From 97b60696b0a676a297cd8212f67507e7bebd21af Mon Sep 17 00:00:00 2001
From: jvoisin <julien.voisin@dustri.org>
Date: Tue, 30 Jun 2015 16:02:55 +0200
Subject: [PATCH] Add filesize check

---
 malwares.yara | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/malwares.yara b/malwares.yara
index 6e28d40..8e10e05 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -21,7 +21,7 @@ private rule IsPhp
         $xml = "<?xml"
 
     condition:
-        $php and not $xml
+        $php and not $xml and filesize < 5MB
 }
 
 private rule IRC