[clamav-users] need help creating signatures

[Al Varnell]

Why not just submit them to the ClamAV signature team so that all of us will benefit from what you’ve found?

<http://www.clamav.net/report/report-malware.html>

-Al-

On Thu, Sep 24, 2015 at 11:27 PM, Hajo Locke wrote:
> 
> Hello,
> 
> these days we see new type of php-malware.  Malware occurs in many different files, but all expand to same php-malware.
> 
> for examle here i have 4 files i have found:
> http://pastebin.com/TzudTPPt
> 
> All files expand to something like this and are used to send spam:
> http://pastebin.com/jhVRMwpE
> 
> I dont find big similarities to create one powerful signature. Need help to create one signature. Otherwise i had to create one signature for each file.
> Please give me a hint in this case.
> 
> Thanks,
> Hajo
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3569 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20150924/759b6a2a/attachment.bin>