From d459125edca99f84b8eda87e6e064c81ec6d53f7 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Thu, 25 Jun 2015 10:27:58 +0200
Subject: What about moar spaces?

---
 malwares.yara | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/malwares.yara b/malwares.yara
index d56ce7d..c421956 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -98,7 +98,7 @@ rule SuspiciousEncoding
 rule DodgyPhp
 {
     strings:
-        $execution = /(eval|passthru|exec|system|win_shell_execute)\((base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|\\?\$_(GET|REQUEST|POST))/
+        $execution = /(eval|passthru|exec|system|win_shell_execute) *\((base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|\\?\$_(GET|REQUEST|POST))/
         $double_encoding = /(base64_decode\s*\(\s*){2}/
         $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/
         $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
-- 
cgit v1.3