From a16310d442a72cd50f6eb7f1f493988f8a87a2f3 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Mon, 4 Jan 2016 15:56:18 +0100
Subject: Add a whitelist for wordpress 4.4

---
 whitelist.yara | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/whitelist.yara b/whitelist.yara
index 858860d..84da6b1 100644
--- a/whitelist.yara
+++ b/whitelist.yara
@@ -13,7 +13,11 @@ private rule Wordpress : Blog
         /* Wordpress 3.2.1 */
         hash.sha1(0, filesize)  == "b4f53b8c360f9e47cc63047305a0ce2e3ff6a251" or // wp-includes/functions.php
         hash.sha1(0, filesize)  == "ac8298df16a560c80fb213ef3f51f90df8ef5292" or // wp-includes/class-phpmailer.php
-        hash.sha1(0, filesize)  == "232e4705e3aa28269c4d5e4a4a700bb7a2d06f24" // wp-admin/includes/menu.php
+        hash.sha1(0, filesize)  == "232e4705e3aa28269c4d5e4a4a700bb7a2d06f24" or // wp-admin/includes/menu.php
+
+        /* Wordpress 4.4 */
+        hash.sha1(0, filesize)  == "2fdf93ae88735d062a8635ac1d22a6904cb89ab8" or // wp-includes/formatting.php
+        hash.sha1(0, filesize)  == "ccd23ef96a588840943fba081bfa6f88531c4abc" // wp-admin/includes/class-pclzip.php
 }
 
 private rule Prestashop : ECommerce
-- 
cgit v1.3