From ea379f075139a40335b4f78451cf7a4bc4d793ac Mon Sep 17 00:00:00 2001 From: Julien "shaddai" Reveret Date: Fri, 28 Oct 2016 16:42:17 +0200 Subject: version 4.2.3 whitelist added --- php-malware-finder/whitelists/wordpress.yar | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/php-malware-finder/whitelists/wordpress.yar b/php-malware-finder/whitelists/wordpress.yar index 55044ef..43ae47c 100644 --- a/php-malware-finder/whitelists/wordpress.yar +++ b/php-malware-finder/whitelists/wordpress.yar @@ -285,6 +285,8 @@ private rule Wordpress : Blog hash.sha1(0, filesize) == "67c7d31d7eefb838131767f7470d85ad2fac8041" or // wp-admin/includes/menu.php hash.sha1(0, filesize) == "cc91aae9a752176317b3e22f915899a46e4b8612" or // wp-includes/load.php hash.sha1(0, filesize) == "a2ab86b24ff3d23fe056db007a083bfe99714ba0" or // wp-admin/includes/schema.php + hash.sha1(0, filesize) == "1a4e6932523c34d95f050960e7c3d082adb28156" or // wp-includes/ID3/getid3.php + hash.sha1(0, filesize) == "b20e3d401b0ab935ed6401392233b36966523e20" or // wp-includes/class-pop3.php /* Wordpress 3.9.2 */ hash.sha1(0, filesize) == "5f238f6427ec6c992233866304ae6ef697d0b227" or // wp-content/plugins/akismet/class.akismet-admin.php @@ -335,6 +337,12 @@ private rule Wordpress : Blog /* Wordpress 4.2.2 */ hash.sha1(0, filesize) == "e350431c90bd2ae81d244b2efc6d3844eb43959d" or // wp-includes/js/tinymce/tinymce.min.js + /* Wordpress 4.2.3 */ + hash.sha1(0, filesize) == "f1c4697ae04da5eb19847c8f1296edce2ad3cec9" or // wp-includes/formatting.php + hash.sha1(0, filesize) == "e7caf1f66c38bb119fe709ade012a989d8610f07" or // wp-admin/includes/class-pclzip.php + hash.sha1(0, filesize) == "8ddb9eff06105b9699c6b03db54472291abcb823" or // wp-includes/taxonomy.php + hash.sha1(0, filesize) == "9dd666651f57ef6e704310fe37ffce7dfd2322e4" or // wp-includes/comment.php + /* Wordpress 4.3 */ hash.sha1(0, filesize) == "2d97f1953b9cc70c72a53515d5339ad46875bba8" or // wp-content/plugins/akismet/class.akismet-admin.php hash.sha1(0, filesize) == "f563d6766a7ef4812132ccb6964faff2f565c4b4" or // wp-includes/js/tinymce/tinymce.min.js -- cgit v1.3