search

scr34m / php-malware-scanner

Scans PHP files for malwares and known threats
GNU General Public License v3.0
556 stars 96 forks source link

New Malware Pattern #20

Closed jaygilmore closed 6 years ago

jaygilmore commented 6 years ago

This was found by another security scanner:

https://gist.github.com/jaygilmore/8edd01b553df0e4604e928bbfb7f7fb7

scr34m commented 6 years ago

These two code parts looks suspicious str_split(rawurldecode(str_rot13( and substr(md5(time()), 0, 8) . ".php" what do you think?

scr34m commented 6 years ago

I have made a regexp for this expression $nfdrtfwcwc ^ $suapacic[$kvjxsitn % strlen($suapacic)] ^ $qiobzdor[$kvjxsitn % strlen($qiobzdor)];

jaygilmore commented 6 years ago

that seems good. I'm no regex-expert but everything so far has been good.