Fix php-malware-finder for yara > 4.0.0

jvoisin · jvoisin · commit 08214fc5242d · 2020-04-03T17:45:59.000+02:00
diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
@@ -206,7 +206,7 @@ private rule IRC
         5 of them
 }
 
-private rule base64
+private rule b64
 {
     strings:
         $user_agent = "SFRUUF9VU0VSX0FHRU5UCg"
@@ -268,7 +268,7 @@ private rule strrev
 rule SuspiciousEncoding
 {
     condition:
-        (base64 or hex or strrev or Hpack) and not IsWhitelisted
+        (b64 or hex or strrev or Hpack) and not IsWhitelisted
 }
 
 rule DodgyStrings

Original file line number	Diff line number	Diff line change
`@@ -206,7 +206,7 @@ private rule IRC`
`206`	`206`	`5 of them`
`207`	`207`	`}`
`208`	`208`
`209`		`-private rule base64`
	`209`	`+private rule b64`
`210`	`210`	`{`
`211`	`211`	`strings:`
`212`	`212`	`$user_agent = "SFRUUF9VU0VSX0FHRU5UCg"`
`@@ -268,7 +268,7 @@ private rule strrev`
`268`	`268`	`rule SuspiciousEncoding`
`269`	`269`	`{`
`270`	`270`	`condition:`
`271`		`- (base64 or hex or strrev or Hpack) and not IsWhitelisted`
	`271`	`+ (b64 or hex or strrev or Hpack) and not IsWhitelisted`
`272`	`272`	`}`
`273`	`273`
`274`	`274`	`rule DodgyStrings`