From f3697c17f8865caf0e4a6dc275b8aa71c723dad2 Mon Sep 17 00:00:00 2001
From: Gaetan ALLART <gaetan@nexylan.com>
Date: Thu, 9 Feb 2017 16:07:23 +0100
Subject: [PATCH] Fixes #13 pattern

---
 data/webshells.txt                | 1 +
 fixtures/samples/infected/018.php | 2 ++
 2 files changed, 3 insertions(+)
 create mode 100644 fixtures/samples/infected/018.php

diff --git a/data/webshells.txt b/data/webshells.txt
index 0aacf2a..8638ea0 100644
--- a/data/webshells.txt
+++ b/data/webshells.txt
@@ -15,3 +15,4 @@ if \(isset\(\$_COOKIE\["id"\]\)\) @\$_COOKIE\["user"\]
 =chr\(112\)\."\\x
 (\$[a-zA-Z]+\{[0-9]+\}\s\.\s){10}
 @\$_=\/\*\-\/
+\$[a-zA-Z0-9]+\s=\s(chr\([0-9]+\^[0-9]+\)\.){10}
diff --git a/fixtures/samples/infected/018.php b/fixtures/samples/infected/018.php
new file mode 100644
index 0000000..402ef20
--- /dev/null
+++ b/fixtures/samples/infected/018.php
@@ -0,0 +1,2 @@
+<?php
+$jCexQiqUToDO3 = chr(38^64).chr(38^79).chr(38^74).chr(38^67).chr(38^121).chr(38^65).chr(38^67).chr(38^82).chr(38^121).chr(38^69).chr(38^73).chr(38^72).chr(38^82).chr(38^67).chr(38^72).chr(38^82).chr(38^85);