exit 1
-fi
-
-OPTS="${OPTS} -r ${CONFIG_PATH}"
-
-ionice -c3 $YARA $OPTS $@
diff --git a/poc.py b/poc.py
deleted file mode 100644
index 8fddc5a..0000000
--- a/poc.py
+++ /dev/null
@@ -1,30 +0,0 @@
-import fnmatch
-import glob
-import os
-import sys
-import time
-
-try:
-    import yara
-except ImportError:
-    print 'Please install python-yara'
-    sys.exit(0)
-
-if len(sys.argv) != 2:
-    print 'Usage: %s folder_to_scan' % sys.argv[0]
-
-rules = yara.compile('malwares.yara')
-
-for cpt, (root, dirnames, filenames) in enumerate(os.walk(sys.argv[1])):
-    for filename in fnmatch.filter(filenames, '*.ph*'):
-        if not cpt % 1000:
-            time.sleep(3)
-        fname = os.path.join(root, filename)
-        if os.stat(fname).st_size:
-            matches = rules.match(os.path.join(root, filename), fast=True)
-            if matches:
-                matches = matches.pop()  #  only one match, since we're scaning files
-                print str(matches) + fname
-                print '\n'.join(hex(m[0]) + ':' + m[1] + ': ' + m[2] for m in matches.strings)
-
-
diff --git a/whitelist.yara b/whitelist.yara
deleted file mode 100644
index cadb7ab..0000000
--- a/whitelist.yara
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
-    Careful; those rules are pretty heavy on computation,
-    since the sha1sum my be recomputed for every since test;
-    please make sure that you're calling them after every other ones.
-*/
-private rule Wordpress : Blog
-{
-    condition:
-        /* Wordpress 3.5.1 */
-        hash.sha1(0, filesize)  == "833281b4d1113180e4d1ca026f5e85a680d52662" or // wp-includes/class-phpmailer.php
-        hash.sha1(0, filesize)  == "b4e4b88f2be38ed9c3147b77c2f3a7f929caba2c" or // wp-admin/includes/menu.php
-
-        /* Wordpress 3.2.1 */
-        hash.sha1(0, filesize)  == "b4f53b8c360f9e47cc63047305a0ce2e3ff6a251" or // wp-includes/functions.php
-        hash.sha1(0, filesize)  == "ac8298df16a560c80fb213ef3f51f90df8ef5292" or // wp-includes/class-phpmailer.php
-        hash.sha1(0, filesize)  == "232e4705e3aa28269c4d5e4a4a700bb7a2d06f24" // wp-admin/includes/menu.php
-}
-
-private rule Prestashop : ECommerce
-{
-    condition:
-        /* Prestashop 1.6.1.0 */
-        hash.sha1(0, filesize)  == "544cd822e2195ac162c9f0387031709042a72cfd" or // tools/htmlpurifier/HTMLPurifier.standalone.php
-        hash.sha1(0, filesize)  == "bb8c0d735809b9412265729906016329f3e681ff" or // classes/webservice/WebserviceOutputJSON.php
-        hash.sha1(0, filesize)  == "15da986fccdc7104f9d4e8c344f332db5ae9a32b" // classes/Tools.php
-}
-
-private rule Magento : ECommerce
-{
-    condition:
-        /* Magento 1.9.2.0 */
-        hash.sha1(0, filesize)  == "4fa9deecb5a49b0d5b1f88a8730ce20a262386f7" or // lib/Zend/Session.php
-        hash.sha1(0, filesize)  == "f214646051f5376475d06ef50fe1e5634285ba1b" or // app/code/core/Mage/Adminhtml/Model/Url.php
-
-        /* Magento 1.7.0.2 */
-        hash.sha1(0, filesize)  == "f46cf6fd47e60e77089d94cca5b89d19458987ca" or // lib/Zend/Session.php
-        hash.sha1(0, filesize)  == "ffb3e46c87e173b1960e50f771954ebb1efda66e" or // lib/Zend/Ldap/Converter.php
-        hash.sha1(0, filesize)  == "7faa31f0ee66f32a92b5fd516eb65ff4a3603156" or // lib/PEAR/SOAP/WSDL.php
-        hash.sha1(0, filesize)  == "539de72a2a424d86483f461a9e38ee42df158f26" or // app/code/core/Mage/Adminhtml/Model/Url.php
-        hash.sha1(0, filesize)  == "6b3f32e50343b70138ce4adb73045782b3edd851" or // lib/phpseclib/Net/SSH1.php
-
-        /* Magento 1.4.1.1 */
-        hash.sha1(0, filesize)  == "0b74f4b259c63c01c74fb5913c3ada87296107c8" or // lib/Zend/Session.php
-        hash.sha1(0, filesize)  == "951a4639e49c6b2ad8adeb38481e2290297c8e70" or // lib/Zend/Ldap/Converter.php
-        hash.sha1(0, filesize)  == "44ba7a5b685f4a52113559f366aaf6e9a22ae21e"  // app/code/core/Mage/Adminhtml/Model/Url.php
-}
-
-private rule Drupal : Blog
-{
-    condition:
-        /* Drupal 7.38 */
-        hash.sha1(0, filesize) == "ad7587ce735352b6a55526005c05c280e9d41822" or // modules/system/system.admin.inc
-        hash.sha1(0, filesize) == "dfa67a40daeb9c1dd28f3fab00097852243258ed" or // modules/system/system.module
-
-        /* Drupal 7.15 */
-        hash.sha1(0, filesize)  == "23cc0e2c6eebe94fe189e258a3658b40b0005891" or // modules/simpletest/tests/upgrade/drupal-6.bare.database.php
-        hash.sha1(0, filesize)  == "8cb36d865b951378c3266dca7d5173a303e8dcff" or // modules/simpletest/tests/upgrade/drupal-6.filled.database.php
-        hash.sha1(0, filesize)  == "6c9c01bef14f8f64ef0af408f7ed764791531cc6" or // modules/system/system.module
-        hash.sha1(0, filesize)  == "ad03ed890400cf319f713ee0b4b6a62a5710f580" // modules/system/system.admin.inc
-}
-
-private rule Roundcube
-{
-    condition:
-        /* Roundcube 1.1.2 */
-        hash.sha1(0, filesize) == "afab52649172b46f64301f41371d346297046af2" or // program/lib/Roundcube/rcube_utils.php
-        hash.sha1(0, filesize) == "e6b81834e081cc2bd38fce787c5088e63d933953" or // program/include/rcmail_output_html.php
-        hash.sha1(0, filesize) == "7783e9fad144ca5292630d459bd86ec5ea5894fc" or // vendor/pear-pear.php.net/Net_LDAP2/Net/LDAP2/Util.php
-
-        /* Roundcube 1.0.6 */
-        hash.sha1(0, filesize) == "76d55f05f2070f471ba977b5b0f690c91fa8cdab" or // program/lib/Roundcube/rcube_utils.php
-        hash.sha1(0, filesize) == "c68319e3e1adcd3e22cf2338bc79f12fd54f6d4a" // program/include/rcmail_output_html.php
-}
-
-private rule Concrete5
-{
-    condition:
-        /* concrete5 7.4.2 */
-        hash.sha1(0, filesize) == "927bbd60554ae0789d4688738b4ae945195a3c1c" or // concrete/vendor/oyejorge/less.php/lib/Less/Tree/Dimension.php
-        hash.sha1(0, filesize) == "67f07022dae5fa39e8a37c09d67cbcb833e10d1f" or // concrete/vendor/oyejorge/less.php/lib/Less/Tree/Unit.php
-        hash.sha1(0, filesize) == "e1dcbc7b05e8ba6cba392f8fd44a3564fcad3666" // concrete/vendor/doctrine/inflector/lib/Doctrine/Common/Inflector/Inflector.php
-}
-
-private rule Dotclear : Blog
-{
-    condition:
-        /* dotclear 2.7.5 */
-        hash.sha1(0, filesize) == "192126b08c40c5ca086b5e4d7433e982f708baf3" or // inc/public/class.dc.template.php
-        hash.sha1(0, filesize) == "51e6810ccd3773e2bd453e97ccf16059551bae08" or // inc/libs/clearbricks/common/lib.date.php
-        hash.sha1(0, filesize) == "4172e35e7c9ce35de9f56fb8dfebe8d453f0dee4" or // inc/libs/clearbricks/template/class.template.php
-        hash.sha1(0, filesize) == "cf65db6ae55486f51370f87c4653aaed56903ccc" // inc/core/class.dc.modules.php
-}
-
-private rule Owncloud
-{
-    condition:
-        /* ownCloud 8.1.0 */
-        hash.sha1(0, filesize) == "a58489a3d8401295bb09cfbad09486f605625658" or // 3rdparty/phpseclib/phpseclib/phpseclib/Net/SSH1.php
-        hash.sha1(0, filesize) == "463627a4064dc05e93e6f9fc5605d4c8a4e09200" or // 3rdparty/jeremeamia/SuperClosure/src/SerializableClosure.php
-        hash.sha1(0, filesize) == "5346cb6817a75c26a6aad86e0b4ffb1d5145caa5" or // 3rdparty/symfony/process/Symfony/Component/Process/Process.php
-        hash.sha1(0, filesize) == "c8a6d4292448c7996e0092e6bfd38f90c34df090" or // core/doc/admin/_images/oc_admin_app_page.png
-        hash.sha1(0, filesize) == "acc7af31d4067c336937719b9a9ad7ac8497561e" // core/doc/admin/_sources/configuration_server/performance_tuning.txt
-}
-
-private rule Phpmyadmin
-{
-    condition:
-        /* phpmyadmin 4.4.11 */
-        hash.sha1(0, filesize) == "52afd26f6d38e76d7d92b96809f98e526e45c021" or // libraries/DatabaseInterface.class.php
-        hash.sha1(0, filesize) == "398507962b9dd89b0352f2ea9c648152fe932475" // libraries/DBQbe.class.php
-}
-
-private rule IsWhitelisted
-{
-    condition:
-        Wordpress or
-        Prestashop or
-        Magento or
-        Drupal or
-        Roundcube or
-        Concrete5 or
-        Dotclear or
-        Owncloud or
-        Phpmyadmin
-}
-- 
cgit v1.3


From 11e20e5d2326a9d5653a3a6b2fff81e10ce94758 Mon Sep 17 00:00:00 2001
From: Julien "shaddai" Reveret
Date: Thu, 8 Oct 2015 17:47:19 +0200
Subject: Makefile changed : no more git clone, new build dir

---
 Makefile | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/Makefile b/Makefile
index 74a305b..c34bcee 100644
--- a/Makefile
+++ b/Makefile
@@ -1,18 +1,13 @@
-BUILDDIR=debian/build
 VERSION=1.0
 
 clean:
-	rm -Rf ${BUILDDIR}
-	rm -f debian/*.log
+	rm -rf php-malware-finder/debian
 
-fetch:
-	git clone git@gitlab.nbs-system.com:packages/php-malware-finder.git
-
-extract: fetch
-	mv php-malware-finder ${BUILDDIR}
+extract:
+	cp -r debian php-malware-finder
 
 set_distribution:
-		sed -e "s/##version/`cut -d'.' -f1 < /etc/debian_version`/" -i debian/control debian/changelog
+		sed -e "s/##version/`cut -d'.' -f1 < /etc/debian_version`/" -i php-malware-finder/debian/control php-malware-finder/debian/changelog
 
 package: clean extract set_distribution
-	debuild -b -us -uc --lintian-opts -X po-debconf
+	cd php-malware-finder && debuild -b -us -uc --lintian-opts -X po-debconf
-- 
cgit v1.3


From 443041f51739fece60b644f81b19aa3b7b3b503a Mon Sep 17 00:00:00 2001
From: Julien "shaddai" Reveret
Date: Fri, 9 Oct 2015 10:08:45 +0200
Subject: control file modification

---
 debian/control | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/control b/debian/control
index de30930..129f993 100644
--- a/debian/control
+++ b/debian/control
@@ -12,4 +12,4 @@ Package: nbs-phpmalwarefinder
 Architecture: any
 Depends: nbs-yara, util-linux
 Description: yara-based php webshell finder
-PhpMalwareFinder is a webshell hunter using yara and signatures.
+ PhpMalwareFinder is a webshell and malware  hunter using yara and signatures.
-- 
cgit v1.3


From 4c07e3c6719c160f1232068991061e75b2528698 Mon Sep 17 00:00:00 2001
From: Julien "shaddai" Reveret
Date: Fri, 9 Oct 2015 10:21:48 +0200
Subject: builddir changed, modifying install files accordingly

---
 debian/nbs-phpmalwarefinder.install | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/debian/nbs-phpmalwarefinder.install b/debian/nbs-phpmalwarefinder.install
index 0b9440a..965f7c0 100644
--- a/debian/nbs-phpmalwarefinder.install
+++ b/debian/nbs-phpmalwarefinder.install
@@ -1,2 +1,2 @@
-debian/build/malwares.yara etc/phpmalwarefinder
-debian/build/phpmalwarefinder usr/bin/
+malwares.yara etc/phpmalwarefinder
+phpmalwarefinder usr/bin/
-- 
cgit v1.3


From 68a104402875c5210b948e5b74c0fb25deba6979 Mon Sep 17 00:00:00 2001
From: Julien "shaddai" Reveret
Date: Fri, 9 Oct 2015 14:53:47 +0200
Subject: added whitelist to package

---
 debian/nbs-phpmalwarefinder.install | 1 +
 1 file changed, 1 insertion(+)

diff --git a/debian/nbs-phpmalwarefinder.install b/debian/nbs-phpmalwarefinder.install
index 965f7c0..dda5a10 100644
--- a/debian/nbs-phpmalwarefinder.install
+++ b/debian/nbs-phpmalwarefinder.install
@@ -1,2 +1,3 @@
 malwares.yara etc/phpmalwarefinder
+whitelist.yara etc/phpmalwarefinder
 phpmalwarefinder usr/bin/
-- 
cgit v1.3


From 2a023bb2862d9df4987e241d95e8d646001bd7ba Mon Sep 17 00:00:00 2001
From: Julien "shaddai" Reveret
Date: Fri, 9 Oct 2015 16:52:10 +0200
Subject: tested php-malware-finder against many webshells, completed the
 signature lists

---
 debian/changelog                 |  8 ++++++++
 php-malware-finder/malwares.yara | 13 ++++++++++---
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index 2489d7a..64332b4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+nbs-phpmalwarefinder (0.2.0-1~deb##version+nbs20151009) wheezy; urgency=medium
+  
+  * Now supports whitelist using yara hash function
+  * New detection rules added (tested against
+    https://github.com/tennc/webshell malware collection)
+
+ -- jre <jre@nbs-system.com>  Fri, 09 Oct 2015 14:58:45 +0200
+
 nbs-phpmalwarefinder (0.1.1-1~deb##version+nbs20150428) wheezy; urgency=medium
 
   * new dependecy on util-linux since the script is using ionice
diff --git a/php-malware-finder/malwares.yara b/php-malware-finder/malwares.yara
index c3664f0..3bc15c2 100644
--- a/php-malware-finder/malwares.yara
+++ b/php-malware-finder/malwares.yara
@@ -15,6 +15,7 @@ include "whitelist.yara"
         - http://sysadmin.cyklodev.com/online-php-obfuscator/
         - http://mohssen.org/SpinObf.php
         - https://code.google.com/p/carbylamine/
+        - https://github.com/tennc/webshell
 */
 
 global private rule IsPhp
@@ -57,11 +58,13 @@ rule ObfuscatedPhp
 {
     strings:
         $eval = /[;}][\t ]*@?(eval|preg_replace|system|exec|assert|passthru)\(/  // ;eval( <- this is dodgy
+        $b374k = /'ev'\.'al'/
         $align = /(\$\w+=[^;]*)*;\$\w+=@?\$\w+\(/  //b374k
         $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec|assert|passthru)\(/
         $weevely3 = /\$\w=\$[a-zA-Z]\('',\$\w\);\$\w\(\);/  // weevely3 launcher
         $c99_launcher = /;\$\w+\(\$\w+(,\s?\$\w+)+\);/  // http://bartblaze.blogspot.fr/2015/03/c99shell-not-dead.html
         $strange_arg = /\${\$[0-9a-zA-z]+}/
+        $too_many_chr = /(chr\([\d]+\)\.){2,}?/
     condition:
         any of them and not IsWhitelisted
 }
@@ -99,17 +102,19 @@ rule SuspiciousEncoding
 rule DodgyPhp
 {
     strings:
-        $vars = /\$___+/ // $__ is rarely used in legitimate scripts
-        $execution = /(eval|assert|passthru|exec|system|win_shell_execute|base64_decode)\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
+        $vars = /\$__+/ // $__ is rarely used in legitimate scripts
+        $execution = /(eval|assert|passthru|exec|system|win_shell_execute|base64_decode)*?\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
         $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/
         $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
         $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/
-        $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir)['"]\)/
+        $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir|disable_function|safe_mode_exec_dir|safe_mode_include_dir)['"]\)/
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
         $pr = /(preg_replace(_callback)?|mb_ereg_replace|preg_filter)\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
         $include = /include\([^\.]+\.(png|jpg|gif|bmp)/  // Clever includes
         $htaccess = "SetHandler application/x-httpd-php"
         $udp_dos = /sockopen\s*\(['"]udp:\/\//
+        $iniset_urlinclude = /ini_set\('allow_url_include,\ * 1'\)/
+        $iis_com = /IIS:\/\/localhost\/w3svc/
 
     condition:
         (any of them or CloudFlareBypass) and not IsWhitelisted
@@ -218,6 +223,8 @@ rule Websites
         $ = "www.fopo.com.ar"  /* Free Online Php Obfuscator */
         $ = "ccteam.ru"
         $ = "locus7s.com"
+        $ = "b374k"
+        $ = "www.egyspider.eu"
 
     condition:
         any of them and not IsWhitelisted
-- 
cgit v1.3


From b456ace96e2bfea050d6991082773a183e476d5f Mon Sep 17 00:00:00 2001
From: Mathieu Deous
Date: Wed, 14 Oct 2015 13:48:20 +0200
Subject: signatures: eval can be prefixed by an open square bracket

---
 php-malware-finder/malwares.yara | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/php-malware-finder/malwares.yara b/php-malware-finder/malwares.yara
index 3bc15c2..866aa66 100644
--- a/php-malware-finder/malwares.yara
+++ b/php-malware-finder/malwares.yara
@@ -57,7 +57,7 @@ private rule CloudFlareBypass
 rule ObfuscatedPhp
 {
     strings:
-        $eval = /[;}][\t ]*@?(eval|preg_replace|system|exec|assert|passthru)\(/  // ;eval( <- this is dodgy
+        $eval = /[;{}][\t ]*@?(eval|preg_replace|system|exec|assert|passthru)\(/  // ;eval( <- this is dodgy
         $b374k = /'ev'\.'al'/
         $align = /(\$\w+=[^;]*)*;\$\w+=@?\$\w+\(/  //b374k
         $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec|assert|passthru)\(/
-- 
cgit v1.3


From 93bfb72efd7ff0a4f5f9f56ccbe8bf8bf2f11f83 Mon Sep 17 00:00:00 2001
From: Julien "shaddai" Reveret
Date: Mon, 19 Oct 2015 11:25:57 +0200
Subject: reverting change since it triggers too many false positives

---
 php-malware-finder/malwares.yara | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/php-malware-finder/malwares.yara b/php-malware-finder/malwares.yara
index 866aa66..1826a5a 100644
--- a/php-malware-finder/malwares.yara
+++ b/php-malware-finder/malwares.yara
@@ -103,7 +103,7 @@ rule DodgyPhp
 {
     strings:
         $vars = /\$__+/ // $__ is rarely used in legitimate scripts
-        $execution = /(eval|assert|passthru|exec|system|win_shell_execute|base64_decode)*?\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
+        $execution = /(eval|assert|passthru|exec|system|win_shell_execute|base64_decode)\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
         $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/
         $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
         $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/
-- 
cgit v1.3