[clamav-users] need help creating signatures

Hajo Locke Hajo.Locke at gmx.de
Fri Sep 25 02:27:03 EDT 2015


Hello,

these days we see new type of php-malware.  Malware occurs in many 
different files, but all expand to same php-malware.

for examle here i have 4 files i have found:
http://pastebin.com/TzudTPPt

All files expand to something like this and are used to send spam:
http://pastebin.com/jhVRMwpE

I dont find big similarities to create one powerful signature. Need help 
to create one signature. Otherwise i had to create one signature for 
each file.
Please give me a hint in this case.

Thanks,
Hajo



More information about the clamav-users mailing list