A question about malware signatures contribution about php-antimalware-scanner

[milosdjakonovic]

Thanks... Now I see the difference. So, Signatures.php for malware and Exploits.php for code often but not exclusively used by malware.

Consider adding mini howto for this subject in README.

[marcocesarato]

Hi @milosdjakonovic , I create a small documentation website of the program (a lot of these informations are on README yet).

Here explained in short the differences between definitions: https://marcocesarato.github.io/PHP-Antimalware-Scanner/
And here explained in short how to contribute: https://marcocesarato.github.io/PHP-Antimalware-Scanner/how-contribute/

[marcocesarato]

Hi @milosdjakonovic, sure, we accept the contribution for malware signatures. In this case it should be an Exploit (here: https://github.com/marcocesarato/PHP-Antimalware-Scanner/blob/master/src/Exploits.php) with level => Match::WARNING because yes it's a malware, but it may also not be malware. On Exploit there are no limits regarding the limit / complexity of the regular expression but just must to be a valid regex to find a valid exploit.

In this case there are some variables like the filename/username key and check if there is others lines of code between the md5 check and move_uploaded_file.

[milosdjakonovic]

Awesome. Malware samples are on the way...