diff --git a/data/webshells.txt b/data/webshells.txt
index 0aacf2a..8638ea0 100644
--- a/data/webshells.txt
+++ b/data/webshells.txt
@@ -15,3 +15,4 @@ if \(isset\(\$_COOKIE\["id"\]\)\) @\$_COOKIE\["user"\]
 =chr\(112\)\."\\x
 (\$[a-zA-Z]+\{[0-9]+\}\s\.\s){10}
 @\$_=\/\*\-\/
+\$[a-zA-Z0-9]+\s=\s(chr\([0-9]+\^[0-9]+\)\.){10}
diff --git a/fixtures/samples/infected/018.php b/fixtures/samples/infected/018.php
new file mode 100644
index 0000000..402ef20
--- /dev/null
+++ b/fixtures/samples/infected/018.php
@@ -0,0 +1,2 @@
+<?php
+$jCexQiqUToDO3 = chr(38^64).chr(38^79).chr(38^74).chr(38^67).chr(38^121).chr(38^65).chr(38^67).chr(38^82).chr(38^121).chr(38^69).chr(38^73).chr(38^72).chr(38^82).chr(38^67).chr(38^72).chr(38^82).chr(38^85);