golden hour

/opt/PHP-Antimalware-Scanner/dist

File/Folder	Size	Actions
scanner	798.73 KB
version	6 B

Edit: scanner

#!/usr/bin/env php
<?php
Phar::mapPhar();
require 'phar://' . __FILE__ . '/index.php';
__HALT_COMPILER(); ?>
��������������������Modules/Wordpress.php-,���i-,�����"�������
���Functions.php����i����WPn����������Templates/Report.html{���i{���a �����������Templates/Table.phpo���io��H�'����������Templates/Report.phpI���iI�����������
���CodeMatch.php�
���i�
���b�ȶ������	���Cache.php����i���L2%h����������Scanner.phpN��iN��̐�����������Console/Argument.php���i���z�`����������Console/Flag.php����i����2����������Console/Argv.php&���i&���e?ö���������Console/Figlet.php:���i:���y������������Console/Fonts/rozzo.flf����i���	�����������Console/Fonts/stop.flf����i����%����������Console/Fonts/colossal.flf5���i5��������������Console/Fonts/smkeyboard.flf����i���]x�L����������Console/Fonts/basic.flf���i����*����������Console/Fonts/ansishadow.flf�.���i�.���ΦѶ���������Console/CLI.php�A���i�A��+L������������Modules.php����i����!/Ѷ���������Actions.phpx���ix��$�a�����������Signatures.php|;��i|;���g������� ���Interfaces/VerifierInterface.phpL���iL���'^z����������Abstracts/SingletonAbstract.php����i�����P����������Path.php����i����->��������	���index.php����i���O�����������Deobfuscator.php3P���i3P��ٺ����������Exploits.php�p���i�p���W�Q�������<?php

/**
 * PHP Antimalware Scanner.
 *
 * @author Marco Cesarato <cesarato.developer@gmail.com>
 * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License
 *
 * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner
 */

namespace AMWScan\Modules;

use AMWScan\Cache;
use AMWScan\Console\CLI;
use AMWScan\Interfaces\VerifierInterface;
use GlobIterator;

class Wordpress implements VerifierInterface
{
    /**
     * Wordpress roots.
     *
     * @var array
     */
    protected static $roots = [];

/**
     * Time to live.
     *
     * @var int
     */
    protected static $ttl = -1;

/**
     * Initialize path.
     *
     * @param $path
     */
    public static function init($path)
    {
        if (self::isRoot($path)) {
            $version = self::getVersion($path);
            if (!empty($version) && !isset(self::$roots[$path])) {
                $locale = self::getLocale($path);
                CLI::writeLine('Found WordPress ' . $version . ' (' . $locale . ') at "' . $path . '"', 1, 'green');

$plugins = self::getPlugins($path);
                self::$roots[$path] = [
                    'path' => $path,
                    'version' => $version,
                    'locale' => $locale,
                    'plugins' => $plugins,
                ];
                self::getChecksums($version, $locale);
                self::getPluginsChecksums($plugins);
            }
        }
    }

/**
     * Detect root.
     *
     * @param $path
     *
     * @return bool
     */
    public static function isRoot($path)
    {
        return
            is_dir($path) &&
            is_dir($path . DIRECTORY_SEPARATOR . 'wp-admin') &&
            is_dir($path . DIRECTORY_SEPARATOR . 'wp-content') &&
            is_dir($path . DIRECTORY_SEPARATOR . 'wp-includes') &&
            is_file($path . DIRECTORY_SEPARATOR . 'wp-includes' . DIRECTORY_SEPARATOR . 'version.php');
    }

/**
     * Get version.
     *
     * @param $root
     *
     * @return string|null
     */
    public static function getVersion($root)
    {
        $versionFile = $root . DIRECTORY_SEPARATOR . 'wp-includes' . DIRECTORY_SEPARATOR . 'version.php';
        if (is_file($versionFile)) {
            $versionContent = file_get_contents($versionFile);
            preg_match('/\$wp_version[\s]*=[\s]*[\'"]([0-9.]+)[\'"]/m', $versionContent, $match);
            $version = trim($match[1]);
            if (!empty($version)) {
                return $version;
            }
        }

return null;
    }

/**
     * Get locale.
     *
     * @param $root
     *
     * @return string
     */
    public static function getLocale($root)
    {
        $versionFile = $root . DIRECTORY_SEPARATOR . 'wp-includes' . DIRECTORY_SEPARATOR . 'version.php';
        if (is_file($versionFile)) {
            $versionContent = file_get_contents($versionFile);
            preg_match('/\$wp_local_package[\s]*=[\s]*[\'"]([A-Za-z_-]+)[\'"]/m', $versionContent, $match);
            if (!empty($match[1])) {
                return $match[1];
            }
        }

return 'en_US';
    }

/**
     * Get plugins.
     *
     * @param $root
     *
     * @return string[]
     */
    public static function getPlugins($root)
    {
        $plugins = [];
        $files = new GlobIterator($root . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'plugins' . DIRECTORY_SEPARATOR . '*' . DIRECTORY_SEPARATOR . '*.php');
        foreach ($files as $cur) {
            if ($cur->isFile()) {
                $headers = self::getPluginHeaders($cur->getPathname());
                if (!empty($headers['name']) && !empty($headers['version'])) {
                    if (empty($headers['domain'])) {
                        $headers['domain'] = $cur->getBasename('.' . $cur->getExtension());
                    }
                    $headers['path'] = $cur->getPath();
                    $plugins[$cur->getPath()] = $headers;
                    CLI::writeLine('Found WordPress Plugin ' . $headers['name'] . ' ' . $headers['version'], 1, 'green');
                }
            }
        }

return $plugins;
    }

/**
     * Get file headers.
     *
     * @param $file
     *
     * @return string[]
     */
    public static function getPluginHeaders($file)
    {
        $headers = ['name' => 'Plugin Name', 'version' => 'Version', 'domain' => 'Text Domain'];
        $fileData = file_get_contents($file);
        $fileData = str_replace("\r", "\n", $fileData);
        foreach ($headers as $field => $regex) {
            if (preg_match('/^[ \t\/*#@]*' . preg_quote($regex, '/') . ':(.*)$/mi', $fileData, $match) && $match[1]) {
                $headers[$field] = trim(preg_replace('/\s*(?:\*\/|\?>).*/', '', $match[1]));
            } else {
                $headers[$field] = '';
            }
        }

return $headers;
    }

/**
     * Get checksums.
     *
     * @param string $version
     * @param string $locale
     *
     * @return array|false
     */
    public static function getChecksums($version, $locale = 'en_US')
    {
        $cache = Cache::getInstance();
        $key = 'wordpress_' . $locale . '-' . $version;
        $checksums = $cache->get($key);

if (is_null($checksums)) {
            CLI::writeLine('Retrieving checksums of Wordpress ' . $version, 1, 'grey');

$checksums = [];
            $dataChecksums = self::getData('https://api.wordpress.org/core/checksums/1.0/?version=' . $version . '&locale=' . $locale);
            if (!$dataChecksums) {
                $cache->set($key, false, self::$ttl);

return false;
            }
            $versionChecksums = $dataChecksums['checksums'];

// Sanitize paths and checksum
            foreach ($versionChecksums as $filePath => $checksum) {
                $sanitizePath = self::sanitizePath($filePath);
                $checksums[$sanitizePath] = strtolower($checksum);
            }
            $cache->set($key, $checksums, self::$ttl);
        }

return $checksums;
    }

/**
     * Get plugins checksums.
     *
     * @param array $plugins
     *
     * @return array|false
     */
    public static function getPluginsChecksums($plugins = [])
    {
        $cache = Cache::getInstance();
        $pluginsChecksums = [];
        foreach ($plugins as $plugin) {
            $key = 'wordpress-plugin_' . $plugin['domain'] . '-' . $plugin['version'];
            $checksums = $cache->get($key);

if (!is_null($checksums)) {
                $pluginsChecksums[$plugin['domain']][$plugin['version']] = $checksums;
                continue;
            }

CLI::writeLine('Retrieving checksums of Wordpress Plugin ' . $plugin['name'] . ' ' . $plugin['version'], 1, 'grey');
            $dataChecksums = self::getData('https://downloads.wordpress.org/plugin-checksums/' . $plugin['domain'] . '/' . $plugin['version'] . '.json');
            if (!$dataChecksums) {
                $cache->set($key, [], self::$ttl);
                $pluginsChecksums[$plugin['domain']][$plugin['version']] = [];
                continue;
            }
            $pluginChecksums = $dataChecksums['files'];

$checksums = [];
            foreach ($pluginChecksums as $filePath => $checksum) {
                $path = $plugin['path'] . DIRECTORY_SEPARATOR . $filePath;
                $root = self::getRoot($path);
                $sanitizePath = str_replace($root['path'], '', $path);
                $sanitizePath = self::sanitizePath($sanitizePath);
                if (is_array($checksum['md5'])) {
                    $checksums[$sanitizePath] = array_filter($checksum['md5'], 'strtolower');
                } else {
                    $checksums[$sanitizePath] = strtolower($checksum['md5']);
                }
            }
            $cache->set($key, $checksums, self::$ttl);
            $pluginsChecksums[$plugin['domain']][$plugin['version']] = $checksums;
        }

return $pluginsChecksums;
    }

/**
     * Is verified file.
     *
     * @param $path
     *
     * @return bool
     */
    public static function isVerified($path)
    {
        if (!is_file($path)) {
            return false;
        }

$root = self::getRoot($path);
        if (!empty($root)) {
            $comparePath = str_replace($root['path'], '', $path);
            $comparePath = self::sanitizePath($comparePath);
            $checksums = self::getChecksums($root['version'], $root['locale']);
            if (!$checksums) {
                return false;
            }
            // Core
            if (!empty($checksums[$comparePath])) {
                $checksum = md5_file($path);
                $checksum = strtolower($checksum);

if (is_array($checksums[$comparePath])) {
                    return in_array($checksum, $checksums[$comparePath], true);
                }

return $checksums[$comparePath] === $checksum;
            }
            // Plugins
            $pluginRoot = self::getPluginRoot($root, $path);
            $pluginsChecksums = self::getPluginsChecksums($root['plugins']);
            if (!empty($root['plugins'][$pluginRoot])) {
                $plugin = $root['plugins'][$pluginRoot];
                $checksums = $pluginsChecksums[$plugin['domain']][$plugin['version']];
                if (!empty($pluginsChecksums[$plugin['domain']][$plugin['version']]) && !empty($checksums[$comparePath])) {
                    $checksum = md5_file($path);
                    $checksum = strtolower($checksum);

return $checksums[$comparePath] === $checksum;
                }
            }
        }

return false;
    }

/**
     * Get root from child file.
     *
     * @param $path
     *
     * @return array
     */
    public static function getRoot($path)
    {
        foreach (self::$roots as $root) {
            if (strpos($path, $root['path']) === 0) {
                return $root;
            }
        }

return null;
    }

/**
     * Get root from child plugin file.
     *
     * @param $root
     * @param $path
     *
     * @return mixed|null
     */
    protected static function getPluginRoot($root, $path)
    {
        $pluginsPaths = array_keys($root['plugins']);
        foreach ($pluginsPaths as $pluginPath) {
            if (strpos($path, $pluginPath) === 0) {
                return $pluginPath;
            }
        }

return null;
    }

/**
     * Sanitize path to be compared.
     *
     * @param $path
     *
     * @return string
     */
    public static function sanitizePath($path)
    {
        $sanitized = preg_replace('#[\\\\/]+#', DIRECTORY_SEPARATOR, $path);
        $sanitized = trim($sanitized);
        $sanitized = trim($sanitized, DIRECTORY_SEPARATOR);

return strtolower($sanitized);
    }

/**
     * HTTP request get data.
     *
     * @param $url
     *
     * @return mixed|null
     */
    protected static function getData($url)
    {
        $headers = get_headers($url);
        if (substr($headers[0], 9, 3) !== '200') {
            return null;
        }

$content = @file_get_contents($url);

return @json_decode($content, true);
    }
}
<?php

namespace AMWScan;

class Functions
{
    /**
     * Default functions definitions.
     *
     * @var array
     */
    public static $default = [
        'il_exec',
        'shell_exec',
        'eval',
        'system',
        'create_function',
        'exec',
        'assert',
        'syslog',
        'passthru',
        'define_syslog_variables',
        'posix_kill',
        'posix_getpwuid',
        'posix_mkfifo',
        'posix_setpgid',
        'posix_setsid',
        'posix_setuid',
        'posix_uname',
        'proc_close',
        'proc_get_status',
        'proc_nice',
        'proc_open',
        'proc_terminate',
        'pcntl_exec',
        'pcntl_fork',
        'inject_code',
        'apache_child_terminate',
        'apache_note',
        'define_syslog_variables',
    ];

/**
     * Dangerous encoded functions definitions.
     *
     * @var array
     */
    public static $dangerous = [
        // PHP Code Execution
        'il_exec',
        'shell_exec',
        'eval',
        'system',
        'create_function',
        'exec',
        'pcntl_exec',
        'pcntl_fork',
        'assert',
        'passthru',
        'create_function',
        'include',
        'include_once',
        'require',
        'require_once',
        'preg_replace',
        // Files and configurations
        'syslog',
        'define_syslog_variables',
        'debugger_off',
        'get_meta_tags',
        'highlight_file',
        'debugger_on',
        'parse_ini_file',
        'php_strip_whitespace',
        'show_source',
        'symlink',
        'fopen',
        'file_get_contents',
        'file_put_contents',
        'chmod',
        'chown',
        'copy',
        'move',
        'is_file',
        'is_dir',
        'ini_alter',
        'ini_get_all',
        'ini_restore',
        'parse_ini_file',
        'inject_code',
        'apache_child_terminate',
        'apache_setenv',
        'apache_note',
        'define_syslog_variables',
        // Curl
        'curl_init',
        'curl_setopt',
        'curl_exec',
        // Posix
        'posix_kill',
        'posix_getpwuid',
        'posix_mkfifo',
        'posix_setpgid',
        'posix_setsid',
        'posix_setuid',
        'posix_uname',
        // Processes
        'popen',
        'proc_close',
        'proc_get_status',
        'proc_nice',
        'proc_open',
        'proc_terminate',
        // Encoding
        'escapeshellarg',
        'escapeshellcmd',
        'base64_decode',
        'urldecode',
        'rawurldecode',
        'str_rot13',
        'preg_replace',
        // Information Disclosure
        'phpinfo',
        'posix_mkfifo',
        'posix_getlogin',
        'posix_ttyname',
        'getenv',
        'get_current_user',
        'proc_get_status',
        'get_cfg_var',
        'disk_free_space',
        'disk_total_space',
        'diskfreespace',
        'getcwd',
        'getlastmo',
        'getmygid',
        'getmyinode',
        'getmypid',
        'getmyuid',
        // Callback functions
        'ob_start',
        'array_diff_uassoc',
        'array_diff_ukey',
        'array_filter',
        'array_intersect_uassoc',
        'array_intersect_ukey',
        'array_map',
        'array_reduce',
        'array_udiff_assoc',
        'array_udiff_uassoc',
        'array_udiff',
        'array_uintersect_assoc',
        'array_uintersect_uassoc',
        'array_uintersect',
        'array_walk_recursive',
        'array_walk',
        'assert_options',
        'uasort',
        'uksort',
        'usort',
        'preg_replace_callback',
        'spl_autoload_register',
        'iterator_apply',
        'call_user_func',
        'call_user_func_array',
        'register_shutdown_function',
        'register_tick_function',
        'set_error_handler',
        'set_exception_handler',
        'session_set_save_handler',
        'sqlite_create_aggregate',
        'sqlite_create_function',
        'win32_create_service',
        'mb_ereg_replace_callback',
        'shmop_open',
        'suhosin.executor.func.blacklist',
        'stream_socket_pair',
    ];

/**
     * Get all default functions to check.
     *
     * @return array
     */
    public static function getDefault()
    {
        return self::$default;
    }

/**
     * Get all dangerous functions to check.
     *
     * @return array
     */
    public static function getDangerous()
    {
        return self::$dangerous;
    }
}
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset='utf-8'>
    <meta http-equiv='X-UA-Compatible' content='IE=edge'>
    <title>Scan Report</title>
    <link rel="icon" type="image/png" sizes="16x16" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAACxMAAAsTAQCanBgAAAMoSURBVDhPZVPfaxxVFP7u/Mjszsya7KbbRNJ00xehWLCbQvGlfWj/gj4oCHlQH1aEin+Czz7mQdBiiiColD7oi1ow26gVKmqChobmRzXRupWku7PJ7M7s3J+eGVREL3PnXoY553zn+77D8J919eMvmsaYltH6ktZ6TisF2rtaqrbW6tp7Lz239tevxfonwWufLPvGYFEr+fLjbs/qHR4iHgxheS4qlQCh46JsOxpKXVdKvf7R1ReTPM7OX1TVh8FncRxfWb+/xRJmoXpqDokw8CYnEcxMg40HGKmMIR3NG6kuzM2fv7H9dVtYeQKCu0jBF3/a2oEuh2CVCUT9AeCOwQkD+LUqJk7OYvqZMyg9NQuh+cVsEC/msezVm583jTY/rK7fY6rkw6lOAjwDY9Sd7WBydgr1E3X4T/gIxym54uh8+x067btGpKNzFhHV2j84YBkR4IYV2JKDUWVjUXdSwC95ODtdR3WigkrgoeaNIfpxFQc795nkWcsidi93H/fguB6CSohjT06BaQWivmhhLCih79ko8RQbH97Eu88vYOWtt/Hw3jpkll12lBSNJCVC/RA8TWFy2dIhtOUSw4RKpFh9/wNs3P4Sw24X0cY6FBcUrCA4b1hKylxnKCGQ9A9xuH8APhxCxEdIOg9x550lrN1aQf/3PxBtbhLhBsym9iwLWnBQArHnOQ5UNiq2HBzRyYuTkxcU4RhFEZJHvxWuYdRqfvGCEJKLPSvt9ZZLzEAM4iKjJiSKTn7Ux7Czh/jnLbpHcMdrsIgTy3ULBEHtGCGXy/apc892ILLWo+1NlnQJfpIR9D2M6C6pFfIIPN9H5Xi9UCYvZOfyzpw0MOYV69M331hTnC/NTE8R7AFEtE8KGHIXPSQtGQJOuYz66adJVknVc280cg8tba7cWius3Jg/v8xgLpQdpxFHPchcDWrDkCcMBYlhjOjBNhR9r9aPY8wrfUXQFnq//iKKBLvf3xUnzjRvEEdTYbl0linJ/ibVECe20SgReePVmrZse4mwLTz45nYxTP8b5+aVF5payhbJe4lOGudC5l1ybJuqXtu50/7XOAN/Ar01xcqF8C92AAAAAElFTkSuQmCC" />
    <meta name='viewport' content='width=device-width, initial-scale=1'>
    
    <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.4/jquery.min.js" crossorigin="anonymous"></script>
    
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/5.2.3/css/bootstrap.min.css" crossorigin="anonymous">
    <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/2.11.6/umd/popper.min.js" crossorigin="anonymous"></script>
    <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/5.2.3/js/bootstrap.min.js" crossorigin="anonymous"></script>
    
    <link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.8.2/css/all.css" crossorigin="anonymous">
    
    <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&display=swap">
    
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/mdbootstrap/4.20.0/css/mdb.min.css">
    <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/mdbootstrap/4.20.0/js/mdb.min.js"></script>
    
    <link rel="stylesheet" href="https://cdn.datatables.net/1.10.23/css/dataTables.bootstrap4.min.css" crossorigin="anonymous">
    <script type="text/javascript" src="https://cdn.datatables.net/1.10.23/js/jquery.dataTables.min.js" crossorigin="anonymous"></script>
    <script type="text/javascript" src="https://cdn.datatables.net/1.10.23/js/dataTables.bootstrap4.min.js" crossorigin="anonymous"></script>
    <style type="text/css">
        body{padding-top:3.7rem;overflow-x:hidden}.table code{overflow-wrap:break-word;word-break:break-word;hyphens:auto}.table>tbody>tr>th{vertical-align:middle}.table>tbody>tr>td p{line-height:100%}#report>tbody>tr>td table td+td{width:50%}#report>tbody>tr{cursor:pointer}#report .dataTables_wrapper{cursor:auto}.dataTables_wrapper{margin-top:1rem}.badge-fileinfo{color:#222!important;background-color:rgba(0,0,0,.05)!important}.pagination .page-item.active .page-link{border-radius:100%;width:35px;height:35px;text-align:center;line-height:35px;padding:0}#back-top{display:none;position:fixed;bottom:20px;border-radius:100%;right:30px;z-index:99;border:none;outline:0;color:#fff;cursor:pointer;vertical-align:middle;padding:0;line-height:50px;font-size:18px;height:50px;width:50px}#back-top:hover{background-color:#555!important}
    </style>
    <script type="text/javascript">
        function expandAll(){$("#report .dataTables_wrapper").show()}function collapseAll(){$("#report .dataTables_wrapper").hide()}function scrollToTop(){document.body.scrollTop=0,document.documentElement.scrollTop=0}!function(o){o(function(){o("#report tr").click(function(t){o(this).find("#report tr table, .dataTables_wrapper").toggle()}),o("#report tr table, #report .dataTables_wrapper").click(function(o){o.stopPropagation()}),window.onscroll=function(){document.body.scrollTop>20||document.documentElement.scrollTop>20?o("#back-top").show():o("#back-top").hide()}})}(jQuery);
    </script>
</head>
<body>
    <nav class="navbar navbar-dark bg-dark fixed-top">
        <div class="container-fluid">
            <span class="navbar-brand">
                <a href="https://github.com/marcocesarato/PHP-Antimalware-Scanner" class="text-white" target="_blank">
                    <i class="fab fa-github mr-3"></i>
                    PHP Antimalware Scanner
                </a>
            </span>
            <span>
                <button class="btn btn-sm btn-primary rounded-pill" onclick="expandAll()"><i class="fas fa-expand mr-3"></i> Expand All</button>
                <button class="btn btn-sm btn-danger rounded-pill" onclick="collapseAll()"><i class="fas fa-compress mr-3"></i> Collapse All</button>
                <a href="https://github.com/marcocesarato/PHP-Antimalware-Scanner" target="_blank">
                    <button class="btn btn-sm btn-secondary rounded-pill"><i class="fab fa-github mr-3"></i> Github</button>
                </a>
            </span>
        </div>
    </nav>
    <div class="jumbotron p-3 text-white bg-secondary">
        <div class="container">
            <h1 class="display-3">Report</h1>
            <p>
                <b>Version:</b> {VERSION}<br>
                <b>Scan date:</b> {DATE}<br>
                <b>Files analyzed:</b> {COUNT} <b>| Files infected:</b> {INFECTED}
            </p>
        </div>
    </div>
    <div class="container">
        {CONTENTS}
    </div>
    <button onclick="scrollToTop()" id="back-top" class="bg-primary"><i class="fas fa-angle-up"></i></button>
  </body>
</html><?php

namespace AMWScan\Templates;

class Table
{
    /**
     * @var string
     */
    private $tableId;
    /**
     * @var string
     */
    private $tableClass;
    /**
     * @var string
     */
    private $headerId;
    /**
     * @var string
     */
    private $headerClass;
    /**
     * @var bool
     */
    private $isDatatable;

/**
     * @var array
     */
    private $data = [];
    /**
     * @var array
     */
    private $header = [];

/**
     * Constructor for table class.
     *
     * @param string $id id name for this table
     * @param string $class class name for this table
     * @param bool $isDatatable is datatable
     */
    public function __construct($id, $class = null, $isDatatable = false)
    {
        $this->tableId = $id;
        if ($class !== null) {
            $this->tableClass = "class=\"$class\"";
        }
        $this->isDatatable = $isDatatable;
    }

/**
     * Setter for table class name.
     *
     * @param string $class class name
     */
    public function setTableClass($class)
    {
        $this->tableClass = "class=\"$class\"";
    }

/**
     * Setter for table id name.
     *
     * @param string $id id name
     */
    public function setTableId($id)
    {
        $this->tableId = $id;
    }

/**
     * Setter for thead class name.
     *
     * @param string $class class name
     */
    public function setHeaderClass($class)
    {
        $this->headerClass = "class=\"$class\"";
    }

/**
     * Setter for thead id name.
     *
     * @param string $id id name
     */
    public function setHeaderId($id)
    {
        $this->headerId = "id=\"$id\"";
    }

/**
     * @param array $data
     */
    public function setData($data)
    {
        $this->data = $data;
    }

/**
     * @param array $row
     */
    public function addRow($row)
    {
        $this->data[] = $row;
    }

/**
     * @param array $header
     */
    public function setHeader($header)
    {
        $this->header = $header;
    }

/**
     * Get the table html.
     *
     * @return string
     */
    public function getHTML()
    {
        $table = "<table id=\"$this->tableId\" $this->tableClass>";

if (!empty($this->header)) {
            $table .= "<thead $this->headerId $this->headerClass><tr>";
            foreach ($this->header as $header) {
                $table .= "<th>$header</th>";
            }
            $table .= '</tr></thead>';
        }

$table .= '<tbody>';
        foreach ($this->data as $row) {
            $table .= '<tr>';
            foreach ($row as $col) {
                $table .= "<td>$col</td>";
            }
            $table .= '</tr>';
        }

$table .= '</tbody></table>';

if ($this->isDatatable) {
            $table .= '<script type="text/javascript">$("#' . $this->tableId . '").DataTable();</script>';
        }

return $table;
    }
}
<?php
/**
 * PHP Antimalware Scanner.
 *
 * @author Marco Cesarato <cesarato.developer@gmail.com>
 * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License
 *
 * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner
 */

namespace AMWScan\Templates;

use AMWScan\CodeMatch;
use AMWScan\Path;
use AMWScan\Scanner;

class Report
{
    /**
     * @var string
     */
    protected $dateFormat = 'Y-m-d H:i:s';
    /**
     * @var string
     */
    protected $dateFileFormat = 'Ymd-His';
    /**
     * @var array
     */
    protected $data;
    /**
     * @var string[]
     */
    protected $formatsText = ['text', 'txt', 'log', 'logs'];
    /**
     * @var string[]
     */
    protected $formatsHTML = ['html', 'htm'];

/**
     * @param array $data
     */
    public function setData($data)
    {
        $this->data = $data;
    }

/**
     * Save report.
     *
     * @param $output
     * @param string $format
     *
     * @return string
     */
    public function save($output, $format = 'html')
    {
        $scanBasename = basename(Scanner::getPathScan());
        $scanBasename = strtolower($scanBasename);
        $scanBasename = str_replace('_', '-', $scanBasename);

$output = str_replace(
            [
                '{DATE}',
                '{DIRNAME}',
            ],
            [
                date($this->dateFileFormat),
                $scanBasename,
            ],
            $output
        );

// Textual report
        if (in_array($format, $this->formatsText)) {
            if (!preg_match('/[\S][.](' . implode('|', $this->formatsText) . ')$/', $output)) {
                $output .= '.log';
            }

return $this->saveText($output);
        }

// Html report
        if (in_array($format, $this->formatsHTML) &&
            !preg_match('/[\S][.](' . implode('|', $this->formatsHTML) . ')$/', $output)) {
            $output .= '.html';
        }

// Default
        return $this->saveHTML($output);
    }

/**
     * Save report with html format.
     *
     * @param $output
     *
     * @return string
     */
    protected function saveHTML($output)
    {
        $template = __DIR__ . '/Report.html';
        $content = file_get_contents($template);
        $mainContent = '<h3>No malware founds!</h3>';

if (!empty($this->data['results'])) {
            $mainTable = new Table('report', 'datatable container table table-bordered');
            $header = [
                'Description',
                'Match',
            ];
            $num = 0;
            foreach ($this->data['results'] as $filePath => $items) {
                $dangerous = 0;
                $warnings = 0;
                $rows = [];
                foreach ($items as $item) {
                    $badges = [];
                    if (!empty($item['line'])) {
                        $badges[] = '<span class="badge badge-pill badge-secondary py-1 px-2 ml-1 shadow-none">Line: ' . $item['line'] . '</span>';
                    }

if (!empty($item['level'])) {
                        switch ($item['level']) {
                            case CodeMatch::WARNING:
                                $warnings++;
                                $badges[] = '<span class="badge badge-pill badge-warning py-1 px-2 ml-1 shadow-none">Warning</span>';
                                break;
                            case CodeMatch::DANGEROUS:
                                $dangerous++;
                                $badges[] = '<span class="badge badge-pill badge-danger py-1 px-2 ml-1 shadow-none">Dangerous</span>';
                                break;
                        }
                    }

$description = '-';
                    if (isset($item['description'])) {
                        $description = '<p>' . htmlentities($item['description']) . '</p>';

if (isset($item['link'])) {
                            $links = explode(',', $item['link']);
                            foreach ($links as $key => $link) {
                                $links[$key] = '<a href="' . $link . '" target="_blank" class="text-primary">' . $link . '</a>';
                            }
                            $description .= '<p><i>[' . implode(', ', $links) . ']</i></p>';
                        }
                    }

$maxLength = 500;
                    $match = trim($item['match']);
                    $match = strlen($match) > $maxLength ? substr($match, 0, $maxLength) . '...' : $match;
                    $match = highlight_string('<?php ' . $match, true);
                    $match = str_replace('&lt;?php&nbsp;', '', $match);

$rows[] = [
                        '<p><b>' . ucfirst($item['type']) . ' ' . htmlentities($item['key']) . ' ' . implode(' ', $badges) . '</b></p>' .
                        $description,
                        '<code>' . $match . '</code>',
                    ];
                }
                usort($rows, function ($item1, $item2) {
                    if ($item1[0] === $item2[0]) {
                        return 0;
                    }

return $item1[0] < $item2[0] ? -1 : 1;
                });
                $table = new Table('file_' . $num, 'table container table-sm table-striped table-borderless', true);
                $table->setHeader($header);
                $table->setData($rows);
                $tableContent = $table->getHTML();
                $fileSize = Path::getFilesize($filePath);
                $fileCreateDate = date($this->dateFormat, filemtime($filePath));
                $fileModifiedDate = date($this->dateFormat, filectime($filePath));

$badges = [];
                $badges[] = '<span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Size: ' . $fileSize . '</span>';
                $badges[] = '<span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Created: ' . $fileCreateDate . '</span>';
                $badges[] = '<span class="badge badge-pill badge-fileinfo py-2 px-3 mr-1 shadow-none">Modified: ' . $fileModifiedDate . '</span>';

if ($warnings > 0) {
                    $badges[] = '<span class="badge badge-pill badge-warning py-2 px-3 mr-1 shadow-none">Warns: ' . $warnings . '</span>';
                }

if ($dangerous > 0) {
                    $badges[] = '<span class="badge badge-pill badge-danger py-2 px-3 mr-1 shadow-none">Dangers: ' . $dangerous . '</span>';
                }

$rowContent = '<p><i class="fas fa-file text-primary mr-2"></i> ' . $filePath . '</p>' . implode(' ', $badges);
                $rowContent .= '<br>' . $tableContent;

$mainTable->addRow([$rowContent]);
                $num++;
            }
            $mainContent = $mainTable->getHTML();
        }

$content = str_replace(
            [
                '{VERSION}',
                '{DATE}',
                '{COUNT}',
                '{INFECTED}',
                '{CONTENTS}',
            ],
            [
                Scanner::getVersion(),
                date($this->dateFormat),
                $this->data['count'],
                count($this->data['results']),
                $mainContent,
            ],
            $content
        );

file_put_contents($output, $content);

return $output;
    }

/**
     * Save report with text format.
     *
     * @param $output
     *
     * @return string
     */
    protected function saveText($output)
    {
        file_put_contents($output, $this->data['content']);

return $output;
    }
}
<?php

namespace AMWScan;

class CodeMatch
{
    const DANGEROUS = 'danger';
    const WARNING = 'warn';

/**
     * Get PHP code parts contained on the text.
     *
     * @param $content
     *
     * @return array
     */
    public static function getCode($content)
    {
        preg_match_all("/<\?(?:php)?(.*)(?!\B\"[^\"]*)(\?>(?=([^\"]*\"[^\"]*\")*[^\"]*$)|$)/six", $content, $codeParts, PREG_SET_ORDER);

return empty($codeParts) ? [] : $codeParts;
    }

/**
     * Get match line number.
     *
     * @param $lastMatch
     * @param $contentRaw
     *
     * @return int|null
     */
    public static function getLineNumber($lastMatch, $contentRaw)
    {
        $lineNumber = null;
        if (empty($lastMatch)) {
            return null;
        }
        @preg_match('/' . preg_quote($lastMatch, '/') . '/', $contentRaw, $lineMatch, PREG_OFFSET_CAPTURE);
        if (!empty($lineMatch[0][1])) {
            $lineNumber = count(explode("\n", substr($contentRaw, 0, $lineMatch[0][1])));
        }

return $lineNumber;
    }

/**
     * Get console pattern found match output text.
     *
     * @param $type
     * @param $name
     * @param $description
     * @param $match
     * @param null $line
     *
     * @return string
     */
    public static function getText($type, $name, $description, $match, $line = null)
    {
        $maxLengthMatch = 500;
        $prefix = ucfirst($type) . ' (' . $name . ')';
        if (!empty($line)) {
            $prefix .= ' [line ' . $line . ']';
        }
        $shortMatch = trim($match);
        $shortMatch = str_replace(PHP_EOL, ' ', $shortMatch);
        $shortMatch = strlen($shortMatch) > $maxLengthMatch ? substr($shortMatch, 0, $maxLengthMatch) . '...' : $match;
        $shortMatch = preg_replace('/[\s]+/', ' ', $shortMatch);

return $matchDescription = '[!] ' . trim($prefix) . "\n    - " . $description . "\n      => " . $shortMatch;
    }

/**
     * Generate regex for function pattern.
     *
     * @param $func
     *
     * @return string
     */
    public static function patternFunction($func)
    {
        return "/(?:^|[\s\r\n]+|[^a-zA-Z0-9_>]+)(" . preg_quote($func, '/') . "[\s\r\n]*$(?<=\().*(?=$)\))/si";
    }

/**
     * Clean function match result.
     *
     * @param $match
     *
     * @return string|null
     */
    public static function cleanFunctionResult($match)
    {
        return preg_replace("/(?:.*?)([a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff]*[\s\r\n]*$(?<=\().*(?=$)\))(?:.*)/si", '$1', $match);
    }
}
<?php

namespace AMWScan;

use AMWScan\Abstracts\SingletonAbstract;
use RuntimeException;

class Cache extends SingletonAbstract
{
    /**
     * Cache.
     *
     * @var array
     */
    protected static $cache;

/**
     * Cache file extension.
     *
     * @var string
     */
    protected static $ext = 'cache';

/**
     * Temp dir.
     *
     * @var string
     */
    protected $tempdir;

/**
     * Cache constructor.
     */
    protected function __construct()
    {
        parent::__construct();
        $tempdir = sys_get_temp_dir() . DIRECTORY_SEPARATOR . Scanner::getLowerName() . DIRECTORY_SEPARATOR . 'cache' . DIRECTORY_SEPARATOR;

if (!is_dir($tempdir) && (!mkdir($tempdir, 0777, true) && !is_dir($tempdir))) {
            throw new RuntimeException(sprintf('Temp Directory "%s" was not created', $tempdir));
        }

$this->tempdir = $tempdir;
    }

/**
     * Set cache item.
     *
     * @param string $key
     * @param mixed $value
     * @param int $ttl
     *
     * @return bool
     */
    public function set($key, $value, $ttl = 3600)
    {
        $key = $this->key($key);

$data = ['ttl' => $ttl > 0 ? time() + $ttl : $ttl, 'data' => $value];

if (!Scanner::isCacheEnabled()) {
            self::$cache[$key] = $data;

return true;
        }

$fileData = '<?php return ' . var_export($data, true) . ';';
        if (file_put_contents($this->tempdir . $key . '.' . self::$ext, $fileData) !== false) {
            self::$cache[$key] = $data;

return true;
        }

return false;
    }

/**
     * Update time to live.
     *
     * @param string $key
     * @param int $ttl
     *
     * @return bool
     */
    public function touch($key, $ttl = 3600)
    {
        if (!Scanner::isCacheEnabled()) {
            return true;
        }

if ($data = $this->get($key)) {
            return $this->set($key, $data, $ttl);
        }

return false;
    }

/**
     * Get cache item.
     *
     * @param string $key
     * @param mixed $default
     *
     * @return mixed
     */
    public function get($key, $default = null)
    {
        $key = $this->key($key);
        $file = $this->tempdir . $key . '.' . self::$ext;

$data = false;
        if (isset(self::$cache[$key])) {
            $data = self::$cache[$key];
        } elseif (Scanner::isCacheEnabled() && is_file($file)) {
            $data = include $file;
            self::$cache[$key] = $data;
        }

if ($data !== false) {
            if (!empty($data)) {
                if (isset($data['ttl'], $data['data'])) {
                    if ($data['ttl'] <= 0 || $data['ttl'] >= time()) {
                        return $data['data'];
                    }

$this->deleteItem($file);
                }
            } else {
                $this->deleteItem($file);
            }
        }

return $default;
    }

/**
     * Clean cache.
     *
     * @return bool
     */
    public function flush()
    {
        return $this->deleteRegex();
    }

/**
     * Delete cache item.
     *
     * @param string $key
     *
     * @return bool
     */
    public function delete($key)
    {
        $key = $this->key($key);

return $this->deleteItem($this->tempdir . $key);
    }

/**
     * Delete item cache by regex.
     *
     * @param string $pattern
     *
     * @return bool
     */
    public function deleteRegex($pattern = '*')
    {
        $return = true;

foreach (glob($this->tempdir . $pattern, GLOB_NOSORT | GLOB_BRACE) as $cacheFile) {
            if (!$this->deleteItem($cacheFile)) {
                $return = false;
            }
        }

return $return;
    }

/**
     * Generate key.
     *
     * @see https://stackoverflow.com/a/42058764
     *
     * @param string $key
     *
     * @return string
     */
    protected function key($key)
    {
        $filename = preg_replace(
            '~' .
            '[<>:"/\\|?*]|' .            // file system reserved https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words
            '[\x00-\x1F]|' .             // control characters http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247%28v=vs.85%29.aspx
            '[\x7F\xA0\xAD]|' .          // non-printing characters DEL, NO-BREAK SPACE, SOFT HYPHEN
            '[#\[\]@!$&\'()+,;=]|' .     // URI reserved https://tools.ietf.org/html/rfc3986#section-2.2
            '[{}^\~`]' .                 // URL unsafe characters https://www.ietf.org/rfc/rfc1738.txt
            '~x',
            '-',
            $key
        );
        // avoids ".", ".." or ".hiddenFiles"
        $filename = ltrim($filename, '.-');
        // maximize filename length to 255 bytes http://serverfault.com/a/9548/44086

// reduce consecutive characters
        $filename = preg_replace([
            '/ +/', // "file   name.zip" becomes "file-name.zip"
            '/_+/', // "file___name.zip" becomes "file-name.zip"
            '/-+/', // "file---name.zip" becomes "file-name.zip"
        ], '-', $filename);
        $filename = preg_replace([
            '/-*\.-*/',  // "file--.--.-.--name.zip" becomes "file.name.zip"
            '/\.{2,}/',  // "file...name..zip" becomes "file.name.zip"
        ], '.', $filename);
        // lowercase for windows/unix interoperability http://support.microsoft.com/kb/100625
        $encoding = mb_detect_encoding($filename);
        $encoding = ($encoding && $encoding !== 'AUTO') ? $encoding : 'UTF-8';
        $filename = mb_strtolower($filename, $encoding);
        // ".file-name.-" becomes "file-name"
        $filename = trim($filename, '.-');

$ext = pathinfo($filename, PATHINFO_EXTENSION);
        $encoding = mb_detect_encoding($filename);
        $encoding = ($encoding && $encoding !== 'AUTO') ? $encoding : 'UTF-8';
        $filename = mb_strcut(pathinfo($filename, PATHINFO_FILENAME), 0, 255 - ($ext !== '' ? strlen($ext) + 1 : 0), $encoding) . ($ext !== '' ? '.' . $ext : '');

return trim($filename, '.-_');
    }

/**
     * Delete a item.
     *
     * @param string $item
     *
     * @return bool
     */
    private function deleteItem($item)
    {
        unset(self::$cache[basename($item)]);

clearstatcache(true, $item);

if (file_exists($item)) {
            if (!unlink($item)) {
                return file_put_contents($item, '') !== false;
            }

clearstatcache(true, $item);
        }

return true;
    }
}
<?php

namespace AMWScan;

use AMWScan\Console\Argv;
use AMWScan\Console\CLI;
use AMWScan\Templates\Report;

/**
 * Class Application.
 */
class Scanner
{
    /**
     * App name.
     *
     * @var string
     */
    public static $name = 'AMWScan';

/**
     * App full name.
     *
     * @var string
     */
    public static $fullname = 'PHP Antimalware Scanner';

/**
     * App description.
     *
     * @var string
     */
    public static $description = 'A tool to scan PHP files and analyze your project to find any malicious code inside it.';

/**
     * App author.
     *
     * @var string
     */
    public static $author = 'Marco Cesarato';

/**
     * Version.
     *
     * @var string
     */
    public static $version = '0.15.1';

/**
     * Repo url.
     *
     * @var string
     */
    public static $repoUrl = 'https://github.com/marcocesarato/PHP-Antimalware-Scanner';

/**
     * Version url.
     *
     * @var string
     */
    public static $latestVersionUrl = 'https://raw.githubusercontent.com/marcocesarato/PHP-Antimalware-Scanner/master/dist/version';

/**
     * Latest release url.
     *
     * @var string
     */
    protected static $latestReleaseUrl = 'https://raw.githubusercontent.com/marcocesarato/PHP-Antimalware-Scanner/master/dist/scanner';

/**
     * @var string
     */
    public static $dateFormat = 'Y-m-d';

/**
     * Root path.
     *
     * @var string
     */
    public static $root = './';

/**
     * Quarantine path.
     *
     * @var string
     */
    public static $pathQuarantine = '/scanner-quarantine/';

/**
     * Backup path.
     *
     * @var string
     */
    public static $pathBackups = '/scanner-backups/';

/**
     * Deobfuscate path.
     *
     * @var string
     */
    public static $pathDeobfuscate = '/deobfuscated/';

/**
     * Logs Path.
     *
     * @var string
     */
    public static $pathLogs = '/scanner.log';

/**
     * Infected logs path.
     *s.
     *
     * @var string
     */
    public static $pathReport = '/scanner-report_{DIRNAME}_{DATE}';

/**
     * Whitelist path.
     *
     * @var string
     */
    public static $pathWhitelist = '/scanner-whitelist.json';

/**
     * Path to scan.
     *
     * @var string
     */
    public static $pathScan = './';

/**
     * Max filesize.
     *
     * @var int
     */
    public static $maxFilesize = -1;

/**
     * File extensions to scan.
     *
     * @var array
     */
    public static $extensions = [
        'htaccess',
        'php',
        'php3',
        'ph3',
        'php4',
        'ph4',
        'php5',
        'ph5',
        'php7',
        'ph7',
        'php8',
        'ph8',
        'phtm',
        'phtml',
        'ico',
        'css',
        'ccss',
    ];

/**
     * Default no to scan all files.
     */
    public static $scanAll = false;

/**
     * Arguments.
     *
     * @var Argv
     */
    public static $argv = [];

/**
     * Whitelist.
     *
     * @var array
     */
    public static $whitelist = [];

/**
     * Functions.
     *
     * @var array
     */
    public static $functions = [];

/**
     * Functions encoded.
     *
     * @var array
     */
    public static $functionsEncoded = [];

/**
     * Functions encoded values.
     *
     * @var array
     */
    protected static $functionsEncodedValues = [];

/**
     * Exploits.
     *
     * @var array
     */
    public static $exploits = [];

/**
     * Settings.
     *
     * @var array
     */
    public static $settings = [
        'scan-exploits' => true,
        'scan-functions' => true,
        'scan-signatures' => true,
    ];

/**
     * Report.
     *
     * @var array
     */
    protected static $report = [
        'scanned' => 0,
        'detected' => 0,
        'removed' => [],
        'ignored' => [],
        'edited' => [],
        'quarantine' => [],
        'whitelist' => [],
        'infectedFound' => [],
    ];

/**
     * Report file format.
     *
     * @var string
     */
    protected static $reportFormat = 'html';

/**
     * Ignore paths.
     *
     * @var array
     */
    public static $ignorePaths = [];

/**
     * Filter paths.
     *
     * @var array
     */
    public static $filterPaths = [];

/**
     * Prompt.
     *
     * @var string
     */
    public static $prompt;

/**
     * Interrupt.
     *
     * @var bool
     */
    public $interrupt = false;

/**
     * @var string
     */
    public $lastError;

protected static $inited = false;

/**
     * Application constructor.
     */
    public function __construct()
    {
        if (!self::isInitialized()) {
            if (function_exists('gc_enable') && (function_exists('gc_enable') && !gc_enabled())) {
                gc_enable();
            }

if (self::$root === './') {
                self::$root = Path::getCurrentDir();
            }

if (self::$pathScan === './') {
                self::$pathScan = Path::getCurrentDir();
            }

self::$pathQuarantine = Path::get(self::$root . self::$pathQuarantine);
            self::$pathLogs = Path::get(self::$root . self::$pathLogs);
            self::$pathWhitelist = Path::get(self::$root . self::$pathWhitelist);
            self::$pathReport = Path::get(self::$root . self::$pathReport);
            self::$pathBackups = Path::get(self::$root . self::$pathBackups);
            self::$pathDeobfuscate = Path::get(self::$root . self::$pathDeobfuscate);

self::$inited = true;
        }
    }

/**
     * Initialize.
     */
    private function init()
    {
        // Load whitelist
        if (file_exists(self::$pathWhitelist)) {
            self::$whitelist = file_get_contents(self::$pathWhitelist);
            self::$whitelist = @json_decode(self::$whitelist, true);
            if (!is_array(self::$whitelist)) {
                self::$whitelist = [];
            }
        }
    }

/**
     * Run application.
     *
     * @param null $args
     *
     * @return bool|object
     */
    public function run($args = [])
    {
        $this->interrupt = false;

try {
            // Print header
            CLI::header();
            // Initialize arguments
            $this->arguments($args);
            // Initialize
            $this->init();
            // Initialize modes
            $this->modes();

// Start scanning
            CLI::displayLine('Start scanning...');

CLI::writeLine('Scan date: ' . date(self::$dateFormat . ' H:i:s'));
            CLI::writeLine('Scanning ' . self::$pathScan, 2);

// Mapping files
            if (self::isVerifierEnabled()) {
                CLI::writeLine('Mapping and retrieving checksums, please wait...', 2);
            } else {
                CLI::writeLine('Mapping, please wait...', 2);
            }

$iterator = $this->mapping();

// Counting files
            $filesCount = iterator_count($iterator);
            CLI::writeLine('Found ' . $filesCount . ' files to check', 2);
            CLI::writeLine('Checking files...', 2);
            CLI::progress(0, $filesCount);

if ($this->interrupt) {
                return false;
            }

// Scan all files
            $this->scan($iterator);

// Scan finished
            CLI::writeBreak(2);
            CLI::write('Scan finished!', 'green');
            CLI::writeBreak(3);

// Print summary
            $this->summary();

return self::getReport();
        } catch (\Exception $e) {
            $this->interrupt = true;
            $this->setLastError($e->getMessage());
            CLI::writeBreak();
            CLI::writeLine($e->getMessage(), 1, 'red');
        }

return true;
    }

/**
     * Initialize application arguments.
     *
     * @param array $args
     */
    private function arguments($args = [])
    {
        $isCLI = self::isCli();
        self::$argv = new Argv(self::getLowerName(), self::getDescription());

// Arguments
        self::$argv->addArgument('path', ['var_args' => true, 'default' => Path::getCurrentDir(), 'help' => 'Define the path of the file or directory to scan']);

// Flags
        self::$argv->addFlag('lite', ['alias' => '-l', 'default' => false, 'help' => 'Running on lite mode help to have less false positive on WordPress and others platforms enabling exploits mode and removing some common exploit pattern']);
        self::$argv->addFlag('help', ['alias' => ['-h', '-?'], 'default' => false, 'help' => 'Check only functions and not the exploits']);
        self::$argv->addFlag('log', ['default' => self::$pathLogs, 'has_value' => true, 'value_name' => 'path', 'help' => 'Write a log file on the specified file path']);
        self::$argv->addFlag('backup', ['alias' => '-b', 'default' => false, 'help' => 'Make a backup of every touched files']);
        self::$argv->addFlag('offset', ['default' => null, 'has_value' => true, 'help' => 'Set file mapping offset']);
        self::$argv->addFlag('limit', ['default' => null, 'has_value' => true, 'help' => 'Set file mapping limit']);
        self::$argv->addFlag('report', ['alias' => '-r', 'default' => false, 'help' => "Report scan only mode without check and remove malware (like --auto-skip).\nIt also write a report with all malware paths found"]);
        self::$argv->addFlag('report-format', ['default' => false, 'has_value' => true, 'value_name' => 'format', 'help' => 'Report format (html|txt)']);
        self::$argv->addFlag('version', ['alias' => '-v', 'default' => false, 'help' => 'Get version number']);
        self::$argv->addFlag('update', ['alias' => '-u', 'default' => false, 'help' => 'Update to last version']);
        self::$argv->addFlag('only-signatures', ['alias' => '-s', 'default' => false, 'help' => "Check only signatures and not the functions or exploits.\nThis is recommended for WordPress or others platforms"]);
        self::$argv->addFlag('only-exploits', ['alias' => '-e', 'default' => false, 'help' => 'Check only exploits and not the functions']);
        self::$argv->addFlag('only-functions', ['alias' => '-f', 'default' => false, 'help' => 'Check only functions and not the exploits']);
        self::$argv->addFlag('defs', ['default' => false, 'help' => 'Get default definitions exploit and functions list']);
        self::$argv->addFlag('defs-exploits', ['default' => false, 'help' => 'Get default definitions exploits list']);
        self::$argv->addFlag('defs-functions', ['default' => false, 'help' => 'Get default definitions functions lists']);
        self::$argv->addFlag('defs-functions-encoded', ['default' => false, 'help' => 'Get default definitions functions encoded lists']);
        self::$argv->addFlag('exploits', ['default' => false, 'has_value' => true, 'help' => 'Filter exploits']);
        self::$argv->addFlag('ignore-exploits', ['default' => false, 'has_value' => true, 'help' => 'Ignore exploit/s, for multiple value separate with comma.']);
        self::$argv->addFlag('functions', ['default' => false, 'has_value' => true, 'help' => 'Define functions to search']);
        self::$argv->addFlag('whitelist-only-path', ['default' => false, 'help' => 'Check on whitelist only file path and not line number']);
        self::$argv->addFlag('max-filesize', ['default' => -1, 'has_value' => true, 'value_name' => 'filesize', 'help' => 'Set max filesize to scan']);
        self::$argv->addFlag('silent', ['default' => !$isCLI, 'help' => 'No output and prompt']);
        self::$argv->addFlag('ignore-paths', ['alias' => '--ignore-path', 'default' => null, 'has_value' => true, 'value_name' => 'paths', 'help' => "Ignore path/s, for multiple value separate with comma.\nWildcards are enabled ex. /path/*/cache or /path/*.log"]);
        self::$argv->addFlag('filter-paths', ['alias' => '--filter-path', 'default' => null, 'has_value' => true, 'value_name' => 'paths', 'help' => "Filter path/s, for multiple value separate with comma.\nWildcards are enabled ex. /path/*/htdocs or /path/*.php"]);
        self::$argv->addFlag('auto-clean', ['default' => false, 'help' => 'Auto clean code (without confirmation, use with caution)']);
        self::$argv->addFlag('auto-clean-line', ['default' => false, 'help' => 'Auto clean line code (without confirmation, use with caution)']);
        self::$argv->addFlag('auto-delete', ['default' => false, 'help' => 'Auto delete infected (without confirmation, use with caution)']);
        self::$argv->addFlag('auto-quarantine', ['default' => false, 'help' => 'Auto quarantine']);
        self::$argv->addFlag('auto-skip', ['default' => false, 'help' => 'Auto skip']);
        self::$argv->addFlag('auto-whitelist', ['default' => false, 'help' => 'Auto whitelist (if you sure that source isn\'t compromised)']);
        self::$argv->addFlag('auto-prompt', ['default' => null, 'has_value' => true, 'value_name' => 'prompt', 'help' => "Set auto prompt command .\nex. --auto-prompt=\"delete\" or --auto-prompt=\"1\" (alias of auto-delete)"]);
        self::$argv->addFlag('path-whitelist', ['default' => self::$pathWhitelist, 'has_value' => true, 'value_name' => 'path', 'help' => 'Set whitelist file']);
        self::$argv->addFlag('path-deobfuscate', ['default' => self::$pathDeobfuscate, 'has_value' => true, 'value_name' => 'path', 'help' => "Set debofuscated files path directory.\nIs recommended put files outside the public document path"]);
        self::$argv->addFlag('path-backups', ['default' => self::$pathBackups, 'has_value' => true, 'value_name' => 'path', 'help' => "Set backups path directory.\nIs recommended put files outside the public document path"]);
        self::$argv->addFlag('path-quarantine', ['default' => self::$pathQuarantine, 'has_value' => true, 'value_name' => 'path', 'help' => "Set quarantine path directory.\nIs recommended put files outside the public document path"]);
        self::$argv->addFlag('path-logs', ['default' => self::$pathLogs, 'has_value' => true, 'value_name' => 'path', 'help' => 'Set quarantine log file']);
        self::$argv->addFlag('path-report', ['default' => self::$pathReport, 'has_value' => true, 'value_name' => 'path', 'help' => "Set report log file path and name.\nNote that name will be appended with .log or .html extension."]);
        self::$argv->addFlag('disable-colors', ['alias' => ['--no-colors', '--no-color'], 'default' => false, 'help' => 'Disable CLI colors']);
        self::$argv->addFlag('disable-cache', ['alias' => '--no-cache', 'default' => false, 'help' => 'Disable Cache']);
        self::$argv->addFlag('disable-report', ['alias' => '--no-report', 'default' => !$isCLI, 'help' => 'Disable report generation']);
        self::$argv->addFlag('disable-checksum', ['alias' => ['--no-checksum', '--no-verify'], 'default' => false, 'help' => 'Disable checksum verifying for platforms/frameworks']);
        self::$argv->addFlag('scan-all', ['alias' => ['--all'], 'default' => false, 'help' => 'Check all files, regardless of extension']);
        // self::$argv->addFlag('deobfuscate', ['default' => false, 'help' => 'Deobfuscate directory']);

self::$argv->parse($args);

// Version
        if (isset(self::$argv['version']) && self::$argv['version']) {
            $this->interrupt();
        }

// Help
        if (isset(self::$argv['help']) && self::$argv['help']) {
            CLI::helper();
            $this->interrupt();
        }

// List exploits
        if (isset(self::$argv['defs']) && self::$argv['defs']) {
            CLI::helplist();
            $this->interrupt();
        }

// List exploits
        if (isset(self::$argv['defs-exploits']) && self::$argv['defs-exploits']) {
            CLI::helplist('exploits');
        }

// List functions
        if (isset(self::$argv['defs-functions']) && self::$argv['defs-functions']) {
            CLI::helplist('functions');
        }

// List functions encoded
        if (isset(self::$argv['defs-functions-encoded']) && self::$argv['defs-functions-encoded']) {
            CLI::helplist('functions-encoded');
        }

// Update
        if (isset(self::$argv['update']) && self::$argv['update']) {
            $this->update();
            $this->interrupt();
        }

// Silent
        if (isset(self::$argv['silent']) && self::$argv['silent']) {
            self::setSilentMode();
        }

// Backups
        if (isset(self::$argv['backup']) && self::$argv['backup']) {
            self::enableBackups();
        }

// Colors
        if (self::$argv['disable-colors']) {
            self::setColors(false);
        } elseif (function_exists('ncurses_has_colors')) {
            self::setColors(ncurses_has_colors());
        }

// Cache
        if (isset(self::$argv['disable-cache']) && self::$argv['disable-cache']) {
            self::disableCache();
        }

// Verifier
        if (isset(self::$argv['disable-checksum']) && self::$argv['disable-checksum']) {
            self::disableChecksum();
        }

// Max filesize
        if (isset(self::$argv['max-filesize']) && is_numeric(self::$argv['max-filesize'])) {
            self::setMaxFilesize(self::$argv['max-filesize']);
        }

// Write logs
        if (isset(self::$argv['log']) && !empty(self::$argv['log'])) {
            self::enableLogs();
            if (is_string(self::$argv['log'])) {
                self::setPathLogs(self::$argv['log']);
            }
        }

// Offset
        self::setOffset(0);
        if (isset(self::$argv['offset']) && is_numeric(self::$argv['offset'])) {
            self::setOffset((int)self::$argv['offset']);
        }

// Limit
        if (isset(self::$argv['limit']) && is_numeric(self::$argv['limit'])) {
            self::setLimit((int)self::$argv['limit']);
        }

// Path quarantine
        if (isset(self::$argv['path-quarantine']) && !empty(self::$argv['path-quarantine'])) {
            self::setPathQuarantine(self::$argv['path-quarantine']);
        }

// Path backups
        if (isset(self::$argv['path-backups']) && !empty(self::$argv['path-backups'])) {
            self::setPathBackups(self::$argv['path-backups']);
        }

// Path deobfuscate
        if (isset(self::$argv['path-deobfuscate']) && !empty(self::$argv['path-deobfuscate'])) {
            self::setPathDeobfuscate(self::$argv['path-deobfuscate']);
        }

// Path Whitelist
        if (isset(self::$argv['path-whitelist']) && !empty(self::$argv['path-whitelist'])) {
            self::setPathWhitelist(self::$argv['path-whitelist']);
        }

// Report mode
        self::setReportMode(isset(self::$argv['report']) && self::$argv['report']);

// Report
        if (isset(self::$argv['disable-report']) && self::$argv['disable-report']) {
            self::setReport(!self::$argv['disable-report']);
        }

// Deobfuscate mode
        if (isset(self::$argv['deobfuscate']) && self::$argv['deobfuscate']) {
            self::enableDeobfuscateMode();
            self::disableReport();
        }

// Path report
        if (isset(self::$argv['path-report']) && !empty(self::$argv['path-report'])) {
            self::setPathReport(self::$argv['path-report']);
        }

// Report format
        if (isset(self::$argv['report-format']) && !empty(self::$argv['report-format'])) {
            self::setReportFormat(self::$argv['report-format']);
        }

// Path logs
        if (isset(self::$argv['path-logs']) && !empty(self::$argv['path-logs'])) {
            self::setPathLogs(self::$argv['path-logs']);
        }

// Ignore paths
        if (isset(self::$argv['ignore-paths']) && !empty(self::$argv['ignore-paths'])) {
            $paths = explode(',', self::$argv['ignore-paths']);
            $ignorePaths = [];
            foreach ($paths as $path) {
                $ignorePaths[] = Path::get($path);
            }
            self::setIgnorePaths($ignorePaths);
        }

// Filter paths
        if (isset(self::$argv['filter-paths']) && !empty(self::$argv['filter-paths'])) {
            $paths = explode(',', self::$argv['filter-paths']);
            $filterPaths = [];
            foreach ($paths as $path) {
                $filterPaths[] = Path::get($path);
            }
            self::setFilterPaths($filterPaths);
        }

// Check on whitelist only file path and not line number
        if (isset(self::$argv['whitelist-only-path']) && self::$argv['whitelist-only-path']) {
            self::setOnlyPathWhitelistMode();
        }

// Check Filter exploits
        if (isset(self::$argv['exploits']) && self::$argv['exploits'] && is_string(self::$argv['exploits'])) {
            $exploits = [];
            $filtered = str_replace(["\n", "\r", "\t", ' '], '', self::$argv['exploits']);
            $filtered = @explode(',', $filtered);
            $filtered = array_map('trim', $filtered);
            if (!empty($filtered) && count($filtered) > 0) {
                foreach (Exploits::getAll() as $key => $value) {
                    if (in_array($key, $filtered, true)) {
                        $exploits[$key] = $value;
                    }
                }
                if (!empty($exploits) && count($exploits) > 0) {
                    CLI::writeLine('Exploit to search: ' . implode(', ', array_keys($exploits)));
                } else {
                    $exploits = [];
                }
            }
            self::setExploits($exploits);
        }

// Ignore exploits
        if (isset(self::$argv['ignore-exploits']) && !empty(self::$argv['ignore-exploits'])) {
            $exploits = [];
            $ignored = str_replace(["\n", "\r", "\t", ' '], '', self::$argv['ignore-exploits']);
            $ignored = @explode(',', $ignored);
            $ignored = array_map('trim', $ignored);
            if (!empty($ignored) && count($ignored) > 0) {
                foreach (Exploits::getAll() as $key => $value) {
                    if (!in_array($key, $ignored, true)) {
                        $exploits[$key] = $value;
                    }
                }
                if (!empty($exploits) && count($exploits) > 0) {
                    CLI::writeLine('Exploit to search: ' . implode(', ', array_keys($exploits)));
                } else {
                    $exploits = [];
                }
            }
            self::setExploits($exploits);
        }

// Check functions to search
        if (isset(self::$argv['functions']) && self::$argv['functions'] && is_string(self::$argv['functions'])) {
            $functions = str_replace(["\n", "\r", "\t", ' '], '', self::$argv['functions']);
            $functions = @explode(',', $functions);
            $functions = array_map('trim', $functions);
            if (!empty($functions) && count($functions) > 0) {
                CLI::writeLine('Functions to search: ' . implode(', ', $functions));
            } else {
                $functions = [];
            }
            self::setFunctions($functions);
        }

// Check if exploit mode is enabled
        if (isset(self::$argv['only-exploits']) && self::$argv['only-exploits']) {
            self::setOnlyExploitsMode();
        }

// Check if functions mode is enabled
        if (isset(self::$argv['only-functions']) && self::$argv['only-functions']) {
            self::setOnlyFunctionsMode();
        }

// Check if only signatures mode is enabled
        if (isset(self::$argv['only-signatures'])) {
            self::setOnlySignaturesMode();
        }

// Check if lite scan is enabled
        if (isset(self::$argv['lite']) && self::$argv['lite']) {
            self::enableLiteMode();
        }

// Prompt
        if (isset(self::$argv['auto-clean']) && self::$argv['auto-clean']) {
            self::setAutoClean();
        }

if (isset(self::$argv['auto-clean-line']) && self::$argv['auto-clean-line']) {
            self::setAutoCleanLine();
        }

if (isset(self::$argv['auto-delete']) && self::$argv['auto-delete']) {
            self::setAutoDelete();
        }

if (isset(self::$argv['auto-quarantine']) && self::$argv['auto-quarantine']) {
            self::setAutoQuarantine();
        }

if (isset(self::$argv['auto-whitelist']) && self::$argv['auto-whitelist']) {
            self::setAutoWhitelist();
        }

if (isset(self::$argv['auto-skip']) && self::$argv['auto-skip']) {
            self::setAutoSkip();
        }

if (isset(self::$argv['auto-prompt']) && !empty(self::$argv['auto-prompt'])) {
            self::setPrompt(self::$argv['auto-prompt']);
        }

// Check if logs and scan at the same time
        if (self::isLogEnabled() && self::isReportMode()) {
            self::disableLogs();
        }

// Check for path or functions as first argument
        $arg = self::$argv->arg(0);
        if (!empty($arg)) {
            $path = trim($arg);
            if (file_exists(realpath($path))) {
                self::setPathScan(realpath($path));
            }
        }
        // Should we scan each and any file?
        if (isset(self::$argv['scan-all']) && self::$argv['scan-all']) {
            self::setScanAll(true);
        }
    }

/**
     * Init application modes.
     */
    private function modes()
    {
        if (self::isOnlyFunctionsMode() && self::isOnlyExploitsMode() && self::isOnlySignaturesMode()) {
            $error = 'Can\'t be set flags --only-signatures, --only-functions and --only-exploits together!';
            CLI::writeLine($error, 2);
            $this->interrupt();
            $this->setLastError($error);
        }

if (self::isOnlyFunctionsMode() && self::isOnlySignaturesMode()) {
            $error = 'Can\'t be set both flags --only-signatures and --only-functions together!';
            CLI::writeLine($error, 2);
            $this->interrupt();
            $this->setLastError($error);
        }

if (self::isOnlySignaturesMode() && self::isOnlyExploitsMode()) {
            $error = 'Can\'t be set both flags --only-signatures and --only-exploits together!';
            CLI::writeLine($error, 2);
            $this->interrupt();
            $this->setLastError($error);
        }

if (self::isOnlyFunctionsMode() && self::isOnlyExploitsMode()) {
            $error = 'Can\'t be set both flags --only-functions and --only-exploits together!';
            CLI::writeLine($error, 2);
            $this->interrupt();
            $this->setLastError($error);
        }

// Malware Definitions
        if (self::isOnlyFunctionsMode() || (!self::isOnlyExploitsMode() && empty(self::$functions))) {
            // Functions to search
            self::setFunctions(Functions::getDefault());
        } elseif (!self::isOnlyExploitsMode() && !self::isLiteMode() && empty(self::$functions)) {
            CLI::writeLine('No functions to search');
        }

if (self::$argv['max-filesize'] > 0) {
            CLI::writeLine('Max filesize: ' . self::getMaxFilesize() . ' bytes', 2);
        }

// Exploits to search
        if (!self::isOnlyFunctionsMode() && empty(self::$exploits)) {
            self::setExploits(Exploits::getAll());
        }

if (self::isLiteMode()) {
            CLI::writeLine('Agile mode enabled');
        }

if (self::isReportMode()) {
            CLI::writeLine('Report scan mode enabled');
        }

if (self::isOnlyFunctionsMode()) {
            CLI::writeLine('Only function mode enabled');
            self::setExploits([]);
        }

if (self::isOnlyExploitsMode() && !self::isLiteMode()) {
            CLI::writeLine('Only exploit mode enabled');
            self::setFunctions([]);
            self::setFunctionsEncoded(Functions::getDangerous());
        }

if (self::isOnlySignaturesMode()) {
            CLI::writeLine('Only signatures mode enabled');
            self::setExploits([]);
            self::setFunctions([]);
        }
    }

/**
     * Map files.
     *
     * @return \ArrayIterator
     */
    public function mapping()
    {
        // Mapping files
        if (is_dir(self::$pathScan)) {
            $directory = new \RecursiveDirectoryIterator(self::$pathScan);
            $files = new \RecursiveIteratorIterator($directory, \RecursiveIteratorIterator::LEAVES_ONLY, \RecursiveIteratorIterator::CATCH_GET_CHILD);
            $filtered = new \CallbackFilterIterator($files, function ($cur) {
                $ignore = false;
                $wildcard = '.*?'; // '[^\\\\\\/]*'
                // Ignore
                foreach (self::$ignorePaths as $ignorePath) {
                    $ignorePath = preg_quote($ignorePath, ';');
                    $ignorePath = str_replace('\*', $wildcard, $ignorePath);
                    if (preg_match(';' . $ignorePath . ';i', $cur->getPathname())) {
                        $ignore = true;
                    }
                }
                // Filter
                foreach (self::$filterPaths as $filterPath) {
                    $filterPath = preg_quote($filterPath, ';');
                    $filterPath = str_replace('\*', $wildcard, $filterPath);
                    if (!preg_match(';' . $filterPath . ';i', $cur->getPathname())) {
                        $ignore = true;
                    }
                }

if (!$ignore
                    && $cur->isDir()) {
                    if (self::isVerifierEnabled()) {
                        Modules::init($cur->getPath());
                    }

return false;
                }

return
                    !$ignore
                    && $cur->isFile()
                    && (self::isScanAll() || in_array($cur->getExtension(), self::getExtensions(), true));
            });
            $mapping = [];

$mapped = 0;
            $count = iterator_count($filtered);

$iterator = $filtered;

if (self::isVerifierEnabled()) {
                unset($iterator);

CLI::writeBreak();
                CLI::writeLine('Verifying files checksum...', 2);

foreach ($filtered as $cur) {
                    CLI::progress($mapped++, $count);
                    if ($cur->isFile() && !Modules::isVerified($cur->getPathname())) {
                        $mapping[] = $cur;
                    }
                    CLI::progress($mapped, $count);
                }

$object = new \ArrayObject($mapping);
                $iterator = $object->getIterator();

CLI::writeBreak();
            }

return $iterator;
        }

$file = new \SplFileInfo(self::$pathScan);
        $obj = new \ArrayObject([$file]);

return $obj->getIterator();
    }

/**
     * Detect infected favicon.
     *
     * @return bool
     */
    public static function isInfectedFavicon($file)
    {
        // Case favicon_[random chars].ico
        $fileName = $file->getFilename();
        $fileExtension = $file->getExtension();

return ((strpos($fileName, 'favicon_') === 0) && ($fileExtension === 'ico') && (strlen($fileName) > 12)) || preg_match('/^\.[\w]+\.ico/i', trim($fileName));
    }

/**
     * Scan file.
     *
     * @return array
     */
    public function scanFile($info)
    {
        $patternFound = [];
        $filePath = $info->getPathname();

$deobfuscator = new Deobfuscator();
        $contentRaw = file_get_contents($filePath);
        $contentClean = php_strip_whitespace($filePath);
        $contentDeobfuscated = $deobfuscator->deobfuscate($contentClean);
        $contentDecoded = $deobfuscator->decode($contentDeobfuscated);

$contents = [
            'raw' => $contentRaw, // Original content
            'cleaned' => $contentClean, // Cleaned content
            'deobfuscated' => $contentDeobfuscated, // Deobfuscated content
            'decoded' => $contentDecoded, // Decoded content
        ];

/**
         * Scan exploits.
         */
        if (self::shouldScanExploits()) {
            foreach (self::$exploits as $key => $exploit) {
                $lastMatch = null;
                $pattern = $exploit['pattern'];
                $checkExploit = function ($match) use ($contentRaw, $exploit, $pattern, $key, &$patternFound) {
                    $type = 'exploit';
                    $lastMatch = $match[0];
                    $patternFoundKey = $type . $key;
                    $lineNumber = CodeMatch::getLineNumber($lastMatch, $contentRaw);
                    if ($lineNumber !== null) {
                        $patternFoundKey .= $lineNumber;
                    }
                    if (!empty($lastMatch)) {
                        $patternFound[$patternFoundKey] = [
                            'type' => $type,
                            'key' => $key,
                            'level' => $exploit['level'],
                            'output' => CodeMatch::getText($type, $key, $exploit['description'], $lastMatch, $lineNumber),
                            'description' => $exploit['description'],
                            'line' => $lineNumber,
                            'pattern' => $pattern,
                            'match' => $lastMatch,
                        ];
                        if (isset($exploit['link'])) {
                            $patternFound[$patternFoundKey]['link'] = $exploit['link'];
                        }
                    }
                };
                // Check exploits
                foreach ($contents as $content) {
                    if (@preg_match_all($pattern, $content, $matches, PREG_OFFSET_CAPTURE)) {
                        foreach ($matches[0] as $match) {
                            $checkExploit($match);
                        }
                    }
                }
            }
        }

/**
         * Scan definitions.
         */
        if (self::shouldScanSignatures()) {
            foreach (Signatures::getAll() as $key => $pattern) {
                $lastMatch = null;
                $regexPattern = '#' . $pattern . '#smiS';
                $checkDefinitions = function ($match) use ($contentRaw, $key, $regexPattern, &$patternFound) {
                    $type = 'sign';
                    $key = hash('crc32b', $key);
                    $lastMatch = $match[0];
                    $patternFoundKey = $type . $key;
                    $lineNumber = CodeMatch::getLineNumber($lastMatch, $contentRaw);
                    if ($lineNumber !== null) {
                        $patternFoundKey .= $lineNumber;
                    }
                    if (!empty($lastMatch)) {
                        $descriptionPrefix = 'Signature';
                        $description = 'Malware Signature (hash: ' . $key . ')';
                        $patternFound[$patternFoundKey] = [
                            'type' => $type,
                            'key' => $key,
                            'level' => CodeMatch::DANGEROUS,
                            'output' => CodeMatch::getText($descriptionPrefix, $key, $description, $lastMatch, $lineNumber),
                            'description' => $description,
                            'line' => $lineNumber,
                            'pattern' => $regexPattern,
                            'match' => $lastMatch,
                        ];
                    }
                };
                // Check definitions
                foreach ($contents as $content) {
                    if (@preg_match_all($regexPattern, $content, $matches, PREG_OFFSET_CAPTURE)) {
                        foreach ($matches[0] as $match) {
                            $checkDefinitions($match);
                        }
                    }
                }
            }
        }

/**
         * Scan functions.
         */
        if (self::shouldScanFunctions()) {
            // Comments are no needed to check function usage so remove raw content type
            unset($contents['raw']);
            $functions = array_merge(self::$functionsEncoded, self::$functions);
            foreach ($functions as $funcRaw) {
                $lastMatch = null;
                $func = preg_quote(trim($funcRaw), '/');
                $checkFunction = function (
                    $match,
                    $pattern,
                    $level = CodeMatch::WARNING,
                    $descriptionPrefix = '',
                    $functionType = ''
                ) use ($contentRaw, $funcRaw, &$patternFound) {
                    $type = 'function';
                    $suffix = '';
                    if (!empty($functionType)) {
                        $suffix = '_' . $functionType;
                    }
                    $lastMatch = CodeMatch::cleanFunctionResult($match[0]); // Clean match
                    $funcKey = $funcRaw . $suffix;
                    $patternFoundKey = $type . $funcKey;
                    $lineNumber = CodeMatch::getLineNumber($lastMatch, $contentRaw);
                    if ($lineNumber !== null) {
                        $patternFoundKey .= $lineNumber;
                    }
                    if (!empty($lastMatch) && empty($patternFound[$patternFoundKey])) {
                        $description = $descriptionPrefix . ' `' . $funcRaw . '`';
                        $patternFound[$patternFoundKey] = [
                            'type' => trim($type . ' ' . $functionType),
                            'key' => $funcKey,
                            'level' => $level,
                            'output' => CodeMatch::getText($type, $funcRaw, $description, $lastMatch, $lineNumber),
                            'description' => $description,
                            'line' => $lineNumber,
                            'pattern' => $pattern,
                            'match' => $lastMatch,
                            'link' => 'https://www.php.net/' . $funcRaw,
                        ];
                    }
                };

/**
                 * Functions.
                 */
                if (in_array($funcRaw, self::$functionsEncoded, true)) {
                    $encoders = [
                        'str_rot13',
                        'base64_decode',
                        'strrev',
                    ];
                    $regexPattern = CodeMatch::patternFunction($func);
                    foreach ($contents as $contentType => $content) {
                        $codeParts = CodeMatch::getCode($content);
                        foreach ($codeParts as $codePart) {
                            /**
                             * Raw functions.
                             */
                            if (@preg_match_all($regexPattern, $codePart[0], $matches, PREG_OFFSET_CAPTURE)) {
                                foreach ($matches[0] as $match) {
                                    $descriptionPrefix = 'Potentially dangerous function';
                                    $severity = CodeMatch::WARNING;
                                    if ($contentType === 'decoded') {
                                        $severity = CodeMatch::DANGEROUS;
                                        $descriptionPrefix = 'Encoded Function';
                                    }
                                    $checkFunction(
                                        $match,
                                        $regexPattern,
                                        $severity,
                                        $descriptionPrefix
                                    );
                                }
                            }

/**
                             * Encoded functions.
                             */
                            foreach ($encoders as $encoder) {
                                $key = $funcRaw . $encoder;
                                if (isset(self::$functionsEncodedValues[$key])) {
                                    $value = self::$functionsEncodedValues[$key];
                                } else {
                                    $value = @$encoder($funcRaw);
                                    self::$functionsEncodedValues[$key] = $value;
                                }
                                $regexPatternEncoded = '/' . preg_quote($value, '/') . '/si';
                                if (@preg_match_all($regexPatternEncoded, $codePart[0], $matches, PREG_OFFSET_CAPTURE)) {
                                    foreach ($matches[0] as $match) {
                                        $checkFunction(
                                            $match,
                                            $regexPatternEncoded,
                                            CodeMatch::DANGEROUS,
                                            'Encoded Function',
                                            $encoder
                                        );
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }

if (self::shouldScanExploits()
            && self::isInfectedFavicon($info)) {
            $type = 'exploit';
            $key = 'infected_icon';
            $description = 'LFI (Local File Inclusion), through an infected file with icon, allow remote attackers to inject and execute arbitrary commands or code on the target machine';
            $patternFound[$key] = [
                'type' => $type,
                'key' => $key,
                'level' => CodeMatch::DANGEROUS,
                'output' => CodeMatch::getText($type, $key, $description, ''),
                'description' => $description,
                'line' => '',
                'pattern' => '',
                'match' => '',
            ];
        }

// Remove duplicated without line number
        $result = $patternFound;
        foreach ($patternFound as $itemKey => $item) {
            foreach ($patternFound as $value) {
                $match1 = preg_replace('/\s+/', '', $item['match']);
                $match2 = preg_replace('/\s+/', '', $value['match']);
                if ($match1 === $match2
                    && $item['type'] === $value['type']
                    && $item['key'] === $value['key']
                    && empty($item['line'])
                    && !empty($value['line'])
                ) {
                    unset($result[$itemKey]);
                }
            }
        }

return $result;
    }

/**
     * Deobfuscate file.
     */
    public function deobfuscateFile($info)
    {
        $filePath = $info->getPathname();

$deobfuscator = new Deobfuscator();
        $content = php_strip_whitespace($filePath);
        $content = $deobfuscator->deobfuscate($content);
        $content = $deobfuscator->decode($content);

// TODO: format code

$scanPath = realpath(self::getPathScan());
        if (is_file($scanPath)) {
            $scanPath = dirname($scanPath);
        }
        $filePath = self::getPathDeobfuscate() . DIRECTORY_SEPARATOR . str_replace($scanPath, '', realpath($filePath));
        $filePath = Path::get($filePath);
        if (!is_dir(dirname($filePath))
            && (!mkdir($concurrentDirectory = dirname($filePath), 0755, true) && !is_dir($concurrentDirectory))) {
            throw new \RuntimeException(sprintf('Directory "%s" was not created', $concurrentDirectory));
        }

Actions::putContents($filePath, $content);
    }

/**
     * Run index.php.
     */
    private function scan($iterator)
    {
        $filesCount = iterator_count($iterator);
        $limit = empty(self::$settings['limit']) ? null : self::$settings['limit'];
        if (!empty(self::$settings['offset'])) {
            self::$report['scanned'] = self::$settings['offset'];
            $iterator = new \LimitIterator($iterator, self::$settings['offset'], $limit);
        } elseif (!empty($limit)) {
            $iterator = new \LimitIterator($iterator, 0, $limit);
        }

// Scanning
        foreach ($iterator as $info) {
            CLI::progress(self::$report['scanned'], $filesCount);

$filePath = $info->getPathname();
            $fileExtension = $info->getExtension();
            $fileSize = filesize($filePath);

if (self::isDeobfuscateMode()) {
                self::$report['scanned']++;
                usleep(10);
                $this->deobfuscateFile($info);
                continue;
            }

$isFavicon = self::isInfectedFavicon($info);

if ((
                (self::isScanAll() || in_array($fileExtension, self::$extensions, true))
                    && (self::$maxFilesize < 1 || $fileSize <= self::$maxFilesize)
                    && (!file_exists(self::$pathQuarantine) || strpos(realpath($filePath), realpath(self::$pathQuarantine)) === false)
                /* && (strpos($fileName, '-') === FALSE) */
            )
                || $isFavicon) {
                $patternFound = $this->scanFile($info);

// Check whitelist
                $inWhitelist = 0;
                foreach (self::$whitelist as $item) {
                    foreach ($patternFound as $pattern) {
                        $lineNumber = $pattern['line'];
                        $exploit = $pattern['key'];
                        $match = $pattern['match'];

if (strpos($filePath, $item['file']) !== false
                            && $match === $item['match']
                            && $exploit === $item['exploit']
                            && (self::isOnlyPathWhitelistMode() || (!self::isOnlyPathWhitelistMode() && $lineNumber === $item['line']))) {
                            $inWhitelist++;
                        }
                    }
                }

// Scan finished

self::$report['scanned']++;
                usleep(10);

if (realpath($filePath) !== realpath(__FILE__) && ($isFavicon || !empty($patternFound)) && ($inWhitelist === 0 || $inWhitelist !== count($patternFound))) {
                    self::$report['detected']++;
                    if (self::isReportMode()) {
                        // Scan mode only
                        self::$report['infectedFound'][$filePath] = $patternFound;
                        self::$report['ignored'][] = 'File: ' . $filePath . PHP_EOL .
                            'Exploits:' . PHP_EOL .
                            ' => ' . implode(PHP_EOL . ' => ', array_column($patternFound, 'output'));
                        continue;
                    }

// Scan with code check
                    $inLoop = true;
                    $fileContent = file_get_contents($filePath);

CLI::newLine(2);
                    CLI::writeBreak();
                    CLI::writeLine('PROBABLE MALWARE FOUND!', 1, 'red');

$previewLines = explode(CLI::eol(1), trim($fileContent));
                    $preview = implode(CLI::eol(1), array_slice($previewLines, 0, 1000));
                    CLI::displayLine($filePath, 2, 'yellow');

$title = CLI::title(' PREVIEW ', '=');
                    CLI::display($title, 'white', 'red');
                    CLI::newLine(2);

CLI::code($preview, $patternFound);
                    if (count($previewLines) > 1000) {
                        CLI::newLine(2);
                        CLI::display('  [ ' . (count($previewLines) - 1000) . ' rows more ]');
                    }
                    CLI::newLine(2);

$title = CLI::title('', '=');
                    CLI::display($title, 'white', 'red');
                    CLI::newLine(2);
                    CLI::writeLine('Checksum: ' . md5_file($filePath), 1, 'yellow');
                    CLI::writeLine('File path: ' . $filePath, 2, 'yellow');
                    CLI::writeLine('Evil code found: ' . CLI::eol(1) . implode(CLI::eol(1), array_column($patternFound, 'output')), 2, 'red');

while ($inLoop) {
                        $fileContent = file_get_contents($filePath);

CLI::displayLine('OPTIONS:', 2);

$confirmation = self::$prompt;
                        if (self::$prompt === null) {
                            $confirmation = CLI::choice('What is your choice? ', [
                                1 => 'Delete file',
                                2 => 'Move to quarantine',
                                3 => 'Dry run evil code fixer',
                                4 => 'Dry run evil line code fixer',
                                5 => 'Open with vim',
                                6 => 'Open with nano',
                                7 => 'Add to whitelist',
                                8 => 'Show source',
                                '-' => 'Ignore',
                            ]);
                            if (empty(trim($confirmation))) {
                                $confirmation = '0';
                            }
                        }
                        CLI::newLine();

unset($previewLines, $preview);

switch (true) {
                            // Remove file
                            case in_array($confirmation, ['1', 'delete']):
                                CLI::writeLine('File path: ' . $filePath, 1, 'yellow');
                                $confirm2 = 'y';
                                if (self::$prompt === null) {
                                    $confirm2 = CLI::read('Want delete this file [y|N]? ', 'purple');
                                }
                                CLI::newLine();
                                if ($confirm2 === 'y') {
                                    Actions::deleteFile($filePath);
                                    self::$report['removed'][] = $filePath;
                                    CLI::writeLine("File '$filePath' removed!", 2, 'green');
                                    $inLoop = false;
                                }
                                break;
                                // Move to quarantine
                            case in_array($confirmation, ['2', 'quarantine']):
                                $quarantine = Actions::moveToQuarantine($filePath);
                                self::$report['quarantine'][] = $quarantine;
                                CLI::writeLine("File '$filePath' moved to quarantine!", 2, 'green');
                                $inLoop = false;
                                break;
                                // Remove evil code
                            case in_array($confirmation, ['3', 'clean']) && count($patternFound) > 0:
                                $fileContent = Actions::cleanEvilCode($fileContent, $patternFound);
                                CLI::newLine();

$title = CLI::title(' SANITIZED ', '=');
                                CLI::display($title, 'black', 'green');
                                CLI::newLine(2);
                                CLI::code($fileContent);
                                CLI::newLine(2);

CLI::newLine();

$title = CLI::title('', '=');
                                CLI::display($title, 'black', 'green');
                                CLI::newLine(2);
                                CLI::displayLine('File sanitized, now you must verify if has been fixed correctly.', 2, 'yellow');
                                $confirm2 = 'y';
                                if (self::$prompt === null) {
                                    $confirm2 = CLI::read('Confirm and save [y|N]? ', 'purple');
                                }
                                CLI::newLine();
                                if ($confirm2 === 'y') {
                                    CLI::writeLine("File '$filePath' sanitized!", 2, 'green');
                                    Actions::putContents($filePath, $fileContent);
                                    self::$report['removed'][] = $filePath;
                                    $inLoop = false;
                                } else {
                                    self::$report['ignored'][] = $filePath;
                                    self::$report['infectedFound'][$filePath] = $patternFound;
                                }
                                break;
                                // Open with vim
                            case in_array($confirmation, ['5', 'vim']):
                                $firstLineNumber = null;
                                foreach ($patternFound as $pattern) {
                                    if (!empty($pattern['line']) && is_numeric($pattern['line'])) {
                                        $firstLineNumber = $pattern['line'];
                                        break;
                                    }
                                }
                                Actions::openWithVim($filePath, $firstLineNumber);
                                self::$report['edited'][] = $filePath;
                                CLI::writeLine("File '$filePath' edited with vim!", 2, 'green');
                                self::$report['removed'][] = $filePath;
                                break;
                                // Open with nano
                            case in_array($confirmation, ['6', 'nano']):
                                $firstLineNumber = null;
                                foreach ($patternFound as $pattern) {
                                    if (!empty($pattern['line']) && is_numeric($pattern['line'])) {
                                        $firstLineNumber = $pattern['line'];
                                        break;
                                    }
                                }
                                Actions::openWithNano($filePath, $firstLineNumber);
                                self::$report['edited'][] = $filePath;
                                CLI::writeLine("File '$filePath' edited with nano!", 2, 'green');
                                self::$report['removed'][] = $filePath;
                                break;
                                // Add to whitelist
                            case in_array($confirmation, ['7', 'whitelist']):
                                if (Actions::addToWhitelist($filePath, $patternFound)) {
                                    self::$report['whitelist'][] = $filePath;
                                    CLI::writeLine("Exploits of file '$filePath' added to whitelist!", 2, 'green');
                                    $inLoop = false;
                                } else {
                                    CLI::writeLine("Exploits of file '$filePath' failed adding file to whitelist! Check write permission of '" . self::$pathWhitelist . "' file!", 2, 'red');
                                }
                                break;
                                // Show source code
                            case in_array($confirmation, ['8', 'show']):
                                CLI::newLine();
                                CLI::displayLine("File path: $filePath", 2, 'yellow');

$title = CLI::title(' SOURCE ', '=');
                                CLI::display($title, 'white', 'red');
                                CLI::newLine(2);

CLI::code($fileContent, $patternFound);
                                CLI::newLine(2);

$title = CLI::title('', '=');
                                CLI::display($title, 'white', 'red');
                                CLI::newLine(2);
                                CLI::displayLine("File path: $filePath", 2, 'yellow');
                                break;
                                // Skip
                            case in_array($confirmation, ['0', '-', 'skip']):
                                CLI::writeLine("File '$filePath' skipped!", 2, 'green');
                                self::$report['ignored'][] = $filePath;
                                self::$report['infectedFound'][$filePath] = $patternFound;
                                $inLoop = false;
                                break;
                            default:
                                CLI::writeLine('Option not found! Retry...', 1, 'red');
                                break;
                        }

CLI::writeBreak();
                    }
                    unset($fileContent);
                }
            }
        }
    }

/**
     * Print summary.
     */
    private function summary()
    {
        if (!empty(self::$settings['offset'])) {
            self::$report['scanned'] -= self::$settings['offset'];
        }

// Statistics
        CLI::displayTitle('SUMMARY', 'black', 'cyan');
        CLI::writeBreak();
        CLI::writeLine('Files scanned: ' . self::$report['scanned']);
        if (!self::isReportMode()) {
            self::$report['ignored'] = array_unique(self::$report['ignored']);
            self::$report['edited'] = array_unique(self::$report['edited']);
            CLI::writeLine('Files edited: ' . count(self::$report['edited']));
            CLI::writeLine('Files quarantined: ' . count(self::$report['quarantine']));
            CLI::writeLine('Files whitelisted: ' . count(self::$report['whitelist']));
            CLI::writeLine('Files ignored: ' . count(self::$report['ignored']), 2);
        }

CLI::writeLine('Malware detected: ' . self::$report['detected']);
        if (!self::isReportMode()) {
            CLI::writeLine('Malware removed: ' . count(self::$report['removed']));
        }

if (self::isReportEnabled()) {
            $report = new Report();
            $format = 'html';
            if (in_array(self::$reportFormat, ['html', 'htm'])) {
                $report->setData([
                    'count' => self::$report['scanned'],
                    'results' => self::$report['infectedFound'],
                ]);
            } else {
                $format = 'text';
                $report->setData([
                    'content' => 'Scan date: ' . date(self::$dateFormat . ' H:i:s') . CLI::eol(1) . implode(CLI::eol(2), self::$report['ignored']),
                ]);
            }
            $output = $report->save(self::$pathReport, $format);

if (self::isReportMode()) {
                CLI::writeLine(CLI::eol(1) . "Report saved to '" . $output . "'", 1, 'red');
                CLI::writeBreak(2);
            }
        }

if (!self::isReportMode()) {
            if (count(self::$report['removed']) > 0) {
                CLI::writeBreak();
                CLI::writeLine('Files removed:', 1, 'red');
                foreach (self::$report['removed'] as $un) {
                    CLI::writeLine($un);
                }
            }
            if (count(self::$report['edited']) > 0) {
                CLI::writeBreak();
                CLI::writeLine('Files edited:', 1, 'green');
                foreach (self::$report['edited'] as $un) {
                    CLI::writeLine($un);
                }
            }
            if (count(self::$report['quarantine']) > 0) {
                CLI::writeBreak();
                CLI::writeLine('Files quarantined:', 1, 'yellow');
                foreach (self::$report['ignored'] as $un) {
                    CLI::writeLine($un);
                }
            }
            if (count(self::$report['whitelist']) > 0) {
                CLI::writeBreak();
                CLI::writeLine('Files whitelisted:', 1, 'cyan');
                foreach (self::$report['whitelist'] as $un) {
                    CLI::writeLine($un);
                }
            }
            if (count(self::$report['ignored']) > 0) {
                CLI::writeBreak();
                CLI::writeLine('Files ignored:', 1, 'cyan');
                foreach (self::$report['ignored'] as $un) {
                    CLI::writeLine($un);
                }
            }
            CLI::writeBreak(2);
        }
    }

/**
     * Update to last version.
     */
    public function update()
    {
        if (!self::isCli()) {
            return;
        }

CLI::writeLine('Checking update...');
        $version = file_get_contents(self::getLatestVersionUrl());
        if (!empty($version)) {
            if (version_compare(self::$version, $version, '<')) {
                CLI::write('New version');
                CLI::write(' ' . $version . ' ');
                CLI::writeLine('of the scanner available!', 2);
                $confirm = CLI::read('You sure you want update the index.php to the last version [y|N]? ', 'purple');
                CLI::writeBreak();
                if (strtolower($confirm) === 'y') {
                    $newVersion = file_get_contents(self::getLatestReleaseUrl());
                    file_put_contents(Path::getCurrent(), $newVersion);
                    CLI::write('Updated to last version');
                    CLI::write(' (' . self::$version . ' => ' . $version . ') ');
                    CLI::writeLine('with SUCCESS!', 2);
                } else {
                    CLI::writeLine('Updated SKIPPED!', 2);
                }
            } else {
                CLI::writeLine('You have the last version of the index.php yet!', 2);
            }
        } else {
            CLI::writeLine('Update FAILED!', 2, 'red');
        }
    }

/**
     * Is console instance.
     *
     * @return bool
     */
    public static function isCli()
    {
        return
            defined('STDIN')
            || php_sapi_name() === 'cli'
            || (
                empty($_SERVER['REMOTE_ADDR'])
                && !isset($_SERVER['HTTP_USER_AGENT'])
                && count($_SERVER['argv']) > 0
            );
    }

/**
     * Interrupt.
     */
    protected function interrupt()
    {
        $this->interrupt = true;
        if (self::isCli()) {
            exit;
        }
    }

/**
     * @return bool
     */
    public static function isLogEnabled()
    {
        return isset(self::$settings['log']) ? self::$settings['log'] : false;
    }

/**
     * @return self
     */
    public static function enableLogs()
    {
        self::$settings['log'] = true;

return new self();
    }

/**
     * @return self
     */
    public static function disableLogs()
    {
        self::$settings['log'] = false;

return new self();
    }

/**
     * @param int $offset
     *
     * @return self
     */
    public static function setOffset($offset)
    {
        self::$settings['offset'] = $offset;

return new self();
    }

/**
     * @param int $limit
     *
     * @return self
     */
    public static function setLimit($limit)
    {
        self::$settings['limit'] = $limit;

return new self();
    }

/**
     * @param  bool  $mode
     *
     * @return self
     */
    public static function setSilentMode($mode = true)
    {
        self::$settings['silent'] = $mode;
        if ($mode) {
            if (self::$prompt === null) {
                self::setAutoSkip();
            }
            self::disableReportMode();
        }

return new self();
    }

/**
     * @return bool
     */
    public static function isSilentMode()
    {
        return isset(self::$settings['silent']) ? self::$settings['silent'] : false;
    }

/**
     * @param  bool  $mode
     *
     * @return self
     */
    public static function setVerifier($mode = true)
    {
        self::$settings['verifier'] = $mode;

return new self();
    }

/**
     * @return bool
     */
    public static function isVerifierEnabled()
    {
        return isset(self::$settings['verifier']) ? self::$settings['verifier'] : true;
    }

/**
     * @param  bool  $mode
     *
     * @return self
     */
    public static function setColors($mode = true)
    {
        self::$settings['colors'] = $mode;

return new self();
    }

/**
     * @return bool
     */
    public static function isColorEnabled()
    {
        return isset(self::$settings['colors']) ? self::$settings['colors'] : true;
    }

/**
     * @return bool
     */
    public static function isCacheEnabled()
    {
        return isset(self::$settings['cache']) ? self::$settings['cache'] : true;
    }

/**
     * @param  bool  $mode
     *
     * @return self
     */
    public static function setDeobfuscateMode($mode = true)
    {
        self::$settings['deobfuscate-mode'] = $mode;
        self::enableReport();

return new self();
    }

/**
     * @return bool
     */
    public static function isDeobfuscateMode()
    {
        return isset(self::$settings['deobfuscate-mode']) ? self::$settings['deobfuscate-mode'] : false;
    }

/**
     * @return self
     */
    public static function enableDeobfuscateMode()
    {
        self::setDeobfuscateMode();

return new self();
    }

/**
     * @return self
     */
    public static function enableChecksum()
    {
        self::setVerifier();

return new self();
    }

/**
     * @return self
     */
    public static function disableChecksum()
    {
        self::setVerifier(false);

return new self();
    }

/**
     * @return self
     */
    public static function enableCache()
    {
        self::$settings['cache'] = true;

return new self();
    }

/**
     * @return self
     */
    public static function disableCache()
    {
        self::$settings['cache'] = false;

return new self();
    }

/**
     * @return self
     */
    public static function disableDeobfuscateMode()
    {
        self::setDeobfuscateMode(false);

return new self();
    }

/**
     * @param  bool  $mode
     *
     * @return self
     */
    public static function setOnlyFunctionsMode($mode = true)
    {
        self::$settings['only-functions'] = $mode;
        self::$settings['scan-exploits'] = false;
        self::$settings['scan-functions'] = true;
        self::$settings['scan-signatures'] = true;

return new self();
    }

/**
     * @return bool
     */
    public static function isOnlyFunctionsMode()
    {
        return isset(self::$settings['only-functions']) ? self::$settings['only-functions'] : false;
    }

/**
     * @param  bool  $mode
     *
     * @return self
     */
    public static function setOnlyExploitsMode($mode = true)
    {
        self::$settings['only-exploits'] = $mode;
        self::$settings['scan-exploits'] = true;
        self::$settings['scan-functions'] = false;
        self::$settings['scan-signatures'] = false;

return new self();
    }

/**
     * @return bool
     */
    public static function isOnlyExploitsMode()
    {
        return isset(self::$settings['only-exploits']) ? self::$settings['only-exploits'] : false;
    }

/**
     * @param  bool  $mode
     *
     * @return self
     */
    public static function setOnlySignaturesMode($mode = true)
    {
        self::$settings['only-signatures'] = $mode;
        self::$settings['scan-exploits'] = false;
        self::$settings['scan-functions'] = false;
        self::$settings['scan-signatures'] = true;

return new self();
    }

/**
     * @return bool
     */
    public static function isOnlySignaturesMode()
    {
        return isset(self::$settings['only-signatures']) ? self::$settings['only-signatures'] : false;
    }

/**
     * @return self
     */
    public static function enableLiteMode()
    {
        self::setLiteMode();

return new self();
    }

/**
     * @return self
     */
    public static function disableLiteMode()
    {
        self::setLiteMode(false);

return new self();
    }

/**
     * @param  bool  $mode
     *
     * @return self
     */
    protected static function setLiteMode($mode = true)
    {
        self::$settings['lite'] = $mode;
        if ($mode) {
            self::$settings['exploits'] = true;
            self::$exploits = Exploits::getLite();
        } else {
            self::$exploits = Exploits::getAll();
        }

return new self();
    }

/**
     * @return bool
     */
    public static function isLiteMode()
    {
        return isset(self::$settings['lite']) ? self::$settings['lite'] : false;
    }

/**
     * @return self
     */
    public static function setReportMode($mode = true)
    {
        self::$settings['report-mode'] = $mode;
        if (self::isCli()) {
            self::enableReport();
        } else {
            self::setReport($mode);
        }

return new self();
    }

/**
     * @return bool
     */
    public static function isReportMode()
    {
        return isset(self::$settings['report-mode']) ? self::$settings['report-mode'] : false;
    }

/**
     * @return self
     */
    public static function enableReportMode()
    {
        self::setReportMode();

return new self();
    }

/**
     * @return self
     */
    public static function disableReportMode()
    {
        self::setReportMode(false);

return new self();
    }

/**
     * @param  bool  $mode
     *
     * @return self
     */
    protected static function setReport($mode = true)
    {
        self::$settings['report'] = $mode;

return new self();
    }

/**
     * @return self
     */
    public static function enableReport()
    {
        self::setReport();

return new self();
    }

/**
     * @return self
     */
    public static function disableReport()
    {
        self::setReport(false);

return new self();
    }

/**
     * @return bool
     */
    public static function isReportEnabled()
    {
        return isset(self::$settings['report']) ? self::$settings['report'] : true;
    }

/**
     * @return self
     */
    public static function enableBackups()
    {
        self::$settings['backup'] = true;

return new self();
    }

/**
     * @return self
     */
    public static function disableBackups()
    {
        self::$settings['backup'] = false;

return new self();
    }

/**
     * @return bool
     */
    public static function isBackupEnabled()
    {
        return isset(self::$settings['backup']);
    }

/**
     * @param  bool  $mode
     *
     * @return self
     */
    public static function setOnlyPathWhitelistMode($mode = true)
    {
        self::$settings['whitelist-only-path'] = $mode;

return new self();
    }

/**
     * @return bool
     */
    public static function isOnlyPathWhitelistMode()
    {
        return isset(self::$settings['whitelist-only-path']) ? self::$settings['whitelist-only-path'] : false;
    }

/**
     * @return array
     */
    public static function getIgnorePaths()
    {
        return self::$ignorePaths;
    }

/**
     * @param array $ignorePaths
     *
     * @return self
     */
    public static function setIgnorePaths($ignorePaths)
    {
        self::$ignorePaths = $ignorePaths;

return new self();
    }

/**
     * @return array
     */
    public static function getFilterPaths()
    {
        return self::$filterPaths;
    }

/**
     * @param array $filterPaths
     *
     * @return self
     */
    public static function setFilterPaths($filterPaths)
    {
        self::$filterPaths = $filterPaths;

return new self();
    }

/**
     * @return string
     */
    public static function getPrompt()
    {
        return self::$prompt;
    }

/**
     * @param string $prompt
     *
     * @return self
     */
    public static function setPrompt($prompt)
    {
        if (!empty($prompt)) {
            self::disableReportMode();
        }
        self::$prompt = $prompt;

return new self();
    }

/**
     * @param string $mode
     *
     * @return self
     */
    public static function setAutoDelete($mode = true)
    {
        self::setPrompt($mode !== '' ? 'delete' : null);

return new self();
    }

/**
     * @param string $mode
     *
     * @return self
     */
    public static function setAutoClean($mode = true)
    {
        self::setPrompt($mode !== '' ? 'clean' : null);

return new self();
    }

/**
     * @param string $mode
     *
     * @return self
     */
    public static function setAutoCleanLine($mode = true)
    {
        self::setPrompt($mode !== '' ? 'clean-line' : null);

return new self();
    }

/**
     * @param string $mode
     *
     * @return self
     */
    public static function setAutoQuarantine($mode = true)
    {
        self::setPrompt($mode !== '' ? 'quarantine' : null);

return new self();
    }

/**
     * @param string $mode
     *
     * @return self
     */
    public static function setAutoWhitelist($mode = true)
    {
        self::setPrompt($mode !== '' ? 'whitelist' : null);

return new self();
    }

/**
     * @param string $mode
     *
     * @return self
     */
    public static function setAutoSkip($mode = true)
    {
        self::setPrompt($mode !== '' ? 'skip' : null);

return new self();
    }

/**
     * @return string
     */
    public static function getPathBackups()
    {
        return self::$pathBackups;
    }

/**
     * @param string $pathBackups
     *
     * @return self
     */
    public static function setPathBackups($pathBackups)
    {
        self::$pathBackups = Path::get($pathBackups);

return new self();
    }

/**
     * @return string
     */
    public static function getPathDeobfuscate()
    {
        return self::$pathDeobfuscate;
    }

/**
     * @param string $pathDeobfuscate
     *
     * @return self
     */
    public static function setPathDeobfuscate($pathDeobfuscate)
    {
        self::$pathDeobfuscate = Path::get($pathDeobfuscate);

return new self();
    }

/**
     * @return string
     */
    public static function getPathQuarantine()
    {
        return self::$pathQuarantine;
    }

/**
     * @param string $pathQuarantine
     *
     * @return self
     */
    public static function setPathQuarantine($pathQuarantine)
    {
        self::$pathQuarantine = Path::get($pathQuarantine);

return new self();
    }

/**
     * @return string
     */
    public static function getPathLogs()
    {
        return self::$pathLogs;
    }

/**
     * @param string $pathLogs
     *
     * @return self
     */
    public static function setPathLogs($pathLogs)
    {
        self::$pathLogs = Path::get($pathLogs);

return new self();
    }

/**
     * @return string
     */
    public static function getPathReport()
    {
        return self::$pathReport;
    }

/**
     * @param string $pathReport
     *
     * @return self
     */
    public static function setPathReport($pathReport)
    {
        self::$pathReport = Path::get($pathReport);

return new self();
    }

/**
     * @param string $reportFormat
     *
     * @return self
     */
    public static function setReportFormat($reportFormat)
    {
        if (in_array($reportFormat, ['txt', 'log', 'logs', 'html', 'htm'])) {
            self::$reportFormat = $reportFormat;
        }

return new self();
    }

/**
     * @return string
     */
    public static function getPathWhitelist()
    {
        return self::$pathWhitelist;
    }

/**
     * @param string $pathWhitelist
     *
     * @return self
     */
    public static function setPathWhitelist($pathWhitelist)
    {
        self::$pathWhitelist = Path::get($pathWhitelist);

return new self();
    }

/**
     * @return string
     */
    public static function getPathScan()
    {
        return self::$pathScan;
    }

/**
     * @param string $pathScan
     *
     * @return self
     */
    public static function setPathScan($pathScan)
    {
        self::$pathScan = Path::get($pathScan);

return new self();
    }

/**
     * @return int
     */
    public static function getMaxFilesize()
    {
        return self::$maxFilesize;
    }

/**
     * @return self
     */
    public static function setMaxFilesize($maxFilesize)
    {
        $maxFilesize = trim($maxFilesize);
        if (!is_numeric(self::$argv['max-filesize'])) {
            $maxFilesize = Path::sizeToBytes($maxFilesize);
        }
        self::$maxFilesize = $maxFilesize;

return new self();
    }

/**
     * @return array
     */
    public static function getExtensions()
    {
        return self::$extensions;
    }

/**
     * @return self
     */
    public static function setFunctions($functions)
    {
        self::$functions = $functions;
        self::$functionsEncoded = $functions;

return new self();
    }

/**
     * @param array $functions
     *
     * @return self
     */
    public static function setFunctionsEncoded($functions)
    {
        $dangerousFunctions = Functions::getDangerous();
        $encodedFunc = array_unique(array_merge($functions, $dangerousFunctions));
        self::$functionsEncoded = $encodedFunc;

return new self();
    }

/**
     * @param array $exploits
     *
     * @return self
     */
    public static function setExploits($exploits)
    {
        self::$exploits = $exploits;

return new self();
    }

/**
     * @param array $extensions
     *
     * @return self
     */
    public static function setExtensions($extensions)
    {
        self::$extensions = $extensions;

return new self();
    }

/**
     * @return string
     */
    public static function getReportFormat()
    {
        return self::$reportFormat;
    }

/**
     * @return int
     */
    public static function getReportFilesScanned()
    {
        return self::$report['scanned'];
    }

/**
     * @return int
     */
    public static function getReportMalwareDetected()
    {
        return self::$report['detected'];
    }

/**
     * @return array
     */
    public static function getReportMalwareRemoved()
    {
        return self::$report['removed'];
    }

/**
     * @return array
     */
    public static function getReportFilesIgnored()
    {
        return self::$report['ignored'];
    }

/**
     * @return array
     */
    public static function getReportFilesEdited()
    {
        return self::$report['edited'];
    }

/**
     * @return array
     */
    public static function getReportQuarantine()
    {
        return self::$report['quarantine'];
    }

/**
     * @return array
     */
    public static function getReportWhitelist()
    {
        return self::$report['quarantine'];
    }

/**
     * @return string
     */
    public static function getLowerName()
    {
        return strtolower(self::$name);
    }

/**
     * @return string
     */
    public static function getName()
    {
        return self::$name;
    }

/**
     * @return string
     */
    public static function getFullName()
    {
        return self::$fullname;
    }

/**
     * @return string
     */
    public static function getVersion()
    {
        return self::$version;
    }

/**
     * @return string
     */
    public static function getRoot()
    {
        return self::$root;
    }

/**
     * @return Argv
     */
    public static function getArgv()
    {
        return self::$argv;
    }

/**
     * @return array
     */
    public static function getWhitelist()
    {
        return self::$whitelist;
    }

/**
     * @param array $whitelist
     *
     * @return self
     */
    public static function setWhitelist($whitelist)
    {
        self::$whitelist = $whitelist;

return new self();
    }

/**
     * @return array
     */
    public static function getFunctions()
    {
        return self::$functions;
    }

/**
     * @return array
     */
    public static function getFunctionsEncoded()
    {
        return self::$functionsEncoded;
    }

/**
     * @return array
     */
    public static function getExploits()
    {
        return array_keys(self::$exploits);
    }

/**
     * @return array
     */
    public static function getSettings()
    {
        return self::$settings;
    }

/**
     * @return object
     */
    public static function getReport()
    {
        return (object)self::$report;
    }

/**
     * @return bool
     */
    public function isInterrupted()
    {
        return $this->interrupt;
    }

/**
     * @return string
     */
    public function getLastError()
    {
        return $this->lastError;
    }

/**
     * @param string $lastError
     *
     * @return self
     */
    protected function setLastError($lastError)
    {
        $this->lastError = $lastError;

return $this;
    }

/**
     * @return bool
     */
    protected static function shouldScanExploits()
    {
        return isset(self::$settings['scan-exploits']) ? self::$settings['scan-exploits'] : true;
    }

/**
     * @return bool
     */
    protected static function shouldScanFunctions()
    {
        return isset(self::$settings['scan-functions']) ? self::$settings['scan-functions'] : true;
    }

/**
     * @return bool
     */
    protected static function shouldScanSignatures()
    {
        return isset(self::$settings['scan-signatures']) ? self::$settings['scan-signatures'] : true;
    }

/**
     * @return string
     */
    public static function getDescription()
    {
        return self::$description;
    }

/**
     * @return string
     */
    public static function getRepoUrl()
    {
        return self::$repoUrl;
    }

/**
     * @return string
     */
    public static function getAuthor()
    {
        return self::$author;
    }

/**
     * @return bool
     */
    public function isInterrupt()
    {
        return $this->interrupt;
    }

/**
     * @return bool
     */
    protected static function isInitialized()
    {
        return self::$inited;
    }

/**
     * @return string
     */
    public static function getLatestVersionUrl()
    {
        return self::$latestVersionUrl;
    }

/**
     * @return string
     */
    public static function getLatestReleaseUrl()
    {
        return self::$latestReleaseUrl;
    }

/**
     * @return bool
     */
    public static function isScanAll()
    {
        return self::$scanAll;
    }

/**
     * @param bool $scanAll
     */
    public static function setScanAll($scanAll)
    {
        self::$scanAll = $scanAll;
    }
}
<?php
/**
 * PHP Antimalware Scanner.
 *
 * @author Marco Cesarato <cesarato.developer@gmail.com>
 * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License
 *
 * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner
 */

namespace AMWScan\Console;

/**
 * Class Argument.
 */
class Argument
{
    /**
     * @var string
     */
    public $name;
    /**
     * @var bool
     */
    public $vararg = false;
    /**
     * @var bool
     */
    public $required = false;
    /**
     * @var mixed
     */
    public $defaultValue;
    /**
     * @var mixed
     */
    public $help;

/**
     * Argument constructor.
     *
     * @param $name
     * @param array $options
     */
    public function __construct($name, $options = [])
    {
        $this->name = $name;
        $this->vararg = (bool)@$options['var_arg'];
        $this->required = (bool)@$options['required'];
        $this->defaultValue = @$options['default'];
        $this->help = @$options['help'];
    }

/**
     * @return string
     */
    public function __toString()
    {
        $arg = "<{$this->name}>";
        if ($this->vararg) {
            $arg = "$arg ...";
        }
        if (!$this->required) {
            return "[$arg]";
        }

return $arg;
    }
}
<?php
/**
 * PHP Antimalware Scanner.
 *
 * @author Marco Cesarato <cesarato.developer@gmail.com>
 * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License
 *
 * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner
 */

namespace AMWScan\Console;

/**
 * Class Flag.
 */
class Flag
{
    /**
     * @var string
     */
    public $name;
    /**
     * @var null
     */
    public $callback;
    /**
     * @var array
     */
    public $aliases = [];
    /**
     * @var bool
     */
    public $hasValue = false;
    /**
     * @var string
     */
    public $valueName;
    /**
     * @var mixed
     */
    public $defaultValue;
    /**
     * @var mixed
     */
    public $var;
    /**
     * @var mixed
     */
    public $help;

/**
     * Flag constructor.
     *
     * @param $name
     * @param array $options
     * @param null $callback
     */
    public function __construct($name, $options = [], $callback = null)
    {
        $this->name = $name;
        $this->callback = $callback;
        $this->aliases = array_merge(["--$name"], (array)@$options['alias']);
        $this->defaultValue = @$options['default'];
        $this->hasValue = (bool)@$options['has_value'];
        $this->valueName = @$options['value_name'];
        $this->help = @$options['help'];
        if (array_key_exists('var', $options)) {
            $this->var = &$options['var'];
        }
    }

/**
     * @return string
     */
    public function __toString()
    {
        $s = implode('|', $this->aliases);
        if ($this->hasValue) {
            $name = empty($this->valueName) ? $this->name : $this->valueName;
            $s = "$s <{$name}>";
        }

return "[$s]";
    }
}
<?php

namespace AMWScan\Console;

/**
 * Class Argv.
 */
class Argv implements \ArrayAccess
{
    /**
     * @var null
     */
    protected $name;
    /**
     * @var string
     */
    protected $description;
    /**
     * @var array
     */
    protected $examples = [];
    /**
     * @var array
     */
    protected $flags = [];
    /**
     * @var array
     */
    protected $args = [];
    /**
     * @var array
     */
    protected $parsedFlags = [];
    /**
     * @var array
     */
    protected $parsedNamedArgs = [];
    /**
     * @var array
     */
    protected $parsedArgs = [];

/**
     * Build.
     *
     * @return static
     */
    public static function build($callback)
    {
        $static = new static();
        $bindTo = [$callback, 'bindTo'];
        if ($callback instanceof \Closure && is_callable($bindTo)) {
            $callback = $callback->bindTo($static);
        }
        $callback($static);

return $static;
    }

/**
     * Argv constructor.
     *
     * @param string $description
     * @param null $name
     * @param array $examples
     */
    public function __construct($name = '', $description = '', $examples = [])
    {
        $this->description = $description;
        $this->name = $name;
        $this->examples = $examples;
    }

/**
     * @param array $examples
     */
    public function setExamples($examples)
    {
        $this->examples = $examples;
    }

/**
     * Parse argvs.
     *
     * @param array $args
     */
    public function parse($args = [])
    {
        if (empty($args) && !empty($_SERVER['argv'])) {
            $args = array_slice($_SERVER['argv'], 1); // First argument removed (php [scanner.php] [<path>] [<functions>])
        }

foreach ($args as $pos => $arg) {
            // reset value
            $value = null;
            if (substr($arg, 0, 1) === '-') {
                if (preg_match('/^(.+)=(?:\"|\\\')?(.+)(?:\"|\\\')?/', $arg, $matches)) {
                    $arg = $matches[1];
                    $value = $matches[2];
                }
                if (!$flag = @$this->flags[$arg]) {
                    return;
                }
                unset($args[$pos]);
                if ($flag->hasValue) {
                    if (!isset($value)) {
                        $value = $args[$pos + 1];
                        unset($args[$pos + 1]);
                    }
                } else {
                    $value = true;
                }
                if (null !== $flag->callback) {
                    call_user_func_array($flag->callback, [&$value]);
                }
                // Set the reference given as the flag's 'var'.
                $flag->var = $this->parsedFlags[$flag->name] = $value;
            }
        }
        foreach ($this->flags as $flag) {
            if (!array_key_exists($flag->name, $this->parsedFlags)) {
                $flag->var = $this->parsedFlags[$flag->name] = $flag->defaultValue;
            }
        }
        $this->parsedArgs = $args = array_values($args);
        $pos = 0;
        foreach ($this->args as $arg) {
            if ($arg->required && !isset($args[$pos])) {
                return;
            }
            if (isset($args[$pos])) {
                if ($arg->vararg) {
                    $value = array_slice($args, $pos);
                    $pos += count($value);
                } else {
                    $value = $args[$pos];
                    $pos++;
                }
            } else {
                $value = $arg->defaultValue;
            }
            $this->parsedNamedArgs[$arg->name] = $value;
        }
    }

/**
     * Add Flag.
     *
     * @param array $options
     * @param null $callback
     *
     * @return $this
     */
    public function addFlag($name, $options = [], $callback = null)
    {
        $flag = new Flag($name, $options, $callback);
        foreach ($flag->aliases as $alias) {
            $this->flags[$alias] = $flag;
        }

return $this;
    }

/**
     * Add flag var.
     *
     * @param array $options
     *
     * @return Argv
     */
    public function addFlagVar($name, &$var, $options = [])
    {
        $options['var'] = &$var;

return $this->addFlag($name, $options);
    }

/**
     * Add Argument.
     *
     * @param array $options
     *
     * @return $this
     */
    public function addArgument($name, $options = [])
    {
        $argument = new Argument($name, $options);
        $this->args[] = $argument;

return $this;
    }

/**
     * Get arguments.
     *
     * @return array
     */
    public function getParsedArgs()
    {
        return $this->parsedArgs;
    }

/**
     * Count arguments.
     *
     * @return int
     */
    public function count()
    {
        return count($this->getParsedArgs());
    }

/**
     * Get flag or argument.
     */
    public function get($name)
    {
        return $this->flag($name) ?: $this->arg($name);
    }

/**
     * Get argument from position.
     */
    public function arg($pos)
    {
        if (array_key_exists($pos, $this->parsedNamedArgs)) {
            return $this->parsedNamedArgs[$pos];
        }
        if (array_key_exists($pos, $this->parsedArgs)) {
            return $this->parsedArgs[$pos];
        }

return null;
    }

/**
     * Get flag.
     */
    public function flag($name)
    {
        if (array_key_exists($name, $this->parsedFlags)) {
            return $this->parsedFlags[$name];
        }

return null;
    }

/**
     * Usage.
     *
     * @return string
     */
    public function usage()
    {
        $flags = implode(' ', array_unique(array_values($this->flags)));
        $args = implode(' ', $this->args);
        $script = $this->name ?: 'php ' . basename($_SERVER['SCRIPT_NAME']);

$usage = '';
        if ($this->description !== '') {
            $usage .= "\n\n{$this->description}";
        }

if (count($this->args) > 0) {
            $usage .= "\n\nArguments:\n";
            $printArgs = [];
            $length = 0;
            foreach ($this->args as $arg) {
                $key = "<{$arg->name}>";
                if ($length < strlen($key)) {
                    $length = strlen($key);
                }
                $printArgs[$key] = CLI::wordWrap($arg->help);
                if ($arg->defaultValue !== null) {
                    $printArgs[$key] .= "\n[default: {$arg->defaultValue}]";
                }
            }
            $length += 3;
            ksort($printArgs);
            foreach ($printArgs as $name => $description) {
                $name = str_pad($name, $length, ' ', STR_PAD_RIGHT);
                $spaces = str_repeat(' ', $length + 2);
                $description = '- ' . str_replace("\n", "\n" . $spaces, $description);
                $usage .= "\n{$name}{$description}";
            }
        }

if (count($this->flags) > 0) {
            $usage .= "\n\nFlags:\n";
            $printFlags = [];
            $length = 0;
            foreach ($this->flags as $flag) {
                $names = ['--' . $flag->name];
                if (!empty($flag->aliases)) {
                    $names = array_merge($flag->aliases);
                }
                usort($names, function ($a, $b) {
                    return strlen($b) - strlen($a);
                });

$key = implode('|', $names);
                if ($flag->hasValue) {
                    $valueName = empty($flag->valueName) ? $flag->name : $flag->valueName;
                    $key .= ' <' . $valueName . '>';
                }
                if ($length < strlen($key)) {
                    $length = strlen($key);
                }
                $printFlags[$key] = CLI::wordWrap($flag->help);
                if ($flag->hasValue && $flag->defaultValue !== null && $flag->defaultValue !== false) {
                    $printFlags[$key] .= "\n[default: {$flag->defaultValue}]";
                }
            }
            $length += 3;
            ksort($printFlags);
            foreach ($printFlags as $name => $description) {
                $name = str_pad($name, $length, ' ', STR_PAD_RIGHT);
                $spaces = str_repeat(' ', $length + 2);
                $description = '- ' . str_replace("\n", "\n" . $spaces, $description);
                $usage .= "\n{$name}{$description}";
            }
        }

$example = CLI::wordWrap("$script $flags $args");
        $example = str_replace("\n", "\n\t", $example);

$usage .= "\n\nUsage: $example";

if ($this->examples !== []) {
            $usage .= "\n\nExamples:\n\n" . implode("\n", $this->examples);
        }

return $usage;
    }

/**
     * @param null $length
     *
     * @return array
     */
    public function slice($start, $length = null)
    {
        return array_slice($this->parsedArgs, $start, $length);
    }

#[\ReturnTypeWillChange]
    public function offsetGet($offset)
    {
        return $this->get($offset);
    }

/**
     * @return bool
     */
    #[\ReturnTypeWillChange]
    public function offsetExists($offset)
    {
        return null !== $this->get($offset);
    }

/**
     * Set Offest.
     */
    #[\ReturnTypeWillChange]
    public function offsetSet($offset, $value)
    {
    }

/**
     * Unset Offset.
     */
    #[\ReturnTypeWillChange]
    public function offsetUnset($offset)
    {
    }
}
<?php

namespace AMWScan\Console;

class Figlet
{
    /**
     * Path fonts.
     *
     * @var string
     */
    public static $pathFonts;

/**
     * Signature.
     *
     * @var string
     */
    protected $signature;
    /**
     * Hard blank.
     *
     * @var string
     */
    protected $hardblank;
    /**
     * Height.
     *
     * @var string
     */
    protected $height;
    /**
     * Baseline.
     *
     * @var string
     */
    protected $baseline;
    /**
     * Max lenght.
     *
     * @var string
     */
    protected $maxLenght;
    /**
     * Old layout.
     *
     * @var string
     */
    protected $oldLayout;
    /**
     * Comment line.
     *
     * @var int
     */
    protected $commentLines;
    /**
     * Print direction.
     *
     * @var string
     */
    protected $printDirection;
    /**
     * Full layout.
     *
     * @var string
     */
    protected $fullLayout;
    /**
     * Code tag count.
     *
     * @var string
     */
    protected $codeTagCount;
    /**
     * Font file.
     *
     * @var string
     */
    protected $fontFile;

/**
     * Figlet constructor.
     */
    public function __construct()
    {
        self::$pathFonts = __DIR__ . '/Fonts';
    }

/**
     * Load a random flf font file.
     */
    public function loadRandomFont()
    {
        $font = null;
        $fonts = new \FilesystemIterator(
            self::$pathFonts,
            \FilesystemIterator::SKIP_DOTS
        );
        $i = mt_rand(0, iterator_count($fonts) - 1);
        $c = 0;
        foreach ($fonts as $file) {
            if ($i === $c) {
                $font = $file->getPathname();
                break;
            }
            $c++;
        }

return $this->loadfont($font);
    }

/**
     * Load an flf font file. Return true on success, false on error.
     *
     * @return bool
     */
    public function loadFont($fontfile)
    {
        if (!is_file($fontfile)) {
            $fontfile = self::$pathFonts . '/' . $fontfile;
        }
        $this->fontFile = file($fontfile);
        if (!$this->fontFile) {
            trigger_error("Couldn't open font $fontfile\n");

return false;
        }

// Header
        $header = explode(' ', $this->fontFile[0]);

$this->signature = substr($header[0], 0, -1);
        $this->hardblank = $header[0][strlen($header[0]) - 1];
        $this->height = @$header[1];
        $this->baseline = @$header[2];
        $this->maxLenght = @$header[3];
        $this->oldLayout = @$header[4];
        $this->commentLines = ((int)@$header[5]) + 1;
        $this->printDirection = @$header[6];
        $this->fullLayout = @$header[7];
        $this->codeTagCount = @$header[8];

if ($this->signature !== 'flf2a') {
            trigger_error('Unknown font version ' . $this->signature . "\n");

return false;
        }

return true;
    }

/**
     * Get a character as a string, or an array with one line
     * for each font height.
     *
     * @return array|string
     */
    public function getCharacter($character)
    {
        $asciValue = ord($character);
        $start = $this->commentLines + ($asciValue - 32) * $this->height;
        $data = [];

// Check if character is out of bounds
        if ($start < 0 || $start >= count($this->fontFile)) {
            // Return empty lines for unsupported characters
            for ($a = 0; $a < $this->height; $a++) {
                $data[] = '';
            }

return $data;
        }

for ($a = 0; $a < $this->height; $a++) {
            $lineIndex = $start + $a;
            if (!isset($this->fontFile[$lineIndex])) {
                $data[] = '';
                continue;
            }

$tmp = $this->fontFile[$lineIndex];

// Get the last character as separator (before newline)
            $tmp = rtrim($tmp, "\r\n");
            if (strlen($tmp) > 0) {
                $separator = substr($tmp, -1);
                // Remove all occurrences of separator from the end
                $tmp = rtrim($tmp, $separator);
            }

// Replace hardblank with space
            $tmp = str_replace($this->hardblank, ' ', $tmp);

$data[] = $tmp;
        }

return $data;
    }

/**
     * Returns a figletized line of characters.
     *
     * @return string
     */
    public function render($line)
    {
        $ret = '';
        $data = [];

for ($i = 0; $i < mb_strlen($line); $i++) {
            $data[] = $this->getCharacter(mb_substr($line, $i, 1));
        }

for ($i = 0; $i < $this->height; $i++) {
            foreach ($data as $v) {
                if (isset($v[$i])) {
                    $ret .= str_replace("\n", '', $v[$i]);
                }
            }
            reset($data);
            $ret .= "\n";
        }

return trim($ret);
    }
}
flf2a$ 7 5 20 -1 2
rozzo.flf font by Mike Rosulek [unar2@sfa.ope.ed.gov] 1/12/95
This was based on FujiyamaBlack TrueType Font.
$$#
$$#
$$#
$$#
$$#
$$#
$$##
888$#
888$#
"8"$#
 e $#
"8"$#
   $#
   $##
8 8$#
8 8$#
   $#
   $#
   $#
   $#
   $##
    d8P d8"$#
88888888888$#
  d8P d8P  $#
88888888888$#
e8P d8P    $#
           $#
           $##
   8   $#
 d8 8e $#
C88    $#
 Y8 8b $#
    88D$#
 "8 8P $#
   8   $##
,8, /  $#
"8"/   $#
  /    $#
 /,8,  $#
/ "8"  $#
       $#
       $##
     d8b,$#
  ,db YP'$#
 e Y8b  ,$#
d8b Y8b" $#
Y88b Y8b $#
         $#
         $##
d8b$#
Y8P$#
,P $#
P  $#
   $#
   $#
   $##
  e88$#
 d888$#
e8888$#
88888$#
"8888$#
 Y888$#
  "88$##
88e  $#
888b $#
8888e$#
88888$#
8888"$#
888P $#
88"  $##
Yb 8 dP$#
 `D8K' $#
dP 8 Yb$#
       $#
       $#
       $#
       $##
     $#
  8  $#
88888$#
  8  $#
     $#
     $#
     $##
   $#
   $#
   $#
d8b$#
Y8P$#
,P $#
P  $##
   $#
   $#
888$#
   $#
   $#
   $#
   $##
   $#
   $#
   $#
d8b$#
Y8P$#
   $#
   $##
    d8P$#
   d8P $#
  d8P  $#
 d8P   $#
d8P    $#
       $#
       $##
  e88 88e  $#
 d888 888b $#
C8888 8888D$#
 Y888 888P $#
  "88 88"  $#
           $#
           $##
  d88$#
 d888$#
d"888$#
  888$#
  888$#
     $#
     $##
,8,"88e $#
 "  888D$#
    88P $#
   ,*"  $#
 8888888$#
        $#
        $##
,8,"88b,$#
 " ,88P'$#
   C8K  $#
 e `88b,$#
"8",88P'$#
        $#
        $##
  d 888 $#
 d8 888 $#
d88 888e$#
""" 888"$#
    888 $#
        $#
        $##
8888888$#
88     $#
"""Y88b$#
 e  888$#
"8",88P$#
       $#
       $##
  e88",8, $#
 d888  "  $#
C8888 88e $#
 Y888 888D$#
  "88 88" $#
          $#
          $##
888888$#
    ,e$#
  ,eP $#
,e8P  $#
88P   $#
      $#
      $##
 ,d8 8b, $#
 "Y8 8P" $#
 ,d8 8b, $#
C888 888D$#
 "Y8 8P" $#
         $#
         $##
 e88 88e  $#
C888 888b $#
 "88 8888D$#
  e  888P $#
 "8",88"  $#
          $#
          $##
d8b$#
Y8P$#
   $#
d8b$#
Y8P$#
   $#
   $##
d8b$#
Y8P$#
   $#
d8b$#
Y8P$#
,P $#
P  $##
  d8P$#
 d8P $#
C8K  $#
 Y8b $#
  Y8b$#
     $#
     $##
       $#
8888888$#
       $#
8888888$#
       $#
       $#
       $##
Y8b  $#
 Y8b $#
  D8D$#
 d8P $#
d8P  $#
     $#
     $##
,8,'88b $#
 "  888D$#
    88P $#
   ,"'  $#
  "8"   $#
        $#
        $##
 ,e""""e, $#
e" e"""e"e$#
8 C    8 8$#
"e "*ee"*"$#
 `"eeeee" $#
          $#
          $##
    e Y8b    $#
   d8b Y8b   $#
  d888b Y8b  $#
 d888888888b $#
d8888888b Y8b$#
             $#
             $##
888 88b,$#
888 88P'$#
888 8K  $#
888 88b,$#
888 88P'$#
        $#
        $##
  e88'Y88$#
 d888  'Y$#
C8888    $#
 Y888  ,d$#
  "88,d88$#
         $#
         $##
888 88e  $#
888 888b $#
888 8888D$#
888 888P $#
888 88"  $#
         $#
         $##
888'Y88$#
888 ,'Y$#
888C8  $#
888 ",d$#
888,d88$#
       $#
       $##
888'Y88$#
888 ,'Y$#
888C8  $#
888 "  $#
888    $#
       $#
       $##
  e88'Y88 $#
 d888  'Y $#
C8888 eeee$#
 Y888 888P$#
  "88 88" $#
          $#
          $##
888 888$#
888 888$#
8888888$#
888 888$#
888 888$#
       $#
       $##
888$#
888$#
888$#
888$#
888$#
   $#
   $##
    888$#
    888$#
    888$#
 e  88P$#
"8",P' $#
       $#
       $##
888 88P$#
888 8P $#
888 K  $#
888 8b $#
888 88b$#
       $#
       $##
888    $#
888    $#
888    $#
888  ,d$#
888,d88$#
       $#
       $##
    e   e    $#
   d8b d8b   $#
  e Y8b Y8b  $#
 d8b Y8b Y8b $#
d888b Y8b Y8b$#
             $#
             $##
Y88b Y88$#
 Y88b Y8$#
b Y88b Y$#
8b Y88b $#
88b Y88b$#
        $#
        $##
  e88 88e  $#
 d888 888b $#
C8888 8888D$#
 Y888 888P $#
  "88 88"  $#
           $#
           $##
888 88e $#
888 888D$#
888 88" $#
888     $#
888     $#
        $#
        $##
  e88 88e  $#
 d888 888b $#
C8888 8888D$#
 Y888 888P $#
  "88 88"  $#
      b    $#
      8b,  $##
888 88e $#
888 888D$#
888 88" $#
888 b,  $#
888 88b,$#
        $#
        $##
 dP"8$#
C8b Y$#
 Y8b $#
b Y8D$#
8edP $#
     $#
     $##
88P'888'Y88$#
P'  888  'Y$#
    888    $#
    888    $#
    888    $#
           $#
           $##
8888 8888$#
8888 8888$#
8888 8888$#
8888 8888$#
'Y88 88P'$#
         $#
         $##
Y8b Y88888P$#
 Y8b Y888P $#
  Y8b Y8P  $#
   Y8b Y   $#
    Y8P    $#
           $#
           $##
Y8b Y8b Y888P$#
 Y8b Y8b Y8P $#
  Y8b Y8b Y  $#
   Y8b Y8b   $#
    Y8P Y    $#
             $#
             $##
Y8b Y8P$#
 Y8b Y $#
  Y8b  $#
 e Y8b $#
d8b Y8b$#
       $#
       $##
Y88b Y8P$#
 Y88b Y $#
  Y88b  $#
   888  $#
   888  $#
        $#
        $##
 8P d8P$#
 P d8P $#
  d8P d$#
 d8P d8$#
d8P d88$#
       $#
       $##
8888$#
88  $#
88  $#
88  $#
88  $#
88  $#
8888$##
    d8P$#
   d8P $#
  d8P  $#
 d8P   $#
d8P    $#
       $#
       $##
8888$#
  88$#
  88$#
  88$#
  88$#
  88$#
8888$##
 d8b $#
dP Yb$#
     $#
     $#
     $#
     $#
     $##
   $#
   $#
   $#
   $#
   $#
888$#
   $##
Y88$#
 Y8$#
  Y$#
   $#
   $#
   $#
   $##
       $#
 ,"Y88b$#
"8" 888$#
,ee 888$#
"88 888$#
       $#
       $##
888     $#
888 88e $#
888 888b$#
888 888P$#
888 88" $#
        $#
        $##
        $#
 e88'888$#
d888  '8$#
Y888   ,$#
 "88,e8'$#
        $#
        $##
     888$#
 e88 888$#
d888 888$#
Y888 888$#
 "88 888$#
        $#
        $##
       $#
 ,e e, $#
d88 88b$#
888   ,$#
 "YeeP"$#
       $#
       $##
 dP,e,$#
 8b " $#
888888$#
 888  $#
 888  $#
      $#
      $##
        $#
 e88 888$#
d888 888$#
Y888 888$#
 "88 888$#
  ,  88P$#
 "8",P" $##
888    $#
888 ee $#
888 88b$#
888 888$#
888 888$#
       $#
       $##
,e,$#
 " $#
888$#
888$#
888$#
   $#
   $##
,e,$#
 " $#
888$#
888$#
888$#
88P$#
8" $##
888   $#
888 ee$#
888 P $#
888 b $#
888 8b$#
      $#
      $##
888$#
888$#
888$#
888$#
888$#
   $#
   $##
           $#
888 888 8e $#
888 888 88b$#
888 888 888$#
888 888 888$#
           $#
           $##
       $#
888 8e $#
888 88b$#
888 888$#
888 888$#
       $#
       $##
         $#
 e88 88e $#
d888 888b$#
Y888 888P$#
 "88 88" $#
         $#
         $##
        $#
888 88e $#
888 888b$#
888 888P$#
888 88" $#
888     $#
888     $##
        $#
 e88 888$#
d888 888$#
Y888 888$#
 "88 888$#
     888$#
     888$##
      $#
888,8,$#
888 " $#
888   $#
888   $#
      $#
      $##
     $#
 dP"Y$#
C88b $#
 Y88D$#
d,dP $#
     $#
     $##
  d8  $#
 d88  $#
d88888$#
 888  $#
 888  $#
      $#
      $##
         $#
8888 8888$#
8888 8888$#
Y888 888P$#
 "88 88" $#
         $#
         $##
         $#
Y8b Y888P$#
 Y8b Y8P $#
  Y8b "  $#
   Y8P   $#
         $#
         $##
             $#
Y8b Y8b Y888P$#
 Y8b Y8b Y8P $#
  Y8b Y8b "  $#
   YP  Y8P   $#
             $#
             $##
        $#
 Y8b Y8Y$#
  Y8b Y $#
 e Y8b  $#
d8b Y8b $#
        $#
        $##
         $#
Y8b Y888P$#
 Y8b Y8P $#
  Y8b Y  $#
   888   $#
   888   $#
   888   $##
      $#
8P d8P$#
P d8P $#
 d8P d$#
d8P d8$#
      $#
      $##
  ,888$#
  88  $#
 e8P  $#
C8K   $#
 "8b  $#
  88  $#
  "888$##
88$#
88$#
88$#
88$#
88$#
88$#
88$##
888,  $#
  88  $#
  Y8  $#
   D8D$#
  d8  $#
  88  $#
888"  $##
,d8b,d8$#
8P"Y8P"$#
       $#
       $#
       $#
       $#
       $##
 e  e Y8b  e $#
"8"d8b Y8b"8"$#
  d888b Y8b  $#
 d888888888b $#
d8888888b Y8b$#
             $#
             $##
 e  e88 88e  e $#
"8"d888 888b"8"$#
  C8888 8888D  $#
   Y888 888P   $#
    "88 88"    $#
               $#
               $##
 e  8888 8888  e $#
"8" 8888 8888 "8"$#
    8888 8888    $#
    Y888 888P    $#
     "88 88"     $#
                 $#
                 $##
 e        e $#
"8","Y88b"8"$#
  "8" 888   $#
  ,ee 888   $#
  "88 888   $#
            $#
            $##
               $#
 e  e88 88e  e $#
"8"d888 888b"8"$#
   Y888 888P   $#
    "88 88"    $#
               $#
               $##
 e           e $#
"8"8888 8888"8"$#
   8888 8888   $#
   Y888 888P   $#
    "88 88"    $#
               $#
               $##
     $#
 dP"Y$#
C88b $#
 Y88D$#
d,dP $#
     $#
     $##
flf2a$ 7 6 20 15 3
Stop by David Walton <walton@cs.ucdavis.edu>
Derived from Rounded by Nick Miners N.M.Miners@durham.ac.uk
21 August 1994
$$#
$$#
$$#
$$#
$$#
$$#
$$##
 _ #
| |#
| |#
|_|#
 _ #
|_|#
   ##
 _  _ #
( )( )#
|/ |/ #
      #
      #
      #
      ##
   __  _   #
 _|  || |_ #
(_   ||  _)#
 _|  || |_ #
(_   ||  _)#
  |__||_|  #
           ##
   _   #
 _| |_ #
|  ___)#
|___  |#
(_   _|#
  |_|  #
       ##
 _   _ #
(_) | |#
   / / #
  / /  #
 / / _ #
|_| (_)#
       ##
  ___   #
 / _ \  #
( (_) ) #
 ) _ (  #
( (/  \ #
 \__/\_)#
        ##
 _ #
( )#
|/ #
   #
   #
   #
   ##
   __ #
  / _)#
 / /  #
( (   #
 \ \_ #
  \__)#
      ##
 __   #
(_ \  #
  \ \ #
   ) )#
 _/ / #
(__/  #
      ##
 _  _  _ #
( \| |/ )#
 \  _  / #
(_ (_) _)#
 /     \ #
(_/|_|\_)#
         ##
       #
   _   #
 _| |_ #
(_   _)#
  |_|  #
       #
       ##
   #
   #
   #
   #
 _ #
( )#
|/ ##
     #
     #
 ___ #
(___)#
     #
     #
     ##
   #
   #
   #
   #
 _ #
(_)#
   ##
     _ #
    | |#
   / / #
  / /  #
 / /   #
|_|    #
       ##
  ______ #
 / __   |#
| | //| |#
| |// | |#
|  /__| |#
 \_____/ #
         ##
  __ #
 /  |#
/_/ |#
  | |#
  | |#
  |_|#
     ##
 ______  #
(_____ \ #
  ____) )#
 /_____/ #
 _______ #
(_______)#
         ##
 ________#
(_______/#
   ____  #
  (___ \ #
 _____) )#
(______/ #
         ##
   __    #
  / /    #
 / /____ #
|___   _)#
    | |  #
    |_|  #
         ##
 _______ #
(_______)#
 ______  #
(_____ \ #
 _____) )#
(______/ #
         ##
    __  #
   / /  #
  / /_  #
 / __ \ #
( (__) )#
 \____/ #
        ##
 _______ #
(_______)#
      _  #
     / ) #
    / /  #
   (_/   #
         ##
  _____  #
 / ___ \ #
( (   ) )#
 > > < < #
( (___) )#
 \_____/ #
         ##
  ____  #
 / __ \ #
( (__) )#
 \__  / #
   / /  #
  /_/   #
        ##
   #
   #
 _ #
(_)#
 _ #
(_)#
   ##
   #
   #
 _ #
(_)#
 _ #
( )#
|/ ##
       #
  _  _ #
 / )/ )#
( (( ( #
 \_)\_)#
       #
       ##
     #
 ___ #
(___)#
 ___ #
(___)#
     #
     ##
       #
 _  _  #
( \( \ #
 ) )) )#
(_/(_/ #
       #
       ##
 ____  #
(___ \ #
    ) )#
   /_/ #
   _   #
  (_)  #
       ##
 $       $ #
 $       $ #
 $       $ #
 $    _|_$ #
 $__   | $ #
$(_/|_/|_/$#
 $       $ ##
        #
   /\   #
  /  \  #
 / /\ \ #
| |__| |#
|______|#
        ##
 ______  #
(____  \ #
 ____)  )#
|  __  ( #
| |__)  )#
|______/ #
         ##
  ______ #
 / _____)#
| /      #
| |      #
| \_____ #
 \______)#
         ##
 _____   #
(____ \  #
 _   \ \ #
| |   | |#
| |__/ / #
|_____/  #
         ##
 _______ #
(_______)#
 _____   #
|  ___)  #
| |_____ #
|_______)#
         ##
 _______ #
(_______)#
 _____   #
|  ___)  #
| |      #
|_|      #
         ##
  ______ #
 / _____)#
| /  ___ #
| | (___)#
| \____/|#
 \_____/ #
         ##
 _     _ #
| |   | |#
| |__ | |#
|  __)| |#
| |   | |#
|_|   |_|#
         ##
 _____ #
(_____)#
   _   #
  | |  #
 _| |_ #
(_____)#
       ##
   _____ #
  (_____)#
     _   #
    | |  #
 ___| |  #
(____/   #
         ##
 _    _ #
| |  / )#
| | / / #
| |< <  #
| | \ \ #
|_|  \_)#
        ##
 _       #
| |      #
| |      #
| |      #
| |_____ #
|_______)#
         ##
 ______  #
|  ___ \ #
| | _ | |#
| || || |#
| || || |#
|_||_||_|#
         ##
 ______  #
|  ___ \ #
| |   | |#
| |   | |#
| |   | |#
|_|   |_|#
         ##
  _____  #
 / ___ \ #
| |   | |#
| |   | |#
| |___| |#
 \_____/ #
         ##
 ______  #
(_____ \ #
 _____) )#
|  ____/ #
| |      #
|_|      #
         ##
  _____  #
 / ___ \ #
| |   | |#
| |   |_|#
 \ \____ #
  \_____)#
         ##
 ______  #
(_____ \ #
 _____) )#
(_____ ( #
      | |#
      |_|#
         ##
    _    #
   | |   #
    \ \  #
     \ \ #
 _____) )#
(______/ #
         ##
 _______ #
(_______)#
 _       #
| |      #
| |_____ #
 \______)#
         ##
 _     _ #
| |   | |#
| |   | |#
| |   | |#
| |___| |#
 \______|#
         ##
 _    _ #
| |  | |#
| |  | |#
 \ \/ / #
  \  /  #
   \/   #
        ##
 _  _  _ #
| || || |#
| || || |#
| ||_|| |#
| |___| |#
 \______|#
         ##
 _    _ #
\ \  / /#
 \ \/ / #
  )  (  #
 / /\ \ #
/_/  \_\#
        ##
 _     _ #
| |   | |#
| |___| |#
 \_____/ #
   ___   #
  (___)  #
         ##
 _______ #
(_______)#
   __    #
  / /    #
 / /____ #
(_______)#
         ##
 ___ #
|  _)#
| |  #
| |  #
| |_ #
|___)#
     ##
 _     #
| |    #
 \ \   #
  \ \  #
   \ \ #
    |_|#
       ##
 ___ #
(_  |#
  | |#
  | |#
 _| |#
(___|#
     ##
   /\  #
  //\\ #
 (____)#
       #
       #
       #
       ##
         #
         #
         #
         #
 _______ #
(_______)#
         ##
 _ #
( )#
 \|#
   #
   #
   #
   ##
       #
       #
  ____ #
 / _  |#
( ( | |#
 \_||_|#
       ##
 _     #
| |    #
| | _  #
| || \ #
| |_) )#
|____/ #
       ##
       #
       #
  ____ #
 / ___)#
( (___ #
 \____)#
       ##
     _ #
    | |#
  _ | |#
 / || |#
( (_| |#
 \____|#
       ##
       #
       #
  ____ #
 / _  )#
( (/ / #
 \____)#
       ##
  ___ #
 / __)#
| |__ #
|  __)#
| |   #
|_|   #
      ##
       #
       #
  ____ #
 / _  |#
( ( | |#
 \_|| |#
(_____|##
 _     #
| |    #
| | _  #
| || \ #
| | | |#
|_| |_|#
       ##
 _ #
(_)#
 _ #
| |#
| |#
|_|#
   ##
   _ #
  (_)#
   _ #
  | |#
  | |#
 _| |#
(__/ ##
 _     #
| |    #
| |  _ #
| | / )#
| |< ( #
|_| \_)#
       ##
 _ #
| |#
| |#
| |#
| |#
|_|#
   ##
       #
       #
 ____  #
|    \ #
| | | |#
|_|_|_|#
       ##
       #
       #
 ____  #
|  _ \ #
| | | |#
|_| |_|#
       ##
       #
       #
  ___  #
 / _ \ #
| |_| |#
 \___/ #
       ##
       #
       #
 ____  #
|  _ \ #
| | | |#
| ||_/ #
|_|    ##
       #
       #
  ____ #
 / _  |#
| | | |#
 \_|| |#
    |_|##
       #
       #
  ____ #
 / ___)#
| |    #
|_|    #
       ##
      #
      #
  ___ #
 /___)#
|___ |#
(___/ #
      ##
      #
 _    #
| |_  #
|  _) #
| |__ #
 \___)#
      ##
       #
       #
 _   _ #
| | | |#
| |_| |#
 \____|#
       ##
       #
       #
 _   _ #
| | | |#
 \ V / #
  \_/  #
       ##
       #
       #
 _ _ _ #
| | | |#
| | | |#
 \____|#
       ##
       #
       #
 _   _ #
( \ / )#
 ) X ( #
(_/ \_)#
       ##
       #
       #
 _   _ #
| | | |#
| |_| |#
 \__  |#
(____/ ##
       #
       #
 _____ #
(___  )#
 / __/ #
(_____)#
       ##
   __ #
  / _)#
 | |  #
( (   #
 | |_ #
  \__)#
      ##
 _ #
| |#
|_|#
 _ #
| |#
|_|#
   ##
 __   #
(_ \  #
  | | #
   ) )#
 _| | #
(__/  #
      ##
  __  _ #
 /  \/ )#
(_/\__/ #
        #
        #
        #
        ##
 _     _ #
(_) _ (_)#
   / \   #
  / _ \  #
 / /_\ \ #
|_______|#
         ##
 _     _ #
(_)___(_)#
 / ___ \ #
| |   | |#
| |___| |#
 \_____/ #
         ##
 _     _ #
(_)   (_)#
 _     _ #
| |   | |#
| |___| |#
 \______|#
         ##
 _   _ #
(_) (_)#
  ____ #
 / _  |#
( ( | |#
 \_||_|#
       ##
 _   _ #
(_) (_)#
  ___  #
 / _ \ #
| |_| |#
 \___/ #
       ##
 _   _ #
(_) (_)#
 _   _ #
| | | |#
| |_| |#
 \____|#
       ##
  ___  #
 / _ \ #
| | ) )#
| |< ( #
| | ) )#
|_|(_/ #
       ##
flf2a$ 11 8 20 32 13
Colossal.flf (Jonathon - jon@mq.edu.au)
8 June 1994

Explanation of first line:
flf2 - "magic number" for file identification
a    - should always be `a', for now
$    - the "hardblank" -- prints as a blank, but can't be smushed
11   - height of a character
8    - height of a character, not including descenders
20   - max line length (excluding comment lines) + a fudge factor
32   - default smushmode for this font
13   - number of comment lines

$  $@
$  $@
$  $@
$  $@
$  $@
$  $@
$  $@
$  $@
$  $@
$  $@
$  $@@
888$@
888$@
888$@
888$@
888$@
Y8P$@
 " $@
888$@
    @
    @
    @@
88 88$@
8P 8P$@
"  " $@
 $  $ @
 $  $ @
 $  $ @
 $  $ @
 $  $ @
 $  $ @
 $  $ @
 $  $ @@
  888  888  $@
  888  888  $@
888888888888$@
  888  888  $@
  888  888  $@
888888888888$@
  888  888  $@
  888  888  $@
            $@
            $@
            $@@
     88    $@
 .d88888b. $@
d88P 88"88b$@
Y88b.88   $ @
 "Y88888b.$ @
     88"88b$@
Y88b 88.88P$@
 "Y88888P"$ @
     88     @
            @
            @@
d88b   d88P$@
Y88P  d88P $@
     d88P $ @
    d88P $  @
 $ d88P  $  @
$ d88P   $  @
$d88P  d88b$@
d88P   Y88P$@
            @
            @
            @@
 .d8888b.  $  @
d88P  "88b $  @
Y88b. d88P $  @
 "Y8888P"  $  @
.d88P88K.d88P$@
888"  Y888P" $@
Y88b .d8888b $@
 "Y8888P" Y88b@
              @
              @
              @@
d8b$@
88P$@
8P $@
" $ @
 $  @
 $  @
 $  @
 $  @
 $  @
 $  @
 $  @@
 $.d88$@
$d88P"$@
d88P $ @
888  $ @
888  $ @
Y88b $ @
$Y88b.$@
 $"Y88$@
       @
       @
       @@
88b.$  @
"Y88b$ @
  Y88b$@
   888$@
   888$@
  d88P$@
.d88P$ @
88P"$  @
       @
       @
       @@
             @
      o  $   @
     d8b  $  @
    d888b  $ @
"Y888888888P"@
  "Y88888P"$ @
  d88P"Y88b $@
 dP"     "Yb$@
             @
             @
             @@
     $  @
     $  @
     $  @
  888  $@
8888888$@
  888  $@
     $  @
     $  @
     $  @
     $  @
     $  @@
  $ @
  $ @
  $ @
  $ @
  $ @
  $ @
d8b$@
88P$@
8P  @
"   @
    @@
 $  $  @
 $  $  @
 $  $  @
 $  $  @
 $  $  @
888888$@
 $  $  @
 $  $  @
 $  $  @
 $  $  @
 $  $  @@
  $ @
  $ @
  $ @
  $ @
  $ @
  $ @
d8b$@
Y8P$@
    @
    @
    @@
     $ d88P$@
    $ d88P $@
   $ d88P $ @
  $ d88P $  @
 $ d88P $   @
$ d88P $    @
$d88P $     @
d88P $      @
            @
            @
            @@
$.d8888b.$ @
d88P  Y88b$@
888    888$@
888    888$@
888    888$@
888    888$@
Y88b  d88P$@
$"Y8888P"$ @
           @
           @
           @@
 d888 $ @
d8888 $ @
  888 $ @
  888 $ @
  888 $ @
  888 $ @
  888 $ @
8888888$@
        @
        @
        @@
 .d8888b.$ @
d88P  Y88b$@
 $     888$@
 $   .d88P$@
 .od888P" $@
d88P"     $@
888"      $@
888888888 $@
           @
           @
           @@
 .d8888b.$ @
d88P  Y88b$@
 $   .d88P$@
 $  8888" $@
 $   "Y8b.$@
888    888$@
Y88b  d88P$@
 "Y8888P" $@
           @
           @
           @@
    d8888 $@
   d8P888 $@
  d8P 888 $@
 d8P  888 $@
d88   888 $@
8888888888$@
      888 $@
      888 $@
           @
           @
           @@
888888888$ @
888      $ @
888      $ @
8888888b.$ @
$    "Y88b$@
$      888$@
Y88b  d88P$@
 "Y8888P"$ @
           @
           @
           @@
$.d8888b.$ @
d88P  Y88b$@
888      $ @
888d888b.$ @
888P "Y88b$@
888    888$@
Y88b  d88P$@
$"Y8888P"$ @
           @
           @
           @@
8888888888$@
    $ d88P$@
   $ d88P $@
  $ d88P $ @
$88888888$ @
$ d88P $   @
$d88P $    @
d88P $     @
           @
           @
           @@
 .d8888b.$ @
d88P  Y88b$@
Y88b. d88P$@
 "Y88888" $@
.d8P""Y8b.$@
888    888$@
Y88b  d88P$@
 "Y8888P" $@
           @
           @
           @@
$.d8888b.$ @
d88P  Y88b$@
888    888$@
Y88b. d888$@
$"Y888P888$@
$      888$@
Y88b  d88P$@
 "Y8888P"$ @
           @
           @
           @@
  $ @
  $ @
  $ @
d8b$@
Y8P$@
  $ @
d8b$@
Y8P$@
    @
    @
    @@
  $ @
  $ @
  $ @
d8b @
Y8P @
  $ @
d8b$@
88P$@
8P  @
"   @
    @@
 $ d88P$@
$ d88P $@
 d88P $ @
d88P $  @
Y88b $  @
 Y88b $ @
$ Y88b $@
 $ Y88b$@
        @
        @
        @@
 $  $  @
 $  $  @
 $  $  @
888888$@
 $   $ @
888888$@
 $  $  @
 $  $  @
 $  $  @
 $  $  @
 $  $  @@
Y88b $  @
 Y88b $ @
  Y88b $@
   Y88b$@
   d88P$@
  d88P $@
 d88P $ @
d88P $  @
        @
        @
        @@
$.d8888b.$ @
d88P  Y88b$@
 $   .d88P$@
 $ .d88P"$ @
 $ 888"  $ @
 $ 888   $ @
 $       $ @
 $ 888   $ @
           @
           @
           @@
$.d8888888b.$ @
d88P"   "Y88b$@
888  d8b  888$@
888  888  888$@
888  888bd88P$@
888  Y8888P" $@
Y88b.     .d8$@
$"Y88888888P"$@
              @
              @
              @@
      $d8888$@
     $d88888$@
    $d88P888$@
   $d88P 888$@
  $d88P  888$@
 $d88P   888$@
$d8888888888$@
d88P     888$@
             @
             @
             @@
888888b.$  @
888  "88b$ @
888  .88P$ @
8888888K.$ @
888  "Y88b$@
888    888$@
888   d88P$@
8888888P"$ @
           @
           @
           @@
$.d8888b.$ @
d88P  Y88b$@
888    888$@
888      $ @
888      $ @
888    888$@
Y88b  d88P$@
$"Y8888P"$ @
           @
           @
           @@
8888888b.$ @
888  "Y88b$@
888    888$@
888    888$@
888    888$@
888    888$@
888  .d88P$@
8888888P"$ @
           @
           @
           @@
8888888888$@
888    $   @
888    $   @
8888888$   @
888    $   @
888    $   @
888    $   @
8888888888$@
           @
           @
           @@
8888888888$@
888    $   @
888    $   @
8888888$   @
888    $   @
888    $   @
888    $   @
888    $   @
           @
           @
           @@
$.d8888b.$ @
d88P  Y88b$@
888    888$@
888       $@
888  88888$@
888    888$@
Y88b  d88P$@
$"Y8888P88$@
           @
           @
           @@
888    888$@
888    888$@
888    888$@
8888888888$@
888    888$@
888    888$@
888    888$@
888    888$@
           @
           @
           @@
8888888$@
  888 $ @
  888 $ @
  888 $ @
  888 $ @
  888 $ @
  888 $ @
8888888$@
        @
        @
        @@
  888888$@
    "88b$@
     888$@
     888$@
     888$@
     888$@
     88P$@
     888$@
   .d88P$@
 .d88P"$ @
888P" $  @@
888    d8P$ @
888   d8P $ @
888  d8P $  @
888d88K $   @
8888888b $  @
888  Y88b $ @
888   Y88b $@
888    Y88b$@
            @
            @
            @@
888   $  @
888   $  @
888   $  @
888   $  @
888   $  @
888   $  @
888   $  @
88888888$@
         @
         @
         @@
888b     d888$@
8888b   d8888$@
88888b.d88888$@
888Y88888P888$@
888 Y888P 888$@
888  Y8P  888$@
888   "   888$@
888       888$@
              @
              @
              @@
888b    888$@
8888b   888$@
88888b  888$@
888Y88b 888$@
888 Y88b888$@
888  Y88888$@
888   Y8888$@
888    Y888$@
            @
            @
            @@
$.d88888b.$ @
d88P" "Y88b$@
888     888$@
888     888$@
888     888$@
888     888$@
Y88b. .d88P$@
$"Y88888P"$ @
            @
            @
            @@
8888888b.$ @
888   Y88b$@
888    888$@
888   d88P$@
8888888P"$ @
888 $      @
888 $      @
888 $      @
           @
           @
           @@
$.d88888b.$ @
d88P" "Y88b$@
888     888$@
888     888$@
888     888$@
888 Y8b 888$@
Y88b.Y8b88P$@
$"Y888888" $@
       Y8b $@
            @
            @@
8888888b.$ @
888   Y88b$@
888    888$@
888   d88P$@
8888888P"$ @
888 T88b $ @
888  T88b$ @
888   T88b$@
           @
           @
           @@
$.d8888b.$ @
d88P  Y88b$@
Y88b.    $ @
$"Y888b. $ @
$   "Y88b.$@
$     "888$@
Y88b  d88P$@
 "Y8888P"$ @
           @
           @
           @@
88888888888$@
    888 $   @
    888 $   @
    888 $   @
    888 $   @
    888 $   @
    888 $   @
    888 $   @
            @
            @
            @@
888     888$@
888     888$@
888     888$@
888     888$@
888     888$@
888     888$@
Y88b. .d88P$@
$"Y88888P"$ @
            @
            @
            @@
888     888$@
888     888$@
888     888$@
Y88b   d88P$@
 Y88b d88P $@
  Y88o88P $ @
   Y888P $  @
    Y8P $   @
            @
            @
            @@
888       888$@
888   o   888$@
888  d8b  888$@
888 d888b 888$@
888d88888b888$@
88888P Y88888$@
8888P   Y8888$@
888P     Y888$@
              @
              @
              @@
Y88b   d88P$@
 Y88b d88P $@
  Y88o88P $ @
   Y888P  $ @
   d888b  $ @
  d88888b $ @
 d88P Y88b $@
d88P   Y88b$@
            @
            @
            @@
Y88b   d88P$@
 Y88b d88P $@
  Y88o88P $ @
   Y888P $  @
    888 $   @
    888 $   @
    888 $   @
    888 $   @
            @
            @
            @@
8888888888P$@
    $ d88P $@
   $ d88P $ @
  $ d88P $  @
 $ d88P  $  @
$ d88P   $  @
$d88P    $  @
d8888888888$@
            @
            @
            @@
8888888$@
888  $  @
888  $  @
888  $  @
888  $  @
888  $  @
888  $  @
8888888$@
        @
        @
        @@
Y88b $      @
$Y88b $     @
$ Y88b $    @
 $ Y88b $   @
  $ Y88b $  @
   $ Y88b $ @
    $ Y88b $@
     $ Y88b$@
            @
            @
            @@
8888888$@
 $  888$@
 $  888$@
 $  888$@
 $  888$@
 $  888$@
 $  888$@
8888888$@
        @
        @
        @@
    o$   @
   d8b$  @
  d888b$ @
 d8P"Y8b$@
  $    $ @
  $    $ @
  $    $ @
  $    $ @
  $    $ @
  $    $ @
  $    $ @@
 $     $ @
 $     $ @
 $     $ @
 $     $ @
 $     $ @
 $     $ @
 $     $ @
88888888$@
         @
         @
         @@
  d8b$@
  Y88$@
   Y8$@
    Y$@
    $ @
   $  @
  $   @
  $   @
  $   @
  $   @
  $   @@
         @
         @
         @
$8888b. $@
$   "88b$@
.d888888$@
888  888$@
"Y888888$@
         @
         @
         @@
888 $    @
888 $    @
888 $    @
88888b.$ @
888 "88b$@
888  888$@
888 d88P$@
88888P"$ @
         @
         @
         @@
         @
         @
         @
$.d8888b$@
d88P"  $ @
888    $ @
Y88b.  $ @
$"Y8888P$@
         @
         @
         @@
     888$@
     888$@
     888$@
$.d88888$@
d88" 888$@
888  888$@
Y88b 888$@
$"Y88888$@
         @
         @
         @@
         @
         @
         @
$.d88b.$ @
d8P  Y8b$@
88888888$@
Y8b.$    @
$"Y8888$ @
         @
         @
         @@
$.d888$@
d88P"$ @
888 $  @
888888$@
888 $  @
888 $  @
888 $  @
888 $  @
       @
       @
       @@
         @
         @
         @
$.d88b.$ @
d88P"88b$@
888  888$@
Y88b 888$@
$"Y88888$@
$    888$@
Y8b d88P$@
 "Y88P"$ @@
888 $    @
888 $    @
888 $    @
88888b.$ @
888 "88b$@
888  888$@
888  888$@
888  888$@
         @
         @
         @@
d8b$@
Y8P$@
$  $@
888$@
888$@
888$@
888$@
888$@
    @
    @
    @@
  $d8b$@
  $Y8P$@
 $    $@
 $8888$@
 $"888$@
 $ 888$@
 $ 888$@
 $ 888$@
 $ 888$@
$ d88P$@
888P"$ @@
888 $    @
888 $    @
888 $    @
888  888$@
888 .88P$@
888888K$ @
888 "88b$@
888  888$@
         @
         @
         @@
888$@
888$@
888$@
888$@
888$@
888$@
888$@
888$@
    @
    @
    @@
              @
              @
              @
88888b.d88b.$ @
888 "888 "88b$@
888  888  888$@
888  888  888$@
888  888  888$@
              @
              @
              @@
         @
         @
         @
88888b.$ @
888 "88b$@
888  888$@
888  888$@
888  888$@
         @
         @
         @@
         @
         @
         @
$.d88b.$ @
d88""88b$@
888  888$@
Y88..88P$@
$"Y88P"$ @
         @
         @
         @@
         @
         @
         @
88888b.$ @
888 "88b$@
888  888$@
888 d88P$@
88888P"$ @
888 $    @
888 $    @
888 $    @@
         @
         @
         @
$.d88888$@
d88" 888$@
888  888$@
Y88b 888$@
$"Y88888$@
   $ 888$@
   $ 888$@
   $ 888$@@
        @
        @
        @
888d888$@
888P"$  @
888 $   @
888 $   @
888 $   @
        @
        @
        @@
         @
         @
         @
.d8888b$ @
88K   $  @
"Y8888b.$@
$    X88$@
$88888P'$@
         @
         @
         @@
888 $  @
888 $  @
888 $  @
888888$@
888 $  @
888 $  @
Y88b.$ @
 "Y888$@
       @
       @
       @@
         @
         @
         @
888  888$@
888  888$@
888  888$@
Y88b 888$@
$"Y88888$@
         @
         @
         @@
         @
         @
         @
888  888$@
888  888$@
Y88  88P$@
$Y8bd8P$ @
$ Y88P $ @
         @
         @
         @@
              @
              @
              @
888  888  888$@
888  888  888$@
888  888  888$@
Y88b 888 d88P$@
$"Y8888888P"$ @
              @
              @
              @@
         @
         @
         @
888  888$@
`Y8bd8P'$@
$ X88K $ @
.d8""8b.$@
888  888$@
         @
         @
         @@
         @
         @
         @
888  888$@
888  888$@
888  888$@
Y88b 888$@
$"Y88888$@
$    888$@
Y8b d88P$@
$"Y88P"$ @@
         @
         @
         @
88888888$@
 $ d88P $@
$ d88P $ @
$d88P $  @
88888888$@
         @
         @
         @@
 $.d888$@
$d88P"$ @
$888  $ @
.888  $ @
888(  $ @
"888  $ @
$888  $ @
$Y88b.$ @
 $"Y888$@
        @
        @@
$ 888 $@
$ 888 $@
$ 888 $@
$ 888 $@
$     $@
$ 888 $@
$ 888 $@
$ 888 $@
$ 888 $@
       @
       @@
888b. $ @
$"Y88b $@
 $ 888 $@
 $ 888.$@
 $ )888$@
 $ 888"$@
 $ 888 $@
$.d88P $@
888P" $ @
        @
        @@
            @
            @
$d888b  d88$@
d888888888P$@
88P  Y888P$ @
            @
            @
            @
            @
            @
            @@
   d8b    d8b@
   Y8P    Y8P@
     $d88888$@
    $d88P888$@
   $d88P 888$@
  $d88P  888$@
 $d888888888$@
$d88P    888$@
             @
             @
             @@
 d8b   d8b  @
 Y8P   Y8P  @
$.d88888b.$ @
d88P" "Y88b$@
888     888$@
888     888$@
Y88b. .d88P$@
$"Y88888P"$ @
            @
            @
            @@
 d8b   d8b  @
 Y8P   Y8P  @
888     888$@
888     888$@
888     888$@
888     888$@
Y88b. .d88P$@
$"Y88888P"$ @
            @
            @
            @@
d8b  d8b @
Y8P  Y8P @
         @
$8888b. $@
$   "88b$@
.d888888$@
888  888$@
"Y888888$@
         @
         @
         @@
d8b  d8b @
Y8P  Y8P @
         @
$.d88b.$ @
d88""88b$@
888  888$@
Y88..88P$@
$"Y88P"$ @
         @
         @
         @@
d8b  d8b @
Y8P  Y8P @
         @
888  888$@
888  888$@
888  888$@
Y88b 888$@
$"Y88888$@
         @
         @
         @@
 .d888b.$  @
d88" "88b$ @
888  .88P$ @
888 888K.$ @
888  "Y88b$@
888    888$@
888   d88P$@
888 888P"$ @
888        @
888        @
           @@
flf2a$ 4 4 16 1 3
Adapted for figlet by Kent Nassen, kentn@cyberspace.org, 11/22/94, based
on the idea:

_________ @
||       ||@
||_______||@
|/_______\|@@
 ____ @
||! ||@
||__||@
|/__\|@@
 ____ @
||" ||@
||__||@
|/__\|@@
 ____ @
||# ||@
||__||@
|/__\|@@
 ____ @
||$ ||@
||__||@
|/__\|@@
 ____ @
||% ||@
||__||@
|/__\|@@
 ____ @
||& ||@
||__||@
|/__\|@@
 ____ @
||' ||@
||__||@
|/__\|@@
 ____ @
||( ||@
||__||@
|/__\|@@
 ____ @
||) ||@
||__||@
|/__\|@@
 ____ @
||* ||@
||__||@
|/__\|@@
 ____ @
||+ ||@
||__||@
|/__\|@@
 ____ @
||, ||@
||__||@
|/__\|@@
 ____ @
||- ||@
||__||@
|/__\|@@
 ____ @
||. ||@
||__||@
|/__\|@@
 ____ @
||/ ||@
||__||@
|/__\|@@
 ____ @
||0 ||@
||__||@
|/__\|@@
 ____ @
||1 ||@
||__||@
|/__\|@@
 ____ @
||2 ||@
||__||@
|/__\|@@
 ____ @
||3 ||@
||__||@
|/__\|@@
 ____ @
||4 ||@
||__||@
|/__\|@@
 ____ @
||5 ||@
||__||@
|/__\|@@
 ____ @
||6 ||@
||__||@
|/__\|@@
 ____ @
||7 ||@
||__||@
|/__\|@@
 ____ @
||8 ||@
||__||@
|/__\|@@
 ____ @
||9 ||@
||__||@
|/__\|@@
 ____ @
||: ||@
||__||@
|/__\|@@
 ____ @
||; ||@
||__||@
|/__\|@@
 ____ @
||< ||@
||__||@
|/__\|@@
 ____ @
||= ||@
||__||@
|/__\|@@
 ____ @
||> ||@
||__||@
|/__\|@@
 ____ @
||? ||@
||__||@
|/__\|@@
 ____ @
||@ ||@
||__||@
|/__\|@@
 ____ @
||A ||@
||__||@
|/__\|@@
 ____ @
||B ||@
||__||@
|/__\|@@
 ____ @
||C ||@
||__||@
|/__\|@@
 ____ @
||D ||@
||__||@
|/__\|@@
 ____ @
||E ||@
||__||@
|/__\|@@
 ____ @
||F ||@
||__||@
|/__\|@@
 ____ @
||G ||@
||__||@
|/__\|@@
 ____ @
||H ||@
||__||@
|/__\|@@
 ____ @
||I ||@
||__||@
|/__\|@@
 ____ @
||J ||@
||__||@
|/__\|@@
 ____ @
||K ||@
||__||@
|/__\|@@
 ____ @
||L ||@
||__||@
|/__\|@@
 ____ @
||M ||@
||__||@
|/__\|@@
 ____ @
||N ||@
||__||@
|/__\|@@
 ____ @
||O ||@
||__||@
|/__\|@@
 ____ @
||P ||@
||__||@
|/__\|@@
 ____ @
||Q ||@
||__||@
|/__\|@@
 ____ @
||R ||@
||__||@
|/__\|@@
 ____ @
||S ||@
||__||@
|/__\|@@
 ____ @
||T ||@
||__||@
|/__\|@@
 ____ @
||U ||@
||__||@
|/__\|@@
 ____ @
||V ||@
||__||@
|/__\|@@
 ____ @
||W ||@
||__||@
|/__\|@@
 ____ @
||X ||@
||__||@
|/__\|@@
 ____ @
||Y ||@
||__||@
|/__\|@@
 ____ @
||Z ||@
||__||@
|/__\|@@
 ____ @
||[ ||@
||__||@
|/__\|@@
 ____ @
||\ ||@
||__||@
|/__\|@@
 ____ @
||] ||@
||__||@
|/__\|@@
 ____ @
||^ ||@
||__||@
|/__\|@@
 ____ @
||_ ||@
||__||@
|/__\|@@
 ____ @
||` ||@
||__||@
|/__\|@@
 ____ @
||a ||@
||__||@
|/__\|@@
 ____ @
||b ||@
||__||@
|/__\|@@
 ____ @
||c ||@
||__||@
|/__\|@@
 ____ @
||d ||@
||__||@
|/__\|@@
 ____ @
||e ||@
||__||@
|/__\|@@
 ____ @
||f ||@
||__||@
|/__\|@@
 ____ @
||g ||@
||__||@
|/__\|@@
 ____ @
||h ||@
||__||@
|/__\|@@
 ____ @
||i ||@
||__||@
|/__\|@@
 ____ @
||j ||@
||__||@
|/__\|@@
 ____ @
||k ||@
||__||@
|/__\|@@
 ____ @
||l ||@
||__||@
|/__\|@@
 ____ @
||m ||@
||__||@
|/__\|@@
 ____ @
||n ||@
||__||@
|/__\|@@
 ____ @
||o ||@
||__||@
|/__\|@@
 ____ @
||p ||@
||__||@
|/__\|@@
 ____ @
||q ||@
||__||@
|/__\|@@
 ____ @
||r ||@
||__||@
|/__\|@@
 ____ @
||s ||@
||__||@
|/__\|@@
 ____ @
||t ||@
||__||@
|/__\|@@
 ____ @
||u ||@
||__||@
|/__\|@@
 ____ @
||v ||@
||__||@
|/__\|@@
 ____ @
||w ||@
||__||@
|/__\|@@
 ____ @
||x ||@
||__||@
|/__\|@@
 ____ @
||y ||@
||__||@
|/__\|@@
 ____ @
||z ||@
||__||@
|/__\|@@
 ____ @
||{ ||@
||__||@
|/__\|@@
 ____ @
||| ||@
||__||@
|/__\|@@
 ____ @
||} ||@
||__||@
|/__\|@@
 ____ @
||~ ||@
||__||@
|/__\|@@
@
@
@
@@
@
@
@
@@
@
@
@
@@
@
@
@
@@
@
@
@
@@
@
@
@
@@
@
@
@
@@
flf2a$ 8 8 17 -1 2
basic.flf by Craig O'Flaherty <cofl@it.ntu.edu.au>
August 17, 1994
$$@
$$@
$$@
$$@
$$@
$$@
$$@
$$@@
db$@
88$@
YP$@
  $@
db$@
YP$@
  $@
  $@@
.o. .o.$@
`8' `8'$@
       $@
       $@
       $@
       $@
       $@
       $@@
       $@
 db db $@
C88888D$@
 88 88 $@
C88888D$@
 YP YP $@
       $@
       $@@
   A   $@
.d8888.$@
88'8 YP$@
`8b8.  $@
  `V8b.$@
db 8 8D$@
`8888Y'$@
   V   $@@
db   dD$@
YP  d8'$@
   d8' $@
  d8'  $@
 d8' db$@
d8'  YP$@
       $@
       $@@
.d888b. $@
8P   8D $@
`Vb d8' $@
 d88C dD$@
C8' d8D $@
`888P Yb$@
        $@
        $@@
Cb$@
`D$@
 '$@
  $@
  $@
  $@
  $@
  $@@
    dD$@
  d8' $@
 d8   $@
C88   $@
 V8   $@
  V8. $@
    VD$@
      $@@
Cb    $@
 `8b  $@
   8b $@
   88D$@
   8P $@
 .8P  $@
CP    $@
      $@@
       $@
8. A .8$@
`8.8.8'$@
  888  $@
.d'8`b.$@
8' V `8$@
       $@
       $@@
      $@
  db  $@
  88  $@
C8888D$@
  88  $@
  VP  $@
      $@
      $@@
  $@
  $@
  $@
  $@
db$@
V8$@
 P$@
  $@@
      $@
      $@
      $@
C8888D$@
      $@
      $@
      $@
      $@@
  $@
  $@
  $@
  $@
db$@
VP$@
  $@
  $@@
     dD$@
    d8'$@
   d8' $@
  d8'  $@
 d8'   $@
C8'    $@
       $@
       $@@
 .d88b. $@
.8P  88.$@
88  d'88$@
88 d' 88$@
`88  d8'$@
 `Y88P' $@
        $@
        $@@
 db$@
o88$@
 88$@
 88$@
 88$@
 VP$@
   $@
   $@@
.d888b.$@
VP  `8D$@
   odD'$@
 .88'  $@
j88.   $@
888888D$@
       $@
       $@@
d8888b.$@
VP  `8D$@
  oooY'$@
  ~~~b.$@
db   8D$@
Y8888P'$@
       $@
       $@@
  j88D $@
 j8~88 $@
j8' 88 $@
V88888D$@
    88 $@
    VP $@
       $@
       $@@
  ooooo$@
 8P~~~~$@
dP     $@
V8888b.$@
    `8D$@
88oobY'$@
       $@
       $@@
   dD  $@
  d8'  $@
 d8'   $@
d8888b.$@
88' `8D$@
`8888P $@
       $@
       $@@
d88888D$@
VP  d8'$@
   d8' $@
  d8'  $@
 d8'   $@
d8'    $@
       $@
       $@@
.d888b.$@
88   8D$@
`VoooY'$@
.d~~~b.$@
88   8D$@
`Y888P'$@
       $@
       $@@
.d888b.$@
88' `8D$@
`V8o88'$@
   d8' $@
  d8'  $@
 d8'   $@
       $@
       $@@
  $@
db$@
VP$@
  $@
db$@
VP$@
  $@
  $@@
  $@
db$@
VP$@
  $@
db$@
V8$@
 P$@
  $@@
      $@
   .dP$@
 .d8  $@
,P    $@
`b    $@
 `Vb  $@
   `Vb$@
      $@@
      $@
C8888D$@
      $@
C8888D$@
      $@
      $@
      $@
      $@@
      $@
Vb    $@
 `Vb  $@
   `V.$@
   .d'$@
 .dP  $@
dP    $@
      $@@
.d888b.$@
VP  `8D$@
   odD'$@
  8P'  $@
  oo   $@
  VP   $@
       $@
       $@@
 .o888b.$@
d8'   Y8$@
8P db dP$@
8b V8o8P$@
Y8.    d$@
 `Y888P'$@
        $@
        $@@
 .d8b. $@
d8' `8b$@
88ooo88$@
88~~~88$@
88   88$@
YP   YP$@
       $@
       $@@
d8888b.$@
88  `8D$@
88oooY'$@
88~~~b.$@
88   8D$@
Y8888P'$@
       $@
       $@@
 .o88b.$@
d8P  Y8$@
8P     $@
8b     $@
Y8b  d8$@
 `Y88P'$@
       $@
       $@@
d8888b.$@
88  `8D$@
88   88$@
88   88$@
88  .8D$@
Y8888D'$@
       $@
       $@@
d88888b$@
88'    $@
88ooooo$@
88~~~~~$@
88.    $@
Y88888P$@
       $@
       $@@
d88888b$@
88'    $@
88ooo  $@
88~~~  $@
88     $@
YP     $@
       $@
       $@@
 d888b $@
88' Y8b$@
88     $@
88  ooo$@
88. ~8~$@
 Y888P $@
       $@
       $@@
db   db$@
88   88$@
88ooo88$@
88~~~88$@
88   88$@
YP   YP$@
       $@
       $@@
d888888b$@
  `88'  $@
   88   $@
   88   $@
  .88.  $@
Y888888P$@
        $@
        $@@
   d88b$@
   `8P'$@
    88 $@
    88 $@
db. 88 $@
Y8888P $@
       $@
       $@@
db   dD$@
88 ,8P'$@
88,8P  $@
88`8b  $@
88 `88.$@
YP   YD$@
       $@
       $@@
db     $@
88     $@
88     $@
88     $@
88booo.$@
Y88888P$@
       $@
       $@@
.88b  d88.$@
88'YbdP`88$@
88  88  88$@
88  88  88$@
88  88  88$@
YP  YP  YP$@
          $@
          $@@
d8b   db$@
888o  88$@
88V8o 88$@
88 V8o88$@
88  V888$@
VP   V8P$@
        $@
        $@@
 .d88b. $@
.8P  Y8.$@
88    88$@
88    88$@
`8b  d8'$@
 `Y88P' $@
        $@
        $@@
d8888b.$@
88  `8D$@
88oodD'$@
88~~~  $@
88     $@
88     $@
       $@
       $@@
 .d88b. $@
.8P  Y8.$@
88    88$@
88    88$@
`8P  d8'$@
 `Y88'Y8$@
        $@
        $@@
d8888b.$@
88  `8D$@
88oobY'$@
88`8b  $@
88 `88.$@
88   YD$@
       $@
       $@@
.d8888.$@
88'  YP$@
`8bo.  $@
  `Y8b.$@
db   8D$@
`8888Y'$@
       $@
       $@@
d888888b$@
`~~88~~'$@
   88   $@
   88   $@
   88   $@
   YP   $@
        $@
        $@@
db    db$@
88    88$@
88    88$@
88    88$@
88b  d88$@
~Y8888P'$@
        $@
        $@@
db    db$@
88    88$@
Y8    8P$@
`8b  d8'$@
 `8bd8' $@
   YP   $@
        $@
        $@@
db   d8b   db$@
88   I8I   88$@
88   I8I   88$@
Y8   I8I   88$@
`8b d8'8b d8'$@
 `8b8' `8d8' $@
             $@
             $@@
db    db$@
`8b  d8'$@
 `8bd8' $@
 .dPYb. $@
.8P  Y8.$@
YP    YP$@
        $@
        $@@
db    db$@
`8b  d8'$@
 `8bd8' $@
   88   $@
   88   $@
   YP   $@
        $@
        $@@
d88888D$@
YP  d8'$@
   d8' $@
  d8'  $@
 d8' db$@
d88888P$@
       $@
       $@@
d88D$@
88  $@
88  $@
88  $@
88  $@
L88D$@
    $@
    $@@
Cb     $@
`8b    $@
 `8b   $@
  `8b  $@
   `8b $@
    `8D$@
       $@
       $@@
C88D$@
  88$@
  88$@
  88$@
  88$@
C888$@
    $@
    $@@
   db   $@
 .dPVb. $@
dP'  `Vb$@
        $@
        $@
        $@
        $@
        $@@
       $@
       $@
       $@
       $@
       $@
C88888D$@
       $@
       $@@
dD$@
C'$@
 `$@
  $@
  $@
  $@
  $@
  $@@
 .d8b. $@
d8' `8b$@
88ooo88$@
88~~~88$@
88   88$@
YP   YP$@
       $@
       $@@
d8888b.$@
88  `8D$@
88oooY'$@
88~~~b.$@
88   8D$@
Y8888P'$@
       $@
       $@@
 .o88b.$@
d8P  Y8$@
8P     $@
8b     $@
Y8b  d8$@
 `Y88P'$@
       $@
       $@@
d8888b.$@
88  `8D$@
88   88$@
88   88$@
88  .8D$@
Y8888D'$@
       $@
       $@@
d88888b$@
88'    $@
88ooooo$@
88~~~~~$@
88.    $@
Y88888P$@
       $@
       $@@
d88888b$@
88'    $@
88ooo  $@
88~~~  $@
88     $@
YP     $@
       $@
       $@@
 d888b $@
88' Y8b$@
88     $@
88  ooo$@
88. ~8~$@
 Y888P $@
       $@
       $@@
db   db$@
88   88$@
88ooo88$@
88~~~88$@
88   88$@
YP   YP$@
       $@
       $@@
d888888b$@
  `88'  $@
   88   $@
   88   $@
  .88.  $@
Y888888P$@
        $@
        $@@
   d88b$@
   `8P'$@
    88 $@
    88 $@
db. 88 $@
Y8888P $@
       $@
       $@@
db   dD$@
88 ,8P'$@
88,8P  $@
88`8b  $@
88 `88.$@
YP   YD$@
       $@
       $@@
db     $@
88     $@
88     $@
88     $@
88booo.$@
Y88888P$@
       $@
       $@@
.88b  d88.$@
88'YbdP`88$@
88  88  88$@
88  88  88$@
88  88  88$@
YP  YP  YP$@
          $@
          $@@
d8b   db$@
888o  88$@
88V8o 88$@
88 V8o88$@
88  V888$@
VP   V8P$@
        $@
        $@@
 .d88b. $@
.8P  Y8.$@
88    88$@
88    88$@
`8b  d8'$@
 `Y88P' $@
        $@
        $@@
d8888b.$@
88  `8D$@
88oodD'$@
88~~~  $@
88     $@
88     $@
       $@
       $@@
 .d88b. $@
.8P  Y8.$@
88    88$@
88    88$@
`8P  d8'$@
 `Y88'Y8$@
        $@
        $@@
d8888b.$@
88  `8D$@
88oobY'$@
88`8b  $@
88 `88.$@
88   YD$@
       $@
       $@@
.d8888.$@
88'  YP$@
`8bo.  $@
  `Y8b.$@
db   8D$@
`8888Y'$@
       $@
       $@@
d888888b$@
`~~88~~'$@
   88   $@
   88   $@
   88   $@
   YP   $@
        $@
        $@@
db    db$@
88    88$@
88    88$@
88    88$@
88b  d88$@
~Y8888P'$@
        $@
        $@@
db    db$@
88    88$@
Y8    8P$@
`8b  d8'$@
 `8bd8' $@
   YP   $@
        $@
        $@@
db   d8b   db$@
88   I8I   88$@
88   I8I   88$@
Y8   I8I   88$@
`8b d8'8b d8'$@
 `8b8' `8d8' $@
             $@
             $@@
db    db$@
`8b  d8'$@
 `8bd8' $@
 .dPYb. $@
.8P  Y8.$@
YP    YP$@
        $@
        $@@
db    db$@
`8b  d8'$@
 `8bd8' $@
   88   $@
   88   $@
   YP   $@
        $@
        $@@
d88888D$@
YP  d8'$@
   d8' $@
  d8'  $@
 d8' db$@
d88888P$@
       $@
       $@@
   .8P$@
   8' $@
 .dP  $@
C88   $@
 `Yb  $@
   8. $@
   `8b$@
      $@@
8$@
8$@
8$@
 $@
8$@
8$@
8$@
 $@@
V8.   $@
 `8   $@
  Vb. $@
   88D$@
  dP' $@
 .8   $@
C8'   $@
      $@@
 .oo.  .$@
P'  `VP'$@
        $@
        $@
        $@
        $@
        $@
        $@@
@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@
@@
flf2a$ 7 7 13 0 2 0 64 0
Font Author: ?

$  $@
$  $@
$  $@
$  $@
$  $@
$  $@
$  $@@
██╗@
██║@
██║@
╚═╝@
██╗@
╚═╝@
   @@
@
@
@
@
@
@
@@
 ██╗ ██╗ @
████████╗@
╚██╔═██╔╝@
████████╗@
╚██╔═██╔╝@
 ╚═╝ ╚═╝ @
         @@
▄▄███▄▄·@
██╔════╝@
███████╗@
╚════██║@
███████║@
╚═▀▀▀══╝@
        @@
██╗ ██╗@
╚═╝██╔╝@
  ██╔╝ @
 ██╔╝  @
██╔╝██╗@
╚═╝ ╚═╝@
       @@
   ██╗   @
   ██║   @
████████╗@
██╔═██╔═╝@
██████║  @
╚═════╝  @
         @@
@
@
@
@
@
@
@@
 ██╗@
██╔╝@
██║ @
██║ @
╚██╗@
 ╚═╝@
    @@
██╗ @
╚██╗@
 ██║@
 ██║@
██╔╝@
╚═╝ @
    @@
      @
▄ ██╗▄@
 ████╗@
▀╚██╔▀@
  ╚═╝ @
      @
      @@
@
@
@
@
@
@
@@
   @
   @
   @
   @
▄█╗@
╚═╝@
   @@
      @
      @
█████╗@
╚════╝@
      @
      @
      @@
   @
   @
   @
   @
██╗@
╚═╝@
   @@
    ██╗@
   ██╔╝@
  ██╔╝ @
 ██╔╝  @
██╔╝   @
╚═╝    @
       @@
 ██████╗ @
██╔═████╗@
██║██╔██║@
████╔╝██║@
╚██████╔╝@
 ╚═════╝ @
         @@
 ██╗@
███║@
╚██║@
 ██║@
 ██║@
 ╚═╝@
    @@
██████╗ @
╚════██╗@
 █████╔╝@
██╔═══╝ @
███████╗@
╚══════╝@
        @@
██████╗ @
╚════██╗@
 █████╔╝@
 ╚═══██╗@
██████╔╝@
╚═════╝ @
        @@
██╗  ██╗@
██║  ██║@
███████║@
╚════██║@
     ██║@
     ╚═╝@
        @@
███████╗@
██╔════╝@
███████╗@
╚════██║@
███████║@
╚══════╝@
        @@
 ██████╗ @
██╔════╝ @
███████╗ @
██╔═══██╗@
╚██████╔╝@
 ╚═════╝ @
         @@
███████╗@
╚════██║@
    ██╔╝@
   ██╔╝ @
   ██║  @
   ╚═╝  @
        @@
 █████╗ @
██╔══██╗@
╚█████╔╝@
██╔══██╗@
╚█████╔╝@
 ╚════╝ @
        @@
 █████╗ @
██╔══██╗@
╚██████║@
 ╚═══██║@
 █████╔╝@
 ╚════╝ @
        @@
   @
██╗@
╚═╝@
██╗@
╚═╝@
   @
   @@
   @
██╗@
╚═╝@
▄█╗@
▀═╝@
   @
   @@
  ██╗@
 ██╔╝@
██╔╝ @
╚██╗ @
 ╚██╗@
  ╚═╝@
     @@
@
@
@
@
@
@
@@
██╗  @
╚██╗ @
 ╚██╗@
 ██╔╝@
██╔╝ @
╚═╝  @
     @@
██████╗ @
╚════██╗@
  ▄███╔╝@
  ▀▀══╝ @
  ██╗   @
  ╚═╝   @
        @@
 ██████╗ @
██╔═══██╗@
██║██╗██║@
██║██║██║@
╚█║████╔╝@
 ╚╝╚═══╝ @
         @@
 █████╗ @
██╔══██╗@
███████║@
██╔══██║@
██║  ██║@
╚═╝  ╚═╝@
        @@
██████╗ @
██╔══██╗@
██████╔╝@
██╔══██╗@
██████╔╝@
╚═════╝ @
        @@
 ██████╗@
██╔════╝@
██║     @
██║     @
╚██████╗@
 ╚═════╝@
        @@
██████╗ @
██╔══██╗@
██║  ██║@
██║  ██║@
██████╔╝@
╚═════╝ @
        @@
███████╗@
██╔════╝@
█████╗  @
██╔══╝  @
███████╗@
╚══════╝@
        @@
███████╗@
██╔════╝@
█████╗  @
██╔══╝  @
██║     @
╚═╝     @
        @@
 ██████╗ @
██╔════╝ @
██║  ███╗@
██║   ██║@
╚██████╔╝@
 ╚═════╝ @
         @@
██╗  ██╗@
██║  ██║@
███████║@
██╔══██║@
██║  ██║@
╚═╝  ╚═╝@
        @@
██╗@
██║@
██║@
██║@
██║@
╚═╝@
   @@
     ██╗@
     ██║@
     ██║@
██   ██║@
╚█████╔╝@
 ╚════╝ @
        @@
██╗  ██╗@
██║ ██╔╝@
█████╔╝ @
██╔═██╗ @
██║  ██╗@
╚═╝  ╚═╝@
        @@
██╗     @
██║     @
██║     @
██║     @
███████╗@
╚══════╝@
        @@
███╗   ███╗@
████╗ ████║@
██╔████╔██║@
██║╚██╔╝██║@
██║ ╚═╝ ██║@
╚═╝     ╚═╝@
           @@
███╗   ██╗@
████╗  ██║@
██╔██╗ ██║@
██║╚██╗██║@
██║ ╚████║@
╚═╝  ╚═══╝@
          @@
 ██████╗ @
██╔═══██╗@
██║   ██║@
██║   ██║@
╚██████╔╝@
 ╚═════╝ @
         @@
██████╗ @
██╔══██╗@
██████╔╝@
██╔═══╝ @
██║     @
╚═╝     @
        @@
 ██████╗ @
██╔═══██╗@
██║   ██║@
██║▄▄ ██║@
╚██████╔╝@
 ╚══▀▀═╝ @
         @@
██████╗ @
██╔══██╗@
██████╔╝@
██╔══██╗@
██║  ██║@
╚═╝  ╚═╝@
        @@
███████╗@
██╔════╝@
███████╗@
╚════██║@
███████║@
╚══════╝@
        @@
████████╗@
╚══██╔══╝@
   ██║   @
   ██║   @
   ██║   @
   ╚═╝   @
         @@
██╗   ██╗@
██║   ██║@
██║   ██║@
██║   ██║@
╚██████╔╝@
 ╚═════╝ @
         @@
██╗   ██╗@
██║   ██║@
██║   ██║@
╚██╗ ██╔╝@
 ╚████╔╝ @
  ╚═══╝  @
         @@
██╗    ██╗@
██║    ██║@
██║ █╗ ██║@
██║███╗██║@
╚███╔███╔╝@
 ╚══╝╚══╝ @
          @@
██╗  ██╗@
╚██╗██╔╝@
 ╚███╔╝ @
 ██╔██╗ @
██╔╝ ██╗@
╚═╝  ╚═╝@
        @@
██╗   ██╗@
╚██╗ ██╔╝@
 ╚████╔╝ @
  ╚██╔╝  @
   ██║   @
   ╚═╝   @
         @@
███████╗@
╚══███╔╝@
  ███╔╝ @
 ███╔╝  @
███████╗@
╚══════╝@
        @@
███╗@
██╔╝@
██║ @
██║ @
███╗@
╚══╝@
    @@
@
@
@
@
@
@
@@
███╗@
╚██║@
 ██║@
 ██║@
███║@
╚══╝@
    @@
 ███╗ @
██╔██╗@
╚═╝╚═╝@
      @
      @
      @
      @@
        @
        @
        @
        @
███████╗@
╚══════╝@
        @@
@
@
@
@
@
@
@@
 █████╗ @
██╔══██╗@
███████║@
██╔══██║@
██║  ██║@
╚═╝  ╚═╝@
        @@
██████╗ @
██╔══██╗@
██████╔╝@
██╔══██╗@
██████╔╝@
╚═════╝ @
        @@
 ██████╗@
██╔════╝@
██║     @
██║     @
╚██████╗@
 ╚═════╝@
        @@
██████╗ @
██╔══██╗@
██║  ██║@
██║  ██║@
██████╔╝@
╚═════╝ @
        @@
███████╗@
██╔════╝@
█████╗  @
██╔══╝  @
███████╗@
╚══════╝@
        @@
███████╗@
██╔════╝@
█████╗  @
██╔══╝  @
██║     @
╚═╝     @
        @@
 ██████╗ @
██╔════╝ @
██║  ███╗@
██║   ██║@
╚██████╔╝@
 ╚═════╝ @
         @@
██╗  ██╗@
██║  ██║@
███████║@
██╔══██║@
██║  ██║@
╚═╝  ╚═╝@
        @@
██╗@
██║@
██║@
██║@
██║@
╚═╝@
   @@
     ██╗@
     ██║@
     ██║@
██   ██║@
╚█████╔╝@
 ╚════╝ @
        @@
██╗  ██╗@
██║ ██╔╝@
█████╔╝ @
██╔═██╗ @
██║  ██╗@
╚═╝  ╚═╝@
        @@
██╗     @
██║     @
██║     @
██║     @
███████╗@
╚══════╝@
        @@
███╗   ███╗@
████╗ ████║@
██╔████╔██║@
██║╚██╔╝██║@
██║ ╚═╝ ██║@
╚═╝     ╚═╝@
           @@
███╗   ██╗@
████╗  ██║@
██╔██╗ ██║@
██║╚██╗██║@
██║ ╚████║@
╚═╝  ╚═══╝@
          @@
 ██████╗ @
██╔═══██╗@
██║   ██║@
██║   ██║@
╚██████╔╝@
 ╚═════╝ @
         @@
██████╗ @
██╔══██╗@
██████╔╝@
██╔═══╝ @
██║     @
╚═╝     @
        @@
 ██████╗ @
██╔═══██╗@
██║   ██║@
██║▄▄ ██║@
╚██████╔╝@
 ╚══▀▀═╝ @
         @@
██████╗ @
██╔══██╗@
██████╔╝@
██╔══██╗@
██║  ██║@
╚═╝  ╚═╝@
        @@
███████╗@
██╔════╝@
███████╗@
╚════██║@
███████║@
╚══════╝@
        @@
████████╗@
╚══██╔══╝@
   ██║   @
   ██║   @
   ██║   @
   ╚═╝   @
         @@
██╗   ██╗@
██║   ██║@
██║   ██║@
██║   ██║@
╚██████╔╝@
 ╚═════╝ @
         @@
██╗   ██╗@
██║   ██║@
██║   ██║@
╚██╗ ██╔╝@
 ╚████╔╝ @
  ╚═══╝  @
         @@
██╗    ██╗@
██║    ██║@
██║ █╗ ██║@
██║███╗██║@
╚███╔███╔╝@
 ╚══╝╚══╝ @
          @@
██╗  ██╗@
╚██╗██╔╝@
 ╚███╔╝ @
 ██╔██╗ @
██╔╝ ██╗@
╚═╝  ╚═╝@
        @@
██╗   ██╗@
╚██╗ ██╔╝@
 ╚████╔╝ @
  ╚██╔╝  @
   ██║   @
   ╚═╝   @
         @@
███████╗@
╚══███╔╝@
  ███╔╝ @
 ███╔╝  @
███████╗@
╚══════╝@
        @@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@@
@
@
@
@
@
@
@@<?php

namespace AMWScan\Console;

use AMWScan\Exploits;
use AMWScan\Functions;
use AMWScan\Scanner;

/**
 * Class Console
 * Console manager.
 */
class CLI
{
    /**
     * Font colors.
     *
     * @var array
     */
    public static $foregroundColors = [
        'black' => '0;30',
        'dark_gray' => '1;30',
        'blue' => '0;34',
        'light_blue' => '1;34',
        'green' => '0;32',
        'light_green' => '1;32',
        'cyan' => '0;36',
        'light_cyan' => '1;36',
        'red' => '0;31',
        'light_red' => '1;31',
        'purple' => '0;35',
        'light_purple' => '1;35',
        'brown' => '0;33',
        'yellow' => '1;33',
        'light_gray' => '0;37',
        'white' => '1;37',
    ];

/**
     * Background colors.
     *
     * @var array
     */
    public static $backgroundColors = [
        'black' => '40',
        'red' => '41',
        'green' => '42',
        'yellow' => '43',
        'blue' => '44',
        'magenta' => '45',
        'cyan' => '46',
        'light_gray' => '47',
    ];

/**
     * Max default line length.
     *
     * @var int
     */
    public static $maxLineLength = 80;

/**
     * Get new line char.
     *
     * @return string
     */
    public static function eol($n)
    {
        $eol = '';
        for ($i = 0; $i < $n; $i++) {
            $eol .= PHP_EOL;
        }

return $eol;
    }

/**
     * Print header.
     */
    public static function header()
    {
        if (!Scanner::isCli()) {
            return;
        }

$figlet = new Figlet();
        $figlet->loadRandomFont();
        $header = $figlet->render(Scanner::getName());
        $header .= "\n\nGithub: " . Scanner::getRepoUrl();

$headerArray = explode("\n", $header);
        foreach ($headerArray as $key => $value) {
            $diff = strlen($value) - mb_strlen($value);
            $headerArray[$key] = str_pad($value, self::$maxLineLength + $diff, ' ', STR_PAD_BOTH);
        }
        $header = implode(PHP_EOL, $headerArray);
        $version = Scanner::getVersion();

self::newLine();
        self::displayLine($header, 2, 'green');
        $title = self::title('version ' . $version);
        self::display($title, 'green');
        self::newLine(2);

$title = self::title('');
        self::display($title, 'black', 'green');
        self::newLine();

$title = self::title(Scanner::getFullName());
        self::display($title, 'black', 'green');
        self::newLine();

$title = self::title('Created by ' . Scanner::getAuthor());
        self::display($title, 'black', 'green');
        self::newLine();

$title = self::title('');
        self::display($title, 'black', 'green');
        self::newLine(2);
        $context = stream_context_create(['http' => ['timeout' => 2]]);
        $version = @file_get_contents(Scanner::getLatestVersionUrl(), false, $context);
        if (!empty($version) && version_compare(Scanner::$version, $version, '<')) {
            self::write('New version', 'green');
            self::write(' ' . $version . ' ', 'green');
            self::writeLine('of the scanner available!', 2, 'green');
        }
    }

/**
     * Print title.
     *
     * @param string $char
     * @param int $length
     *
     * @return string
     */
    public static function title($text, $char = ' ', $length = null)
    {
        if ($length === null) {
            $length = self::$maxLineLength;
        }
        $result = '';
        $strLength = strlen($text);
        $spaces = $length - $strLength;
        $spacesLenHalf = $spaces / 2;
        $spacesLenLeft = round($spacesLenHalf);
        $spacesLenRight = round($spacesLenHalf);

if ((round($spacesLenHalf) - $spacesLenHalf) >= 0.5) {
            $spacesLenLeft--;
        }

for ($i = 0; $i < $spacesLenLeft; $i++) {
            $result .= $char;
        }

$result .= $text;

for ($i = 0; $i < $spacesLenRight; $i++) {
            $result .= $char;
        }

return $result;
    }

/**
     * Print progress.
     *
     * @param float $done
     * @param float $total
     * @param int $size
     */
    public static function progress($done, $total, $size = 30)
    {
        static $startTime;
        if ($done > $total || $total === 0) {
            return;
        }
        if (empty($startTime)) {
            $startTime = time();
        }
        $now = time();
        $perc = (float)($done / $total);
        $bar = floor($perc * $size);
        $statusBar = "\r[";
        $statusBar .= str_repeat('=', $bar);
        if ($bar < $size) {
            $statusBar .= '>';
            $statusBar .= str_repeat(' ', $size - $bar);
        } else {
            $statusBar .= '=';
        }
        $disp = number_format($perc * 100);
        $statusBar .= "] $disp%";
        $rate = $done !== 0.0 ? ($now - $startTime) / max(1, $done) : ($now - $startTime);
        $left = $total - $done;

$eta = round($rate * $left, 2);
        $etaType = 'sec';
        $elapsed = $now - $startTime;
        $elapsedType = 'sec';

if ($eta > 59) {
            $etaType = 'min';
            $eta = round($eta / 60);
        }

if ($elapsed > 59) {
            $elapsedType = 'min';
            $elapsed = round($elapsed / 60);
        }

self::display("$statusBar ", 'black', 'green');
        self::display(' ');
        self::display("$done/$total", 'green');
        self::display(' [' . number_format($elapsed) . ' ' . $elapsedType . '/' . number_format($eta) . ' ' . $etaType . ']');
        @ob_flush();
        @flush();
        if ($done === $total) {
            self::newLine();
        }
    }

/**
     * Display title bar.
     */
    public static function displayTitle($string, $foregroundColor, $backgroundColor)
    {
        $title = self::title('');
        self::display($title, $foregroundColor, $backgroundColor);
        self::newLine();

$title = self::title(strtoupper($string));
        self::display($title, $foregroundColor, $backgroundColor);
        self::newLine();

$title = self::title('');
        self::display($title, $foregroundColor, $backgroundColor);
        self::newLine();
    }

/**
     * Print break without writing logs.
     *
     * @param int $eol
     */
    public static function newLine($eol = 1)
    {
        self::write(self::eol($eol), 'white', null, false);
    }

/**
     * Print message without writing logs.
     *
     * @param int $eol
     * @param string $foregroundColor
     * @param null $backgroundColor
     * @param bool $escape
     */
    public static function displayLine($string, $eol = 1, $foregroundColor = 'white', $backgroundColor = null, $escape = true)
    {
        self::write($string . self::eol($eol), $foregroundColor, $backgroundColor, false, $escape);
    }

/**
     * Choice.
     *
     * @return string
     */
    public static function choice($question, $options)
    {
        foreach ($options as $key => $value) {
            self::displayOption($key, $value);
        }
        self::newLine(2);

return self::read(trim($question) . ' ', 'purple');
    }

/**
     * Print option.
     *
     * @param string $foregroundColor
     * @param null $backgroundColor
     * @param bool $escape
     */
    public static function displayOption($num, $string, $foregroundColor = 'white', $backgroundColor = null, $escape = true)
    {
        self::write('    [' . $num . '] ' . $string . self::eol(1), $foregroundColor, $backgroundColor, false, $escape);
    }

/**
     * Print message without writing logs.
     *
     * @param string $foregroundColor
     * @param null $backgroundColor
     */
    public static function display($string, $foregroundColor = 'white', $backgroundColor = null, $escape = true)
    {
        self::write($string, $foregroundColor, $backgroundColor, false, $escape);
    }

/**
     * Print break.
     *
     * @param int $eol
     */
    public static function writeBreak($eol = 1)
    {
        self::write(self::eol($eol));
    }

/**
     * Print message and print eol.
     *
     * @param string $string
     * @param int $eol
     * @param string $foregroundColor
     * @param null $backgroundColor
     * @param null $log
     * @param bool $escape
     */
    public static function writeLine($string, $eol = 1, $foregroundColor = 'white', $backgroundColor = null, $log = null, $escape = true)
    {
        self::write($string . self::eol($eol), $foregroundColor, $backgroundColor, $log, $escape);
    }

/**
     * Print message.
     *
     * @param string|null $foregroundColor
     * @param string|null $backgroundColor
     * @param null $log
     */
    public static function write($string, $foregroundColor = 'white', $backgroundColor = null, $log = null, $escape = true)
    {
        $returnString = $string;
        if (!Scanner::isColorEnabled()) {
            $foregroundColor = null;
            $backgroundColor = null;
        }
        if (Scanner::isLogEnabled() && $log === null) {
            $log = true;
        }
        if ($escape) {
            $returnString = self::escape($returnString);
        }
        $coloredString = '';
        if (isset(self::$foregroundColors[$foregroundColor])) {
            $coloredString .= "\033[" . self::$foregroundColors[$foregroundColor] . 'm';
        }
        if (isset(self::$backgroundColors[$backgroundColor])) {
            $coloredString .= "\033[" . self::$backgroundColors[$backgroundColor] . 'm';
        }
        $coloredString .= $returnString . "\033[0m";

if (!Scanner::isSilentMode()) {
            if (Scanner::isColorEnabled()) {
                echo $coloredString;
            } else {
                echo $returnString;
            }
        }

if ($log) {
            self::log($string, !empty($foregroundColor) && $foregroundColor !== 'white' ? $foregroundColor : $backgroundColor);
        }
    }

/**
     * Read input.
     *
     * @param string|null $string
     * @param string|null $foregroundColor
     * @param null $backgroundColor
     *
     * @return string
     */
    public static function read($string, $foregroundColor = 'white', $backgroundColor = null)
    {
        if (!Scanner::isColorEnabled()) {
            $foregroundColor = null;
            $backgroundColor = null;
        }
        $coloredString = '';
        if (isset(self::$foregroundColors[$foregroundColor])) {
            $coloredString .= "\033[" . self::$foregroundColors[$foregroundColor] . 'm';
        }
        if (isset(self::$backgroundColors[$backgroundColor])) {
            $coloredString .= "\033[" . self::$backgroundColors[$backgroundColor] . 'm';
        }
        $coloredString .= $string . "\033[0m";

$read = null;

if (!Scanner::isSilentMode()) {
            if (Scanner::isColorEnabled()) {
                echo Scanner::getLowerName() . ' > ' . trim($coloredString) . ' ';
            } else {
                echo Scanner::getLowerName() . ' > ' . trim($string) . ' ';
            }
        }

if (self::isWindows()) {
            $read = stream_get_line(STDIN, 1024, PHP_EOL);
        } else {
            $in = [STDIN];
            $out = [];
            $oob = [];
            while (@stream_select($in, $out, $oob, 0)) {
                fgets(STDIN);
            }
            $read = rtrim(fgets(STDIN));
        }

return (string)$read;
    }

/**
     * Print code.
     *
     * @param array $errors
     * @param bool $log
     */
    public static function code($string, $errors = [], $log = false)
    {
        $code = $string;
        foreach ($errors as $pattern) {
            $escaped = self::escape($pattern['match']);
            $code = str_replace($pattern['match'], "\033[" . self::$foregroundColors['red'] . 'm' . $escaped . "\033[" . self::$foregroundColors['white'] . 'm', $code);
        }
        $lines = explode("\n", $code);
        foreach ($lines as $i => $iValue) {
            if ($i !== 0) {
                self::newLine();
            }
            self::display('  ' . str_pad((string)($i + 1), strlen((string)count($lines)), ' ', STR_PAD_LEFT) . ' | ', 'yellow');
            self::display($iValue, 'white', null, false);
        }
        if ($log) {
            self::log($string);
        }
    }

/**
     * Write logs.
     *
     * @param string $color
     */
    public static function log($string, $color = '')
    {
        $string = trim($string);
        if (!empty($string)) {
            $string = trim($string, '.');
            $string = str_replace(self::eol(1), ' ', $string);
            $string = preg_replace("/[\s]+/m", ' ', $string);
            $type = 'INFO';
            switch ($color) {
                case 'green':
                    $type = 'SUCCESS';
                    break;
                case 'yellow':
                    $type = 'WARNING';
                    break;
                case 'red':
                    $type = 'DANGER';
                    break;
            }
            $string = '[' . date('Y-m-d H:i:s') . '] [' . $type . '] ' . $string . PHP_EOL;
            file_put_contents(Scanner::getPathLogs(), $string, FILE_APPEND);
        }
    }

/**
     * Escape colors string.
     *
     * @return string
     */
    public static function escape($string)
    {
        $cleaned = preg_replace('/(e|\x1B|[[:cntrl:]]|\033)\[(\d{1,2}(;\d{1,2})?)?[mGKc]/', '', $string);
        $encoding = mb_detect_encoding($cleaned, mb_detect_order(), true);
        $encoding = ($encoding && $encoding !== 'AUTO') ? $encoding : 'UTF-8';

return mb_convert_encoding($cleaned, 'UTF-8', $encoding);
    }

/**
     * Print lists.
     *
     * @param null $type
     */
    public static function helplist($type = null)
    {
        if (!Scanner::isCli()) {
            return;
        }

$list = '';
        if (empty($type) || $type === 'exploits') {
            $exploitList = implode(self::eol(1) . '- ', array_keys(Exploits::getAll()));
            $list .= self::eol(1) . 'Exploits:' . self::eol(1) . "- $exploitList";
        }
        if (empty($type)) {
            $list .= self::eol(1);
        }
        if (empty($type) || $type === 'functions') {
            $functionsList = implode(self::eol(1) . '- ', Functions::getDefault());
            $list .= self::eol(1) . 'Functions:' . self::eol(1) . "- $functionsList";
        }
        if (empty($type)) {
            $list .= self::eol(1);
        }
        if (empty($type) || $type === 'functions-encoded') {
            $functionsList = implode(self::eol(1) . '- ', Functions::getDangerous());
            $list .= self::eol(1) . 'Functions Encoded:' . self::eol(1) . "- $functionsList";
        }
        self::displayTitle(trim($type . ' List'), 'black', 'cyan');
        self::displayLine($list, 2);
    }

/**
     * @return string
     */
    public static function wordWrap($text)
    {
        return wordwrap($text, self::$maxLineLength);
    }

/**
     * Print Helper.
     */
    public static function helper()
    {
        if (!Scanner::isCli()) {
            return;
        }

$name = Scanner::getLowerName();
        $argv = Scanner::getArgv();
        $argv->setExamples([
            'php ' . $name . ' ./mywebsite/http/ -l -s --only-exploits',
            'php ' . $name . ' -s --max-filesize="5MB"',
            'php ' . $name . ' -s -logs="/user/marco/scanner.log"',
            'php ' . $name . ' --lite --only-exploits',
            'php ' . $name . ' --exploits="double_var2" --functions="eval, str_replace"',
            'php ' . $name . ' --ignore-paths="/my/path/*.log,/my/path/*/cache/*"',
        ]);
        $help = $argv->usage();

self::displayTitle('Help', 'black', 'cyan');
        self::newLine();
        self::displayLine(self::wordWrap('IMPORTANT: You will be solely responsible for any damage to your computer system or loss of data' .
            'that results from such activities. You are solely responsible for adequate protection and backup' .
            'of the data before execute the scanner.'));
        self::displayLine($help, 2);
        self::displayLine('Notes:');
        self::displayLine('For open files with nano or vim run the scripts with "php -d disable_functions=\'\'"', 2);
    }

/**
     * Is windows environment.
     *
     * @return bool
     */
    public static function isWindows()
    {
        return stripos(PHP_OS, 'WIN') === 0;
    }
}
<?php

namespace AMWScan;

use AMWScan\Modules\Wordpress;

class Modules
{
    /**
     * Check path.
     *
     * @param $path
     */
    public static function init($path)
    {
        Wordpress::init($path);
    }

/**
     * Is verified file.
     *
     * @param $path
     *
     * @return bool
     */
    public static function isVerified($path)
    {
        return Wordpress::isVerified($path);
    }
}
<?php

namespace AMWScan;

use RecursiveDirectoryIterator;
use RecursiveIteratorIterator;
use RuntimeException;

class Actions
{
    /**
     * Put contents.
     *
     * @param $filename
     * @param $data
     * @param int $flags
     * @param null $context
     *
     * @return false|int
     */
    public static function putContents($filename, $data, $flags = 0, $context = null)
    {
        if (Scanner::isBackupEnabled()) {
            self::makeBackup($filename);
        }

return file_put_contents($filename, $data, $flags, $context);
    }

/**
     * Clean Evil Code.
     *
     * @param $code
     * @param $patternFound
     *
     * @return string|string[]|null
     */
    public static function cleanEvilCode($code, $patternFound)
    {
        foreach ($patternFound as $pattern) {
            preg_match('/(<\?php)(.*?)(' . preg_quote($pattern['match'], '/') . '[\s\r\n]*;?)/si', $code, $match);
            $match[2] = trim($match[2]);
            $match[4] = trim($match[4]);
            if (!empty($match[2]) || !empty($match[4])) {
                $code = str_replace($match[0], $match[1] . $match[2] . $match[4] . $match[5], $code);
            } else {
                $code = str_replace($match[0], '', $code);
            }
            $code = preg_replace('/<\?php[\s\r\n]*\?>/i', '', $code);
        }

return $code;
    }

/**
     * Clean Evil Code Line.
     *
     * @param $code
     * @param $patternFound
     *
     * @return string
     */
    public static function cleanEvilCodeLine($code, $patternFound)
    {
        $lines = explode(PHP_EOL, $code);
        foreach ($patternFound as $pattern) {
            unset($lines[(int)$pattern['line'] - 1]);
        }

return implode(PHP_EOL, $lines);
    }

/**
     * Delete File.
     *
     * @param $file
     *
     * @return bool
     */
    public static function deleteFile($file)
    {
        if (Scanner::isBackupEnabled()) {
            self::makeBackup($file);
        }

return self::unlink($file);
    }

/**
     * Move to Quarantine.
     *
     * @param $file
     *
     * @return string
     */
    public static function moveToQuarantine($file)
    {
        $quarantine = Scanner::getPathQuarantine() . DIRECTORY_SEPARATOR . str_replace(realpath(Scanner::getPathScan()), '', realpath($file));
        $quarantine = str_replace(['/', '\\'], DIRECTORY_SEPARATOR, $quarantine);
        if (!is_dir(dirname($quarantine)) && (!mkdir($concurrentDirectory = dirname($quarantine), 0755, true) && !is_dir($concurrentDirectory))) {
            throw new RuntimeException(sprintf('Directory "%s" was not created', $concurrentDirectory));
        }
        rename($file, $quarantine);

return $quarantine;
    }

/**
     * Move to Quarantine.
     *
     * @param $file
     *
     * @return string
     */
    public static function makeBackup($file)
    {
        $scanPath = realpath(Scanner::getPathScan());
        if (is_file($scanPath)) {
            $scanPath = dirname($scanPath);
        }
        $backup = Scanner::getPathBackups() . DIRECTORY_SEPARATOR . str_replace($scanPath, '', realpath($file));
        $backup = Path::get($backup);
        if (!is_dir(dirname($backup)) &&
            (!mkdir($concurrentDirectory = dirname($backup), 0755, true) && !is_dir($concurrentDirectory))) {
            throw new RuntimeException(sprintf('Directory "%s" was not created', $concurrentDirectory));
        }
        copy($file, $backup);

return $backup;
    }

/**
     * Add to Whitelist.
     *
     * @param $file
     * @param $patternFound
     *
     * @return false|int
     */
    public static function addToWhitelist($file, $patternFound)
    {
        $whitelist = Scanner::getWhitelist();
        foreach ($patternFound as $key => $pattern) {
            $exploit = $pattern['key'];
            $lineNumber = $pattern['line'];
            $match = $pattern['match'];
            $fileName = str_replace(Scanner::getPathScan(), '', $file);
            $key = md5($exploit . $fileName . $lineNumber);
            $whitelist[$key] = [
                'file' => $fileName,
                'exploit' => $exploit,
                'line' => $lineNumber,
                'match' => $match,
            ];
        }
        Scanner::setWhitelist($whitelist);

return file_put_contents(Scanner::getPathWhitelist(), json_encode($whitelist));
    }

/**
     * Open with VIM.
     *
     * @param $file
     * @param $lineNumber
     */
    public static function openWithVim($file, $lineNumber = null)
    {
        if (Scanner::isBackupEnabled()) {
            self::makeBackup($file);
        }

$descriptors = [
            ['file', '/dev/tty', 'r'],
            ['file', '/dev/tty', 'w'],
            ['file', '/dev/tty', 'w'],
        ];
        $command = "vim ";
        if ($lineNumber !== null && is_numeric($lineNumber) && $lineNumber > 0) {
            $command .= "+$lineNumber ";
        }
        $command .= "'$file'";
        $process = proc_open($command, $descriptors, $pipes);
        while (true) {
            $procStatus = proc_get_status($process);
            if ($procStatus['running'] == false) {
                break;
            }
        }
    }

/**
     * Open with Nano.
     *
     * @param $file
     * @param $lineNumber
     */
    public static function openWithNano($file, $lineNumber = null)
    {
        if (Scanner::isBackupEnabled()) {
            self::makeBackup($file);
        }

$descriptors = [
            ['file', '/dev/tty', 'r'],
            ['file', '/dev/tty', 'w'],
            ['file', '/dev/tty', 'w'],
        ];
        $command = "nano ";
        if ($lineNumber !== null && is_numeric($lineNumber) && $lineNumber > 0) {
            $command .= "+$lineNumber ";
        }
        $command .= "'$file'";
        $process = proc_open($command, $descriptors, $pipes);
        while (true) {
            $procStatus = proc_get_status($process);
            if ($procStatus['running'] == false) {
                break;
            }
        }
    }

/**
     * Clean Quarantine path.
     *
     * @return bool
     */
    public static function cleanQuarantine()
    {
        return self::unlink(Scanner::getPathQuarantine());
    }

/**
     * Unlink.
     *
     * @param $path
     *
     * @return bool
     */
    protected static function unlink($path)
    {
        if (is_dir($path) && !is_link($path)) {
            $files = new RecursiveIteratorIterator(
                new RecursiveDirectoryIterator($path, RecursiveDirectoryIterator::SKIP_DOTS),
                RecursiveIteratorIterator::CHILD_FIRST
            );

foreach ($files as $fileinfo) {
                $action = ($fileinfo->isDir() ? 'rmdir' : 'unlink');
                $action($fileinfo->getRealPath());
            }

return rmdir($path);
        }

if (file_exists($path)) {
            return unlink($path);
        }

return false;
    }
}
<?php

namespace AMWScan;

class Signatures
{
    /**
     * Signatures raw data.
     *
     * @var array
     */
    public static $raw = [
        'SFRUUF9VU0VSX0FHRU5UCg',
        'ZXZhbCg',
        'c3lzdGVt',
        'cHJlZ19yZXBsYWNl',
        'ZXhlYyg',
        'YmFzZTY0X2RlY29kZ',
        'IyEvdXNyL2Jpbi9wZXJsCg',
        'Y21kLmV4ZQ',
        'cG93ZXJzaGVsbC5leGU',
        '\\x47\\x4c\\x4f\\x42\\x41\\x4c\\x53',
        '\\x65\\x76\\x61\\x6C\\x28',
        '\\x65\\x78\\x65\\x63',
        '\\x73\\x79\\x73\\x74\\x65\\x6d',
        '\\x70\\x72\\x65\\x67\\x5f\\x72\\x65\\x70\\x6c\\x61\\x63\\x65',
        '\\x48\\124\\x54\\120\\x5f\\125\\x53\\105\\x52\\137\\x41\\107\\x45\\116\\x54',
        '\\x61\\x73\\x65\\x36\\x34\\x5f\\x64\\x65\\x63\\x6f\\x64\\x65\\x28\\x67\\x7a\\x69\\x6e\\x66\\x6c\\x61\\x74\\x65\\x28',
        '474c4f42414c53',
        '6576616C28',
        '65786563',
        '73797374656d',
        '707265675f7265706c616365',
        '61736536345f6465636f646528677a696e666c61746528',
        '1337day.com',
        'antichat.ru',
        'b374k',
        'ccteam.ru',
        'crackfor',
        'darkc0de',
        'egyspider.eu',
        'exploit-db.com',
        'fopo.com.ar',
        'hashchecker.com',
        'hashkiller.com',
        'md5crack.com',
        'md5decrypter.com',
        'milw0rm.com',
        'milw00rm.com',
        'packetstormsecurity',
        'pentestmonkey.net',
        'phpjiami.com',
        'rapid7.com',
        'securityfocus',
        'shodan.io',
        'github.com/b374k/b374k',
        'mumaasp.com',
        '.mysql_history',
        '.ssh/authorized_keys',
        '/(.*)/e',
        '/etc/passwd',
        '/etc/proftpd.conf',
        '/etc/resolv.conf',
        '/etc/shadow',
        '/etc/syslog.conf',
        '/proc/cpuinfo',
        '/var/log/lastlog',
        '/windows/system32/',
        'LOAD DATA LOCAL INFILE',
        'WScript.Shell',
        'WinExec',
        'b374k',
        'backdoor',
        'c99shell',
        'r57shell',
        'fx29shell',
        'cmd.exe',
        'powershell.exe',
        'evilc0ders',
        'exploit',
        'find . -type f',
        'hashcrack',
        'ipconfig',
        'kernel32.dll',
        'kingdefacer',
        'Wireghoul',
        'htshell',
        'LD_PRELOAD',
        'libpcprofile',
        'locus7s',
        'ls -la',
        'meterpreter',
        'nc -l',
        'netstat -an',
        'ps -aux',
        'rootkit',
        'slowloris',
        'suhosin',
        'sun-tzu',
        'trojan',
        'uname -a',
        'visbot',
        'warez',
        "@eval(\$_POST['",
        'Backdoor',
        '@include($_GET[',
        'system($_GET[',
        'md5($_GET[',
        'fwrite($fpsetv, getenv("HTTP_COOKIE")',
        'system\"$cmd 1> /tmp/',
        '\\145\\166\\141\\154\\050\\142\\141\\163\\145\\066\\064\\137\\144\\145\\143\\157\\144\\145\\050',
        '$sh3llColor',
        'w4ck1ng shell',
        'private Shell by m4rco',
        'Shell by Mawar_Hitam',
        'SHELL_PASSWORD',
        'ConnectBackShell',
        'ShellBOT',
        '== "bindshell"',
        'curl_get_from_webpage',
        "file_get_contents('http://codepad.org",
        'c2hlbG',
        'NoZWxs',
        'zaGVsb',
        'PD9waH',
        'w/cGhw',
        '8P3Boc',
        'c3Rhd',
        'N0YX',
        'zdGF0',
        'Y29we',
        'NvcH',
        'jb3B5',
        'Y2hy',
        'c3lzdGVt',
        'N5c3Rlb',
        'zeXN0ZW',
        'cmVwbGFjZ',
        'JlcGxhY2',
        'yZXBsYWNl',
        'c3RyX',
        'N0cl',
        'zdHJf',
        'ZXhlYy',
        'V4ZWMo',
        'leGVjK',
        'ZWNob',
        'VjaG',
        'lY2hv',
        'ZnVuY3Rpb2',
        'Z1bmN0aW9u',
        'mdW5jdGlvb',
        'aW5jbHVkZ',
        'luY2x1ZG',
        'pbmNsdWRl',
        'cmVxdWlyZ',
        'JlcXVpcm',
        'yZXF1aXJl',
        'YmFzZTY0',
        'Jhc2U2N',
        'iYXNlNj',
        'ZXZhb',
        'V2YW',
        'ldmFs',
        'SFRUUF9VU0VSX0FHRU5U',
        'hUVFBfVVNFUl9BR0VOV',
        'IVFRQX1VTRVJfQUdFTl',
        'Z3ppbmZsYXRl',
        'd6aW5mbGF0Z',
        'nemluZmxhdG',
        'b3Blb',
        '9wZW',
        'vcGVu',
        'Y2xvc2',
        'Nsb3Nl',
        'jbG9zZ',
        'YXJyYXlf',
        'FycmF5X',
        'hcnJheV',
        'Y3NsYXNoZX',
        'NzbGFzaGVz',
        'jc2xhc2hlc',
        'ZXh0cmFjd',
        'V4dHJhY3',
        'leHRyYWN0',
        'JF9HRV',
        'RfR0VU',
        'kX0dFV',
        'JF9QT1NU',
        'RfUE9TV',
        'kX1BPU1',
        'JF9DT09LSU',
        'RfQ09PS0lF',
        'kX0NPT0tJR',
        'JF9SRVFVRVNU',
        'RfUkVRVUVTV',
        'kX1JFUVVFU1',
        'R0xPQkFMU',
        'dMT0JBTF',
        'HTE9CQUxT',
        'c2l6ZW9m',
        'NpemVvZ',
        'zaXplb2',
        'cHJpbnRm',
        'ByaW50Z',
        'wcmludG',
        'ZGVmaW5l',
        'RlZmluZ',
        'kZWZpbm',
        'eval("?>',
        '"base64_decode"',
        "='base'.(32*2).'_de'.'code'",
        '"p"."r"."e"."g"."_"',
        'WSOstripslashes',
        '\x73\x79\x73\x74\x65\x6d',
        '\x70\x72\x65\x67\x5f\x72\x65\x70\x6c\x61\x63\x65',
        '\x65\x78\x65\x63',
        'ev\x61l',
        '\x65\166\x61\154\x28',
        '\x65\x76\x61\x6C',
        "ev'.'al'.'",
        'eval(base64_decode(',
        '<?php eval',
        '$data = base64_decode("',
        'edoced_46esab',
        'base=base64_encode',
        "'b'.'ase6'.'4_e'.'ncode'",
        'cr"."eat"."e_fun"."cti"."on',
        "gz' . 'inf' . 'late",
        'http://www.fopo.com.ar/',
        '@eval("\\',
        'MagelangCyber',
        '//rasta//',
        'Baby_Drakon',
        'Created By EMMA',
        '3xp1r3',
        'NinjaVirus Here',
        '<dot>IrIsT',
        'Hacked By EnDLeSs',
        'Punker2Bot',
        'Zed0x',
        'darkminz',
        'ReaL_PuNiShEr',
        'OoN_Boy',
        'Pashkela',
        'Webcommander at',
        'YENI3ERI',
        'd3lete',
        'Made by Delorean',
        'Cybester90',
        'K!LL3r',
        'MrHazem',
        'BY MMNBOBZ',
        'Hackeado',
        'bgeteam',
        'VOBRA GANGO',
        'Asmodeus',
        'Cautam fisierele de configurare',
        'BRUTEFORCING',
        'FaTaLisTiCz_Fx Fx29Sh',
        'DX_Header_drawn',
        'Dr.abolalh',
        'C0derz.com',
        'Mr.HiTman',
        'IrSecTeam',
        'FLoodeR',
        'eriuqer',
        'zehirhacker',
        'freetellafriend.com',
        'casus15',
        'temp_r57_table',
        'By Psych0',
        'c99ftpbrutecheck',
        'd3b~X',
        'profexor.hell',
        'ZOBUGTEL',
        'The Dark Raver',
        '<kuku>',
        'M4ll3r',
        'itsoknoproblembro',
        'tmhapbzcerff',
        'IndoXploit',
        'FaisaL Ahmed aka rEd X',
        'smisbot',
        'smotherbot',
        'Indonesian Hacker Rulez',
        'wp-vcd',
        'class.theme-modules.php',
        'wp-tmp.php',
        'tmpcontentx',
        'function wp_temp_setupx',
        'derna.top/code.php',
        'stripos($tmpcontent, $wp_auth_key)',
        'dealonline.su',
        'uname -a',
        '/etc/shadow',
        '/etc/passwd',
        '\x47\x4c\x4f\x42\x41LS',
        '${${',
        'PHPJiaMi',
        'DisablePHP=',
        'moban.html',
        'a,b,c,d,e,f,g',
        '@x0powo',
        '@preg_replace',
        '1@1.com',
        'META http-equiv="refresh" content="0;',
        '="create_";global',
        'Net@ddress Mail',
        '__VIEWSTATEENCRYPTED',
        'createFilesForInputOutput',
        'R0lGODlhEwAQALMAAAAAAP///5ycAM7OY///nP//zv/OnPf39////wAAAAAA',
        'ayu pr1 pr2 pr3 pr4 pr5 pr6',
        'f0VMRgEBAQA',
        '0d0a0d0a676c6f62616c20246d795f736d7',
        'etalfnizg',
        'JHZpc2l0Y291bnQgPSAkSFRUUF9DT09LSUVf',
        'R2aXNpdGNvdW50ID0gJEhUVFBfQ09PS0lFX',
        'kdmlzaXRjb3VudCA9ICRIVFRQX0NPT0tJRV',
        'HTTP flood complete after',
        'exploitcookie',
        'az88pix00q98',
        'Q3JlZGl0IDogVW5kZXJncm91bmQgRGV2aWwgJm5ic3A7ICB8DQo8YSBocmVmP',
        '463839610c000b00800100ffffffffffff21f90401000001002c000',
        'AAAAAAAAMAAwABAAAAeAUAADQAAADsCQAAAAAAADQAIAADACgAFwAUAAEA',
        'HJ3HjutckoRfpXf9A1zQO2AwDRrRey9uGvTeez79qAao1a0rgudkZkR8Ra',
        'Ly83MTg3OWQyMTJkYzhjYmY0ZDRmZDA0NGEzZDE3Zjk3ZmI2N',
        'DJ7VIU7RICXr6sEEV2cBtHDSOe9nVdpEGhEmvRVRNURfw1wQ',
        'LS0gRHVtcDNkIGJ5IFBpcnVsaW4uUEhQIFdlYnNoM2xsIHYxLjAgYzBkZWQgYnkgcjBkcjEgOkw\=',
        '5jb20iKW9yIHN0cmlzdHIoJHJlZmVyZXIsImFwb3J0Iikgb3Igc3RyaXN0cigkcmVmZXJlciwibmlnbWEiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJ3ZWJhbHRhIikgb3Igc3RyaXN0cigk',
        'X1NFU1NJT05bJ3R4dGF1dGhpbiddID0gdHJ1ZTsNCiAgICBpZiAoJF9QT1NUWydybSddKSB7DQogICAgICBzZXRjb29raWUoJ3R4dGF1dGhfJy4kcm1ncm91cCwgbW',
        'R0lGODlhFAAUAKIAAAAAAP///93d3cDAwIaGhgQEBP///wAAACH5BAEAAAYALAAAAAAUABQAA',
        'm91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdX',
        'CB2aTZpIDEwMjQtDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KI3JlcXVp',
        'BDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAAQABADASIAAhEBA',
        'REREFER_PTTH',
        'Joomla_brute_Force',
        '/usr/sbin/httpd',
        'sshkeys',
        'eggdrop',
        'rwxrwxrwx',
        'GIF89A;<?php',
        'putbot $bot',
        'bind join - *',
        'privmsg $chan',
        '\u003c\u0069\u006d\u0067\u0020\u0073\u0072\u0063\u003d\u0022\u0068\u0074\u0074\u0070\u003a\u002f\u002f',
        '\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd',
        'find / \-type f \-name \.htpasswd',
        'find / \-type f \-perm \-02000 \-ls',
        'find / \-type f \-perm \-04000 \-ls',
        'find / -type f -name .htpasswd',
        'find / -type f -perm -02000 -ls',
        'find / -type f -perm -04000 -ls',
        "if(''==(\$df=@ini_get('disable_functions",
        'ncftpput -u',
        'wsoEx(',
        'WSOsetcookie(',
        '\x47\x4c\x4f\x42\x41\x4c\x53',
        "'OY<--X17N-.OB8X'^',+YLY=nQ;CM;+W6';",
        'Mister Spy',
        'Souheyl Bypass Shell',
        'Welcome To Our Shell',
        'Devloped By El Moujahidin',
        '$f1 = ".ht"; $f2 = "acc"; $f3 = "ess";',
        '.php.suspected',
        '\x6A\x6F\x69\x6E',
        '\x72\x65\x76\x65\x72\x73\x65',
        '\x73\x70\x6C\x69\x74',
        '\x3E\x74\x70\x69\x72\x63\x73\x2F\x3C',
        '/*;*/',
        'php_uname()',
        'str_split(rawurldecode(str_rot13(',
        'substr(md5(time()), 0, 8) . ".php"',
        '0byt3m1n1',
        'ZeroByte',
        "'str_' .'rot13'",
        "'st' .'rrev'",
        '100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59',
        '83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40',
        '"http://$xxx',
        '?useragent=$botbotbot',
    ];

/**
     * Signatures regular expressions.
     *
     * @var array
     */
    public static $regex = [
        '<\\?php\\s*eval\$\\s*base64_decode\\(\\s*"ew0KaWYgKCFkZWZpbmVkKC[^"]{100,60000}"\$\\);\\s*(\\?>)?',
        '<\\?php\\s*eval\$base64_decode\\("ew0KaWYgKCFkZ.{100,1000}Qp9DQp9"\$\\);\\?>\\s*',
        'eval\\s*\$\\s*base64_decode\\s*\\(\\s*"[^"]{1000,20000}hbC8qbmxpcHlmbWNreSovKGliY2ticmJ2KCRzaXVyeGJyYSwgJHlkKSk7Cn0="\\s*\$\\s*\\)\\s*;',
        '<script\\s*[^>]{0,40}>var\\s*(\\w{1,40})\\s*=\\s*\\[["\'][^\\]]{400,550}[\'"]\\];\\s*var\\s*url\\s*=\\s*String\\[\\1\\[\\d\\][^`]{700,950}var\\s*(\\w)\\s*=\\s*true;\\s*for\$var\\s*i=scrpts\\[\\1\\[15\\]\\];\\w--;\$\\{if\$scrpts\\[\\w\\]\\[\\1\\[\\d+\\]\\]\\s*==\\s*\\1\\[\\d+\\]\$\\{\\2\\s*=\\s*false\\}\\};if\$\\2\\s*==\\s*true\$\\{a\$\$\\}\\}</script>',
        '\\A\\s*var\\s*(\\w{1,40})\\s*=\\s*\\[(?:[\'"](?:\\\\x\\w{1,2}){1,40}[\'"]\\,?){1,40}\\]\\s*\\;\\s*.{700,1250}\\s*==\\s*\\1\\s*\\[\\s*\\d+\\s*\\]\\s*\\)\\s*\\{\\s*(\\w{1,40})\\s*=\\s*false\\s*\\}\\s*\\}\\s*;\\s*if\\s*\$\\s*\\2\\s*==\\s*true\\s*\$\\s*\\{\\s*\\w{1,40}\\s*\$\\s*\$\\s*\\}\\s*\\}',
        '\\A\\s*var\\s*(\\w{1,40})\\s*=\\s*document\\.createElement\$[\'"](\\w{1,40})[\'"]\$\\;\\s*\\1\\.type\\s*\\=\\s*[\'"]text\\/javascript[\'"]\\;\\s*\\1\\.src\\s*=\\s*String\\.fromCharCode\$(\\s*\\d+\\s*\\,?){20,140}\\s*\$\\;\\s*var\\s*scripts\\s*\\=\\s*document\\.getElementsByTagName\$[\'"]\\2[\'"]\$\\;',
        'var\\s*(\\w{1,40})\\s*=\\s*document\\.createElement\$[\'"](\\w{1,40})[\'"]\$\\;\\s*\\1\\.type\\s*\\=\\s*[\'"]text\\/javascript[\'"]\\;\\s*\\1\\.src\\s*=\\s*String\\.fromCharCode\$(\\s*\\d+\\s*\\,?){20,140}\\s*\$\\;\\s*var\\s*scripts\\s*\\=\\s*document\\.getElementsByTagName\$[\'"]\\2[\'"]\$\\;',
        '<script\\s+language=javascript>\\s*eval\$\\s*String\\.fromCharCode\\((\\d+\\s*,\\s*){3}[^)]+\$\\s*\\)\\s*;</script>',
        '\\A\\s*eval\$\\s*String\\.fromCharCode\\((\\d+\\s*,\\s*){3}[^)]+\$\\s*\\)\\s*;',
        '\\$\\w{1,40}\\s*=\\s*[\'"][\'"\\s\\.base64_dco]{15,40}[\'"]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*[\'"][\'"\\s\\.creat_funio]{17,40}[\'"]\\s*;\\s*\\s*\\$\\w{1,40}\\s*=\\s*["\'][\'"\\s\\.gzuncompres]{15,40}\\s*\\;.{2500,3000}[\'"]\\s*\\)\\s*\\)\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;\\s*//\\w{32}',
        '\\A\\s*<\\?php\\s*\\$\\{[\'"][^\'"]{1,40}[\'"]\\}\\[["][^`]{40000,64000}\\}=create_function\$[\'"][\'"],@?gzuncompress\\(\\$\\{\\$\\{[\'"][^\'"]{1,40}[\'"]\\}\\[[\'"][^\'"]{1,40}[\'"]\\]\\}\$\\);\\$\\{\\$\\w{1,40}\\}\$\$;\\s*\\?>\\Z',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*!class_exists\\s*\\(\\s*[\'"](Ratel)[\'"]\\s*\$\\s*\\)\\s*\\{.{9000,9999}\\s*\\)\\s*;\\s*\\}\\s*\\}\\s*fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*\\}\\s*return\\s*TRUE\\s*;\\s*\\}\\s*\\}\\s*(\\$\\w{1,40})\\s*=\\s*new\\s*\\1\\s*;\\s*\\2->init\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*@?preg_match\\s*\\(\\s*[\'"]/?(?:checkout|admin|\\|){1,3}/?[\'"]\\s*,\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]{1,20}[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*@?file_put_contents\\s*\$\\s*.{1,200}\\s*\\?>',
        '\\A\\s*<\\?php\\s*if\\s*\\(\\s*!class_exists\\s*\\(\\s*[\'"]Ratel[\'"]\\s*\$\\s*\\)\\s*\\{.{42000,44000}\\s*echo\\s*[\'"]\\$\\w{1,40}[\'"]\\s*;\\s*unset\\s*\$(?:\\s*\\$\\w{1,40}\\s*\\,?\\s*){1,9}\$\\s*\\;\\s*exit\$\\s*\$\\s*;\\s*\\}\\s*\\}\\s*[\'"]\\s*\\)\\s*\\;\\s*\\$\\{[\'"][^\'"]{1,40}[\'"]\\}\\[[\'"][^\'"]{1,40}[\'"]\\]\$\$\\;\\s*\\?>',
        '\\A\\s*<\\?php\\s*[^`]{1000,60000}\\s*\\?>\\s*(<\\?php\\s+/\\*\\*\\s*\\*\\sFront\\sto\\sthe\\sWordPress\\sapplication)',
        '\\A\\s*<\\?php\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$(?:\\s*[\'"][^\'"]{24,96}[\'"]\\s*,?){50,70}\\s*\$\\s*;.{0,284}eval\\s*\$\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*[\'"][\'"]\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*\\)\\s*;\\s*\\?>',
        '\\A\\s*<\\?php\\s*if\$isset\\(\\$_GET\\[[\'"]\\w{1,10}[\'"]\\].{60,70}\\$disable_functions\\s*=\\s*@ini_get\\([\'"]disable_functions[\'"]\$;\\s*.{320,350}echo[\'"]<b>\\s*gagal[\\s\\w]{0,15}[\'"];\\s*\\}\\s*\\}\\s*\\}\\s*\\?>',
        '@file_put_contents\$[\'"]\\w{1,40}\\.php[\'"]\\s*,\\s*file_get_contents\\s*\\(\\s*[\'"]https?://pastebin\\.com/raw[^\$]{1,40}\\)\\)\\;',
        '<\\?php\\s*(?:\\s*\\$\\w{1,9}\\s*=\\s*(?:\\s*chr\$\\d+\$\\.?){1,20}\\;|\\s*\\$\\w{1,9}\\s*=\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)(?:\\s*\\[\\s*[\'"][^\'"]{1,9}[\'"]\\s*\\])?\\s*;\\s*){1,20}(?:\\s*\\$\\w{1,9}\\s*[\$,\\.\$]\\s*){1,9}\\s*\\)\\s*;\\s*include\\s*\$\\s*\\$\\w{1,9}\\s*\$\\s*;\\s*\\$\\w{1,9}\\s*\$\\s*\\$\\w{1,9}\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*if\$isset\\(\\$_GET\\[[\'"]\\w{1,10}[\'"]\\].{60,70}\\$disable_functions\\s*=\\s*@ini_get\\([\'"]disable_functions[\'"]\$;\\s*.{320,350}echo[\'"]<b>\\s*gagal[\\s\\w]{0,15}[\'"];\\s*\\}\\s*\\}\\s*\\}\\s*\\?>',
        '<\\?php\\s*(?:\\s*(?:error_reporting|set_time_limit|ignore_user_abort)\\s*\$\\s*\\w{0,40}?\\s*\$\\s*;){3}(?:\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{1,210}?[\'"]\\s*;){2}\\s*do\\s*\\{.{100,300}@?copy\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\1\\s*\$\\s*\\;\\s*chmod\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\d+\\s*\$\\s*;\\s*\\}\\s*sleep\\s*\$\\s*\\d+\\s*\$\\s*;\\s*\\}\\s*while\\s*\$\\s*true\\s*\$\\s*;\\s*\\?>',
        '\\A\\s*<\\?php\\s*@?(echo)\\s*[\'"][^\\;]{15,250}[\'"]\\s*\\;\\s*if\\s*\$\\s*\\$_POST\\s*\\[\\s*[\'"]_upl[\'"]\\s*\\]\\s*==\\s*[\'"]\\w[\'"]\\s*\$\\s*\\{\\s*if\\s*\$\\s*\\@?copy\\s*\\(\\s*\\$_FILES\\[[\'"]\\w{1,40}[\'"]\\]\\s*\\[[^\\{]{1,40}\\s*\\{\\s*\\1\\s*[\'"].{1,40}[\'"]\\;\\s*\\}\\s*else\\s*\\{\\s*\\1[^\\}]{1,40}(\\s*\\}\\s*){2}\\s*\\?>',
        '\\A\\s*<\\?php\\s+[^\\$]{0,10}\\$\\w{1,40}[^\\$]{0,10}\\=[\'"]\\w{1,40}[\'"]\\;.{10,150}\\s*;\\s*(\\$\\w{1,40})\\s*=\\$\\w{1,40}\\s*\\(\\s*[\'"][^\'"]{0,40}[\'"]\\s*,\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*[\'"][^\'"]{0,40}[\'"]\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\1\\s*\$\\s*\$\\s*;',
        '<\\?php\\s*@?extract\\s*\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\$\\s*\\&\\&\\s*@?(assert|eval)\\s*\$\\s*stripslashes\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\&\\&\\s*@?exit\\s*;\\s*',
        '\\*/@\\$\\w\\&\\&@\\$\\w\\s*\$\\s*\\$\\w\\s*\\(\\s*\\$\\w\\s*,\\s*\\$\\w\\s*\$\\s*\\)\\s*;/\\*',
        '\\*/extract\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\$\\s*;/\\*',
        'if\\s*\$isset(\\(\\$\\_REQUEST\\[)[^\\]]{1,40}\\]\$\\s*\\&\\&\\s*isset\\1([^\\]]{1,40})\\]\\)\\s*\\&\\&\\s*\\1\\2\\]\\s*\\=\\=\\s*\\\'\\w{1,40}\\\'\\)\\)\\s*\\{\\s*(\\$\\w{1,40})\\s*\\=\\s*([^\\;]{1,40})\\;\\s*switch\\s*\$.{6000,8000}extract\\s*\\(\\s*theme_temp_setup\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\}\\s*\\}\\s*\\}(\\s*\\/\\/\\$?\\w{1,40}){0,3}',
        'call_user_func\\s*\$\\s*create_function\\s*\\(\\s*\\w{1,40}\\s*\\,\\s*str_rot13\\s*\\(\\s*strrev\\s*\\(\\s*[\'"][^\']{1,400}\'\$\\)\\)\\);',
        '\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]*[\'"]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*;\\s*foreach\\s*\$\\s*\\$\\w{1,40}\\s*as\\s*\\$\\w{1,40}\\s*=\\s*>\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*if.{1,200}\\s*echo\\s*@\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*\\}',
        '<\\?php\\s*@?file_put_contents\\s*\$\\s*([\'"][^\'"]*[\'"])\\s*,\\s*[\'"][^\'"]*[\'"]\\s*\\.\\s*base64_decode\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]*[\'"]\\s*\\]\\s*\$\\s*\\)\\s*;\\s*@?include\\s*\$\\s*\\1\\s*\$\\s*;\\s*@?unlink\\s*\$\\s*\\1\\s*\$\\s*;\\s*\\?>',
        'extract\$\\$_(?:COOKIE|GET|POST|SERVER|REQUEST)\$;\\s*if\\s*\$\\$\\w\$\\s*\\{\\s*@\\$\\w\$\\$\\w\\s*,\\s*\\$\\w\$\\s*;\\s*@?\\$\\w\$\\$\\w\\(\\$\\w\\s*,\\s*\\$\\w\$\\)\\s*;\\s*\\}',
        '\\A\\s*<\\?php\\s+echo\\s*[\'"]\\s*Priv8\\s+Home\\s+Root\\s+Uploader.{500,1000}echo\\s*[\'"]gagal\\s+upload[\'"];\\s*}\\s*\\}\\s*\\}\\s*\\?>',
        'file_put_contents\\s*\$\\s*[\'"][^,]{1,120}\\,\\s*base64_decode\\s*\\(\\s*[\'"]PD9waHANCmVjaG8gIlRoaXMgc2hpdCB3b3JrcyEiOw0KaWYgKGlzc2V0KCRfRklMRVNbImZpbGVuYW1lIl0pK[^,]{500,510}\\;(\\s/\\*[\'"]\$\\;)?',
        '\\A\\s*<\\?php\\s*\\$\\w{1,40}="[^"]+";\\s*\\$\\w{1,40}=\'[^\']+\';\\s*(\\$\\w{1,40}=(\\$\\w{1,40}\\[\\d+\\]\\.?)+;\\s*){4,10}\\s*\\$\\w{1,40}=\\$\\w{1,40}\$[\'"]{2},\\$\\w{1,40}\\("[^"]+",\\$\\w{1,40}\\(\\$\\w{1,40}\\(\\$\\w{1,40}\$\\)\\)\\);\\s*\\$\\w{1,40}\$\\$\\w{1,40},\\$\\w{1,40}\\(\\$\\w{1,40}\$,\\$\\w{1,40}(,\\d)?\\);\\s*\\?>',
        '<\\?php\\s*\\$[_0O]{1,40}\\s*=\\s*[\'"]?\\w{1,40}[\'"]?;[^`]{30000,38000}\\?>\\s*(<\\?php\\s+/\\*\\*\\s+\\*\\sCodeIgniter)',
        '<\\?php\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"]JGFyclswXT0[^"]{60000,}[\'"]\$\\)\\;',
        'if\\s*\$\\s*!function_exists\\s*\\(\\s*[\'"]wp_func_jquery[\'"]\\s*\$\\s*\\)\\s*(?:\\{\\s*if\\s*\$!current_user_can\\(\\s*[\'"]read[\'"]\\s*\$\\))?\\s*\\{\\s*function\\s*wp_func_jquery\\s*\$\\s*\$\\s*{\\s*\\$host\\s*=\\s*[\'"]https?://[\'"]\\s*;.{100,500}?add_action\$[\'"]wp_footer[\'"]\\s*,\\s*[\'"]wp_func_jquery[\'"]\$;\\s*\\}\\s*\\}',
        'error_reporting\$0\$;\\s*ini_set\$\\s*(chr\\(\\d+\$\\s*\\.?)+,\\s*\\d+\\);\\s*echo\\s+@?file_get_contents\$\\s*(chr\\(\\d+\$\\s*\\.?)+\\);',
        'set_time_limit\$\\d+\$;\\s*error_reporting\$\\d+\$;\\s*preg_replace\$[\'"]\\\\x[^\'"]+[\'"],[\'"].{50000,}[\'"],[\'"].{2,5}\$;',
        '<\\?php\\s*(\\$\\w{1,40})=range\$1,\\d+\$;\\s*(\\$\\w{1,40})=chr\$\\1\\[[^;]{10,300};\\s*\\2\\(\\$\\{chr\\(\\1\\[[^;]{10,300};\\s*\\?>',
        'function\\s+(\\w{1,40})\\(\$\\s*\\{\\s*if\\s*\$isset\\(\\$_REQUEST\\[([^]]+)\\]\$\\)\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*[\'base64_decode.]+;\\s*(\\$\\w{1,40})\\s*=\\s*\\3\$\\$_REQUEST\\[\\2\\]\$;\\s*eval\$\\4\$;\\s*\\}\\s*return;\\s*\\}\\s*add_action\$\'after_setup_theme\'\\s*,\\s*\'\\1\'\$;',
        '<\\?php\\s*echo\\s*"[^"]*"\\s*;\\s*move_uploaded_file\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*(passthru|system|shell_exec|popen)\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*basename\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*if\\s*\$\\s*copy\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\?>',
        '<\\?php\\s+\\$\\w{1,40}=\'[^;]+;if\$isset\\(\\$\\{\\$\\w{1,40}\\[[^}]+}\\[\\$\\w{1,40}[^)]+\$\\)\\{eval\$\\$\\{[^)]+\$;\\}\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*@?eval.+\'\\)\\);\\s*/\\*,\\*/\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*;\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*&&\\s*!empty\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*@eval\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '\\A<\\?php\\s*(?:\\$[O0_]{1,40}\\s*=[^;]{1,300};+\\s*){3,5}.{50000,};exit\$\$;\\}\'\\);\\$\\{"[^"]+"\\}\\["[^"]+"\\]\$\$;\\$[O0_]{1,40}="[^"]+";\\?>',
        '\\A<\\?php\\s+\\$GLOBALS\\[\'_\\d+_\'\\]=Array\$.{800,2000};\\}echo \\$_\\d+;exit;\\}\\s*/\\*',
        '<\\?php\\s*\\$[O0_]{1,40}=\'.{30000,}Content-Type:text/html;charset=utf-8\\\\\'\$;echo\\s+"\\$[O0_]{1,40}";exit\$\$;\\}\'\\);\\$\\{"[^"]+"\\}\\["[^"]+"\\]\$\$;\\$[O0_]{1,40}="[^"]+";\\?>',
        '<\\?php\\s*@?(eval|assert)\\s*\$\\s*\\$_(?:REQUEST|GET|POST|COOKIE|SERVER)\\s*\\[\'p\'\\]\\s*\$\\s*$',
        '<\\?php\\s*preg_replace\$"\\\\x2F\\\\x2E\\\\x2A\\\\x2F\\\\x65"\\s*,\\s*"[^"]+"\\s*,\\s*""\\s*\$;\\s*\\?>',
        '<\\?php\\s*\\$[O0_]{1,40}=\'.{10000,40000}ltrim\$\\s*str_replace\\(\\s*\'index\\.php\'\\s*,\\s*\'\'\\s*,\\s*\\$_SERVER\\[\'REQUEST_URI\'\\]\$\\s*,\\s*\'/\'\\s*\\)\\s*\\);\\s*die\$\\s*\$;\\s*\\}',
        '<\\?php\\s*\\$\\w{1,40}\\s*=.{1,100}str_replace\$\'[^\']+\'\\s*,\\s*\'\'\\s*,\\s*base64_decode\\(\\s*\'[^\']+\'\\s*\$\\s*;\\s*call_user_func\$[^;]+;\\s*\\?>',
        '@include\\s+"(/|\\\\057|\\\\x2f).{20,300}(\\.|\\\\056|\\\\x2e)(i|\\\\x69|\\\\071|\\\\151)(c|\\\\143|\\\\x63)(o|\\\\157|\\\\x6f)"\\s*;',
        '\\$auth_pass\\s*=\\s*"[^"]*"\\s*;\\s*\\$color\\s*=\\s*"[^"]*"\\s*;\\s*\\$default_use_ajax\\s*=\\s*true\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*eval\\s*\\(\\s*"[^"]*"\\s*\$\\s*;',
        '\\$links\\s*=\\s*new\\s+Get_links\$\$;\\s*\\$links\\s*=\\s*\\$links->get_remote\$\$;\\s*echo\\s*\\$links;',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*array_filter\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*exit\\s*;\\s*\\?>',
        '<meta\\s+http-equiv="refresh"\\s+content="\\d+;\\s+url=[^"]+">\\s*<body\\s+onLoad="tiktak\$\$;">',
        'function (\\w{1,50})\$\$\\s*\\{\\s*(\\$a)=\'(\\w{1,50})\';\\s*if\$stripos\\(@\\$_SERVER\\[\\2\\(\'\\w+\',\\d+\$\\],\\2\$\'\\w+\',\\d+\$\\)!==false\\)\\s+return;\\s*\\$\\w=dirname\$__FILE__\$\\.\\2\$\'\\w+\',\\d+\$;.{8000,10000}add_action\$\\s*\\3\\(\'\\w+\',\\d+\$\\s*,\\s*"\\1"\\s*\\);',
        'if\$md5\\(\\$bannermass\$==\\$get_url_var\\)\\s*\\{\\s*\\$set_cookie\$stripslashes\\(\\$check_category\$\\);\\s*\\}',
        '<\\?php\\s*(\\$\\w{1,40})=range\$1,\\d+\$;\\s*(\\$\\w{1,40})=chr\$\\1\\[[^;]+;\\s*\\2\\(\\$\\{chr\\(\\1\\[[^;]+;\\s*\\?>',
        '\\$USER->Authorize\\(1\\s*,\\s*true\$;\\s*\\?>',
        '\\$links\\s*=\\s*\\$client_lnk->build_links\$\$;\\s*if\\s*\$!\\$iKnowYou\$\\s*\\{\\s*\\$bodyText\\s*=\\s*preg_replace\$".\\(\\.\\*\$\$<\\(\\\\s\\*\\?\$\\\\/\$\\\\s\\*\\?\$body\$\\[\\^>\\]\\*\\?\$>\\).s"\\s*,\\s*"\\$1\\\\r\\\\n<div>"\\s*\\.\\s*\\$links\\s*\\.\\s*"</div>\\$2"\\s*,\\s*\\$bodyText\\);\\s*\\}',
        '<\\?php\\s*\\$GLOBALS\\[\'_\\d+_\'\\]=Array\$.{1,600}@eval\\(\\$_\\d+\$;exit\$\$;\\}\\}',
        '<\\?php\\s*(\\$\\w{1,40}\\s*=\\s*"[^"]+";\\s*|\\$\\w{1,40}\\s*=\\s*str_replace\$"\\w+"\\s*,\\s*""\\s*,\\s*"\\w+"\$;\\s*|\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$"\\w+"\\s*,\\s*""\\s*,\\s*"\\w+"\\s*\$;\\s*){6,}\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$[\'"]{2}\\s*,\\s*\\$\\w{1,40}\\(\\$\\w{1,40}\\("\\w+"\\s*,\\s*""\\s*,[^)]+\$\\)\\)\\s*;.{1,30}\\?>',
        '<\\?php\\s*function\\s(\\w{1,40})\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*[^;]+;\\s*\\$\\w{1,40}\\s*=\\s*&\\$\\w{1,40}\\s*;.{1,300};\\1\\s*\$\\s*\\$_(GET|POST|COOKIE)\\s*\\[\\$d\\]\\s*\$;\\s*\\?>',
        '<\\?php\\s*\\$[O0_]+=\'[^\']+\';\\s*\\$[O0_]+=\$"[^"]+"\$;\\$[O0_]+=\\$[O0_]+\\{.{20000,30000};\\$\\{"[^"]+"\\}\\["[^"]+"\\]\$\$;\\?>',
        'function\\s+\\w{1,40}\\s*\$\\s*\\$wp_kses_data\\s*,\\s*\\$wp_nonce\\s*\$\\s*\\{\\s*\\$kses_str\\s*=\\s*str_replace\\s*\$\\s*array.{2000,23000}setcookie\\(\\s*\'\\w+\'\\s*,\\s*\\$_POST\\[\'\\w+\'\\]\\s*\$;\\s*(\\$\\w{1,40})\\s*=\\s*create_function\$\\s*\'\'\\s*,\\s*\\$\\w{1,40}\\s*\$;\\s*unset\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$;\\s*\\1\$\$;\\s*\\}',
        'if\\s*\$isset\\(\\$_POST\\[\'\\w+\'\\]\$\\)\\s*eval\$\\$_POST\\[\'\\w+\'\\]\$;\\s*else\\s*echo\\s*"<form.{1,70}</button></form>";',
        '<\\?php\\s*error_reporting\$0\$;\\$[O0o]{1,40}=.{10000,20000}chr\$hexdec\\((\\$\\w+)\\[(\\$\\w+)\\]\\.\\1\\[\\2\\+1\\]\$\\);return\\s*\\$\\w{1,40};\\s*\\}\\s*\\?>\\s*<\\?php\\s*/\\*\\*\\s+\\*',
        '<\\?php\\s*\\$GLOBALS\\[\'_\\d+_\'\\]=Array.{1000,1500}\\);\\}\\s*echo\\s*\\$_\\d+;exit;\\}\\s*/\\*\\*\\s+\\*',
        'if\\s*\$isset\\(\\$_GET\\[\'view\'\\]\$\\)\\s*\\{.{1,100}eval/\\*\\*/\\s*\$\\s*\'[^\']*\'\\s*\\.\\s*join\\s*\\(\\s*"[^"]*"\\s*,\\s*file\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\.\\s*\'[^\']*\'\\s*\\)\\s*;\\s*die\\s*;\\s*\\}',
        'if\\s*\$isset\\((\\$_(?:(POST|GET|COOKIE))\\[[^]]+\\])\$\\)\\{@?\\$_(?:POST|GET|COOKIE)\\[[^]]+\\]\$stripslashes\\(\\1\$\\);\\};',
        '\\A\\s*<\\?php\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*"aWYoaXNzZXQoJF9SRVFVRVNUWy[^"]{400,1000}"\\s*\$\\s*\\)\\s*;\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*@?eval\\s*\$\\s*stripslashes\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\}\\s*;\\s*\\?>',
        '<\\?php\\s*error_reporting\$0\$;(\\$\\w{1,40})="[^"]+";\\1=str_replace.{14000,19000}=chr\$hexdec\\(\\$\\w{1,40}\\[\\$\\w{1,40}\\]\\.\\$\\w{1,40}\\[\\$\\w{1,40}\\+1\\]\$\\);return\\s*\\$\\w{1,40};\\s*\\}\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*@\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\\(\\s*\'[^\']*\'\\s*,\\s*"[^"]*"\\s*\$\\s*\\)\\s*;',
        '<\\?php\\s*//header\$.{30000,40000}@\\$\\{"[^"]*"\\}\\["[^"]*"\\]\\(\\$\\w{1,40},\\$\\w{1,40}\$;\\}\\s*\\}@\\$\\{"[^"]*"\\}\\["[^"]*"\\]\$\\$\\w{1,40},0444\$;\\}\\}\'\\);\\$\\{"[^"]*"\\}\\["[^"]*"\\]\$\$;\\s*\\?>',
        'extract\\s*\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\$\\s*;\\s*@\\$\\w{1,40}\\s*\$\\s*@\\$\\w{1,40}\\s*\\(\\s*(\\$\\w{1,40})\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;',
        'extract\\s*\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\$\\s*;\\s*if\\s*\$\\s*(\\$\\w{1,40})\\s*\$\\s*\\{\\s*\\1\\s*\$\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\}',
        'if\\s*\$\\s*\\$_(GET|POST|COOKIE)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*!=\'[^\']*\'\\s*\$\\s*\\{\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$_(GET|POST|COOKIE)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\}\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$_(GET|POST|COOKIE)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\}',
        'if\$preg_match_all\\(\'/\\\\\\$tmpcontent\\s*=\\s*@file_get_contents\\\\\\("http:\\\\/\\\\/\\(\\.\\*\$\\\\/code20\\\\.php.{1,300}newdomain\'\\],\\s*\\$file\\);\\s*@file_put_contents\$__FILE__,\\s*\\$file\$;\\s*print\\s*"true";\\s*\\}',
        'function\\s*theme_temp_setup\$\\s*\\$phpCode\\s*\$\\s*\\{\\s*\\$tmpfname\\s*=\\s*tempnam\$sys_get_temp_dir\\(\$\\s*,\\s*"theme_temp_setup"\\);\\s*\\$handle\\s*=\\s*fopen\$\\s*\\$tmpfname\\s*,\\s*"w\\+"\$;\\s*fwrite\$\\s*\\$handle\\s*,\\s*"<\\?php\\\\n".{1,100}return\\s*get_defined_vars\\(\$;\\s*\\}',
        '\\$\\w{1,40}\\s*=\\s*""\\s*;\\s*(?:\\$\\w{1,40}\\s*.=\\s*"[^"]{0,2000}"\\s*;\\s*){3,}?.{100,7000}\\$\\w{1,40}\\s*=\\s*create_function\\s*\$\\s*null\\s*,\\s*\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;',
        '<\\?php\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*str_replace\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*@eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*unset\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*@?preg_replace\$\'/[^/]{1,40}/e\'\\s*,\\s*\'[^,]+,\\s*\'[^\']+\'\\s*\$;\\s*\\?>',
        'print_r\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*;',
        'print_r\\s*\$\\s*call_user_func_array\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*array\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\)\\s*;',
        '<\\?php\\s+passthru\$getenv\\("HTTP_\\w{1,50}"\$\\);.{1,200}\\?>',
        '/\\*([^*]{1,40})\\*/\\s*ini_set\$\'error_reporting\'\\s*,\\s*E_ALL\$;\\s*ini_set\$\'display_errors\'\\s*,\\s*1\$;\\s*ini_set\$\'display_startup_errors\'\\s*,\\s*1\$;\\s*@include\\s*"[^"]{10,250}";\\s*/\\*\\1\\*/',
        '\\A\\s*<\\?php\\s*(\\$\\w{1,40})\\s*=\\s*file_get_contents\$[\'"][^\'"]{1,40}[\'"]\$;\\s*eval\$\\1\$;\\s*\\?>',
        '<\\?php\\s*(//header\$\'Content-Type:text/html; charset=utf-8\'\$;)?(\\s*\\$[O0_]+=(\'[^\']*\'|\\d+);){3,}\\s*\\$[O0_]+=array\$.{300,500}\\?>',
        '@copy\\s*\\(\\s*\\$_FILES\\[file\\]\\[tmp_name\\]\\s*,\\s*\\$_FILES\\[file\\]\\[name\\]\$;\\s*exit;',
        '<\\?php\\s*if\\s*\$isset\\s*\\(\\$_GET\\[\'check\'\\]\$\\)\\s*\\{\\s*echo\\s*"checked.{300,600}echo\\s*\'<a href=\'\\.\\$file\\.\'>\'\\.\\$file\\.\'</a>\';\\s*\\}\\s*else\\s*\\{\\s*echo\$"FILE"\$;\\s*\\}\\s*\\?>\\s*</body>\\s*</html>',
        '\\A<\\?php\\s*eval\$base64_decode\\(\'ZWNobyBmaWxlX2dldF9jb250ZW50cygiaHR0c.{1,100}\'\$\\);\\s*\\?>',
        '<\\?php\\s*echo\\s*md5\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*system\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*unlink\\s*\$\\s*\\$_SERVER\\s*\\[\\s*\'SCRIPT_FILENAME\'\\s*\\]\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*/\\*(\\w{1,40})\\*/\\s*if\\s*\$\\s*md5\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*===\\s*"[^"]*"\\s*\\)\\s*\\{\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\}\\s*/\\*\\1\\*/\\s*\\?>',
        '(include|include_once|require|require_once)\\s*\$\\s*\\$_SERVER\\[\\s*\'DOCUMENT_ROOT\'\\s*\\]\\s*\\.\\s*\'[\\w/_0%]{0,200}\\.(jpg|gif|jpeg|bmp)\'\\s*\$\\s*;',
        '<\\?php\\s*\$\\$\\w{1,40}\\s*=\\s*\\$_POST\\[[^]]+\\]\$\\s*&&\\s*@?preg_replace\$\'/ad/e\',[^;]{1,200};\\s*\\?>',
        '<\\?php\\s+ob_start\\(\\s*\$;\\s*var_dump\$[^;]+;\\s*\\$output\\s*=\\s*ob_get_clean\\(\$;\\s*\\$fp\\s*=\\s*fopen.{10,100}eval\$gzinflate\\(base64_decode\\("[^"]{10000,30000}"\$\\)\\);\\s*\\?>',
        '<\\?php\\s+preg_replace\$"/\\.\\*/e","eval\\(gzinflate\\(base64_decode.{1500,3000}\$\\)\\);",""\\);\\?>',
        '<\\?php\\s+echo\\s+\\d+[\\+\\-\\*\\/]\\d+;\\$\\w{1,40}=base64_decode.{100,2000}\\)]\\);};\\s*\\?>',
        '(\\$\\w{1,40})\\s*=\\s*[assert\'"\\. ]{7,};\\s*(\\$\\w{1,40})=[eval\'"\\. ]{5,};\\s*@\\1\$"\\2\\(\\\\\\$_(GET|POST|COOKIE|SERVER)\\[[^]]{1,40}\\]\\s*\$"\\s*\\)\\s*;',
        '<\\?php\\s*\\$f\\s*=\\s*[create_function.\'" ]{15,};if.{10,200}print_r\$\\s*\\$out\\s*\$;\\s*die\$\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*class\\s*(\\w{1,40})\\s*\\{\\s*public\\s*\\$data\\s*=\\s*\'[^\']*\'\\s*;\\s*public\\s*function\\s*__destruct\\s*\$\\s*\$\\s*\\{\\s*echo\\s*base64_decode\\s*\$\\s*\\$\\w{1,40}-\\s*>\\s*data\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*new\\s*\\1\\s*\$\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*echo\\s*"[^"]+";\\s*\\$payload\\s*=\\s*base64_decode.{900,1500}fputs\$\\s*\\$f\\s*,\\s*\\$payload\\s*\$;\\s*fclose\$\\$f\$;\\s*unlink\$__FILE__\$;\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^"\']*[\'"]\\s*\\]\\s*\$\\s*\\{\\s*\\$\\w{1,40}="[^;]+"\\s*;\\s*preg_replace\\s*\$\\s*"/[^/]+/e"\\s*,\\s*\\$_\\s*\\(\\s*"[^"]{1,500}"\\s*\$\\s*,\\s*0\\s*\\)\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*@set_time_limit\$0\$;\\s*\\$xmlname\\s*=\\s*\'\\w{1,40}\\.xml.{300,1000}\\};eval\$\\$[O0]{1,20}\\("[^"]{5000,}"\$\\);\\s*\\?>',
        '<\\?php\\s*@ini_set\$"display_errors.{1600,1900}fwrite\\((\\$\\w{1,40})\\s*,\\s*"<\\?php\\\\n\\$\\w{1,40}\\[1\\]\\\\n\\?>"\$;\\s*fclose\$\\1\$;\\s*include\$([^)]{1,50})\$;\\s*unlink\$\\2\$;\\s*\\$\\w{1,40}\\s*=\\s*"\\w{1,40}";\\s*\\}\\s*\\?>\\s*',
        '<\\?php\\s*/\\*\\s*\\w{1,40}\\s*\\*/\\s*\\?>\\s*<\\?php\\s*error_reporting\$E_ALL\$;\\$DOMAIN.{2500,4500}enc\$\\$str\$;fwrite\$\\$file,\\$str\$;fclose\$\\$file\$;\\}\\?>\\s*<\\?php\\s*/\\*\\s*\\w{1,40}\\s*\\*/\\s*\\?>',
        '<\\?php\\s*@ini_set\$"log_errors", false\$;@ini_set\$"display_errors.{500,1200}gzuncompress\\(base64_decode\\(\\$_POST\\["\\w{1,40}"\\]\$\\)\\);\\s*@fclose\$\\$\\w{1,40}\$;\\s*include\\s*\\$\\w{1,40};\\s*\\};\\s*\\?>',
        'if\$isset\\(\\$_GET\\[\'bataboom.{100,300}Submit"/></form><\\?php\\s*\\}\\}',
        '\\A<\\?php\\s*/\\*\\w{1,42}\\*/\\s*\\$\\{"\\\\x.{100,4000}?"\$;\\}\\s*/\\*\\w{1,42}\\*/\\s*\\?><\\?php',
        'if\\s*\$!empty\\(\\$_REQUEST\\[\'ch2\'\\]\$\\s*&&\\s*\\$_REQUEST\\[\'ch2\'\\]\\s*==.{400,650};fclose\$\\$fp\$;include\$[^)]+\$;\\s*\\}\\s*\\}',
        '@preg_replace\$\\s*\\$exif\\[[^\\]]+\\]\\s*\\.\\s*\\$exif\\[[^\\]]+\\]\\s*,\\s*\\$exif\\[[^\\]]+\\]\\s*\\.\\s*\\$exif\\[[^\\]]+\\]\\s*\\.\\s*\\$exif\\[[^\\]]+\\]\\s*\\.\\s*\\$exif\\[[^\\]]+\\]\\s*,\\s*\'\'\\s*\$;',
        '<\\?php\\s*if\\s*\$\\$_GET\\s*\\[\'ch\'\\]\$\\s*\\{\\s*echo "OK";\\s*exit;\\s*\\}.{100,400}echo\\s*"An error occured";\\s*\\}\\s*\\?>',
        '\\$\\w{1,40}\\s*=\\s*@\\$\\w{1,40}\$\'\'\\s*,\\s*strrev\\(\';\$\\)\\]\\w{1,40}\\[REVRES_\\$\$edoced_46esab\\(lave\'\\s*\$\\s*\\);\\s*@\\$\\w{1,40}\$\\s*\$;',
        'include\$\'/[0-9a-zA-Z_\\-/]{1,150}/bitrix/images/iblock/ib\\.gif\'\$;',
        '<\\?php\\s*echo\\s*"PHP\\s+Uploader.{200,500}echo "Failed to Upload\\.";\\s*\\}\\s*\\}\\s*\\?>',
        '<\\?php\\s*extract\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\$\\s*&&\\s*@\\$\\w{1,40}\\s*\$\\s*stripslashes\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*&&\\s*exit\\s*;',
        'include\\s*"\\\\x2.{1,300}?(\\.|\\\\x2e)(p|\\\\x70)(h|\\\\x68)(p|\\\\x70)"\\s*;',
        '<\\?php\\s*error_reporting\$0\$;\\s*if\$isset\\(\\$_GET\\[\\w{1,40}\\]\$\\)\\s*\\{\\s*echo.{100,1000}-->"\\.\\$_FILES\\["\\w+"\\]\\["\\w+"\\];\\}else\\{echo"<b>";\\}\\}\\}\\s*\\?>',
        '<\\?php\\s*ini_set\$"log_errors", false\$;ini_set\$"display_errors", false\$;error_reporting\$0\$;if\\s*\$isset\\(\\$_REQUEST.{1,1000};file_put_contents\\(\\$tmp, "<\\?php "\\.gzuncompress\\(base64_decode\\(\\$_POST\\["\\w+"\\]\$\\)\\);include \\$tmp;\\};\\s*\\?>',
        'if\\s*\$\\s*!empty\\s*\\(\\s*(\\$_(GET|POST|COOKIE|REQUEST))\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*@\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\\(\\s*\\1\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\$\\s*\\)\\s*;\\s*if\\s*\$\\s*!empty\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*@\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*if\\s*\$\\s*!empty\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*\'\'\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\}',
        '\\A\\s*<\\?php\\s*\\$\\w{1,40}=\\s*\'\';if\$!empty\\(\\$_COOKIE\$\\){foreach.{100,1000}Cookie\'\\s*\\)\\s*!==\\s*false\\s*\\)\\s*header\$\\$\\w{1,40}\$;\\s*return\\s*strlen\$\\$\\w{1,40}\$;\\s*\\}\\s*\\?>\\s*\\Z',
        '\\$payload\\s*=\\s*"[^"]{100,9000}"\\s*;\\s*preg_replace\\s*\$\\s*\'/.*/e\'\\s*,\\s*"[^"]{1,300}"\\s*,\\s*\'\\.\'\\s*\$\\s*;',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*(?:system|exec|shell_exec|popen|passthru)\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\.\\s*\'\\s*2>&1\\s*\'\\s*\$\\s*;\\s*\\}',
        '\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*strtoupper\\s*\$[^)]{1,100}\$\\s*;\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$\\s*\\{\\s*\\$\\w{1,40}\\s*\\}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*(?:assert|eval)\\s*\$\\s*\\$\\s*\\{\\s*\\$\\w{1,40}\\s*\\}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\}',
        '<\\?php\\s*(\\$\\w{1,40})\\s*=\\s*"[^;]+;\\s*\\1\\s*\\.=\\s*"[^;]+;\\s*@\\1\$.{100,3000}"\$\\)\\)\'\\);',
        'if\$is_uploaded_file\\(\\$_FILES\\["filename"\\]\\["tmp_name"\\]\$\\)\\s*\\{\\s*move_uploaded_file\$.{100,400}\\$filename\\s*=\\s*\\$_SERVER\\[SCRIPT_FILENAME\\];\\s*\\$time\\s*=\\s*time\\(\$\\s*-\\s*\\d+;\\s*touch\$\\$filename\\s*,\\s*\\$time\$;',
        '<\\?php\\s*error_reporting\$0\$;\\s*set_time_limit\$\\d+\$;\\s*function id2str\$\\$id\$\\s*\\{.{1000,3000}curl_close\$\\$curl\$;\\s*echo\\s*\\$content;\\s*\\?>',
        '\\$user\\s*=\\s*new\\s*CUser;\\s*(\\$arFields)\\s*=\\s*array\$[^)]+\$;\\s*\\$ID\\s*=\\s*\\$user->Add\$\\1\$;\\s*if\$intval\\(\\$ID\$\\s*>\\s*0\\)\\s*echo\\s*\'[^\']+\';\\s*else\\s*echo\\s*\\$user->LAST_ERROR;',
        '(/\\*[^*]{1,30}\\*/)\\s*error_reporting\$0\$;\\s*@ini_set\$\\s*\'error_log\'\\s*,\\s*NULL\\s*\$;\\s*@ini_set\$\\s*\'log_errors\'\\s*,\\s*0\$;\\s*@ini_set\$\\s*\'display_errors\'\\s*,\\s*\'Off\'\$;\\s*@eval\$\\s*base64_decode\\(.{100,20000}\\1',
        '<\\?php\\s*@?eval\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*["\'][^"\']*["\']\\s*\\]\\s*\$\\s*;?\\s*\\?>',
        'wp_load_cachers\$\$;\\s*function.{1000,1300}strip_tags\$\\$mdetailes\\(\$\\);\\s*\\}',
        '<\\?=\\s*\$\\s*\\$\\w{1,40}=@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\w+\\s*\\]\\s*\$\\s*\\.\\s*stripslashes\\s*\$\\s*@\\$\\w{1,40}\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\w+\\s*\\]\\s*\$\\s*\\)\\s*;\\s*exit\\s*;\\s*\\?>',
        '\\A<\\?php\\s*\\$function\\s*=\\s*create_function\$.{10,200}?\$;\\s*\\$function\$\\s*\$;\\s*\\?>\\s*\\Z',
        '<\\?php\\s*function\\s*encode\$\\s*\\$string\\s*\$\\s*\\{.{500,800}=\\s*function\$\\s*\$\\s*\\{\\s*\'\\.\\$b\\[\'code\'\\]\\.\'\\}\'\\s*\\)\\s*;\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*md5\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*==\\s*\'[^\']*\'\\s*\\)\\s*\\{\\s*preg_replace\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\}',
        '(\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*){1,4}\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\\.\\s*\\$\\w{1,40}\\s*\\.\\s*\'[^\']*\'\\s*;\\s*if\\s*\$\\s*@md5\\s*\\(\\s*\\$_REQUEST\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*==\\s*\'[^\']*\'\\s*\\)\\s*@\\$\\w{1,40}\\s*\$\\s*\\$_FILES\\[\\s*\'\\w+\'\\s*\\]\\s*\\[\\s*\'\\w+\'\\s*\\]\\s*,\\s*\\$_POST\\s*\\[\\s*\'\\w+\'\\s*\\]\\s*\\.\\s*\\$\\w{1,40}\\s*\\[\\s*\'\\w+\'\\s*\\]\\s*\\[\\s*\'\\w+\'\\s*\\]\\s*\$\\s*;',
        '<\\?php\\s*\\$\\w{1,40}\\s*=[^;]{1,100};\\s*\\$\\w{1,40}\\s*=\\s*"[^"]{1,500}"\\s*;\\s*eval\\s*\$\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\[\\s*\'[^\']{1,10}\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*(system|shell_exec|exec|passthru|popen)\\s*\$\\s*\\[\\s*\'[^\']{1,10}\'\\s*\\]\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*echo\\s*"<pre>"\\s*;\\s*(?:system|exec|eval|assert|shell_exec|passthru)\$\\$_(?:GET|POST|COOKIE|REQUEST)\\[[^]]{1,20}\\]\$\\s*;\\s*echo\\s*"</pre>"\\s*;\\s*\\?>',
        '<\\?php\\s*if\\s*\$isset\\(\\$_REQUEST\\[\'action\'\\]\$\\s*&&\\s*isset\$\\$_REQUEST\\[\'password.{6500,7500}?\\?>',
        'if\\s*\\(\\s*isset\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*die\\s*\$\\s*(?:eval|assert|passthru|exec|system|shell_exec)\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*;',
        '\\$\\w{1,10}\\s*=\\s*\'[^\']{1,10}\'\\s*\\.\\s*substr\$\\s*\\$\\w{1,10}\\s*,\\s*\\d+\\s*,\\s*\\d+\$;\\s*\\$\\w{1,10}\\s*=\\s*preg_replace\$\\s*\\$\\w{1,10}\\s*,\\s*strtr\\(\\s*\\$\\w{1,10}\\s*,\\s*\\$\\w{1,10}\\s*,\\s*\\$\\w{1,10}\$\\s*,\\s*\'[^\']{1,20}\'\\s*\\);',
        '\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|REQUEST);.{100,300}var_dump\$\\$\\w{1,40}\\(\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\);\\s*\\}\\s*\\?>',
        '\\$arr\\s*=\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER);\\s*foreach\\s*\$\\s*\\$arr\\s*as\\s*\\$\\w{1,40}\\s*=>\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*==\\s*"\\w{1,40}"\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*end\$\\$\\w{1,40}\$;.{1,100}echo\\s*\\$\\w{1,40};\\s*}\\s*}',
        '<\\?\\s*=\\s*\$\\s*\\$(\\w{1,20})\\s*=\\s*@?\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[[^]]{1,10}\\s*\\]\\s*\$\\s*\\.@?\\$\\1\$\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[[^]{1,10}]\\s*\\]\\s*\$\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*md5\\(\\s*\\$_(GET|POST|COOKIE|REQUEST)\\[\'\\w{1,40}\'\\]\$\\s*===.{100,1000},\\);array_walk\$\\$\\w{1,40}\\s*,\\s*strval\\(\\$_\\1\\[\'\\w{1,40}\'\\]\$\\s*,\\s*\'\'\\)\\s*;\\s*\\}\\s*\\}\\s*\\?>',
        '<\\?php\\s*if\$isset\\(\\$_(GET|POST|COOKIE|REQUEST)\\[\'\\w{1,40}\'\\]\$\\)\\s*var_dump\$(eval|assert|system|shell_exec|exec|passthru)\\(\\$_\\1\\[\'\\w{1,40}\'\\]\$\\);\\?>',
        '<\\?php\\s*@set_time_limit\$\\d+\$;\\s*if\$isset\\(\\$_(GET|POST|COOKIE|REQUEST)\\[\'\\w{1,40}\'\\]\$\\)\\s*system\$base64_decode\\(\\$_\\1\\[\'.\'\\]\$\\);\\s*\\?>',
        '<\\?\\s*if\$\\$\\w{1,40}\\s*!=\\s*""\$\\s*print\\s*Shell_Exec\$\\$\\w{1,40}\$;\\s*\\?>',
        '<\\?php\\s*/\\*\\s*(.{1,40}?)\\s*\\*/\\s*function\\s*\\w{1,40}\$\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\$\\{\\$\\w{1,40}\\s*=\\s*"";\\s*foreach\$\\s*\\$\\w{1,40}.{7000,9000}\$;\\s*/\\*\\s*/\\1\\s*\\*/',
        '\\$_(GET|POST|REQUEST|COOKIE)\\[\\s*"\\w{1,40}"\\s*\\]\\s*\\?\\s*\\$_\\1\\[\\s*"\\w{1,40}"\\s*\\]\\s*\$\\s*\\$_\\1\\[\\s*"\\w{1,40}"\\s*\\]\\s*\$\\s*:\\s*null;',
        '<\\?php\\s*\\$\\w{1,40}="\\w{32}";.{20000,30000};\\$\\w{1,40}\$\\$\\w{1,40}\\(\\$\\w{1,40}\\(\\$\\w{1,40}\\(\\$\\w{1,40}\$\\)\\)\\);\\s*\\?>',
        '<\\?php\\s*@copy\$\\$_FILES\\[\'\\w{1,40}\'\\]\\[\'tmp_name\'\\]\\s*,\\s*\\$_POST\\[\'\\w{1,40}\'\\]\$;',
        '<\\?php\\s*error_reporting\$0\$;\\s*if\$isset\\(\\$_GET\\[\'ms-load\'\\]\$\\s*&&.{100,1000}\\}\\s*\\}\\s*endif;\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=".{100,1000}\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*"[^"]*"\\s*,\\s*"",[^;]+;\\s*\\$\\w{1,40}\\s*\\(\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*(\\$\\w{1,10}=["\'][^"\']{0,5}["\'];){10,}.{50,300}eval\$\\s*\\$\\w{1,40}\\(\\s*\\$\\w{1,40}\\(\\s*"[^"]{2000,5000}"\$\\)\\);\\s*\\?>',
        'if\$\\$_REQUEST\\["key"\\]\\s*!=\\s*""\\s*\$\\s*{\\s*if\\s*\$\\s*\\$_REQUEST\\["key"\\]\\s*==\\s*"[^{]+{\\$\\w{1,40}\\s*=\\s*copy\\(\\$_SERVER\\["DOCUMENT_ROOT"\\]\\s*\\.\\s*".{1,100}/restore\\.php"\\s*,\\s*\\$_SERVER\\["DOCUMENT_ROOT"\\]\\s*\\."[^"]{1,100}"\$\\s*;\\s*if\$\\$\\w{1,40}\$\\s*{\\s*die\$\\s*"ok"\\s*\$\\s*;\\s*}\\s*else\\s*{\\s*die\\s*\$\\s*"fail"\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\};',
        '<\\?php\\s*(//\\w{1,40})?\\s*\\$\\{"[^"]+"\\}\\["[^"]+"\\]="[^"]+";\\$\\{".+;echo\\$\\{\\$\\w{1,30}};exit\$\$;\\}\\}\\}\\}\\s*(//\\w{1,40})?\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*isset\\(\\s*\\$_GET\\[\\s*"ms-load"\\s*\\]\\s*\$\\s*&&.{100,1000}print "Error:n";\\s*\\}\\s*\\}\\s*\\}',
        '\\A<\\?php\\s*\\$\\w{1,40}=\'[^\']+\'\\s*\\^\\s*\'[^\']+\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\$\\s*\'\',.{1000,3000}\'\$;\\s*\\$\\w{1,40}\$\$;\\s*\\Z',
        'function\\s*sendCcNumber\$\\s*\$\\s*\\{.{2000,8000}curl_close\$\\$ch\$;\\s*\\}',
        '<\\?\\s*if\$!isBot\\(\$\\)\\{\\s*if\$isset\\(\\$_SERVER\\[\'HTTP_REFERER\'\\]\$\\s*AND\\s*!isset\$\\$_COOKIE\\["\\w+"\\]\$\\)\\s*\\{setcookie\$".{300,7000}\\$botname\\s*=\\s*\\$bot;\\s*return\\s*true;\\s*\\}\\s*return false;\\s*\\}\\s*\\?>',
        'if\\s*\\(\\s*@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[^]]+\\s*\\]\\s*\$\\s*\\{\\s*\\$\\w{1,40}=\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[^]]+\\s*\\]\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[^]]+\\s*\\]\\s*\$\\s*;\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}',
        '\\$USER->Update\$1\\s*,\\s*array\\(\\s*"PASSWORD"\\s*=>\\s*["\'][^\'"]+[\'"]\\s*\$\\s*\\);\\s*require\$\\$_SERVER\\[\'DOCUMENT_ROOT\'\\]\\."/bitrix/footer\\.php"\$;',
        '<\\?php\\s*file_put_contents\\s*\$\\s*"[^"]+"\\s*,\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\Z',
        '\\A\\s*<\\?php\\s*/\\*[^*]{32}\\*/\\s*eval\$base64_decode\\("[^"]{500,2000}"\$\\);\\s*\\?>\\s*\\Z',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$GLOBALS\\[\'\\w{1,40}\'\\]\\s*=\\s*Array\$\\s*\$;\\s*global.{100,40000}\\{eval(/\\*[^\\*]+\\*/)?\$\\$\\w{1,40}\\[\\$\\w{1,40}\\[\'\\w{1,40}\'\\]\\[\\d+\\]\\]\$\\s*;\\s*\\}\\s*exit\$\\s*\$;\\s*\\}\\s*\\?>',
        '<\\?php\\s*(?:/\\*.{1,3000}\\*/\\s*)?@?(eval|assert)\\s*(/\\*[^*]{1,5000}\\*/\\s*)?\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*[^]]+\\]\$;\\s*(\\?>)?',
        '<\\?php\\s*(?://header\$\'Content-Type:text/html; charset=utf-8\'\$;)?\\s*\\$\\w{1,40}=\'\\d+\';\\s*\\$\\w{1,40}=urldecode\$"%.{20000,}\\}\\}\'\$;\\$\\{"[^"]{3,100}"\\}\\["[^"]{3,100}"\\]\$\$;\\s*\\?>',
        'eval\$base64_decode\\("aWYgKCFkZWZpbmVkKCdBTFJFQURZX1JVTl[^"]+"\$\\);',
        '<\\?php\\s*\\$\\w{1,40}=gzinflate\$base64_decode\\(\'[^\']{20000,}\'\$\\);\\s*preg_replace\$[^\\?]{1,50}\\?>',
        '<\\?php\\s*\\$.{1,100}\\$\\w\\s*=\\s*"[^"]{50000,}";\\s*@\\$\\w\\([^)]+\$;"\\);\\s*\\Z',
        '<\\?php\\s*/\\*[^*]{1,100}\\*/\\s*\\$GLOBALS.{3000,5000}function\\s+\\w{1,40}\$\\$a\\s*,\\s*\\$b\${\\s*\\$c=\\$GLOBALS\\[\'\\w{1,40}\'\\];\\$d=pack\$\'H\\*\',[^)]+\$;\\s*return \\$d\$substr\\(\\$c, \\$a, \\$b\$\\);};eval\$\\w{1,40}\\(\\d+,\\d+\$\\);};\\?>',
        '<\\?php\\s*/\\*[^*]{1,200}\\*/\\s*\\$auth_pass = ".{32}";\\s*\\$eval=\$"\\?>"\\.gzuncompress\\(base64_decode\\("[^"]{20000,}"\$\\)\\);\\s*@?eval\$\\$eval\$;\\s*\\?>',
        '<\\?php\\s*(?:system|passthru|shell_exec)\$\\s*"\\$\\w{1,40}"\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*@ini_set\$\'display_errors.{800,1300}\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\(\\$\\w{1,40}\\(\\$\\w{1,40}\\("\\$\\w{1,40}"\$\\s*,\\s*\'wp_function\'\\s*\\)\\s*\\);\\s*preg_match\$\\s*\'\\#gogo.{100,1000}unlink\\([^)]+\$;\\s*\\$\\w{1,40}\\s*=\\s*\'\\w{1,40}\';\\s*}\\s*',
        '<\\?php\\s*header\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\'[^;]{5,100};\\s*@\\$\\w{1,40}\\s*\$\\s*stripslashes\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\?>',
        '\\A\\w{1,50}\\s*<\\?php\\s*eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*str_rot13\\s*\\(\\s*"[^"]{100,1000}"\\s*\$\\s*\\)\\s*\\)\\s*\\)\\s*;\\s*\\?>\\s*\\Z',
        '\\$z0\\s*=\\s*\\$_REQUEST.{10,300}?(\\$\\w{1,40})\\s*=\\s*\\$\\w{1,40}\$\\s*""\\s*,\\s*\\$\\w{1,40}\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\1\$\$;',
        '<\\?php\\s*preg_replace\\s*\$\\s*"\\|\\.\\*\\|ie"\\s*,\\s*"[^"]*"\\s*,\\s*"[^"]+"\\s*\$\\s*;',
        '<\\?\\s*\\$GLOBALS\\[\'_\\d+_\'\\]=Array.{400,1000}?\$\\d+\$\\)\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$_POST\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\?>',
        '\\A<\\?php\\s*\\$\\w{1,40}\\s*="[^"]{20000,}"\\s*;\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\?>\\s*\\Z',
        'if\\s*\$JRequest::getVar\\(\'get_product\',0,\'POST\'\$\\|\\|JRequest::getVar\$\'get_product\',0,\'COOKIE\'\$\\){.{300,1000}?exit\$\$;}',
        '\\A<\\?php\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\?>\\s*',
        '<\\?\\s*eval\$base64_decode\\(\'.{76}\'\\.\\s*\'.{76}\'\\.',
        '<\\?php.{100,2000};include\\s*\\$\\w{1,40}\\(\\$\\{\\$\\w{1,40}\\[\\d+\\]\\.\\$\\w{1,40}\\[\\d+\\]\\}\$\\[\\$\\w{1,40}\\[\\d+\\]\\.\\$\\w{1,40}\\[\\d+\\]\\.\\$\\w{1,40}\\[\\d+\\]\\];\\}\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\\w+;\\$GLOBALS\\[\'\\w+\'\\]=Array\$\$;global\\s*\\$\\w{1,40};\\$\\w{1,40}=\\$GLOBALS;\\$\\{"\\\\x[^"]{10,100}"}\\[\'\\w+\'\\]="\\\\x.{4000,7000}\\);\\}\\}\\s*\\?>',
        '\\*/\\s*preg_replace\\s*\$\\s*"\\\\[^"]{10,30}"\\s*,\\s*"\\\\[^"]{10,110}"\\s*,\\s*"\\\\[^"]+"\\s*\$\\s*;\\s*/\\*',
        '<\\?php\\s+\\$.{6000,9000}"",\\w+\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*""\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\$[^)]+\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}-1\\s*;\\s*\\?>',
        '{\\s*move_uploaded_file\\s*\$\\s*\\$_FILES\\["filename"\\]\\["tmp_name"\\]\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*;\\s*echo\\s*"true"\\s*;\\s*\\}',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*error_reporting\\s*\$\\s*\\w+\\s*\$\\s*;.{100,1000}if\\s*\$\\s*md5\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*==\'[^\']*\'\\s*\\)\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\?>',
        '\\*/\\s*\\$GLOBALS\\[\'_\\d+_\'\\]=Array\$base64_decode\\(.{10000,15000};\\$GLOBALS\\[\'_\\d+_\'\\]\\[\\d+\\]\\(\\$_\\d+,\\$_\\d+\$;\\$GLOBALS\\[\'_\\d+_\'\\]\\[\\d+\\]\$\\$_\\d+,\\$_\\d+\$;\\}\\}\\}\\s*/\\*',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\\w{1,40}\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*if\\s*\$\\s*is_uploaded_file\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\\w+\\s*\\]\\s*\\[\\s*tmp_name\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*move_uploaded_file\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*\\w+\\s*\\]\\s*\\[\\s*tmp_name\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*\\w+\\s*\\]\\s*\\[\\s*name\\s*\\]\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\?>\\s*<form.{50,200}</form>',
        '\\$\\w{1,40}\\s*=\'[^\']*\'\\s*\\^\\s*\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\$\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*\\^\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;',
        'if\\s*\$\\s*is_file\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\{\\s*include_once\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\}\\s*@ini_set\\s*\$\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*\$\\s*;\\s*error_reporting\\s*\$\\s*\\d+\\s*\$\\s*;\\s*if\\s*\$\\s*!\\$(\\w{1,40})\\s*\$\\s*\\{.{1500,2500}?include\$"\\{\\$\\w+\\}\\.\\$\\w+"\$;\\s*unlink\$"\\{\\$\\w+\\}\\.\\$\\w+"\$;\\s*\\$\\1\\s*=\\s*\'[^\']*\'\\s*;\\s*}',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*preg_replace\\s*\$\\s*\'/\\w+/e\'\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;',
        '{\\s*\\$USER->Authorize\$\\$_REQUEST\\[\'ID\'\\]\$;\\s*LocalRedirect\$"/bitrix/admin/"\$;\\s*}',
        '<\\?php.{5000,10000}\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*,\\s*\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*\$\\s*;.{1,200}?\\?>',
        '\\$UnixTimeLastEdit\\s*=\\s*"[^"]{1,100}";\\s*\\$MenuAcoAuthor\\s*=\\s*"[^"]{1,100}";.{100,2000}?echo\\s*eval\\s*\$\\s*base64_decode\\(\\s*\\$SystemJoCode\\s*\$\\s*\\);',
        '\\$\\w{1,40}\\s*=\'[^\']*\'\\^\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\$\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\^\'[^\']*\'\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*preg_replace\\s*\$\\s*\'.\\w{1,30}.e\'\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;',
        '<\\?php.{1,2000};}else\\{\\$\\w{1,40}="[^"]+";\\${"[^"]+"}\\["[^"]+"\\]="[^"]+";move_uploaded_file\$\\$_FILES.{100,1000}";}}',
        '\\$USER->Authorize\\(\\$_(?:REQUEST|GET)\\[\'\\w+\'\\]\$;\\s*LocalRedirect\$"/bitrix/admin/"\$;',
        '<\\?php\\s*eval\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*str_replace\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*;',
        'if\\s*\$\\s*@isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*tryyr\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*(?:\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*){2,}\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}[^;]+;\\s*echo\\s*\'[^\']*\'\\s*\\.\\s*@?\\$\\w{1,40}\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\}',
        '//\\#\\#\\#==\\#\\#\\#\\s*assert\\s*\$.{1000,5000}\$\\)"\\);\\s*//\\#\\#\\#==\\#\\#\\#',
        '@\\s*include(_once)?\\s*\$\\s*\\$_SERVER\\[\\s*"DOCUMENT_ROOT"\\s*\\]\\s*\\.\\s*"/bitrix/.{1,200}?\\.gif"\\s*\$\\s*;',
        '<\\?php\\s*\\$user_agent_to_filter\\s*=\\s*array\\s*\$\\s*"\\#Ask\\\\s\\*Jeeves.{2000,4000}\\$_SERVER\\[HTTP_HOST]"\\s*\$\\s*;\\s*\\$result\\s*=\\s*curl_exec\$\\s*\\$ch\\s*\$;\\s*curl_close\\s*\$\\s*\\$ch\\s*\$\\s*;\\s*echo\\s*\\$result\\s*;\\s*}\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*"[^;]+;\\s*\\$\\w{1,40}\\s*=\\s*@\\$\\w{1,40}\$\'\\$\\w{1,40}\'\\s*,\\s*".+?\'\\s*\$\\s*;\\s*@?\\$\\w{1,40}\$"[^"]+"\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*file_put_contents\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\'[^\']*\'\\s*\\.\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*include\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*unlink\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\'[^;]+\\s*;\\s*@?eval\$\\$\\w{1,40}\\([^)]{5000,}\$\\);',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*==\'[^\']*\'\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*curl_init\\s*\$\\s*\$\\s*;.+?curl_close\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*print\\s*"[^"]*"\\s*;\\s*print\\s*\\$\\w{1,40}\\s*;\\s*\\}\\s*else\\s*\\{\\s*print\\s*"[^"]*"\\s*;\\s*\\}\\s*\\}\\s*\\?>',
        '<\\?php\\s*/\\*\\*[^*]{1,5000}\\*\\*/\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;(\\s*//\\s*Password\\s*)?\\$\\w{1,40}=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*str_rot13\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*;\\s*eval\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\?>',
        '\\*/\\s*(include|require|include_once|require_once)\\s*/\\*',
        '(<\\s*\\?\\s*eval\\s*\$\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]*[\'"]\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\?>\\s*){3,}',
        '<\\?php\\s*function\\s*\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*for\\s*\$\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*<\\s*strlen\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\+\\+\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*\\.\\s*=\\s*isset\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\\]\\s*\$\\s*\\?\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\\]\\s*:\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*return\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*=.+eval\\s*\$\\s*\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*(\\?>)?',
        '<\\s*\\?\\s*require\\s*\$\\s*\\$_SERVER\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\.\\s*"[^"]*"\\s*\$\\s*;\\s*global\\s*\\$\\w{1,40}\\s*;\\s*\\$\\w{1,40}-\\s*>\\s*Authorize\\s*\$\\s*[^)]+\$\\s*;\\s*LocalRedirect\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*\\?>',
        '\\$\\w{1,40}\\s*=\\s*([\'"][^"\']*[\'"]\\s*\\.\\s*)+[\'"][^"\']+[\'"];.+?function\\s*\\w+\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*return\\s*\\$\\w{1,40}\\s*\\^\\s*str_repeat\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*ceil\\s*\\(\\s*strlen\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*/\\s*strlen\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\}',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*eval\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\}\\s*',
        '\\$\\w{1,40}\\s*=\\s*[\'"][^;]+;\\s*\\$\\w{1,40}\\s*=(\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\.\\s*){2,}\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=(\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\.\\s*){2,}\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*;\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$\\s*\\{\\s*(\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\.?\\s*){2,}\\s*}\\s*\\[\\s*\\$\\w{1,40}\\s*\\(\\s*(\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\.?\\s*){2,}\\s*\$\\s*\\]\\s*\\)\\s*\\)\\s*{\\s*eval\\s*\$\\s*\\$\\s*\\{\\s*(\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\.?\\s*){2,}}\\[\\$\\w{1,40}\\s*\\((\\$\\w+\\[\\d+\\]\\s*\\.?){2,}\$]\\);}',
        '<\\?php\\s*class\\s*\\w+\\s*\\{\\s*public\\s*function\\s*__construct\\s*\$\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]*[\'"]\\s*\\]\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]*[\'"]\\s*\\]\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*["\'][^\'"]*["\']\\s*,\\s*\\$\\w{1,40}\\s*,\\s*438\\s*\$\\s*;\\s*\\}\\s*else\\s*\\{\\s*header\\s*\$\\s*["\'][^\'"]*["\']\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*new\\s*\\w+\\s*;\\s*',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*md5\\s*\$\\s*\\$\\w{1,40}\\s*\\.\\s*"[^"]*"\\s*\$\\s*;\\s*eval\\s*\$\\s*gzuncompress\\s*\\(\\s*str_rot13\\s*\\(\\s*base64_decode\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\)\\s*\\)\\s*;\\s*exit\\s*;',
        'define\\s*\$\\s*\'[^\']*\'\\s*,\\s*class_exists\\s*\\(\\s*[\'"]COM[\'"]\\s*\$\\s*\\?\\s*1\\s*:\\s*0\\s*\\)\\s*;\\s*define\\s*\$\\s*\'PHPINFO_IS\'\\s*,\\s*\\(\\s*!eregi\\s*\\(\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\?\\s*1\\s*:\\s*0\\s*\\)\\s*;',
        '\\$\\w{1,40}\\s*=\\s*new\\s*Get_links\\s*\$\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}-\\s*>\\s*return_links\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*;\\s*',
        'class\\s+Get_links\\s*{\\s*var\\s*\\$host\\s*=.+?(return\\s*\'\';\\s*}\\s*}|\\$data = file_get_contents\$\\$file\$;\\s*return \\$data;\\s*}\\s*}\\s*})',
        '<\\?php\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*eval\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*eval\\s*\$\\s*trim\\s*\\(\\s*base64_decode\\s*\\(\\s*["\'][^\'"]*[\'"]\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\?>',
        '\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*sprintf\\s*\$\\s*base64_decode\\s*\\(\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*\\)\\s*;\\s*\\?>',
        '<\\?php\\s*@error_reporting\\s*\$\\s*\\d+\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^"\']*[\'"]\\s*\\]\\s*;\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]*[\'"]\\s*\$\\s*\\)\\s*;\\s*\\}\\s*else\\s*\\{\\s*echo\\s*base64_decode\\s*\$\\s*\\w+\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*echo\\s*file_get_contents\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*exit\\s*;\\s*\\?>',
        '<\\?php\\s*echo\\s*[\'"][^\'"]+[\'"];\\s*preg_replace\\s*\$[\'"][^\'"]+[\'"]\\s*,\\s*["][^"]+["]\\s*,\\s*["][^"]+["]\\s*\$;\\s*\\?>',
        '<\\?php\\s*die\$\\$\\w{1,40}\\(\\$\\w{1,40}\\(\\$\\w{1,40}\\([^}]+\\s*}\\s*\\?>',
        '(/\\*[^\\*]+\\*/)?if(/\\*[^\\*]+\\*/)?\\s*\\((/\\*[^\\*]+\\*/)?\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*(/\\*[^\\*]+\\*/)?\\s*\$\\s*(/\\*[^\\*]+\\*/)?\\s*\\)(/\\*[^\\*]+\\*/)?\\s*\\{\\s*(/\\*[^\\*]+\\*/)?\\s*(eval|assert)\\s*(/\\*[^\\*]+\\*/)?\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$(/\\*[^\\*]+\\*/)?;\\s*(/\\*[^\\*]+\\*/)?exit\\s*;(/\\*[^\\*]+\\*/)?\\s*\\}',
        'if\\s*\$\\s*isset\\(\\s*\\${\\s*[^}]+\\s*}\\s*\\[[^\\]]+\\]\\s*\$\\s*\\)\\s*{\\s*\\$\\w{1,40}\\s*=\\s*["\'evalbs64srtprglc\\s\\.]+;\\s*\\$\\w{1,40}\\s*\$\\s*\\${[^}]+}\\s*\\[[^\\]]+\\]\\s*\$;\\s*exit;\\s*}',
        '<\\?php\\s*if\$(/\\*[^*]+\\*/)?isset\\((/\\*[^*]+\\*/)?\\${(/\\*[^*]+\\*/)?"_.{1,250}?exit;[^}]+}',
        '<\\?php\\s*if\\s*\\(\\s*md5\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*["\'][^"\']*["\']\\s*\\]\\s*\$\\s*==["\'][^"\']*["\']\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*system\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*dirname\\s*\$\\s*__FILE__\\s*\$\\s*;\\s*echo\\s*<\\s*<\\s*<\\s*HTML\\s*<\\s*form\\s*enctype\\s*="[^"]*"\\s*method\\s*="[^"]*"\\s*>\\s*.+?\\s*\\}\\s*else\\s*\\{\\s*print\\s*"[^"]*"\\s*;\\s*\\}\\s*\\}\\s*\\}\\s*',
        '<\\?php\\s*\\$\\w{1,40}\\s*=__FILE__\\s*;\\s*\\$\\w{1,40}\\s*=__LINE__\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*eval\\s*\$\\s*\\(\\s*base64_decode\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\)\\s*;\\s*return\\s*;\\s*\\?>',
        '\\*/\\s*["\'](\\\\x2f|/)[\\\\\\-\\*\\sa-zA-Z0-9_/\\.]+?(\\.|\\\\x2e)(p|\\\\x70)(h|\\\\x68)(p|\\\\x70)["\'];\\s*/\\*',
        '<\\?php\\s*\$\\s*\\$\\w{1,40}=@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\w+\\s*\\]\\s*\$\\s*\\.\\s*@\\$\\w{1,40}\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*["\'][^"\']*["\']\\s*\\]\\s*\$\\s*\\?>',
        '\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*header\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*header\\s*\$\\s*"Pragma: hack"\\s*\$\\s*;\\s*header\\s*\$\\s*"[^"]*"\\s*\\.\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*header\\s*\$\\s*"[^"]*"\\s*\\.\\s*\\(\\s*string\\s*\$\\s*\$\\s*filesize\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*;\\s*header\\s*\$\\s*\'[^\']*\'\\s*\\.\\s*\\$\\w{1,40}\\s*\\.\\s*\'[^\']*\'\\s*\$\\s*;\\s*header\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*readfile\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*exit\\s*;',
        '<\\?php\\s*/\\*[^*]+\\*/\\s*\\$\\w+\\s*=[\'"][^\'"]+[\'"];\\s*\\$\\w+\\s*=\\s*str_rot13\\s*\$\\s*gzinflate\\s*\\(\\s*str_rot13\\s*\\(\\s*base64_decode\\s*\\(\\s*\\$\\w+\\s*\$\\s*\\)\\s*\\)\\s*\\)\\s*;\\s*eval\\s*\$\\s*\\$\\w+\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*isset\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*&&\\s*array_map\\s*\$\\s*"[^"]*"\\s*,\\s*\\(\\s*array\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\)\\s*;\\s*',
        'isset\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]*[\'"]\\s*\\]\\s*\$\\s*&&\\s*\$\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'][^"\']*[\'"]\\s*\\]\\s*\$\\s*&&\\s*@preg_replace\\s*\$\\s*[\'"][^\'"]*e[\'"]\\s*,\\s*[^,]+\\s*,\\s*[\'][^"\']*[\']\\s*\$\\s*;',
        '\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*["\'][^\'"]*[\'"]\\s*\\]\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*=\\s*isset\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\?\\s*base64_decode\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*:["\'][^"\']*[\'"]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]*[\'"]\\s*;\\s*foreach\\s*\$\\s*array\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*as\\s*\\$\\w{1,40}\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*\\.\\s*=\\$\\w{1,40}\\s*;\\s*\\}\\s*ob_start\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*echo\\s*\\$\\w{1,40}\\s*;\\s*\\}\\s*ob_end_flush\\s*\$\\s*\$\\s*;',
        'print\\s*[\'"][^\']*["\']\\s*;\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*["\'][^"\']*[\'"]\\s*\\]\\s*\\[\\s*["\'][^"\']*[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*foreach\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*["\'][^"\']*[\'"]\\s*\\]\\s*\\[\\s*["\'][^"\']*[\'"]\\s*\\]\\s*as\\s*\\$\\w{1,40}\\s*=\\s*>\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*==\\s*UPLOAD_ERR_OK\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*["\'][^"\']*[\'"]\\s*\\]\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\\[\\s*["\'][^"\']*[\'"]\\s*\\]\\s*\\[\\s*["\'][^"\']*[\'"]\\s*\\]\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*;\\s*move_uploaded_file\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*["\'][^"\']*[\'"]\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\}',
        '<\\s*\\?\\s*if\\s*\$\\s*\\$_FILES\\[\'F1l3\'\\]\\s*\$\\s*\\{\\s*move_uploaded_file\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*echo\\s*\'[^\']*\'\\s*;\\s*\\}\\s*else\\s*\\{\\s*echo\\s*\'[^\']*\'\\s*;\\s*\\}\\s*\\?>',
        '\\$\\w{1,40}\\s*=\\s*["\']<\\?php\\s*\$["\']\\s*;.+?\\$\\w{1,40}\\s*=\\s*@fopen\\s*\\(\\s*["\'][^\'"]*["\']\\s*,\\s*["\'][^\'"]*["\']\\s*\$\\s*;\\s*@fwrite\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;',
        '\\$cookey\\s*=\\s*"[^"]*"\\s*;\\s*preg_replace\\s*\$\\s*["\'][^"\']*["\']\\s*,\\s*["\'][^\'"]*["\']\\s*,\\s*["\'][^\'"]*["\']\\s*\$\\s*;',
        'if\\s*\$\\s*@?\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*["\'][^"\']*["\']\\s*\\]\\s*==\\s*["\'][^"\']*["\']\\s*\$\\s*\\{\\s*error_reporting\\s*\$\\s*\\d+\\s*\$\\s*;\\s*@array_map\\s*\$\\s*\\([^)]+\$\\s*,\\s*\$\\s*array\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*HTTP_X\\s*\\]\\s*\\)\\s*;\\s*\\}',
        '<\\?php\\s*(//header\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;)?\\s*\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*urldecode\\s*\$\\s*.+?;\\${"(\\\\x[0-9a-fA-F]{2,3})+"}\\s*\\["(\\\\x[0-9a-fA-F]{2,3})+"\\]\\(\$;\\s*\\?>',
        '\\$\\w{1,40}\\s*=[^;]+;\\s*\\$\\w{1,40}\\s*=\\s*create_function\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\w+\\s*\\(\\s*base64_decode\\s*\\(\\s*[^)]+\$\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*str_replace\\s*\$\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\]\\s*\\)\\s*\\.\\s*\'[^\']*\'\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*function\\s*\\w+\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*return\\s*\\$\\w{1,40}\\s*\\^\\s*str_repeat\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*ceil\\s*\\(\\s*strlen\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*/\\s*strlen\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\}',
        'if\\s*\$\\s*!isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*header\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*exit\\s*;\\s*\\}\\s*\\?>\\s*<\\s*\\?\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*=\\s*Array\\s*\$\\s*base64_decode\\s*\\(\\s*\'[^\']*\'\\s*\\.\\s*\'[^\']*\'\\s*\$\\s*,\\s*base64_decode\\s*\$\\s*[^{]+{\\s*\\$\\w{1,40}\\s*=\\s*Array\\([^>]+>\\s*<\\?php\\s*\\$\\w{1,40}\\s*=_\\d+\\s*\\(\\s*\\d+\\s*\$\\s*;\\s*.+?\\s*,\\s*\\$\\w{1,40}\\s*,\\s*_\\d+\\s*\$\\s*\\d+\\s*\$\\s*\\)\\s*;',
        '<\\?php\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\s*\\{\\s*"[^"]*"\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\s*\\{\\s*\\$\\w{1,40}\\s*\\}\\s*=\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[[^;]+;\\s*\\w+\\$\\s*\\{\\s*\\$\\w{1,40}\\s*\\}\\s*\\.\\s*"[^"]*"\\s*;\\s*Smarty3::redirect\\s*\$\\s*[^)]+\\s*\$\\s*;\\s*\\?>',
        '^\\s*<\\?php\\s*header\\s*\$\\s*\'Location:\\s*https?://[^/]+/\\?a=\\w+&c=\\w+\'\\s*\$\\s*;\\s*\\?>\\s*$',
        '<\\?php\\s*error_reporting\\s*\$\\s*\\d+\\s*\$\\s*;\\s*echo\\s*"[^"]*"\\s*;\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*==\\s*"[^"]*"\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*file_get_contents\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*fopen\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*fwrite\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*fopen\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*fwrite\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*echo\\s*"[^"]*"\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*/\\*\\s*\\w+\\s*\\*/\\s*header\\s*\$\\s*"Location:\\s*http[^"]*"\\s*\$\\s*;\\s*/\\*\\s*\\w+\\s*\\*/\\s*exit\\s*;\\s*\\?>',
        '\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*if\\s*\$\\s*@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*==\'[^\']*\'\\s*\$\\s*\\{\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*file_exists.+?file_exists\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\?\\s*@filemtime\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*:\\$\\w{1,40}\\s*;\\s*@file_put_contents\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\'[^\']*\'\\s*\\.\\s*base64_encode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*,\\s*FILE_APPEND\\s*\\)\\s*;\\s*@touch\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}',
        '\\$\\w{1,40}-\\s*>\\s*sendCcNumber\\s*\$\\s*\$\\s*;\\s*return\\s*\\$\\w{1,40}\\s*;',
        'class\\s*Ma\\w+\\s*extends\\s*Mage_\\w+\\s*\\{\\s*public\\s*function\\s*indexAction\\s*\$\\s*\$\\s*\\{\\s*@?eval\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\w+\\s*\\]\\s*\$\\s*;\\s*\\}\\s*\\}',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]+["\']\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*echo\\s*.+?\\s*\\}\\s*else\\s*\\{\\s*move_uploaded_file\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*["\'][^\'"]+["\']\\s*\\]\\s*\\[\\s*["\'][^\'"]+["\']\\s*\\]\\s*,\\s*["\'][^"\']*["\']\\s*\\.\\s*\\$\\w{1,40}\\s*\\[\\s*["\'][^"\']+["\']\\s*\\]\\s*\\[\\s*["\'][^\'"]+["\']\\s*\\]\\s*\$\\s*;\\s*echo[^$]+\\$_FILES\\s*\\[\\s*["\'][^"\']+["\']\\s*\\]\\s*\\[\\s*["\'][^"\']+["\']\\s*\\]\\s*;\\s*echo\\s*["\'][^\'"]+["\']\\s*;\\s*\\}\\s*\\}',
        '<\\?php\\s*echo\\s*"[^"]*"\\s*;\\s*(passthru|exec|shell_exec|popen|system|eval)\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\w+\\s*\\]\\s*\$\\s*;\\s*\\?>',
        '(\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*)+\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\$\\s*;\\s*if\\s*\$\\s*!empty\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*foreach\\s*\$.+?\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\\(\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*CURLOPT_URL\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*CURLOPT_POST\\s*,\\s*1\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*CURLOPT_POSTFIELDS\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*\\}',
        '<\\?php\\s*/\\*\\*\\s*\\*\\s*Plugin\\s*Name:\\s*Login\\s*Wall.+?\\s*;\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}\\s*add_action\\s*\$\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*,\\s*0\\s*\$\\s*;\\s*add_action\\s*\$\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\}',
        '<\\?php\\s*error_reporting\\s*\$\\s*E_ALL\\s*\$\\s*;\\s*ini_set\\s*\$\\s*\'[^\']*\'\\s*,\\s*1\\s*\$\\s*;\\s*function\\s*str_between.+magento\\s*not\\s*found\'[^\']*\'Content-type:\\s*application/json\'\\s*\\)\\s*;\\s*echo\\s*json_encode\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*die\\s*\$\\s*pi\\s*\\(\\s*\$\\s*\\)\\s*;\\s*\\$\\s*\\{\\s*"[^"]*"\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*="[^"]*"\\s*;.+eval\\s*\$\\s*\\$\\s*\\{\\s*\\$\\w{1,40}\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*;\\s*\\}\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=["\'][^\'"]+["\']\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*header\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*@date_default_timezone_set\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*@ini_set\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*error_reporting\\s*\$\\s*E_ALL\\s*\$\\s*;\\s*ini_set\\s*\$\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\\?\\s*l1HXxk0\\s*\$\\s*\$\\s*:l11x\\s*\$\\s*\$\\s*;\\s*l15Oe\\s*\$\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*;.+?break\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*<\\s*0\\s*\\?\\s*abs\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*:\\$\\w{1,40}\\s*;\\s*\\$\\w{1,40}%=\\$\\w{1,40}\\s*;\\s*return\\s*\\$\\w{1,40}\\s*;\\s*\\}',
        '<\\?php\\s*function\\s+getBot\$\\s*\\$\\w{1,40}\\s*\$.+if\\s*\$\\s*@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*==\\s*"[^"]*"\\s*\$\\s*\\{\\s*if\\s*\$\\s*@?(copy|move_uploaded_file)\\s*\\(\\s*\\$_FILES\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*"[^"]*"\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*echo\\s*"[^"]*"\\s*;\\s*\\}\\s*else\\s*\\{\\s*echo\\s*"[^"]*"\\s*;\\s*\\}\\s*\\}\\s*\\}\\s*else\\s*\\{\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*str_rot13\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*\\.\\s*=\'[^\']*\'\\s*\\.\\s*\\$\\w{1,40}\\s*;\\s*@\\$\\w{1,40}\\s*\$\\s*\\$\\w+\\s*\\(.+?\$\\);',
        '<\\?php\\s*error_reporting\\s*\$\\s*\\d+\\s*\$\\s*;\\s*echo\\s*"[^"]*"\\s*;\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*["\'][^"\']+["\']\\s*\\]\\s*==\\s*"[^"]*"\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*file_get_contents\\s*\$\\s*["\'][^"\']*["\']\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*fopen\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*fwrite\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*fopen\\s*\$\\s*[\'"][^"\']+[\'"]\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*fwrite\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*echo\\s*["\'][^\'"]+["\']\\s*;\\s*\\}\\s*\\?>',
        '<\\s*\\?\\s*if\\s*\$\\s*!isset\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*@import_request_variables\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*\\}\\s*if\\s*\$\\s*md5\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*!=\'[^\']*\'\\s*\\)\\s*\\{\\s*echo\\s*"[^"]*"\\s*;\\s*\\}\\s*else\\s*\\{\\s*if\\s*\$\\s*get_magic_quotes_gpc\\s*\\(\\s*\$\\s*\\)\\s*\\$\\w{1,40}\\s*=\\s*stripslashes\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*eval\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*;\\s*return\\s*;\\s*\\?>',
        'require_once\\s*\$\\s*findsysfolder\\s*\\(\\s*__FILE__\\s*\$\\s*\\.\\s*\'[^\']*\'\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\w+\\s*\$\\s*\\w+\\s*\\(\\s*__FILE__\\s*\$\\s*\\)\\s*;\\$\\w+=\'[^\']+\';\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*eval\\s*\$\\s*\\w+\\s*\\(\\s*[\'"][^\'"]*[\'"]\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\?>',
        'if\\s*\$\\s*!function_exists\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\{\\s*function\\s*findsysfolder\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*dirname\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\\.\\s*\'[^\']*\'\\s*;\\s*clearstatcache\\s*\$\\s*\$\\s*;\\s*if\\s*\$\\s*!is_dir\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*return\\s*findsysfolder\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*else\\s*return\\s*\\$\\w{1,40}\\s*;\\s*\\}\\s*\\}',
        '<\\?(php)?\\s*\\$\\w+\\s*=(\\s*chr\$\\s*\\d+\\s*\$\\s*\\.?\\s*)+\\s*;\\s*(\\s*\\$\\w+\\s*=(\\$\\w+\$\\s*\\d+\\s*\$\\s*\\.?\\s*){10,};\\s*){2,}\\$\\w+=\\$\\w+\\s*\$\\s*["\']+\\s*,\\s*\\$\\w+\\s*\$\\s*;\\s*@\\$\\w+\$\\s*\$;\\s*\\?>',
        '<\\s*\\?\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*pass\\s*\\]\\s*==\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*getcwd\\s*\$\\s*\$\\s*;\\s*Echo.+?<input\\s+type="submit" name="\\w+"\\s+value="go!"\\s+/></form>\\s*<\\?php\\s*}\\s*\\?>',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*error_reporting\\s*\$\\s*E_ALL\\s*\$\\s*;\\s*@ini_set\\s*\$\\s*\'[^\']*\'\\s*,\\s*TRUE\\s*\$\\s*;\\s*@ini_set\\s*\$\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*\$\\s*;\\s*@set_time_limit\\s*\$\\s*\\d+\\s*\$\\s*;.+?http_build_query\\s*\$\\s*array\\s*\\(\\s*\'[^\']*\'\\s*=\\s*>\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\\s*stream_context_create\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*return\\s*file_get_contents\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*false\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*&&\\s*isset\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*echo\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*[*+/-^]\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*exit\\s*;\\s*\\}',
        'if\\s*\$\\s*md5\\s*\\(\\s*@?\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\w+\\s*\\]\\s*\$\\s*==[\'"][^\'"]*[\'"]\\s*\\)\\s*\$\\s*\\$\\w{1,40}=@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\w+\\s*\\]\\s*\$\\s*\\.\\s*@\\$\\w{1,40}\\s*\$\\s*stripslashes\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\w+\\s*\\]\\s*\$\\s*\\)\\s*;',
        '\\$GLOBALS\\[[^]]+\\]\\s*=\\s*\\$_SERVER;\\s*function\\s*\\w+\$\\$\\w+\$\\s*{\\s*\\$\\w+\\s*=\\s*["\'][\'"]\\s*;\\s*global.+?\$\\s*\\$url\\s*,\\s*FALSE\\s*,\\s*\\${\\s*\\w+\\(\\s*[^)]+\$\\s*}\\s*\\);\\s*return\\s*\\${\\s*\\w+\$\\s*[^)]+\$\\s*}\\s*;\\s*}',
        '<\\?\\s*php\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"login"\\s*\\]\\s*=="[^"]*"\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;.+?<\\s*form\\s*enctype\\s*="[^"]*"\\s*method\\s*="[^"]*"\\s*>\\s*<\\s*input\\s*name\\s*="[^"]*"\\s*type\\s*="[^"]*"/\\s*>\\s*<\\s*input\\s*type\\s*="[^"]*"\\s*value\\s*="[^"]*"/\\s*>\\s*<\\s*/form\\s*>',
        '<\\?\\s*\\$GLOBALS\\[\'_\\d+_\'\\]=Array\$base64_decode\\(.+\\$password=_\\d+\\(0\$;\\$GLOBALS\\[\'_\\d+_\'\\]\\[\\d+\\]\$_\\d+\\(\\d+\$,_\\d+\$\\d+\$,_\\d+\$\\d+\$\\);',
        '\\#!/usr/bin/env.+?\\]\\s*\\[\\s*\\d+\\s*\\]\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*_\\d+\\s*\\(\\s*9\\s*\$\\s*\\]\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\\d+\\s*\\]\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*echo\\s*\\$\\w{1,40}\\s*;\\s*exit\\s*;\\s*\\}',
        'define\\s*\$\\s*\'[^\']*\'/\'[^\']*\'\\s*,\\s*DIRECTORY_SEPARATOR\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*realpath\\s*\$\\s*dirname\\s*\\(\\s*__FILE__\\s*\$\\s*\\.\\s*[^)]+\\)\\s*;\\s*if\\s*\$\\s*!file_exists\\s*\\(\\s*\\$\\w{1,40}\\s*\\.\\s*[^)]+\$\\s*&&\\s*isset\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*str_replace\\s*\$\\s*[^)]+\$\\s*;\\s*\\}\\s*define\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*("[^"]*"\\s*\\.)?\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*@array_filter\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*echo\\s*"[^"]*"\\s*;\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}',
        '<\\?\\s*php\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*==\'[^\']*\'\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\$\\s*htmlspecialchars\\s*\\(\\s*file_get_contents\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\)\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*;\\s*\\}\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*==\'[^\']*\'\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\$\\s*htmlspecialchars\\s*\\(\\s*file_get_contents\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\)\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*;\\s*\\}(\\s*//file\\s*end)?',
        '<\\?php\\s/\\*\\s*--\\s*enphp.+unset\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;\\s*\\}\\s*echo\\s*\\$\\w{1,40}\\s*;\\s*\\?>',
        '(\\$\\w+=[^;]+;)+@\\$\\w+\$@\\$\\w+\\(@\\$\\w+\\(\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[[^]]+\\]\$\\)\\);die\$\$;',
        '(\\$arr_word\\[\\d+\\]\\[\\]\\s*=\\s*"\\d+";){10,}',
        '//insta\\w+\\s*(require|include|require_once|include_once)\$["\'][^\'"]+[\'"]\$;\\s*//insta\\w+',
        '<\\?\\s*php\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*;\\s*function\\s*\\w+\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*global\\s+\\$\\w.+@\\$\\s*\\{\\s*\\w+\\s*\$\\s*"[^"]*"\\s*\$\\s*\\}\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*FALSE\\s*,\\s*\\$\\s*\\{\\s*\\w+\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\}\\s*\\)\\s*;\\s*return\\s*\\$\\s*\\{\\s*\\w+\\s*\$\\s*"[^"]*"\\s*\$\\s*\\}\\s*;\\s*\\}',
        '<\\?php\\s*\\$str\\s*=\\s*\'PGRpdi[^\']+\';\\s*echo\\s+base64_decode\$\\$str\$;\\?>',
        '<\\?php\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*["\'][^"\']*["\']\\s*\\]\\s*==["\'][^\'"]*["\']\\s*\$\\s*\\{\\s*echo\\s*\\w+\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}!="[^"]*"\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*@?eval\\s*\$\\s*["\'][^"\']*["\']\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\?>',
        '<\\?php\\s*\\$\\s*\\{\\s*"[^"]*"\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*="[^"]*"\\s*;.+?\\s*;\\s*eval\\s*\$\\s*\\$\\s*\\{\\s*\\$\\s*\\{\\s*"[^"]*"\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*==\'upload\'\\s*\$\\s*\\{\\s*if\\s*\$\\s*is_uploaded_file\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*move_uploaded_file\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*"[^"]*"\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*"[^"]*"\\s*\\]\\s*;\\s*\\}\\s*\\}\\s*\\?>',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*;',
        '<\\?php\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\w+[^)]{1000,}\$\\s*\\);\\s*\\?>',
        '\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^"\']*[\'"]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^"\']*["\']\\s*;\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$(\\s*\\d+\\s*,\\s*){2,}\\s*\\d+\\s*\$\\s*;\\s*foreach\\s*\$\\s*\\$\\w{1,40}\\s*as\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*\\.\\s*=\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*strrev\\s*\$[^)]+\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;\\s*return\\s*;',
        'include\\s*\$\\s*dirname\\s*\\(\\s*__FILE__\\s*\$\\s*\\.\\s*\'/includes/_bb_press_plugin.class.php\'\\s*\\)\\s*;\\s*register_activation_hook\\s*\$\\s*__FILE__\\s*,\\s*array\\s*\\(\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*;\\s*//\\s*M\\s*register_deactivation_hook\\s*\$\\s*__FILE__\\s*,\\s*array\\s*\\(\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*;\\s*add_filter\\s*\$\\s*\'[^\']*\'\\s*,\\s*array\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\'[^\']*\'\\s*\$\\s*,\\s*10\\s*,\\s*3\\s*\\)\\s*;\\s*add_action\\s*\$\\s*\'[^\']*\'\\s*,\\s*array\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*;',
        '<\\?php\\s*echo\\s*eval\\s*\$base64_decode\\s*\\(\\s*(str_replace\\s*\\(\\s*[\'"][^\'"]+[\'"]\\s*,\\s*[\'"][^\'"]+[\'"]\\s*\\s*,)+\\s*[\'"][^\'"]+[\'"]\\s*(\$\\s*)+;',
        '<\\?php\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*==\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*@set_time_limit\\s*\$\\s*\\d+\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*\\.\\s*"[^"]*".+?<\\s*form\\s*method\\s*="[^"]*"\\s*enctype\\s*="multipart/form-data"\\s*>\\s*<\\s*input\\s*name\\s*="[^"]*"\\s*type\\s*="[^"]*"\\s*>\\s*<\\s*input\\s*type\\s*="[^"]*"\\s*value\\s*="[^"]*"\\s*>\\s*<\\s*/form\\s*>\\s*<\\?php\\s*\\}\\s*\\?>',
        '<\\?php\\s*require_once\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\.\\s*"[^"]*"\\s*\$\\s*;\\s*\\$\\w{1,40}-\\s*>\\s*Authorize\\s*\$\\s*1\\s*\$\\s*;\\s*require_once\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\.\\s*"[^"]*"\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*extract\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*,\\s*\\d+\\s*\$\\s*;\\s*strripos\\s*\$\\s*@sha1\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*,\\s*"[^"]*"\\s*\\)\\s*==\\s*\\d+\\s*&&\\s*@\\$\\w{1,40}\\s*\$\\s*stripslashes\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;',
        '<\\?php\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*(\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\.?\\s*){3,};\\s*\\$\\w+\$(\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\.?\\s*){3,}\\s*,\\s*\\$\\w+\\s*,\\s*[\'"]+\\s*\$;',
        '<\\?php\\s*\\$\\w{1,40}="[^"]{3000,}"\\s*;\\s*(\\$\\w+\\.?="[^"]+";\\s*){3,}\\s*@?\\$\\w+(?:\$\\$\\w{1,40}){3,}\${3,};\\s*(\\?>)?',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*for\\s*\$\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*<\\s*strlen\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*-\\d+\\s*;\\s*\\$\\w{1,40}\\+=\\s*\\d+\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*\\.\\s*=\\s*chr\\s*\$\\s*hexdec\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\\.\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\+\\d+\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\}\\s*preg_replace\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*function\\s*clear_folder\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*if\\s*\$\\s*is_dir\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*=\\s*opendir\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\).+\\s*\$\\s*is_dir\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*rmdir\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*if\\s*\$\\s*is_dir\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*echo\\s*"[^"]*"\\s*;\\s*else\\s*echo\\s*"[^"]*"\\s*;\\s*exit\\s*;\\s*\\}\\s*\\?>',
        'if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*==\'[^\']*\'\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\$\\s*htmlspecialchars\\s*\\(\\s*file_get_contents\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\)\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*;\\s*\\}\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*==\'[^\']*\'\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\$\\s*htmlspecialchars\\s*\\(\\s*file_get_contents\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\)\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*;\\s*\\}(\\s*//file\\s*end)?',
        'function\\s+css\$\\$i\$\\s*{\\s*\\$\\w+\\s*=\\s*"[^"]+";\\s*\\$xml_content=file_get_contents\$\\$\\w+\\.\\$\\w+\$;\\s*\\$\\w+\\s*=\\s*array\$(\\s*"[^"]+"\\s*,?)+\$;\\s*reset\$\\$\\w+\$;.+?echo\\s*\\$xml_content;(\\s*exit\$\$;)?\\s*}\\s*}\\s*}\\s*(css\$\\s*\'[^\']+\'\\s*\$;)?',
        '<\\?php\\s*\\$\\w+=\'[^\']+\';\\s*\\$\\w+=(\\$\\w+\\{\\d+\\}\\.?){3,};(\\s*\\$\\w+\\s*=(\\$\\w+\\{\\d+\\}\\.?)+;)+\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$(\\s*[\'"].[\'"]\\s*,?){1,}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*create_function\\s*\$((\\s*[\'"].[\'"]\\s*\\.?)\\s*,\\s*?){1,}\\s*,\\s*(\\$\\w{1,40}\\[\\d+\\]\\.?)+\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\?>',
        '@?file_get_contents\$"[^"]+"\\s*\\.\\s*\\$_SERVER\\[\'HTTP_REFERER\'\\]\\s*\\.\\s*"&\\w+=http://"\\s*\\.\\s*\\$_SERVER\\[\'SERVER_NAME\'\\]\\s*\\.\\s*"/[^"]+"\$;',
        'if\\s*\$\\s*@?\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*=="[^"]*"\\s*\$\\s*\\{\\s*error_reporting\\s*\$\\s*\\d+\\s*\$\\s*;\\s*@?array_map\\s*\$\\s*\\([^)]+\$\\s*,\\s*\$\\s*array\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*HTTP_X\\s*\\]\\s*\\)\\s*;\\s*\\}',
        '(GIF\\d+a\\+\\s*)?<\\?\\s*php\\s*eval\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\w+\\s*\\]\\s*\$\\s*\\?>',
        'copy\$\'http://.+?\'\\s*,\\s*\'\\w+\\.php\'\$;exit;',
        '\\$wp_nonce=isset\$\\$_POST\\[\\$_SERVER{\\$_SERVER{.+?unset\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;\\s*\\}\\s*echo\\s+\\$wp_auth_check;',
        '/\\s*\\*\\w+\\s*\\*/\\s*@include\\s*"[^"]*"\\s*;\\s*/\\s*\\*\\w+\\s*\\*/',
        '<\\?php(\\s*//.+?$)?(\\s*/\\*[^*]{1,5000}\\*/)?\\s*preg_replace\\s*\$\\s*"/\\.\\*/e"\\s*,\\s*"[^"]+"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*(\\?>)?',
        '\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*str_replace\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*(\\$\\w{1,40}\\s*\\.?){2,}\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;\\s*',
        '<div\\s+id="\\w+">\\s*(<a\\s+href=\'[^\']+\'\\s+title=\'[^\']+\'>[^<]+</a>\\s*){20,}<script>\\s*eval.+?</script>\\s*</div>',
        '<\\?\\s*php\\s*\$\\s*\\$\\w{1,40}=@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\d+\\s*\\]\\s*\$\\s*\\.\\s*@\\$\\w{1,40}\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\d+\\s*\\]\\s*\$\\s*\\?>',
        '\\$\\w{1,40}\\s*=\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}!=\'[^\']*\'\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*@eval\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*\\}',
        '<\\?\\s*php\\s*eval\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\\d+\\s*\\]\\s*\$\\s*\\?>',
        '<\\?php\\s*error_reporting\\s*\$\\s*\\d+\\s*\$\\s*;\\s*if\\s*\$\\s*function_exists\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\{\\s*set_time_limit\\s*\$\\s*\\d+\\s*\$.+?echo\\s*\\$\\w{1,40}\\s*;\\s*@file_get_contents\\s*\$\\s*\'[^\']*\'\\s*\\.\\s*\\$\\w{1,40}\\s*\\.\\s*\'[^\']*\'\\s*\\.\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*exit\\s*\$\\s*\$\\s*;\\s*\\?>',
        '<\\s*\\?\\s*eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*\'[^\']{1000,}\'\\s*\$\\s*\\)\\s*\\)\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*if\\s*\$\\s*\\$_(?:GET|POST)\\s*\\[\\s*pass\\s*\\]\\s*==\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\s*\\{\\s*"[^"]*"\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*="[^"]*"\\s*;.{1000,5000}/>\\s*</form>\\s*<\\?php\\s*\\}\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*=="[^"]*"\\s*\$\\s*\\{\\s*echo\\s*success\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}!="[^"]*"\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*@?eval\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\?>',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*&&\\s*isset\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*&&\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*==\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\{\\s*switch\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\{\\s*case.+?print\\s*stripslashes\\s*\$\\s*\\$\\w{1,40}\\s*->\\s*content\\s*\$\\s*;\\s*get_search_form\\s*\$\\s*\$\\s*;\\s*get_sidebar\\s*\$\\s*\$\\s*;\\s*get_footer\\s*\$\\s*\$\\s*;\\s*\\}\\s*exit\\s*;\\s*\\}',
        '<\\?php\\s*\\$\\s*\\{\\s*"[^"]*"\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*="[^"]*"\\s*;\\s*\\$\\s*\\{\\s*.+?\\s*;\\s*eval\\s*\$\\s*\\$\\s*\\{\\s*\\$\\w{1,40}\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*;\\s*\\}\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$\\s*.+?preg_split\\s*\\(\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*,\\s*-1\\s*,\\s*PREG_SPLIT_NO_EMPTY\\s*\$\\s*;\\s*foreach\\s*\$\\s*\\$\\w{1,40}\\s*as\\$\\w{1,40}\\s*=>\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*=\\s*chr\\s*\$\\s*ord\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*-3\\s*\\)\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*implode\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\.\\s*\\$\\w{1,40}\\s*\\.\\s*\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*;\\s*\\}\\s*return\\s*\\$\\w{1,40}\\s*;\\s*\\}',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*4\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*str_replace\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*str_replace\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*strlen\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*for\\s*\$\\s*\\$\\w{1,40}\\s*=\\s*0\\s*;\\s*\\$\\w{1,40}<\\$\\w{1,40}\\s*;\\s*\\$\\w{1,40}\\+\\+\\s*\$\\s*\\$\\w{1,40}\\s*\\.\\s*=\\s*chr\\s*\$\\s*ord\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\$\\s*\\^\\s*\\$\\w{1,40}\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\\s*fopen\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*fputs\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*include\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*fopen\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*echo\\s*\\d+\\+\\d+\\s*;\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$[^;]+;\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\\([^;]+;\\s*eval\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*base64_decode\\s*\\([^;]+;\\s*if\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*base64_decode\\s*\\([^\\]]+\\]\\s*==\\s*base64_decode\\s*\\([^}]+\\{\\s*@\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*base64_decode\\s*\\(.+?\$\\s*\\]\\s*\\)\\s*;\\s*\\}\\s*;\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$(\\s*\\d+\\s*,\\s*){3,}\\d+\\s*\$\\s*;\\s*foreach\\s*\$\\s*\\$\\w{1,40}\\s*as\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*\\.\\s*=\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*strrev\\s*\$[^)]+\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}\\s*',
        '<\\?php\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*\\)\\s*;\\s*\\?>',
        '\\$\\w{1,20}\\s*=\\s*[\'"][^\'"]+["\']\\s*;\\s*\\$\\w{1,20}\\s*=(?:\\$\\w{1,20}\\[\\s*\\d{1,5}\\s*\\]\\s*\\.?\\s*){3,}.+?include[^?]+\\?>',
        '\\$\\w{1,20}\\s*=\\s*[\'"][^\'"]+["\']\\s*;\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\${\\s*(\\$\\w{1,20}\\[\\s*\\d+\\s*\\]\\s*\\.?\\s*){3,}\\s*\\}\\s*\\[\\s*(\\$\\w{1,20}\\[\\s*\\d+\\s*\\]\\s*\\.?\\s*){3,}\\s*\\]\\s*\$\\s*\\)\\s*{\\s*eval\$\\s*\\${\\s*(\\$\\w{1,20}\\[\\s*\\d+\\s*\\]\\s*\\.?\\s*){3,}\\s*\\}\\[\\s*(\\$\\w{1,20}\\[\\s*\\d+\\s*\\]\\s*\\.?\\s*){3,}\\s*\\]\\s*\$;\\s*}',
        '\\$\\w{1,40}="\\w{1,20}";if\$!empty\\(\\$_(REQUEST|GET|POST|COOKIE)\\[\\$\\w+\\]\$\\){\\$[^@]+@\\$\\w+\$stripslashes\\(\\$_(REQUEST|GET|POST|COOKIE)\\[\\$\\w+\\]\$\\);}else\\s*@unlink\$__FILE__\$;',
        '<\\?php\\s*\\$\\w{1,20}=\\$_POST\\[\\w{1,20}\\];echo\\s*eval\$\\$\\w{1,20}\$;echo "404 Not Found";\\s*\\?>',
        '(/\\*[^*]+\\*/)?if(/\\*[^*]+\\*/)?(/\\*[^*]+\\*/)?\$(/\\*[^*]+\\*/)?isset\\((/\\*[^*]+\\*/)?\\$_(REQUEST|GET|POST|SERVER|COOKIE)\\[[\'"]\\w{1,20}[\'"]\\](/\\*[^*]+\\*/)?\$(/\\*[^*]+\\*/)?\\)(/\\*[^*]+\\*/)?{(/\\*[^*]+\\*/)?\\$_(REQUEST|GET|POST|SERVER|COOKIE)(/\\*[^*]+\\*/)?\\[[\'"]\\w{1,20}[\'"]\\]\$(/\\*[^*]+\\*/)?\\$_(REQUEST|GET|POST|SERVER|COOKIE)\\["\\w{1,20}"\\](/\\*[^*]+\\*/)?\$(/\\*[^*]+\\*/)?;(/\\*[^*]+\\*/)?(/\\*[^*]+\\*/)?exit(/\\*[^*]+\\*/)?;(/\\*[^*]+\\*/)?}(/\\*[^*]+\\*/)?',
        '(/\\*[^*]+\\*/)?if(/\\*[^*]+\\*/)?(/\\*[^*]+\\*/)?\$(/\\*[^*]+\\*/)?isset\\((/\\*[^*]+\\*/)?\\$_(REQUEST|GET|POST|SERVER|COOKIE)\\[\'\\w{1,20}\'\\](/\\*[^*]+\\*/)?\$(/\\*[^*]+\\*/)?\\)(/\\*[^*]+\\*/)?{(/\\*[^*]+\\*/)?\\$\\w{1,20}(/\\*[^*]+\\*/)?=(/\\*[^*]+\\*/)?["\'][assert\'".\\s]+["\'];(/\\*[^*]+\\*/)?\\$\\w{1,20}(/\\*[^*]+\\*/)?=(/\\*[^*]+\\*/)?\\$\\w{1,20}(/\\*[^*]+\\*/)?\$(/\\*[^*]+\\*/)?\\$_(REQUEST|GET|POST|SERVER|COOKIE)\\[\'\\w{1,20}\'\\](/\\*[^*]+\\*/)?\$(/\\*[^*]+\\*/)?;(/\\*[^*]+\\*/)?exit;(/\\*[^*]+\\*/)?}(/\\*[^*]+\\*/)?',
        '\\$\\w{1,}\\s*=\\s*[\\s_.GET"\']+;\\s*if\\s*\$(!empty|isset)\\(\\s*\\$\\{\\s*\\$\\w+\\s*\\}\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\$\\s*\\)\\s*preg_replace\$\\s*[^,]+\\s*,\\s*[\\s"e.\'Val]+\\(\\s*\\$\'\\s*\\.\\s*\\$\\w+\\s*\\.\\s*\'\\[\\s*[\'"]\\w+[\'"]\\s*\\]\$[\'"]\\s*,\\s*[\'"][\'"]\\);',
        '<\\?php\\s*if\$!empty\\(\\$_FILES\\[\'\\w+\'\\]\\[\'\\w+\'\\]\$ && \$md5\\(\\$_POST\\[\'\\w+\'\\]\$ == \'\\w{32}\'\\)\\)\\s*{\\s*\\$sc = \$empty\\(\\$_POST\\[\'\\w+\']\$\\).+<br/>Security Code: <br/><input name="\\w+" value=""/>\\s*<br/>Name:\\s*<br/><input name="name" value=""/>\\s*<br/>\\s*<input type="submit" value="Sent" />\\s*</form>\\s*</body>\\s*</html>\';',
        '<\\?php\\s*\\${"\\\\x[^"]+"}\\["[^"]+"\\]=.+?\\);\\s*exit\$\\s*\$;\\s*}\\s*\\?>',
        '<title>\\s*ol\\s+Erivfvhz',
        'if \$!defined\\(\'ALREADY_RUN.+eval\\s*(/\\*\\w+\\*/)?\\s*\\(\\s*\\w+\\s*\\(\\$\\w+\\s*,\\s*\\$\\w+\$\\s*\\);\\s*}',
        '(\\$\\w{1,20}\\s*=\\s*\'[^\']+\'\\s*;\\s*){6,}.+(\\$\\w{1,20}\\[\\s*[\'"]?\\d+[\'"]?\\s*\\]\\s*\\.?\\s*){5,}\\);',
        'if\$\\$\\w+===0\${@\\${\\w+}\$\\$\\w+\$;}',
        'if\$isset\\(\\$_COOKIE\\[[^]]+]\$\\s*&&\\s*isset\$\\$_COOKIE\\[[^]]+\\]\$\\)\\s*{.+include\$\\$f\$;\\s*}',
        'echo\\s+file_get_contents\$\'index\\.html(\\.bak)+\'\$;',
        '/\\*(\\w+)\\*/\\s*@(include|require|include_once|require_once)\\s*"[^"]+";\\s*/\\*\\1\\*/',
        '\\A\\s*<\\?echo\\s+\\d+\\s*[+*/-]\\s*\\d+;\\?>\\Z',
        '<\\?php\\s*(\\$arrUrlId\\[\'[^\']+\'\\]=\'[^\']+\';\\s*)+',
        'if\$\\s*isset\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\["test_url"\\]\\s*\$\\s*\\)\\s*{\\s*echo "file test okay";\\s*}.+\\$f\\s*=\\s*\\$a\$"",\\s*\\$array_name\\(\\$string\$\\);\\s*\\$f\$\$;',
        '<\\?php\\s+(\\$\\w+=base64_decode\$("[a-zA-Z0-9=/]+"|\\s|\\.|chr\\(\\d+\$)+\\);)+eval\$\\$\\w+\\(\\$_POST\\[base64_decode\\(("[a-zA-Z0-9=/]+"|\\s|\\.|chr\\(\\d+\$)+\\)\\]\\)\\);.+base64_decode\$("[a-zA-Z0-9=/]+"|\\s|\\.|chr\\(\\d+\$)+\\)]\\);\\s*};\\s*\\?>',
        'ini_set\$\'display_errors\',\'Off\'\$;\\s*error_reporting\$\'E_ALL\'\$;\\s*if\$isset\\(\\$_FILES\\[\'u\'\\]\$\\s*&&\\s*isset\$\\$_POST\\[\'n\'\\]\$\\)\\s*move_uploaded_file\$\\$_FILES\\[\'u\'\\]\\[\'tmp_name\'\\],\\$_POST\\[\'n\'\\]\$;\\s*setcookie\$\'server\',1,time\\(\$\\+1e6\\);\\s*\\$s=\\$_SERVER;\\s*if\$\\$server!=1\\s*&&\\s*\\$s\\[\'HTTP_REFERER\'\\]\\s*&&\\s*strpos\\(\\$s\\[\'HTTP_REFERER\'\\],\\$s\\[\'HTTP_HOST\'\\]\$===false\\s*&&\\s*\\$_COOKIE\\[\'server\'\\]!=1\\)\\s*{\\s*\\$server=1;\\s*eval\$file_get_contents\\(base64_decode\\(\'\\w+\'\$\\.\\$s\\[\'HTTP_HOST\'\\]\\)\\);\\s*}',
        '(\\$\\w{1,30}\\s*=\\s*[^;]+;){1,}\\s*@\\$\\w{1,30}\$@\\$\\w{1,30}\\(@\\$\\w+\\(\\$_POST\\[[^\\]]+\\]\$\\)\\);\\s*die\$\\s*\$;',
        'if\$isset\\(\\$_POST\\[.+@\\$\\w{1,30}\\(@\\$\\w{1,30}\\(@\\$\\w{1,30}\\(\\$_POST.+<h2>Error 404</h2>\\s*</body>\\s*</html>',
        'if\\(\\s*isset\\(\\s*\\$_POST\\[\\s*[\'"](\\w+)[\'"]\\s*\\]\\s*\$\\s*\\)\\s*{\\s*@?eval\$\\s*stripslashes\\(\\s*\\$_POST\\[\\s*["\']\\1["\']\\s*\\]\\s*\$\\s*\\);\\s*};',
        '<?php\\s*\\$jquery_start\\s*=\\s*true;.*?\\$jquery_end\\s*=\\s*true;.*?>',
        'RewriteEngine\\s+On\\s*(RewriteCond\\s*%{HTTP_REFERER\\}\\s*\\.\\*[^.]+\\.\\*\\$\\s*\\[NC(,OR)?\\]\\s*)+RewriteRule\\s*\\.\\*\\s*http://[^[]+\\[R,L\\]',
        'RewriteEngine\\s+On\\s*RewriteRule\\s+\\^\$\\[A-Za-z0-9-\\]\\+\$\\.html\\$\\s+\\w+\\.php\\?br=\\$1\\s+\\[L\\]',
        '<IfModule mod_rewrite\\.c>\\s*RewriteEngine On\\s*RewriteCond %{HTTP_REFERER}\\s+\\^\\.\\*\$[^)]+\$\\\\.\$\\.\\*\$\\s*RewriteCond\\s*%{HTTP_USER_AGENT}\\s*\\^\\.\\*\$msie\\|opera\$\\s*\\[NC\\]\\s*RewriteCond\\s*%{REQUEST_FILENAME}\\s*!/index\\.php\\s*RewriteRule\\s*\$\\.\\*\$\\s*/index\\.php\\?query=\\$1\\s*\\[QSA,L\\]\\s*</IfModule>',
        'RewriteEngine\\s+on\\s*RewriteCond %{HTTP_ACCEPT} "text/vnd\\.wap\\.wml\\|application/vnd\\.wap\\.xhtml\\+xml"\\s*\\[NC,OR\\].+?RewriteCond\\s*%{HTTP_USER_AGENT}\\s*!windows-media-player\\s+\\[NC\\]\\s*RewriteRule\\s+\\^\$\\.\\*\$\\$\\s+http[^]]+\\[L,R=302\\]',
        'RewriteEngine\\s+on\\s*RewriteCond\\s+%{HTTP_USER_AGENT}\\s*\\^\\.\\*Android\\.\\*\\$\\s*RewriteRule\\s*\\^\$\\.\\*\$\\$[^[]+\\[L,R=302\\]',
        'RewriteEngine\\s+on\\s+RewriteCond\\s+%{HTTP_USER_AGENT}\\s+acs.+?RewriteRule\\s+\\^\$\\.\\*\$\\$[^\\[]+\\[L,R=302\\]',
        '<html>\\s*<head>\\s*<script>\\s*window\\s*\\.\\s*top\\s*\\.\\s*location\\s*\\.\\s*href\\s*="[^<]+</script>\\s*</head>\\s*<body>\\s*<script>\\s*document\\s*\\.\\s*write\\s*\$\\s*\'[^)]+\$\\s*;\\s*</script>\\s*</body>',
        '<html>\\s*<head>\\s*<script type="text/javascript" src="http://ajax\\.googleminiapi\\.com/angular\\.min\\.js">\\s*</script>\\s*<META HTTP-EQUIV="REFRESH" CONTENT="1;URL=[^"]+">\\s*</head>\\s*<body>\\s*</body>\\s*</html>',
        '<script>\\s*window\\.top\\.location\\.href="http://[a-zA-Z0-9-._ +"]{1,100}?"\\s*</script>',
        'DirectoryIndex\\s*index\\.php\\s*RewriteEngine On\\s*RewriteBase\\s*/\\w+/\\s*RewriteCond\\s*%{REQUEST_FILENAME}\\s*!-d\\s*RewriteCond\\s*%{REQUEST_FILENAME}\\s*!-f\\s*RewriteRule\\s*index\\.php\\.\\* -\\s*\\[L\\]\\s*RewriteCond\\s*%{REQUEST_FILENAME}\\s*!-d\\s*RewriteCond\\s*%{REQUEST_FILENAME}\\s*!-f\\s*RewriteRule\\s*\\^\$\\.\\*\$\\s*index\\.php\\?id=\\$1',
        '\\A<script\\s+type="text/javascript">\\s*location\\.replace\$"http://[^"]+"\$;\\s*</script>\\s*\\Z',
        '<html>\\s*<head>\\s*<meta http-equiv="refresh" content="\\d+;\\s*url=http://.+?\\s*r = Math\\.floor\$Math\\.random\\(\$ \\* 10000\\);\\s* .+?document\\.write\$"<img src=\'" \\+ l \\+ "\'>"\$;\\s*</script>\\s*<body>\\s*<h1>Loading...</h1>\\s*</body>\\s*</html>\\s*',
        '<html>\\s*<head>\\s*<meta http-equiv="refresh" content="\\d+;\\s*url=http://[^"]+">\\s*</head>\\s*<body>\\s*<h1>Loading...</h1>\\s*</body>\\s*',
        '\\A(?:\\s*<\\?php\\s*@?include(?:_once)?\$[\'"][^\'"]{1,100}[\'"]\$;\\s*\\?>){3,5}\\s*(<\\?php\\s*/\\*\\*\\s+\\*\\s+CodeIgniter)',
        '\\A\\s*<\\?php\\s*(\\$\\w{1,40})\\s*=[^\\?]{1000,}(\\$\\w{1,40})\\s*=\\s*array\$[^)]{20,60}\$;\\s*foreach\$\\s*\\2\\s*as\\s*(\\$\\w{1,40})\$\\{\\s*\\$\\w{1,40}\\s*\\.=\\s\\1\\s*\\[\\3\\];\\s*\\}\\s*(\\$\\w{1,40})\\s*=\\s*strrev\$[^)]{20,60}\$;\\s*(\\$\\w{1,40})\\s*=\\s*\\4\\s*\$[^)]{20,60}\$\\s*\\);\\s*\\5\$\$;\\s*(?:\\?>)?\\s*(<\\?|\\Z)',
        '\\A\\s*<\\?php\\s*(\\$\\w{1,40})\\s*=[^\\?]{1000,}[\'"][\'"]\\.\\$[\\w]{1,40};\\$[\\w]{1,40}\$(?:\\1\\[\\d+\\]\\.?){5},\\s*\\$[\\w]{1,40}\\s*,\\s*[\'"][^\'"]{0,40}[\'"]\\s*\$;\\s*(?:\\?>)?\\s*(<\\?|\\Z)',
        '<\\?php\\s*\\$\\{[\'"][^\\?]{1000,60000}eval\$\\$\\w{1,40}\\[\\$GLOBALS\\[[\'"][^\'"]{1,40}[\'"]\\]\\[\\w{1,40}\\]\\]\$;\\s*\\}\\s*exit\$\$;\\s*\\}\\s*(?:\\?>)?\\s*(<\\?|\\Z)',
        '\\A\\s*<\\?php\\s+[^\\[]{1,600}\\s*function\\s+\\w{1,40}\$\\s*\\$ip,\\s*\\$array\$ \\{[^`]{60000,}<\\?php\\s+@?chdir\$\\s*\\$lastdir\\s*\$;\\s*c99shexit\\s*\$\\s*\$;\\s*(?:\\?>)?\\s*(<\\?|\\Z)',
        '\\A\\s*<\\?php\\s*\\$\\w{1,40}\\s*=\\s*[\'"]?\\w{1,40}[\'"]?;\\s*function\\s+(\\w{1,40})\\s*\$[^\\?]{99,200}\\?[^\\?]{60000,}=\\s*array\\((?:\'[^\']\'=>\'[^\']\'\\s*,?\\s*){50,70}\$;\\s*eval(?:/\\*\\w{1,40}\\*/)?\$\\s*\\1\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\);\\s*(?:\\?>)?\\s*(<\\?|\\Z)',
        '\\A\\s*<\\?php\\s*@?preg_replace\\s*\$\\s*[\'"](.).{0,40}\\1e[\'"]\\s*,\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\]\\s*,\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$\\s*;\\s*\\?>',
        '<\\?(?:php)?\\s*\\$USER->Authorize\$[\'"]1[\'"]\$;(?:\\s*//\\s*[^/]{0,39})?\\s*\\?>',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*!function_exists\\s*\\(\\s*[\'"](\\w{1,40})[\'"].{300,450}\\$\\w{1,40}\\s*=\\s*[\'"]\\1[\'"]\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*(\\$\\w{1,40})\\s*\\(\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*\\2\\s*\$\\s*[\'"][\'"]\\s*,\\s*\\3\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\4\\s*\$\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '/\\\\x65"\\s*,\\s*"\\$2\$\\$3\\(urldecode\\(\'\\$1\'\$\\)\\)"',
        '\\A<\\?php\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*==\\s*\'[^\']*\'\\s*\$\\s*\\{\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*;\\s*\\}\\s*\\?>\\s*\\Z',
        '(<\\?php\\s*)?if\\s*\$\\s*(copy|move_uploaded_file)\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*[\'"][^\'"]+[\'"]\\s*\\]\\s*\\[\\s*[\'"][^\'"]+[\'"]\\s*\\]\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]*[\'"]\\s*\\]\\s*\$\\s*\\)\\s*exit\\s*;\\s*(\\?>)?',
        '<\\?php\\s*\\$\\s*\\{\\s*"[^"]*"\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*="[^"]*"\\s*;\\${.+?;\\s*@\\$\\s*\\{\\s*\\$\\w{1,40}\\s*\\}\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*;\\s*echo\\s*"[^"]*"\\s*;\\s*\\?>',
        '@(require|include|include_once|require_once)\$[\'"][^/]+/\\d+[\'"]\$;',
        '<\\?php\\s*@include_once\$"index\\.php"\$;\\s*\\?>',
        '\\$\\w{1,40}\\s*=\\s*"[preg_replace\\s\\.\\"]+";\\s*\\$\\w+\$"/\\[discuz\\]/e",\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\],"[^\\"]+"\$;',
        '<\\?php\\s*\\$\\w+=\\".+?\\";\\$GLOBALS\\[\'\\w+\'\\]\\s*=\\s*\\${(\\$\\w+\\[\\d+\\]\\.?)+};\\$GLOBALS\\[\'\\w+\'\\]\\s*=\\s*(\\$\\w+\\[\\d+\\]\\.?)+;if\\s*\$!empty\\(\\$GLOBALS\\[\'\\w+\'\\]\\[\'\\w+\'\\]\$\\)\\s*{\\s*eval\$\\$GLOBALS\\[.+?echo\\s+(\\$\\w+\\[\\d+\\]\\.?){10,};',
        '(\\$\\w+)\\s*=\\s*scandir\\(\\$_SERVER\\[\'DOCUMENT_ROOT\'\\]\$;\\s*for\\s*\$(\\$\\w+)=0;\\2<count\\(\\1\$;\\2\\+\\+\\)\\s*{\\s*if\$stristr\\(\\1\\[\\2\\],\\s*\'php\'\$\\)\\s*{\\s*(\\$\\w+)\\s*=\\s*filemtime\$\\$_SERVER\\[\'DOCUMENT_ROOT\'\\]\\."/"\\.\\1\\[\\2\\]\$;\\s*break;\\s*}\\s*}\\s*touch\$dirname\\(__FILE__\$,\\s*\\3\\);\\s*touch\$\\$_SERVER\\[\'SCRIPT_FILENAME\'\\],\\s*\\3\$;\\s*chmod\$\\$_SERVER\\[\'SCRIPT_FILENAME\'\\],\\s*0444\$;',
        '<\\?php\\s*\\$\\w+\\s*=\\s*"\\w+";\\s*if\$isset\\(\\$_REQUEST\\[\\$\\w+\\]\$\\)\\s*{\\s*eval\$\\s*stripslashes\\(\\s*\\$_REQUEST\\[\\$\\w+\\]\$\\);\\s*exit\$\$;\\s*};\\s*\\?>\\s*',
        '<\\?php eval\$"[^"]+"\\.\\$_REQUEST\\[\'.\'\\]\\."[^"]+"\$;\\?>',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w*\'\\]\\s*\$\\s*\\)\\s*\\{\\s*\$\\s*\\$www\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w*\'\\]\\s*\$\\s*&&\\s*@preg_replace\$\\s*\'.ad.e\'\\s*,\\s*\'@\'\\s*.\\s*str_rot13\\(\\s*\'riny\'\\s*\$\\s*\\.\\s*\'\$\\$www\$\'\\s*,\\s*\'add\'\\s*\\);\\s*exit;\\s*}',
        '<\\?php\\s+\\$[a-z].+?strtoupper.+?isset.+?eval\\s*\$\\s*\\${\\s*\\$[a-z0-9]+\\s*}\\s*\\[\\s*\'[a-z0-9]+\'\\s*\\]\\s*\$;\\s*}\\s*\\?>\\s*',
        'if\\s*\$\\$_REQUEST\\[.param1.\\]&&\\$_REQUEST\\[.param2.\\]\$\\s*{\\$f.+?array\$\\$_REQUEST\\[.param2.\\]\$;.+?array_filter.+?OK.;\\s*Exit;}',
        'if\\s*\$\\$_FILES\\[.F1l3.+?\\$_POST\\[.Name.\\]\$;\\s*echo\\s*.OK.; Exit;}',
        '<\\?php global \\$[a-z0-9]+; \\$[a-z0-9]+=array\$.+?\$\\);\\};unset\$\\$[a-z0-9]+\$;',
        '<\\?php\\s*\\@preg_replace\$./\\(\\.\\*\$/e.+?, ..\\);',
        '<\\?php\\s+\\$GLOBALS.+?\\[\\d+\\]\\]\\);}exit\$\$;\\}\\s+\\?>',
        '<\\?php\\s+\\$sF="\\w+_.+?\\)\\);\\}\\?>\\s*',
        '<\\?php\\s+\\$qV="stop_.+?\\]\\);\\}\\?>\\s*',
        '\\A\\s*<\\?(?:php)?\\s*require\$\\$_SERVER\\[[\'"]DOCUMENT_ROOT[\'"]\\]\\.[\'"]/bitrix/header\\.php[\'"]\$;[^`]{60,80}\\$user\\s*=\\s*new\\s+CUser;\\s*\\$arFields\\s*=\\s*Array\$[^\\;]{350,400};\\s*\\$ID\\s*=\\s*\\$user->Add\\(\\$arFields\$;\\s*[^\\\']{170,200}\\s*\\?>\\s*\\Z',
        '<\\?php\\s+include(?:_once)?\\s*\$[\'"][^\'"]{1,40}\\.(png|gif|jpg|jpeg|ico)[\'"]\$;\\s*\\?>\\s*\\Z',
        '\\A\\s*<\\?php\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{1,100}[\'"][\'"];\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{2000,4000}[\'"]\\)\\)[\'"];\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{1,100}[\'"];\\s*\\s*(\\$\\w{1,40})\\s*=\\s*[\'"](.).{0,40}\\3e\\w?[\'"];\\s*\\1\\s*\$\\s*\\2\\s*,\\s*\\$\\w{1,40}\\s*\\.\\s*\\$\\w{1,40}\\s*,\\s*[\'"][^\'"]{0,40}[\'"]\$;\\s*(?:\\Z|\\?>)',
        '\\A\\s*(<\\?php)\\s*@?eval\\s*(?:\$\\s*(?:base64_decode|gzuncompress|gzinflate|str_rot13)\\s*){0,6}\\(\\s*[\'"][^\'"]{1000,60000}[\'"]\\s*\$\\s*\\);(\\s*\\/\\*\\*\\s+\\*\\s+Front\\sto\\sthe\\sWordPress\\sapplication\\.)',
        '\\A\\s*(<\\?php)\\s+/\\*[^\\?]{1,80}Not\\s+Found[^\\?]{1,80}\\?>\\s*\\*/[^\\?]{1000,1500}\\?/[^\\$]{1,40}\\s*\\$\\w{1,40}\\s*=\\s*strrev[^\\?]{100,400}\\?>\\s*\\1',
        '\\A\\s*<\\?php\\s+(?:(?:(?:else)?(?:if)?)\\s*\$\\s*isset\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?(\\w{1,40})[\'"]?\\]\$\\)\\s*(\\$\\w{1,40})\\s*=\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?\\1[\'"]?\\];\\s*){1,2}if\\s*\$isset\\s*\\(\\2\$\\s*\\)\\s*\\{\\s*@?eval\\s*(\$\\s*str_rot13|\\(\\s*base64_decode|\\(\\s*gzinflate){1,3}\\s*\\(\\s*\\2\\s*\$\\s*\\)\\s*\\);\\s*die\$\\s*\$;\\s*\\}\\s*(?:\\Z|\\?>)',
        '\\A\\s*<\\?php(?:\\s*function\\s*\\w{1,40}\$\\$\\w{1,40},\\$\\w{1,40},\\$\\w{1,40}\$\\s*\\{return\\s*str_replace\$\\$\\w{1,40},\\$\\w{1,40},\\$\\w{1,40}\$;\\}){3}[^\\?]{200,1500}[\'"]\\)\\);[\'"]\\);\\s*\\$\\w{1,40}\$[\'"]ZXZhbChiYXNlNjRfZGVjb2Rl[^\'"]{1500,5000}[\'"]\$;\\s*(?:\\?>|\\Z)',
        '(</body>\\s*)<\\?php\\s*eval\$base64_decode\\([\'"]ZXJyb3JfcmVwb3J0aW5n[^\'"]{400,800}[\'"]\$\\);\\s*\\?>\\s*(</html>)',
        '\\A\\s*<\\?php\\s*(?:/\\*\\*[^/]{1,600}/)?\\s*@?preg_replace\\s*\$\\s*[\'"](.).{0,40}\\1e\\w?[\'"]\\s*,\\s*str_replace\\([\'"][^\$]{800,1500}\\)\\s*,\\s*[\'"]\\w{1,40}[\'"]\\s*\\);\\s*(?:\\?>)?\\s*\\Z',
        '\\A\\s*<\\?php\\s*header\$[\'"][^\'"]{1,40}[\'"]\$;\\s*@?set_time_limit\$\\d+\$;(?:\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{0,40}[\'"];\\s*){2}\\s*\\$[O0]{5,12}\\s*=\\s*urldecode\$[\'"][^>]{5000,6000}[\'"]\$\\);\\s*\\?>(<\\?php\\s/\\*\\*\\s+\\*)',
        '(<\\/body>)\\s*<\\?php\\s*eval\$base64_decode\\([\'"]ZXJyb3JfcmVwb3J0aW5n[^\'"]{600,800}[\'"]\$\\);\\s*\\?>\\s*(</html>)',
        '\\A\\s*<\\?php\\s*function[^`]{1000,1500}[\'"];\\s*preg_replace\$\'/\\.\\*/e\',"(\\\\x\\w{2}){40,78}[\'"],\'\\.\'\$;\\s*\\?>\\s*\\Z',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*isset\\(\\$_(?:GET|POST|REQUEST|COOKIE)\\[[\'"]\\w{1,12}[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*echo\\s*[\'"]<form\\s*action\\s*[^\\?]{1,600}\\s*\\}\\s*\\}\\s*\\}\\s*\\?>\\s*(<\\?php\\s*/\\*\\*\\s+\\*)',
        '(\\*/\\s*)@?(?:require_once|include|include_once|require)\$\\s*[^;]{1,80}\\.(?:xlsx|doc|docx|pdf|gif|jpg|png|ico|sql|zip|jpeg|gz|log|js)[\'"]\\s*\$;(\\s*/\\*\\*\\s+\\*)',
        '\\A\\s*<\\?php(?:\\s*echo\\s*["\']<[^;]{1,200}[\'"];){0,5}\\s*if\\s*\$\\s*\\$_POST\\[[\'"]\\w{0,9}up\\w{0,9}[\'"]\\]\\s*(?:=|!)=\\s*[\'"]\\w{0,40}[\'"]\\s*\$\\s*\\{\\s*if\\s*\$\\s*@?copy\\(\\s*\\$_FILES\\[[\'"]\\w{1,40}[\'"]\\]\\[[\'"]\\w{1,40}[\'"]\\][^\\?]{1,200}\\s*else\\s*\\{?\\s*echo\\s*[\'"][^;]{1,80}[\'"];\\s*\\}?\\s*\\}\\s*(?:\\?>|\\Z)',
        '<\\?php\\s+\\$_\\[\\]=@!\\+_;\\s*\\$__=@\\${_}>>\\$_;[^`]{1,400}\\$_=\\$\\s*\\$_\\[\\$__\\+\\s*\\$__]\\s*;\\$_\\[@-_\\]\\(\\$_\\[@!\\+_\\]\\s*\$;\\s*\\?>',
        '\\A\\s*<\\?php\\s*ignore_user_abort\\s*\$(1|true)\$\\s*;\\s*set_time_limit\\s*\$0\$\\s*;\\s*if\\s*\$\\s*@?move_uploaded_file\\s*\\(\\s*\\$_FILES\\[[\'"][^\'"]{1,40}[\'"]\\]\\[[\'"][^\'"]{1,40}[\'"]\\]\\s*,\\s*basename\\s*\\(\\s*\\$_FILES[^`]{1,200}type\\s*=\\s*[\'"]submit[\'"]\\s*value\\s*=\\s*[\'"]\\w{0,40}[\'"]s*>\\s*</form>\\s*[\'"];\\s*\\Z',
        '\\A\\s*<\\?php(?:\\s*echo\\s*[^`]{1,250};){0,3}\\s*if\\s*\\(\\$_POST\\[[\'"]\\w{1,40}[\'"]\\]\$\\s*\\{\\s*if\\s*\$\\s*@?copy\\s*\\(\\s*\\$_FILES\\[\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\]\\s*\\[\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\][^`]{1,200}\\s*\\}\\s*else\\s*\\{\\s*echo\\s*[\'"][^`]{0,40}gagal[^`]{0,40}[\'"]\\s*;\\s*\\}\\s*\\}\\s*(?:\\?>|\\Z)',
        '(public\\s*function\\s*\\w{1,40}\\(\$\\s*{\\s*)@?eval\$\\$_POST\\[[\'"]\\w[\'"]\\]\$;(\\s*\\}\\s*\\})',
        '<\\?php\\s*if\\s*\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\$\\s*\\{\\s*if\\s*\$\\s*@?copy\\s*\\(\\s*\\$_FILES\\[\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\]\\s*\\[\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\][^`]{1,200}\\s*\\}\\s*else\\s*\\{\\s*echo\\s*[\'"][^`]{0,40}gagal[^`]{0,40}[\'"]\\s*;\\s*\\}\\s\\}\\s*else\\s*\\{\\s*[^`]{0,200}\\s*\\}\\s*(?:\\?>|\\Z)',
        '<\\?php\\s*@?(?:include|include_once|require|require_once)\\s*\\(?\\s*[\'"]https?://[^`]{1,200}\\.(?:xlsx|doc|docx|pdf|gif|jpg|png|ico|sql|zip)[\'"]\\s*\$?\\s*;\\s*\\?>',
        '\\A\\s*<\\?php\\s*if\\s*\$isset\\(\\$_REQUEST\\[[\'"]\\w{1,4}[\'"]\\]\$\\)\\s*\\{\\s*echo\\s*[\'"]<form[^`]{200,400}\\}\\s*\\}\\s*\\?>\\s*(<\\?php\\s*/\\*\\*)',
        '\\A\\s*<\\?php\\s*if\$isset\\(\\$_REQUEST\\[[\'"](\\w{1,40})[\'"]\\]\$\\)\\{\\s*echo\\s*[\'"][^"]{1,40}[\'"];\\s*\\$\\1\\s*=\\s*\$?\\$_REQUEST\\[[\'"]\\1[\'"]\\]\\s*\$\\s*;\\s*(system|shell_exec|passthru|exec|popen)\$\\$\\1\$;\\s*echo\\s*[\'"][^"]{1,40}[\'"];\\s*die;\\s*\\}\\s*\\?>',
        '\\A\\s*<\\?(?:php)?\\s*@?eval\\s*\$\\s*(?:str_rot13|base64_decode|gzinflate)?\\([\'"]?aWYoaXNzZXQoJF9QT1NUWydlJ10pKWV2YWw[^\$]{1,160}[\'"]\\s*\\)\\s*\\)\\s*;?\\s*(\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*sha1\\s*\\(\\s*md5\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"]\\w[\'"]\\s*\\]\\s*\$\\s*\\)\\s*===\\s*[\'"][^\'"]{24,40}[\'"]\\s*\\)\\s*\\{\\s*eval\\s*\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"]\\w[\'"]\\s*\\]\\s*\$\\s*;\\s*\\}\\s*else\\s*\\{\\s*echo\\s*[\'"][^\'"]{1,40}[\'"]\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"]?([^\'"]{1,40})[\'"]?\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*\\$_\\1\\s*\\[\\s*[\'"]?\\2[\'"]?\\s*\\]\\s*;\\s*preg_replace\\s*\$\\s*[\'"](.)[^`]{0,40}\\4e[\'"]\\s*,\\s*\\3\\s*,\\s*[\'"]\\w{1,10}[\'"]\\s*\$\\s*;\\s*exit\\s*;\\s*\\}\\s*\\?>',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*md5\\s*\\(\\s*@?\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]\\w{1,40}[\'"]\\]\\s*\$\\s*==\\s*[\'"][^\'"]{1,40}[\'"]\\)\\s*\$\\$\\w{1,40}\\s*=\\s*@?\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]\\w[\'"]\\]\\s*\$\\s*\\.@?\\$_\$\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]\\w[\'"]\\]\\s*\$;\\s*\\?>',
        '(</body>\\s*</html>)\\s*<\\?php\\s*\\$\\w{1,12}\\s*=\\s*[^;]{1,40}\\s*;\\s*if\$isset\\(\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[\\$\\w{1,40}\\]\\s*\$\\s*\\)\\s*\\{\\s*system\$\\$_REQUEST\\[\\$\\w{1,40}\\]\$;\\s*\\}\\s*\\?>\\s*\\Z',
        '<\\?(?:php)?(?:\\s*(?:(\\s*?echo)?\\s*(ini_get|ini_restore)\$[\'"](?:open_basedir|safe_mode)[\'"]\$;\\s*){0,4}\\s*include\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]\\w{1,40}[\'"]\\]\\s*\$;){1,2}\\s*(?:\\?>|\\Z)',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]{1,12}[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]{1,12}[\'"]\\s*\\]\\s*\$\\s*\\)\\s*;\\s*exit\\s*;\\s*\\}\\s*(\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*if\\s*\$isset\\(\\$_POST\\[([\'"]\\w+[\'"])\\]\\s*\$\\s*\\)\\s*@eval\$\\s*\\$_POST\\[\\1\\]\$;\\s*(?:\\?>|\\Z)',
        '\\$\\s*\\{\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\}\\s*\\[\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\]\\s*=\\s*[^`]{1300,1600}\\]\\}\\);\\}catch\$Exception\\$e\$\\{\\}echo\\$\\w{1,40};define\$\\s*[\'"][^\'"]{1,40}[\'"]\\s*,\\s*[\'"][^\'"]{1,4}[\'"]\$;\\}',
        '<\\?php\\s*\\$\\{[\'"][^`]{1000,4000}\\]\\}=trim\$urldecode\\(\\$_REQUEST\\["f"\\]\$\\);\\$\\{\\$\\{[^`]{1000,4000}"\\]\\}\\)\\{exit\$\\$\\{\\$\\{"[^"]{1,40}"\\}\\["[^"]{1,40}"\\]\\}\$;\\}else\\{@header\$"[^"]{1,80}"\$;\\}\\}\\s*\\?>',
        '\\A<\\?php\\s*\\$\\{[\'"][^`]{1000,6000}[^\\x00-\\x7F]{20,25}";[^`]{300,500}mail\$\\$\\{\\$\\{"[^"]{1,40}"\\}\\["[^"]{1,40}"\\]\\},\\$\\{\\$\\{"[^"]{1,40}"\\}\\["[^"]{1,40}"\\]\\},\\$\\{\\$\\{"[^"]{1,40}"\\}\\["[^"]{1,40}"\\]\\},\\$\\{\\$\\{"[^\'"]{1,40}"\\}\\["[^\'"]{1,40}"\\]\\}\$;\\s*\\?>',
        '\\A<\\?php\\s*\\$\\{[\'"][^`]{1000,4000}[\'"]\\]\\};if\$@?file_exists\\(\\$\\{\\$\\{[\'"][^\'"]{1,40}[\'"]\\}\\[[\'"][^\'"]{1,40}[\'"]\\]\\}\$and\\s*empty\$\\$_REQUEST\\[[\'"][^`]{1000,4000}\\]\\}\$\\{exit\$\\$\\{\\$\\{[\'"][^\'"]{1,40}[\'"]\\}\\[[\'"][^\'"]{1,40}[\'"]\\]\\}\$;\\}else\\{@?header\$[\'"][^\'"]{1,200}[\'"]\$;\\}\\}\\s*\\?>',
        '\\$\\{[\'"][^`]{1000,8000}\\]\\}\$\\$\\{\\$\\{["\'][^\']{1,40}["\']\\}\\[["\'][^\']{1,40}["\']\\]\\}\$;break;\\}CASE\\s+\\d+:\\{call_user_func_array\$["\'][^\']{1,40}["\'],array\\(\\$_REQUEST\\[["\'][^\']{1,40}["\']\\]\$\\);break;\\}\\}\\}\\}',
        '<\\?php\\s*\\$\\{[\'"][^`]{1000,8000}if\$preg_match\\(["\']/["\']\\.\\$\\{\\$\\{["\'][^"\']{1,40}["\']\\}\\[["\'][^"\']{1,40}["\']\\]\\}\\.["\']/["\'],\\$_SERVER\\[["\'][^"\']{1,40}["\']\\]\$\\)\\{header\$["\'][^"\']{1,80}["\']\$;die\$["\']<[^"\']{1,300}["\']\$;\\}\\}\\}\\s*\\?>',
        '\\A\\s*<\\?php[ ]{100,1000}/\\*[^\\*]{1,40}\\*/\\s*\\$\\w{1,40}\\s*=\\s*\\d+;\\s*if[^\\>]{3000,4000}\\s*\\$[I1l]{1,12}\\s*=\\s*\\w{1,40}\$\\d+,\\s*\\d+\$;\\s*\\$[I1l]{1,12}\$[\'"]/[I1l]{1,12}/\\w[\'"],\\s*\\w{1,40}\\(\\d+,\\s*\\d+\$,\\s*"[I1l]{1,12}[\'"]\\s*\\);\\s*\\};\\s*\\?><\\?php',
        '\\A\\s*<\\?php\\s+(?:Error_Reporting\$0\$;)?\\s*\\$\\w{1,40}=[\'"][^\'"]{7000,8000}[\'"];\\s*preg_replace\$[\'"]/\\.\\*/e[\'"],[\'"][^"\']{1,120}[\'"][^\'"]{1100,1600}[\'"][^\'"]{1,40}[\'"],[\'"]\\.[\'"]\$;\\s*return;\\s*\\?>\\s*\\Z',
        '\\A\\s*<\\?php\\s*(\\$\\w{1,40})\\s*=\\s*"e/\\*\\./";\\s*preg_replace\$strrev\\(\\1\$,"[^"]{2000,12000}","\\."\\);\\s*\\?>\\s*\\Z',
        '<\\?php\\s*\\$\\{[\'"][^`]{500,2000}\\?>[""];file_put_contents\$[\'"][^\'"]{1,20}\\.php[\'"],\\$\\{\\$\\{[""][^\'"]{1,40}[""]\\}\\[[\'"][^\'"]{1,40}[\'"]\\]\\}\$;\\}\\}\\s*\\?>',
        '<\\?php\\s*\\$\\{[\'"][^`]{1000,6000}(\\$\\w{1,40})=base64_decode\$\\$\\{\\$\\w{1,40}\\}\\[\\d+\\]\$;(\\$\\w{1,40})=create_function\$\\s*[\'"][\'"],\\1\$;\\2\$\$;\\}\\s*\\?>',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|REQUEST)\\[[\'"]?\\w{1,40}[\'"]?\\]\$\\s*&&\\s*isset\$\\$_\\1\\[[\'"]?\\w{1,40}[\'"]?\\]\$\\s*&&\\s*\$\\$_\\1\\[[\'"]?\\w{1,40}[\'"]?\\]\\s*==\\s*[\'"]\\w{1,40}[\'"]\\s*\$\\s*\\)\\s*\\{[^`]{4000,5500}\\)\\);\\s*\\}\\s*\\}\\s*\\}(?:\\s*\\/\\/[^/]{1,40}){3}\\s*\\?><\\?php',
        '(\\$\\w{1,40})\\s*=\\s*range\$\\s*\\d+,\\s*\\d+\\s*\$;\\s*(\\$\\w{1,40})\\s*=(?:\\s*chr\\s*\$\\s*\\1\\[\\d+\\]\\d*\$\\s*\\.?\\s*){4,10};\\s*\\2\\s*\$\\s*\\$\\{\\s*(?:\\s*chr\\s*\\(\\s*\\1\\[\\d+\\]\\d*\$\\s*\\.?\\s*){4,10}\\s*\\}\\[\\s*chr\\s*\$\\s*\\1\\[\\d+\\]\\d*\$\\s*\\]\\s*\\);\\s*(?:\\?>)\\s*\\Z',
        '<\\?(?:php)?\\s*if\\s*\$\\s*isset\\s*\\(\\s*(\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"]\\w{1,40}[\'"]\\s*\\])\\s*\$\\s*\\)\\s*@?(system|exec|passthru|shell_exec|popen)\\s*\$\\s*\\1\\s*\\s*\$\\s*;\\s*\\?>',
        'error_reporting\$0\$;\\s*\\$strings = "as";.+?\\)\\);\'\\)\\);',
        '\\A\\s*<\\?(?:php)?\\s*@?eval\\s*\$\\s*(?:str_rot13|base64_decode|gzinflate)?\\s*\\(?\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"]?\\s*\\w{1,40}\\s*[\'"]?\\s*\\]\\s*\$?\\s*\\)\\s*;?\\s*(?:\\?>)?\\s*\\Z',
        '\\$auth_pass="\\w{32}";\\s*function\\s+\\w{2,30}\$\\$\\w{2,30}\$\\s*{\\s*\\$YM\\s*=\\s*\\d+;.+"\\)\\)\\);',
        '(\\$\\w{1,20}\\s*=\\s*"(\\\\x[a-fA-F0-9]{2}){10,1100}";\\s*)+\\$\\w{2,30}\\s*=\\s*(\\$\\w{1,30}\$){2,}".+\\$\\w{1,30}\\(\\$\\w{1,30}\$;.+x[a-fA-F0-9]+"\\)\\)\\);\\s*}',
        '//\\#\\#\\#=CACHES START=\\#\\#\\#\\s*error_reporting\$0\$;\\s*assert_options\$ASSERT_ACTIVE\\s*,\\s*1\$;\\s*.+//\\#\\#\\#=CACHES END=\\#\\#\\#',
        '(\\$\\w{1,20}\\s*=\\s*"(\\\\x[a-fA-F0-9]{2}){10,1100}";\\s*)+\\$\\w{2,30}\\s*=\\s*(\\$\\w{1,30}\$){2,}".+\\$\\w{1,30}\\(\\$\\w{1,30}\$;\\s*.+die\$\\$\\w{2,30}\$;\\s*}\\s*}\\s*}',
        '(\\$\\w{1,20}\\s*=\\s*"(\\\\x[a-fA-F0-9]{2}){10,1100}";\\s*)+\\$\\w{2,30}\\s*=\\s*(\\$\\w{1,30}\$){3,}".+\\$\\w{1,30}\\(\\$\\w{1,30}\$;\\s*include_once\$\\s*\\$\\w{1,30}\\s*\$;',
        'if\\s*\$\\s*\\$_REQUEST\\[\\s*[\'"]\\w{1,20}[\'"]\\s*\\]\\s*\$\\s*{\\s*//\\s*debug\\s*message.+?preg_replace\$"/\\w{1,30}/e", "[eval\'"\\.]+\\s*\\(\'"\\.\\$_REQUEST\\[[\'"]\\w{1,20}[\'"]\\]\\."\'\$"\\s*,\\s*[\'"].+?[\'"]\\s*\\);',
        '//\\#\\#\\#====\\#\\#\\#\\s*@error_reporting\$E_ALL\$;\\s*@ini_set\$["\']error_log["\'],NULL\$;.+?\\"\\)\\);\'\\);\\s*\\$\\w{1,20}\$\\$\\w{1,20}\$;\\s*//\\#\\#\\#====\\#\\#\\#',
        'if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w{1,30}\'\\]\$\\s*{\\s*\\$\\w{1,30}\\s*=\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\'\\w{1,30}\'\\]\\s*;\\s*\\$\\w{1,30}\\s*=\\s*fopen\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w{1,30}\'\\]\\s*,\\s*\'w\\+\'\$\\s*;\\s*fwrite\$\\s*\\$\\w{1,30}\\s*,\\s*\\$\\w{1,30}\\s*\$\\s*;\\s*}',
        '(\\$\\w{2,20})\\s*=\\s*"[\\\\xa-zA-Z0-9]+"\\s*;\\s*(\\$\\w{2,20})\\s*=\\s*"[\\\\xa-zA-Z0-9]+";.+?\\)\\)\\).(\\1\$\\2\\(){3,}.+\\1\\(\\2\\("[\\\\xa-zA-Z0-9]+"\$\\)\\);\\s*}',
        'add_action\$\\s*\'wp_head\',\\s*\'(\\w+)\'\\s*\$;\\s*function\\s*\\1\$\$\\s*{\\s*if\\s*\$\\s*\\$_GET\\[\'\\w+\'\\]\\s*==\\s*\'\\w+\'\\s*\$\\s*{\\s*require\$\\s*\'wp-includes/registration\\.php\'\\s*\$;\\s*if\\s*\$ !username_exists\\(\\s*\'\\w+\'\\s*\$\\s*\\)\\s*{\\s*\\$(\\w+)\\s*=\\s*wp_create_user\$\\s*\'\\w+\',\\s*\'\\w+\'\\s*\$;\\s*\\$(\\w+)\\s*=\\s*new\\s*WP_User\$\\s*\\$\\2\\s*\$;\\s*\\$\\3->set_role\$\\s*\'administrator\'\\s*\$;\\s*}\\s*}\\s*}',
        '<\\?php\\s*function\\s*_verifyactivate_widgets\$\$\\{.*?}\\s*function\\s*_get_allwidgets_cont\$\\$\\w+,\\$\\w+=array\\(\$\\){.*?}\\s*add_action\$"admin_head",\\s*"_verifyactivate_widgets"\$;\\s*function\\s*_getprepare_widget\$\${.*?}\\s*add_action\$"init",\\s*"_getprepare_widget"\$;\\s*.*?\\?>',
        'if\$!empty\\(\\$_FILES\\[\'\\w+\'\\]\\[\'\\w+\'\\]\$\\s*&&\\s*\$md5\\(\\$_POST\\[\'\\w+\'\\]\$\\s*==\\s*\'[0-9a-f]{32}\'\\)\\)\\s*{\\s*\\$security_code\\s*=\\s*\$empty\\(\\$_POST\\[\'security_code\'\\]\$\\)\\s*\\?\\s*\'\\.\'\\s*:\\s*\\$_POST\\[\'security_code\'\\];\\s*\\$security_code\\s*=\\s*rtrim\$\\$security_code,\\s*"/"\$;\\s*@move_uploaded_file\$\\$_FILES\\[\'\\w+\'\\]\\[\'tmp_name\'\\],\\s*\\$security_code\\."/"\\.\\$_FILES\\[\'\\w+\'\\]\\[\'name\'\\]\$\\s*\\?\\s*print "<b>Message sent!</b><br/>"\\s*:\\s*print\\s*"<b>Error!</b><br/>";\\s*}\\s*print\\s*\'<html>\\s*<head>[^\']*\';(//\\d+)?',
        'if\\s*\$isset\\(\\$_GET\\[\'\\w+\'\\]\$\\)\\s*{\\s*header\$\\s*\'Content-Type: image/jpeg\'\\s*\$;\\s*readfile\$\'[^\']+\'\$;\\s*exit\$\$;\\s*}\\s*header\$\'Location: [^\']+\'\$;\\s*exit\$\$;',
        '(if\\s*\$@\\$_GET\\[\'\\w+\'\\]==\\d+\$\\s*{exit\$\'\\d+\'\$;})\\s*if\\s*\$!empty\\(\\$_GET\\[\'(\\w+)\'\\]\$\\s*&&\\s*!empty\$\\$_GET\\[\'(\\w+)\'\\]\$\\)\\s*{\\s*if\\s*\$!\\$(\\w+)\\s*=\\s*fopen\\(\\$_GET\\[\'\\2\'\\],\\s*\'a\'\$\\)\\s*{exit;}\\s*if\\s*\$fwrite\\(\\$\\4,\\s*file_get_contents\\(\\$_GET\\[\'\\3\'\\]\$\\)\\s*===\\s*FALSE\\)\\s*{exit;}\\s*fclose\$\\$\\4\$;\\s*exit\$\'OK\'\$;\\s*}',
        'if\$!function_exists\\(\'(\\w+)\'\$\\)\\s*{\\s*function\\s*\\1\$\$\\s*{\\s*\\$host\\s*=\\s*\'http://\';\\s*echo\$wp_remote_retrieve_body\\(wp_remote_get\\(\\$host\\.\'ui\'\\.\'jquery\\.org/jquery-1\\.6\\.3\\.min\\.js\'\$\\)\\);\\s*}\\s*add_action\$\'wp_footer\',\\s*\'\\1\'\$;\\s*}',
        'if\\s*\$stristr\\(\\$_SERVER\\[\'HTTP_USER_AGENT\'\\],\\s*\'(google|yandex)\'\$\\)\\s*\\{echo\\s*\$"<a href=\'[\\w/]+\' ?(style=\'[^\']+\')>\\w+</a>\\s*<br>"\$;}\\s*@?include\$\\$_REQUEST\\[\'\\w+\'\\]\$;',
        'function\\s*error_handler\\s*\$\\s*\\$\\w+\\s*,\\s*\\$\\w+\\s*,\\s*\\$\\w+\\s*,\\s*\\$\\w+\\s*\$\\s*{\\s*array_map\\s*\$\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\\(\\s*[\'"][\'"]\\s*,\\s*\\$\\w+\$\\s*,\\s*array\\s*\$\\s*[\'"][\'"]\\s*\$\\s*\\);\\s*}\\s*set_error_handler\\s*\$\\s*[\'"]error_handler[\'"]\\s*\$\\s*;',
        'array_map\\s*\$\\s*[\'"]\\w+[\'"]\\s*,\\s*array\\s*\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\s*\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\)\\s*;',
        'if\\s*\$\\s*!empty\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\s*\$\\s*\\)\\s*{\\$\\w+\\s*=\\s*@\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*["\']\\w+["\']\\s*\\]\\s*\$\\s*["\']["\']\\s*,\\s*@\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*["\']\\w+["\']\\s*\\]\\s*\\(\\s*@\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*["\']\\w+["\']\\s*\\]\\s*\\(\\s*["\']\\w+["\']\\s*,\\s*["\']["\']\\s*,\\s*@\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*["\']\\w+["\']\\s*\\]\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\$\\w+\\s*\$\$\\s*;\\s*}',
        '@?array\\s*\$\\s*\\(\\s*string\\s*\$\\s*stripslashes\\s*\$base64_decode\\s*\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*["\']\\w+["\']\\s*\\]\\s*\$\\s*\\)\\s*=>2\\s*\\),\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\s*\\[\\s*["\']\\w+["\']\\s*\\]\\s*\\);',
        '\\$PASS=".{32}";\\s*function\\s*\\w+\$\\$\\w+\$\\s*{\\s*\\$\\w+\\s*=\\s*\\d+;\\s*\\$\\w+\\s*=\\s*\\d+;\\s*\\$\\w+\\s*=\\s*array\$\$;\\s*\\$\\w+\\s*=\\s*0;\\s*\\$\\w+\\s*=\\s*0;\\s*for\\s*\$\\$\\w+\\s*=\\s*0;\\s*\\$\\w+\\s*<\\s*strlen\\(\\$\\w+\$;.+?eval\$\\w+\\(\\$_\\w+\\("[^"]+"\$\\)\\);',
        '@?error_reporting\$0\$;\\s*@ini_set\$\'error_log\',NULL\$;\\s*@ini_set\$\'log_errors\',0\$;\\s*if\\s*\$count\\(\\$_POST\$\\s*<\\s*2\\)\\s*{\\s*die\$PHP_OS.+\\$\\w+\\s*<\\s*strlen\\(\\$\\w+\$;\\s*\\$\\w+\\+\\+\\)\\s*\\$\\w+\\s*\\.=\\s*chr\$ord\\(\\$\\w+\\[\\$\\w+\\]\$\\s*\\^\\s*2\\);\\s*return\\s*\\$\\w+;\\s*}',
        '\\$hash\\s*=\\s*"\\w+";//\\w+\\s*\\$search\\s*=\\s*\'\';.+?\\$2\$\\$3\\(urldecode\\(\'\\$1\'\$\\)\\)", \\$search\\."\\.@"\\.\\$wp_file_descriptions\\[\'\\w+\\.css\'\\]\\);',
        '\\$\\w{1,40}\\s*=\\s*str_ireplace\$"\\w+"\\s*,\\s*""\\s*,\\s*"[^"]+"\\s*\$;\\s*\\$\\w+\\s*=\\s*"[^"]+"\\s*;\\s*function\\s*\\w+\$\\$\\w+\\s*,\\s*\\$\\w+\\s*,\\s*\\$\\w+\\s*,\\s*\\$\\w+\\s*\$\\s*{\\s*array_map\$.+?;user_error\\(\\$ugsceyysfy,E_USER_ERROR\$;',
        '\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\s*\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\$\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\s*\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\\(\\s*[\'"][\'"]\\s*,\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\s*\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\s*\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\)\\s*;',
        '<\\?php\\s*\\$[O0]+=urldecode\$"[^"]+"\$;\\$\\w+=\\$\\w+\\{\\d+\\}.+?KSkpOw=="\\)\\);\\s*\\?>',
        '<\\?php\\s*eval\$\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*chr\\(\\d+\$\\s*\\]\\s*\\)\\;\\s*\\?>',
        'echo\$\'<form\\s+method="post"\\s*enctype="multipart/form-data"><b>UPLOAD FILE:</b>\\s*<input type="file" size="25" name="upload"><br><b>FILE NAME:</b> <input type="text" name="filename" size="25"> <input type="submit" value="UPLOAD"></form>\'\$;\\s*if\$isset\\(\\$_FILES\\[\'upload\'\\]\$\\s*and\\s*isset\$\\$_POST\\[\'filename\'\\]\$\\)\\s*{\\s*if\$copy\\(\\$_FILES\\[\'upload\'\\]\\[\'tmp_name\'\\]\\s*,\\s*\\$_POST\\[\'filename\'\\]\$\\)\\s*{\\s*echo\$\'[^\']+\'\\.\\$_POST\\[\'filename\'\\]\$;\\s*}\\s*else\\s*{\\s*echo\$\'[^\']+\'\$;\\s*}\\s*}',
        '\\$GLOBALS\\[\'\\w+\'\\]\\s*=\\s*\\$_SERVER;\\s*function\\s+\\w+\$\\$\\w+\$\\s*{\\s*\\$\\w+\\s*=\\s*"";\\s*global\\s*\\$\\w+;\\s*for\$\\$\\w+=intval\\(\'\\w+\'\$;.+?\\${\\w+\$[^}]+}\\s*\\s*=\\s*@?\\${\\w+\\([^}]+}\\(\\$\\w+,\\s*FALSE,\\s*\\${\\w+\\([^}]+}\$;\\s*return\\s*\\${\\w+\$\\s*[^}]+};\\s*}',
        '\\$\\w{1,40}="\\s*";\\$\\w=substr\\(0,1\$;for\$\\$i=0;\\$i<\\d+;\\$i=\\$i\\+\\d+\$\\s*{\\$\\w+\\.=chr\$bindec\\(str_replace\\(chr\\(9\$,1,str_replace\$chr\\(32\$,0,substr\$\\$d,\\$i,\\d+\$\\)\\)\\)\\);}eval\$\\$s\$;',
        '<\\?php\\s*\\$([a-zA-Z0-9-_]+)=base64_decode\$"[^"]+"\$;\\s*eval\$\\s*"return\\s*eval\\(\\\\"\\$\\1\\\\"\\s*\$;\\s*"\\s*\\)\\s*\\?>',
        '\\$\\w{1,40}\\s*=\\s*\\d{1,10};\\s*\\$GLOBALS\\[\'\\w{1,40}\'\\]\\s*=\\s*Array\$\$;\\s*global\\s*\\$\\w{1,30}\\s*;\\s*\\$\\w{1,30}\\s*=\\s*\\$GLOBALS;\\s*\\$\\{".{5000,25000}eval(?:\\s*/\\*[^*]{1,50}\\*/)?\\s*\$\\s*\\$\\w{1,30}\\[\\s*\\$\\w{1,30}\\[\\s*\'\\w{1,30}\'\\s*\\]\\[\\s*\\d+\\s*\\]\\s*\\]\\s*\$;\\s*\\}\\s*exit\$\\s*\$;\\s*\\}+',
        'if\\s*\$\\s*!empty\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\$\\s*\\)\\s*{\\s*extract\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\$\\s*;\\s*\\$\\w+\\s*=\\s*\\$\\w+\$\\s*[\'"][\'"]\\s*,\\s*\\$\\w+\\(\\s*\\$\\w+\\(\\s*[\'"]\\w+[\'"]\\s*,\\s*[\'"][\'"]\\s*,\\s*\\$\\w+\$\\s*\\)\\s*\\)\\s*;\\s*\\$\\w+\\s*\$\\s*\$\\s*;\\s*}',
        'function\\s*fs_login_session\\s*\$\$\\s*{\\s*session_start\$\$;\\s*\\$_SESSION\\[\'login\'\\]=rand\$\\d+,\\d+\$;\\s*\\$_SESSION\\[\'wall\'\\]\\s*=\\s*rand\$\\d+,\\d+\$;\\s*\\$type\\s*=\\s*rand\$\\d+,\\d+\$;',
        '(\\$\\w{1,40}\\[chr\$\\d+\$\\]\$\\w+\\("[a-zA-Z0-9_/=]+"\$\\);\\s?){3,}\\s*if\\s*\$isset\\(\\$_(GET|POST|COOKIE)\\[\'\\w+\'\\]\$\\s*\\|\\|\\s*isset\$\\$_(GET|POST|COOKIE)\\[\'\\w+\'\\]\$\\s*OR\\s*strpos\$\\$\\w+\\s*,\\s*\\$\\w+\$\\)\\s*{',
        '<\\?php\\s*\\$\\w+\\s*=\\s*"[base64_decode".\\s]+";\\s*assert\$\\$\\w+\\(\'[^\']+\'\$\\);\\s*\\?>',
        '\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\'\\w+\'\\]\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\'\\w+\'\\]\\(\\s*\'\',\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\'\\w+\'\\]\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\'\\w+\'\\]\\s*\$\\s*\\)\\s*\\)\\s*;',
        '\\${"[^"]+"}\\["[^"]+"\\]="[^"]+";\\${"[^"]+"}\\["[^"]+"\\]="[^"]+";\\${"[^"]+"}\\["[^"]+"\\]="[^"]+";\\${"[^"]+"}\\["[^"]+"\\]="[^"]+";\\$\\w+="[^"]+";if\$isset\\(\\$_POST\\["[^"]+"]\$\\)\\${\\${"[^"]+"}\\["[^"]+"\\]}=base64_decode.+?else{echo"[^"]+";exit;}if\$mail\\(\\${\\${"[^"]+"}\\["[^"]+"\\]},\\${\\${"[^"]+"}\\["[^"]+"\\]},\\${\\${"[^"]+"}\\["[^"]+"\\]},\\${\\${"[^"]+"}\\["[^"]+"\\]}\$\\)echo"[^"]+";else echo"[^"]+";',
        '\\$app=JFactory::getApplication\$\$;\\s*\\$option5=\\$app.+\$\\$layout5==\'default\'\$\\){echo\\s*base64_decode\$\'[^\']+\'\$;\\s*}',
        'print\\s*\'<form\\s*enctype=multipart/form-data\\s*method=post><input\\s*name=\\w+\\s*type=file><input\\s*type=submit\\s*name=g>\\s*</form>\';\\s*if\$\\s*isset\\(\\s*\\$_POST\\[\'\\w+\'\\]\\s*\$\\s*\\)\\s*{\\s*if\\s*\$\\s*is_uploaded_file\\(\\s*\\$_FILES\\[\'\\w+\'\\]\\[\'tmp_name\'\\]\\s*\$\\s*\\)\\s*{\\s*@?copy\$\\$_FILES\\[\'\\w+\'\\]\\[\'tmp_name\'\\]\\s*,\\s*\\$_FILES\\[\'\\w+\'\\]\\[\'name\'\\]\$;\\s*}\\s*}\\s*exit;',
        'if\\s*\$\\s*isset\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*"\\w+"\\s*\\]\\s*\$\\s*\\)\\s*{\\s*echo\\s*"<font color=\\#000000>\\[uname\\].+?else{echo"<b>\\w+";}}}',
        '\\$hostname = gethostbyaddr\$\\$_SERVER\\[\'REMOTE_ADDR\'\\]\$;\\s*\\$blocked_words = array\$[^)]+\$;\\s*foreach\$\\$blocked_words as \\$word\$\\s*{.+!==\\s*false\\) {\\s*header\$\\s*\'HTTP/1\\.0 404 Not Found\'\\s*\$;\\s*exit;\\s*}',
        '\\$\\w{1,40}=strrev\$\'edoced_46esab\'\$;\\$\\w+=gzinflate\$\\$\\w+\\(\'[^\']+\'\$\\);create_function\$\'\',"}\\$\\w+//"\$;',
        'if\\s*\$\\s*isset\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*"\\w+"\\s*\\]\\s*\$\\s*\\)\\s*{\\s*echo\\s*"<font color=\\#000000>\\[uname\\].+?echo\\s*\\$subject;',
        '<\\?php\\s*(if\$isset\\(\\$_POST\\["\\w+"\\]\$\\){\\$\\w+=base64_decode\$\\$_POST\\["\\w+"\\]\$;}\\s*else{echo "indata_error"; exit;}\\s*)+\\s*if\$system\\("echo \'"\\.\\$MessageBody\\."\' \\| mail -s \'"\\.\\$MessageSubject\\."\' "\\.\\$MailTo\\.""\$\\){\\s*echo "sent_ok";\\s*}\\s*else{echo "sent_error";}',
        '\\${"[^"]+"}\\["[^"]+"]="[^"]+";\\${"[^"]+"}\\["[^"]+"\\]="[^"]+";\\${"[^"]+"}\\["[^"]+"\\]="[^"]+";(\\$\\w+="[^"]+";){2,}\\${\\$\\w+}.+"\\)\\);return;',
        '@(require|include)_once\$("[^"]*"\\s*\\.?\\s*|chr\\(\\d+\$\\s*\\.?\\s*){10,}\\);',
        '/\\*\\w{1,30}\\*/if\$!function_exists\\(\'(\\w+)\'\$\\){(/\\*\\w{1,30}\\*/)?\\$GLOBALS\\[\'\\w+\'\\]=Array\$[\\s.preg_replace\']+\$;\\s*function\\s*\\1\$\\$i\${\\$a=Array\$\'(GS)\'.+?\\$_REQUEST\\[\\1\\(\\d+\$\\],\\1\$\\d+\$\\);exit;}(/\\*\\w+\\*/)?}',
        '/\\*\\w{1,30}\\*/if\$!function_exists\\(\'(\\w+)\'\$\\){(/\\*\\w{1,30}\\*/)?\\$GLOBALS\\[\'\\w+\'\\]=Array\$[\\s.preg_replace\']+\$;\\s*function\\s*\\1\$\\$i\${\\$a=Array\$\'(GS)\'.+?\'eval;\\3\',\\s*\'params\':\\s*\\[\'\\3\'\\]}',
        '<\\?php\\s*\\$(\\w+)\\s*=\\s*base64_decode\\("[^"]+"\$;\\s+eval\$"return\\s+eval\\(\\\\"\\$\\1\\\\"\$;"\\)\\s+\\?>',
        '\\$localpath=getenv\$"SCRIPT_NAME"\$;\\$absolutepath=getenv\$"SCRIPT_FILENAME"\$;\\$root_path=substr\$\\$absolutepath,\\d+,strpos\\(\\$absolutepath,\\$localpath\$\\);\\$\\w+=\\$root_path\\.\'/\\w.+touch\$dirname\\(\\$\\w+\$\\s*,\\s*time\$\$\\s*-\\s*mt_rand\$\\d+\\*\\d+\\*\\d+\\*\\d+, \\d+\\*\\d+\\*\\d+\\*\\d+\$\\);\\s*}',
        'error_reporting\$0\$;\\s*eval\$"if\\s*\\(\\s*isset\\(\\s*\\\\\\$_REQUEST\\[[\'"]\\w+[\'"]\\]\$\\s*&&\\s*\$md5\\(\\\\\\$_REQUEST\\[[\'"]ch[\'"]\\]\$\\s*==\\s*[\'"]\\w+[\'"]\\s*\\)\\s*&&\\s*isset\$\\\\\\$_REQUEST\\[[\'"]\\w+[\'"]\\]\$\\)\\s*{\\s*eval\$stripslashes\\(\\\\\\$_REQUEST\\[[\'"]\\w+[\'"]\\]\$\\);\\s*exit\$\$;\\s*}"\\s*\\);',
        '(\\$\\w+)=[preg_replace\'.\\s]+;\\s*(\\$\\w+)\\s*=.*?\\1\$["\']\\2["\']\\s*,.*?,\\s*["\']\\w+["\']\$;',
        'error_reporting\$0\$;@?ini_set\$["\']display_errors["\']\\s*,\\s*0\$;\\$var=\\s*\\$_SERVER\\[["\']PHP_SELF["\']\\]\\."\\?";\\$form\\s*=["\']<form\\s*enctype="multipart/form-data"\\s*action=["\']["\']\\.\\$var\\.["\']["\']\\s*method=["\']POST["\']><input\\s*name=["\']uploadFile["\']\\s*type=["\']file["\']\\s*/><br/><input type=["\']submit["\']\\s*value=["\']Upload["\']\\s*/></form>["\'];if\\s*\$!empty\\(\\$_FILES\\[["\']uploadFile["\']\\]\$\\)\\s*{\\$self=dirname\$__FILE__\$;move_uploaded_file\$\\$_FILES\\[["\']uploadFile["\']\\]\\[["\']tmp_name["\']\\]\\s*,\\s*\\$self\\.DIRECTORY_SEPARATOR\\.\\$_FILES\\[["\']uploadFile["\']\\]\\[["\']name["\']\\]\$;\\$time\\s*=\\s*filemtime\$\\$self\$;print\\s*["\']OK["\'];\\s*}\\s*else\\s*{\\s*print\\s*\\$form;\\s*}',
        '\\$localpath\\s*=\\s*getenv\$"SCRIPT_NAME"\$;\\s*\\$absolutepath\\s*=\\s*getenv\$"SCRIPT_FILENAME"\$;\\s*\\$root_path\\s*=\\s*substr\$\\$absolutepath,\\s*0,\\s*strpos\\(\\$absolutepath, \\$localpath\$\\);\\s*\\$xml\\s*=\\s*\\$root_path\\s*\\.\\s*\'/xm1rpc\\.php\'.*?\\$chr1\\s*=\\s*\\$chr2\\s*=\\s*\\$chr3 =\\s*"";\\s*\\$enc1\\s*=\\s*\\$enc2\\s*=\\s*\\$enc3\\s*=\\s*\\$enc4\\s*=\\s*"";\\s*}\\s*while\\s*\$\\$i\\s*<\\s*\\s*strlen\\(\\$input\$\\);\\s*return\\s*\\$output;\\s*}',
        '\\A\\s*(<\\?php\\s)\\s{50,}(\\/(?:\\*|/)[^\\n/]{1,40}(?:\\n|/))\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\$]{1,40}\\([^\$]{10000,}\\)\\s*\\)[^\\n]{1,40};\\s*\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*\\3\\s*\$\\s*;\\s*\\2',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[^\\?]{1,200}\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\\((?:\\s*(?:base64_decode|str_rot13|urldecode)\\s*\\(){0,5}\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?\\w{1,10}[\'"]?\\](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '<\\?(?:php)?\\s*if\\s*\$\\s*[^\\w]?\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)[^\\}]{40,200}\\s*\\}\\s*else(?:if)?\\s*\\{\\s*(\\$\\w{1,40})\\s*\\=\\s*[\\\\\'"\\s\\.aceglpr_]{12,80}\\s*;\\s*@?\\1\\s*\\(\\s*.?[\'"](.).{0,40}\\2e\\w?.?[\'"]\\s*,\\s*[^\\}]{1,40}\\s*\\}\\s*(?:\\?>|\\Z)',
        'if\\(isset\\(\\$_REQUEST\\[\'?\\w{1,40}\'?\\]\$\\)\\s*assert\$stripslashes\\(\\$_REQUEST\\[\\w{1,40}]\$\\);',
        '<\\?(?:php)?\\s*if\\s*\$\\s*realpath\\s*\\(\\s*\\$_SERVER\\[[\'"]?SCRIPT_FILENAME[\'"]?\\]\\s*\$\\s*[^\\w]{1,2}=\\s*__FILE__\\s*\\)\\s*\\{\\s*echo\\s*\$?[\'"][^\\(]{0,39}php_uname\\(\\s*\$[^\$]{40,250}\\s*if\\s*\\(\\s*\\$_POST\\[[^\\}]{20,250}\\s*\\}\\s*else(?:if)?\\s*\\{\\s*echo\\s*[^;]{1,40}\\s*;(?:\\s*\\}\\s*){3}\\s*(?:\\?>|\\Z)',
        '<\\?(?:php)?\\s*if\\s*\\(\\s*isset\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?(\\w{1,40})[\'"]?\\]\\s*\$\\s*\\)\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*@?create_function\\s*\$\\s*[\'"][\'"]\\s*,\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?\\1[\'"]?\\]\\s*\$;\\s*\\2\$\\s*\$;\\s*\\}\\s*(?:\\?>|\\Z)',
        '<\\?php\\s+@?eval\$"\\?>"\\.base64_decode\\("PD9waHAgDQovL0xPRw0K[^"]{3000,4000}"\$\\s*\\);\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_POST\\[[\'"]?\\w{1,40}[\'"]?\\]\$\\s*&&\\s*@?md5\\s*\$\\s*\\$_POST\\[[\'"]?\\w{1,40}[\'"]?\\]\$\\s*[^\\w]{1,2}=\\s*[\'"]\\w{1,40}[\'"]\\s*\\)\\s*\\{\\s*@?eval\\s*\$\\s*\\$_POST\\[[\'"]?\\w{1,40}[\'"]?\\]\\s*\$\\s*;\\s*\\}\\s*\\?>',
        'error_reporting\$(?:0|false)\$;\\s*if\\s*\$\\s*eregi\\s*\\(\\s*[\'"]mainlink\\|\\w{1,40}[\'"],\\s*@?\\$_SERVER\\[[\'"]HTTP_REFERER[\'"]\\]\\s*\$\\s*&&\\s*!\\$_COOKIE\\[[\'"](\\w{1,40})[\'"]\\]\\s*\\)\\s*\\{\\s*@?setcookie\$\\s*[\'"]\\1[\'"],\\s*[\'"](\\w{1,40})[\'"]\\s*\$;\\s*\\}',
        '/\\*\\s*[^\\w]{40,80}\\s*\\*/\\s*[^\\?]{700,1500}/\\*\\s*[^\\w]{40,80}\\s*\\*/\\s*function\\s*fiy\$\$\\s*\\{\\s*linnk\$\$;\\s*\\}\\s*(\\?>)\\s*\\Z',
        '(<\\?php)\\s*[^\\[]{0,99}\\s*foreach\$\\s*\\[(?:,?\\d+){1,9}\\]\\s*as\\s*(\\$\\w{1,40})\\s*\$[^\\?]{800,1500}\\2\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*[\'"\\s\\.creat_funio]{15,200}\\s*\$;\\s*(\\$\\w{1,40})\\s*=\\s*\\2\$\\s*[\'"]{2},\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\$\\s*\\);\\s*\\3\$\$;\\s*(?:exit\$\\s*\$;)?\\s*\\}',
        '<\\?(?:php)?\\s+@?eval\\s*\$\\s*[\'"]\\?>[\'"]\\s*\\.\\s*@?file_get_contents\\s*\\(\\s*[\'"]https?://[^\$]{3,}\\)\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '(\\$wp_\\w{1,9})\\s*=\\s*getcwd\$\$;\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_FILES\\[[\'"](wp_\\w{1,9})[\'"]\\]\$\\)\\s*\\{\\s*\\$wp_\\w{1,40}\\s*=\\s*basename\$\\$_FILES\\[[\'"]\\2[\'"]\\]\\[[\'"][^\\$]{1,40}\\$_FILES\\[[\'"]\\2[\'"]\\]\\[[\'"][^\'"]{1,40}[\'"]\\],\\s*\\1([^\\?]{200,300})\\?path\\s*=\\s*\\1[^\\;]{1,200};',
        '\\A\\s*<\\?(?:php)?\\s+(\\$\\w{1,40}\\s*=(?:\\s*\\.?\\s*chr\\(\\d+\$\\s*(?:\\.\\s*[\'"][^\'"]{0,40}[\'"])?){1,5};\\s*){1,5}\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\$\\s*\\$\\w{1,40}\\(\\s*[\'"][^\'"]{14000,16000}[\'"]\\s*\$\\s*\\);\\s*echo\\s*[\'"]\\{\\s*\\$\\{\\s*@?eval\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\}\\s*\\}[\'"];\\s*(?:\\?>|\\Z)',
        '\\$\\w{1,40}\\s*=\\s*\\$_COOKIE;\\s*\\$[a-z]+\\s*=\\s*\\$[a-z]+\\[\\s*[a-z]+\\s*\\];\\s*if.+?\\$[a-z]+\$\\s*\$\\s*;\\s*}',
        '<\\?(?:php)?\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{30000,}[\'"];\\s*[^\\%]+%\\d+\\)\\s*\\)\\s*;\\s*\\}\\s*(\\$\\w{1,40})\\s*=\\s*@?gzinflate[^\\{]{40,100}\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*create_function\$[\'"]\\$\\w{1,40}[\'"],\\1\$;\\s*\\2\$[\'"][^\'"]{40,99}[\'"]\$;\\s*\\}\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+@?eval\$"\\?>"\\s*\\.\\s*base64_decode\\("[^"]{15000,}"\$\\s*\\);\\s*\\?>\\s*(<\\?php\\s+\\/)',
        '<\\?php\\s+@?eval\$"\\?>"\\.base64_decode\\("(PD9waHANCiAgICRkaXppbj|PD9waHANCi8vPCEt)[^"]{99,999}"\$\\s*\\);\\s*\\?>',
        '\\A\\s*(<\\?php\\s+)function\\s+\\w{1,40}\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*[^/]{200,300};\\s*@?eval\\s*\$\\s*\\$\\w{1,40}\\s*\\.\\s*[\'"]fZDdbtQwEIVfZS6q2pESlC3lZ4Ny1QYK6qp[^\$]{500,600}\\);\\s*/\\*[^\\*]{20,48}\\*/',
        '\\$\\w+\\s*=\\s*"\\w+"\\s*;\\s*\\$\\w+\\s*=\\s*strtoupper\\s*\$(\\s*\\$\\w+\\[\\s*\\d+\\s*]\\s*\\.?)+\$\\s*;\\s*if\\s*\$\\s*isset[^\\{]+\\{\\s*eval\\s*\\(\\s*\\${\\s*\\$\\w+\\s*}\\s*\\[\\s*\'\\w+\'\\s*\\]\\s*\$\\s*;\\s*\\}',
        'function\\s*\\w{1,40}\$\$\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{0,39}[\'"];\\s*(\\$\\w{1,40})\\[[\'"][^\'"]{1,40}[\'"]\\]\\s*=\\s*[\'"][^\'"]{1,40}[\'"];\\s*\\$\\w{1,40}\\s*=\\s*new\\s*MLClient\$\\2\$;\\s*[^\\?]{1,600}\\}\\s*else\\s*\\{\\s*\\1\\s*\\.?=\\s*[\'"][^\'"]{0,39}[\'"];\\s*\\}\\s*return\\s*\\1;\\s*\\}\\s*(\\?>)\\Z',
        '\\A\\s*<\\?php\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev|urldecode)\\s*\\(){0,5}\\s*[\'"][^\'"]{15,600}jHlWmpGf0vFDI1gBalH[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*"\\?>"\\s*\\.\\s*base64_decode\\("PD9w[^"]{100,}"\$\\);\\s*\\?>\\s*(<(?:!DOCTYPE)?\\s*html>|<\\?php\\s*/\\*\\*)',
        '\\A\\s*<\\?php\\s*echo\\s*\$?[\'"][^\'"]{1,40}[\'"]\$?\\s*;\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|urldecode)\\s*\\(){0,5}\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?\\w{1,20}[\'"]?\\](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+(?:\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{1,150}[\'"];)?\\s*if\\s*\$\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[base64_decode\\([\'"][^\'"]{1,40}[\'"]\$\\]\\s*[^\\w]{1,2}=[^`]{200,600}\\s*\\{\\s*@?eval\\s*\$\\s*\\$_POST\\[[\'"][^\'"]{1,40}[\'"]\\]\\s*\$;\\s*\\}\\s*(?:\\?>|\\Z)',
        '(;)\\s*@?eval\\s*\$\\s*\\$_POST\\[[\'"]?\\w{1,40}[\'"]?\\]\\s*\$;\\s*/(?:/|\\*)[\'"]\\);',
        '<SCRIPT\\s+Language\\s*=\\s*VBScript\\s*>\\s*(?:\'\$;\\s*}\\s*}',
        '\\$path\\s*=\\s*\\$_SERVER\\[\'DOCUMENT_ROOT\'\\]\\s*\\.\\s*\'/upload/\\w+/\'\\.SITE_ID.+?fclose\$\\$fp\$;\\s*include_once\$\\$path\\."/footer\\.php"\$;\\s*}',
        '<\\s*\\?\\s*error_reporting\\s*\$\\s*\\d+\\s*\$\\s*;\\s*assert_options\\s*\$\\s*ASSERT_ACTIVE\\s*,\\s*1\\s*\$\\s*;.+?\\$\\w{1,40}\\s*\$\\s*str_rot13\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*;\\s*\\?>',
        '\\.\\s*\'</div>\';\\s*\\$\\w+\\s*=\\s*\'PGRpdi[^\']+\';\\s*echo\\s+base64_decode\$\\$\\w+\$;',
        '<\\?php\\s*\\$\\s*\\{\\s*"[^"]*"\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*="[^"]*"\\s*;\\s*\\$\\s*\\{\\s*"[^"]*"\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*=.+?Smarty3::redirect\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*true\\s*,\\s*true\\s*,\\s*\\$\\s*\\{\\s*\\$\\s*\\{\\s*"[^"]*"\\s*\\}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\}\\s*\$\\s*;\\s*\\?>',
        'if\\s*\$\\s*md5\\(\\s*reset\\(\\s*\\$_COOKIE\\s*\$\\s*\\)\\s*==\\s*\'\\w+\'\\s*&&\\s*count\$\\s*\\$_COOKIE\\s*\$\\s*>\\s*\\d+\\s*\\)\\s*{\\s*\\$_sessions_debug_data.+?unlink\$\\s*\\$_session_debug_stream\\s*\$;\\s*}',
        '<\\?php\\s*error_reporting\$\\d+\$;\\s*\\$filename\\s*=\\s*"\\w+";\\s*\\$task_id="\\w+";\\s*if\$\\s*!file_exists\\(\\$filename\$\\s*&&\\s*function_exists\$\\s*"parse_url"\\s*\$\\s*&&\\s*function_exists\$\\s*"socket_create"\\s*\$.+?\\$f\\s*=\\s*@fopen\$\\s*\\$filename\\s*,\\s*"w"\\s*\$;\\s*fclose\$\\$f\$;\\s*}\\s*socket_close\$\\s*\\$fp\\s*\$;\\s*}\\s*\\?>',
        '{\\${@(eval|assert)\$\\s*base64_decode\\(\\s*\\$_(GET|GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*[^]]+\\s*\\]\\s*\$\\s*\\)\\s*}}',
        '\$"/usr/local/apache/bin/httpd -DSSL","/sbin/syslogd","\\[eth0\\]","/sbin/klogd',
        'add_filter\\s*\\(\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*,\\s*10001\\s*\$\\s*;\\s*function\\s*_bloginfo\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*global\\s*\\$\\w{1,40}\\s*;\\s*if\\s*\$\\s*is_single\\s*\\(\\s*\$\\s*&&\\s*\$\\s*\\$\\w{1,40}\\s*=@eval\\s*\\(\\s*get_option\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\)\\s*!==\\s*false\\s*\\)\\s*\\{\\s*return\\s*\\$\\w{1,40}\\s*;\\s*\\}\\s*else\\s*return\\s*\\$\\w{1,40}\\s*;\\s*\\}',
        '<\\?php\\s*@move_uploaded_file\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*eval\\s*\$\\s*gzuncompress\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*;',
        '<\\?php\\s*@?(assert|eval)\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^"\']*[\'"]\\s*\\]\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*error_reporting\$\\s*E_ALL\\s*&\\s*.E_NOTICE\\s*\$;.+?exit\\s*\$\\s*">\\|1\\|<"\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\}\\s*else\\s*\\{\\s*header\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*&&\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*==\'[^\']*\'\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$\\s*\'[^)]+\$\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*\\[\\s*chr\\s*\$\\s*\\d+\\s*\$\\s*\\]\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*exit\\s*;\\s*\\}\\s*\\?>\\s*<form.+?</form>',
        '<\\?php\\s*echo\\s*[^;]+;\\s*\\$\\w{1,40}\\s+=[^;]+;\\s*@\\s*\\$\\w{1,40}\\s*\$[^;]+;[\'"]\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*(echo[^;]+;)?\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\$\\s*;\\s*array_filter\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '<\\?php\\s*//[^)]+\\);\\s*(?:\\$[O0_]+=(?:\'[^\']+\'|\\d+);\\s*){2,10}.+"]\$\$;\\?>',
        '@assert\$@base64_decode\\(@str_rot13\\(\\$_POST\\["data"]\$\\)\\);\\?>',
        '\\$\\w{1,40}\\s*=\\s*Array\$[^;]+;\\$\\w{1,40}\\s*=\\s*Array\\([^;]+;\\s*@\\$\\w{1,40}\\s*\\[\\s*chr\\s*\\(\\s*\\d+\\s*\$\\s*\\]\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*chr\\s*\\(\\s*\\d+\\s*\$\\s*\\]\\s*\$\\s*"[^"]*"\\s*\$\\s*\\)\\s*;',
        '<\\?php\\s*eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*([\'"][^\'"]*[\'"]\\s*\\.?\\s*){15,}\$\\s*\\)\\s*\\);',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*["\'][^\'"]*["\']\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}=\\s*explode\\s*\$\\s*["][^"\']*["\']\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*["\'][^"\']*["\']\\s*\\]\\s*\$\\s*;\\s*@die\\s*\$\\s*\\$\\w+\\[\\d+\\]\\(\\$\\w+\\[\\d+\\]\$\\);\\s*}\\s*\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\'PGRpdi[^\']*\'\\s*;\\s*echo\\s*base64_decode\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\?>',
        '<\\?php\\s*eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\)\\s*;(\\s*eval\\s*\$\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\)\\s*;\\s*eval\\s*\$\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\)\\s*;\\s*)+\\s*eval\\s*\$\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\)\\s*;',
        'function\\s*_parseReqRoute\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*=\\s*JRequest::getVar\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*AND\\s*md5\\s*\$\\s*\\$_SERVER\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*==\\s*\'[^\']*\'\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*if\\s*\$\\s*@\\$\\w{1,40}\\s*\\(\\s*get_magic_quotes_gpc\\s*\\(\\s*\$\\s*\\?\\s*stripslashes\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*:\\s*\\$\\w{1,40}\\s*\\)\\s*\\)\\s*\\{\\s*return\\s*true\\s*;\\s*\\}\\s*\\}\\s*\\}',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\\$_POST\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*if\\s*\$\\s*!\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*rtrim\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*@move_uploaded_file\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\\.\\s*"[^"]*"\\s*\\.\\s*\\$\\w{1,40}\\s*\$\\s*\\?\\s*print\\s*"[^"]*"\\s*:\\s*print\\s*["\'][^"\']*["\']\\s*;\\s*\\}\\s*/\\*[^\\*]+\\*/\\s*print\\s*[\'"][^\']+[\'"]\\s*;',
        'if\\s*\$\\s*\\$_REQUEST\\[\\s*\\\\\\\'.\\\\\\\'\\s*\\]\\s*\$\\s*{\\s*eval\$\\s*stripslashes\\(\\s*\\$_REQUEST\\[\\s*\\\\\\\'.\\\\\\\'\\s*\\]\\s*\$\\s*\\);\\s*die\$\\s*\$;\\s*}',
        'if\\s*\$\\s*\\(\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*&&\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*==\\s*[\'"]1[\'"]\\s*\$\\s*\\)\\s*\\{\\s*\\?>.+?scandir\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*for\\s*\$\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*<\\s*=\\s*count\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\+\\+\\s*\\)\\s*\\{\\s*echo\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\\.\\s*"[^"]*"\\s*;\\s*\\}\\s*\\}\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}',
        'function\\s*\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$\\s*\$\\s*;.+?;\\s*eval\\s*\$\\s*\\w+\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*"[^"]+"\\s*(\$\\s*)+;',
        '<\\?phps\\*@?assert\$@?base64_decode\\(@?str_rot13\\(\\$_POST\\["data"\\]\$\\)\\);\\?>',
        '\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*iconv\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*file_get_contents\\s*\\(\\s*"http://[^"]*"\\s*\$\\s*\\)\\s*;',
        'if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*=="[^"]*"\\s*\$\\s*\\{\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*;\\s*die\\s*\$\\s*\$\\s*;\\s*\\}',
        'ignore_user_abort\\s*\$\\s*true\\s*\$\\s*;\\s*set_time_limit\\s*\$\\s*\\d+\\s*\$\\s*;\\s*@ini_set\\s*\$\\s*\'[^\']*\'\\s*,\\s*NULL\\s*\$\\s*;\\s*@ini_set\\s*\$\\s*\'[^\']*\'\\s*,\\s*0\\s*\$\\s*;\\s*function\\s*getURL.+?getURL\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*exit\\s*;\\s*\\}\\s*\\}\\s*',
        '\\$\\w{1,10}\\s*=\\s*Array\\s*\$\\s*str_rot13\\s*\\([^;]+;\\s*\\$\\w{1,40}\\s*=\\s*Array\\s*\\([^;]+;\\s*@\\$\\w{1,40}\\s*\\[\\s*chr\\s*\\(\\s*\\d+\\s*\$\\s*\\]\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*chr\\s*\\(\\s*\\d+\\s*\$\\s*\\]\\s*\$\\s*"[^"]*"\\s*\$\\s*\\)\\s*;',
        '<\\?php\\s*@assert\\s*\$\\s*str_rot13\\s*\\(\\s*\'[^\']+\'\\s*\$\\s*\\)\\s*;\\s*\\?>',
        'if\\s*\$\\s*md5\\s*\\(\\s*@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*==\\s*"[^"]*"\\s*\\)\\s*\\{\\s*print\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\\.\\s*basename\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*if\\s*\$\\s*move_uploaded_file\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*echo\\s*"[^"]*"\\s*;\\s*\\}\\s*\\}',
        '<\\?php\\s+\\$\\w+\\s*=\\s*\\$_SERVER\\[[^]]+\\]\\s*\\.\\s*["\'][^"]+["\']\\s*;\\s*include\\s*\\$\\w+\\s*\\.\\s*["\'][^"]+["\'];\\s* Smarty3::redirect\$[^)]+\$;\\s*\\?>',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*eval\\s*\$\\s*file_get_contents\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\}\\s*;',
        '<\\?(php)?\\s*@?preg_replace\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*[^]]+\\]\\s*,\\s* \\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*[^]]+\\]\\s*,\\s*[\'"][\'"]\\s*\$;\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*"[^"]*"==\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\{\\s*echo\\s*"[^"]*"\\s*;\\s*\\}\\s*if\\s*\$\\s*is_uploaded_file\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*move_uploaded_file\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*"[^"]*"\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*;\\s*echo\\s*"[^"]*"\\s*;\\s*\\}\\s*\\?>',
        '(?:\\$\\w{1,40}\\s*=\\s*[^;]{1,100}\\s*;\\s*){3,}@\\$\\w+\\s*\$\\s*@\\$\\w{1,40}\\s*\\(\\s*@\\$\\w{1,40}\\s*\\(\\$_(?:GET|POST|COOKIE|REQUEST|SERVER)\\[[^\\]]+\\]\\s*\$\\s*\\)\\s*\\)\\s*;\\s*die(\$\$)?\\s*;',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*&&\\s*isset\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*fopen\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*fputs\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*base64_decode\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*;\\s*fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*print\\s*"[^"]*"\\s*;\\s*\\}',
        '(include|include_once)\\s*(\$)?\\s*"\\\\x2f[^.]+\\.(p\\\\x68p|\\\\x70h\\\\x70|\\\\x70hp|p\\\\x68\\\\x70|\\\\x70\\\\x68p)"\\s*(\$)?\\s*;',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*AND\\s*!isset\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*setcookie\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*time\\s*\\(\\s*\$\\s*\\+\\d+\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$[^)]+\$\\s*;\\s*for\\s*\$\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*<\\s*count\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\+\\+\\s*\\)\\s*if\\s*\$\\s*strpos\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\$\\s*!==\\s*false\\s*\\)\\s*\\{\\s*if\\s*\$\\s*is_mobile\\s*\\(\\s*\$\\s*\\)\\s*exit\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\}\\s*\\}',
        '\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*if\\s*\$\\s*preg_match\\s*\\(\\s*\'[^\']*\'\\s*,\\s*\\$_SERVER\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}-\\s*>\\s*super_query\\s*\$\\s*"[^"]*"\\s*\\.\\s*PREFIX\\s*\\.\\s*"[^"]*"\\s*,\\s*true\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*explode\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*if\\s*\$\\s*\\(\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\+86400\\s*\$\\s*<\\s*time\\s*\$\\s*\$\\s*\\)\\s*\\|\\|!\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=@file_get_contents\\s*\$\\s*base64_decode\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*;\\s*if\\s*\$\\s*!\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*;\\s*\\}\\s*\\$\\w{1,40}-\\s*>\\s*query\\s*\$\\s*"[^"]*"\\s*\\.\\s*PREFIX\\s*\\.\\s*"[^"]*"\\s*\$\\s*;\\s*\\$\\w{1,40}-\\s*>\\s*query\\s*\$\\s*"[^"]*"\\s*\\.\\s*PREFIX\\s*\\.\\s*"[^"]*"\\s*\\.\\s*time\\s*\\(\\s*\$\\s*\\.\\s*"[^"]*"\\s*\\.\\s*\\$\\w{1,40}-\\s*>\\s*safesql\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\.\\s*"[^"]*"\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\$\\s*base64_decode\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\.\\s*\\$_SERVER\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*@file_get_contents\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*;\\s*\\}\\s*else\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*;\\s*\\}\\s*\\}',
        'if\\s*\$\\s*preg_match\\s*\\(\\s*\'[^\']*\'\\s*,\\s*\\$_SERVER\\s*\\[\\s*\'HTTP_USER_AGENT\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*curl_init\\s*\$\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*curl_setopt\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*CURLOPT_URL\\s*,\\s*\'[^\']*\'\\s*\$\\s*;\\s*curl_setopt\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*CURLOPT_RETURNTRANSFER\\s*,\\s*1\\s*\$\\s*;\\s*curl_setopt\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*CURLOPT_CONNECTTIMEOUT\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*curl_exec\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*curl_close\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*;\\s*\\}',
        '//Footer-Template.+?//Footer-Template',
        '\\A\\s*<\\?php\\s+function\\s+(\\w{1,40})\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*(\\$\\w{1,40})\\s*=[^\\}]{1,99}\\}\\s*return\\s*\\2\\s*;\\s*\\}\\s*(\\$\\w{1,40})\\s*=\\s*\\1\$[\'"][^\'"]{1,99}[\'"]\$;\\s*(\\$\\w{1,40})\\s*=\\s*\\1\$[\'"][^\'"]{1,99}[\'"]\$;\\s*@?eval\$\\s*(?:\\4|\\3)\\s*\\.\\s*[\'"][^\'"]{60000,}[\'"]\\s*\\.\\s(?:\\4|\\3)\\s*\$;\\s*(?:\\?>|\\Z)',
        '(\\$subject)\\s*=\\s*[\'"]Amazon\\s+LogIn\\s*Info[^\'"]{1,40}[\'"];\\s*mail\$\\$\\w{1,40},\\s*\\1,\\s*\\$\\w{1,40}\$;\\s*header\$[\'"]Location:',
        '\\A\\s*<\\?(?:php)?\\s*[^\\?]{1,200}=\\s*@?file_get_contents\\s*\\(\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)\\w{1,40}[\'"]\\s*\$;\\s*\\s*@?(?:eval|assert|system)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\\s*\\(){0,5}\\s*\\(?\\s*\\$\\w{1,40}\\s*\$?(?:\\s*\\)\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '(\\$\\w{1,40})\\s*=\\s*@?create_function\\s*\$\\s*[\'"]\\s*[\'"]\\s*,\\s*@?str_rot13\\s*\\(\\s*[\'"]\\s*@?riny\\s*\\(\\s*\\$\\w{1,40}\\[\\s*[^\\w]{0,2}\\w{1,40}[^\\w]{0,2}\\s*\\]\\s*\$\\s*;\\s*[^\\w]{0,2}\\s*\\)\\s*\\)\\s*;\\s*@?\\1\$\\s*\$\\s*;',
        '\\A\\s*<\\?php\\s+/\\*[^\\*]{1,99}\\*/\\s+\\?>\\s*<\\?php\\s*\\$\\w{1,40}\\s*=[^\\?]{1,99}function\\s+(\\w{1,40})\\s*\$[^\\?]{200,999}(\\$\\w{1,40})\\s*=\\s*\\1\\(\\s*[\'"]\\s*[\'"][\\.\\,][^\\?]{21000,26000},\\2\$[^\\)]{0,9}\\)\\s*;\\s*(?:\\?>|\\Z)',
        '<\\?php\\s*@?eval\\s*\$\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]eNqFVm1vE0cQ.itbK6I.4oR7N47lVoQ4raUkTv0SQVl02pzX9jWX2[^\$]{999,2000}["\']\\s*\\)\\s*\\)\\s*\\);?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+if\\s*\$\\s*!defined\\s*\\(\\s*[\'"]([^\'"]{1,40})[\'"]\\s*\$\\s*\\)\\s*\\{\\s*define\$\\s*[\'"]\\1[^@]{99,999}\\}function\\s*([^\\(]{1,40})\\(&\\$[^=]{1,40}=[\'"][^\'"]*[\'"]\$\\{global[^\\?]{999,9999}\\.=\\2\$(\\$\\2)(?:\$){3,6}[\'"],[\'"]\\w{16,48}[\'"]\\.\$\\3=[\'"][^\'"]{1,999}[\'"]\$\\);\\s*return\\s+true;\\s*\\?>\\w{16,40}',
        '\\A\\s*(<\\?php\\s*)@?unlink\\s*\$\\s*__FILE__\\s*\$;[^>]{1,300}(\\$\\w{1,40})\\s*=\\s*\\$\\w{1,20}->user_login;\\s*(\\$\\w{1,9})\\s*=\\s*get_user_by\\s*\$[\'"]login[\'"],\\s*\\2\\s*\$;[^\\}]{9,99}wp_set_current_user\\s*\$\\s*(\\3->ID)\\s*\$;\\s*wp_set_auth_cookie\\s*\$\\s*\\4\\s*\$;[^\\}]{1,99}exit\\s*\$\$;?\\s*\\}?',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*(?:ZXZhbCAoIGJhc2U2NF8|ZXZhbCAoYmFzZTY0Xw|ZXZhbChiYXNlNjRf|QGV2YWwoYmFzZTY0X|QGV2YWwgKGJhc2U2NF8|QGV2YWwgKCBiYXNlNjRf|QGV2YWwoIGJhc2U2NF8)[^?]{50,999}\$\\s*\\)\\s*;?\\s*\\?>',
        '\\A\\s*<\\?php\\s*(?:@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*[\'"]cd\\s*\\w{1,9};\\s*mv\\s+\\w{1,9}\\.ico\\s+\\w{1,9}\\.php;\\s*[\'"]\\s*\$;\\s*){1,9}(\\$\\w{1,40})\\s*=[^;]{1,50};\\s*(\\$\\w{1,40})\\s*=\\s*[\'"]\\w{1,20}@\\w{1,7}\\.\\w{2,6}[\'"]\\s*;[^?]{1,50}mail\\s*\$\\2,\\$\\w{1,20},\\1\\s*\$;?\\s*(?:\\?>|\\Z)',
        '<\\?php\\s+(?:\\$\\w{1,40}\\s*=(?:\\s*\\.?\\s*chr\$\\d+\$\\s*(?:\\.\\s*[\'"][^\'"]{0,40}[\'"])?){2,25};\\s*){1,5}[^,]{49,99},\\s*@?array\\s*\$[^;]{1,99};\\s*@?(?:include|include_once|require)\\s*\\(\\s*\\$\\w{1,40}\$;\\s*@?unlink\$\\s*\\$\\w{1,40}\\s*\$;\\s*(?:\\?>|\\Z)',
        '\\A\\s*(<\\?php\\s+)(?:shell_exec|exec)\\s*\$\\s*[\'"]/bin/bash[^\\>]{1,20}-i\\s+>&\\s+/dev/tcp/[\\d+\\.]{1,20}/\\d{1,6}\\s+\\d>&\\d[\'"][\'"]\\s*\$\\s*;?',
        '\\A\\s*(<\\?php\\s*)(\\$\\w{1,9})\\s*=\\s*@?\\$_(?:GET|POST|COOKIE|REQUEST)\\[[\'"]?\\d+[\'"]?\\];\\s*if\\s*\$?\\s*(?:md5)?\\s*\\((?:\\s*\\.?\\s*\\2\\s*){1,9}\$\\s*[^\\w]{2,3}\\s*[\'"]\\w{0,40}[\'"]\\s*\\)?\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*\\$_(?:GET|POST|COOKIE|REQUEST)\\[\\2\\]\\s*\$\\s*;?',
        '\\A\\s*<\\?php\\s*@?error_reporting\\s*\$0\$;\\s*ini_set\\s*\$[\'"]display_errors[\'"],0\$;\\s*eval\\s*\$\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{9000,13000}[\'"]\$\\)\\);(\\$\\w{1,40})[^\\?]{9,150}mail\$\\1[^\$]+\\);\\s*print\\s*\$[^\$]+\\);?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*(?:echo|print)\\s*[\'"][^\'"]+[\'"];\\s*\\?>\\s*<\\?php\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*[\'"]wget\\s*https?:\\/\\/[^\\s]{1,99}\\s+-O\\s+\\w{1,40}\\.php[\'"]\\s*\$\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"](?:ZXJyb3JfcmVwb3J0aW5nKDAp|cnJvcl9yZXBvcnRpbmcoMCk|cm9yX3JlcG9ydGluZygwKQ)[^\'"]{50,1000}(?:X2V4aXN0cygnc2hlbGxfZXhlYw|ZXhpc3RzKCdzaGVsbF9leGVj|eGlzdHMoJ3NoZWxsX2V4ZWM)[^\'"]{400,1500}[\'"]\\s*\$\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*(<\\?php\\s*)@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"](?:ZXJyb3JfcmVwb3J0aW5nKDAp)[^\'"]{999,3000}(?:cmxfZXhlY|dXJsX2V4ZWM|Y3VybF9leGVj)[^\'"]{9,200}(?:cmVnX21hdGNo|cHJlZ19tYXRjaA|ZWdfbWF0Y2g)[^\'"]{1,300}[\'"]\\s*\$\\s*\\)\\s*;?',
        '\\A\\s*<\\?php\\s[ ]{200,}[^\\?]+\\?>\\s*(<\\?php\\s+//\\sSilence\\sis\\sgolden\\.?\\s*(?:\\?>|\\Z))',
        'RewriteCond\\s*%{HTTP_USER_AGENT}\\s+android\\|[^\\[]{199,400}\\s*\\[NC,OR\\]\\s+RewriteCond\\s*%{HTTP_USER_AGENT}\\s+\\^\$\\d+[^\\$]{999,1999}RewriteRule\\s+\\^\\$\\s+http://\\w{1,9}\\.\\w{1,6}/redirect\\.php\\s+\\[R,L\\]',
        '\\A\\s*<\\?php\\s+(\\$\\w{1,40})\\s*=\\s*\\$_SERVER\\[[\'"]\\\\x44\\\\117\\\\103\\\\125[^\'"]{5,99}[\'"]\\]\\s*\\.\\s*[\'"]\\\\x2f\\\\143\\\\x6f\\\\x72[^\'"]{1,99}[\'"];\\s*include\\s*\\1\\s*\\.\\s*[\'"]\\\\x[^\'"]{1,40}[\'"]\\s*;\\s*Smarty\\d*::redirect\\([\'"]\\\\x[^\'"]{1,99}[\'"]\\s*,\\s*[\'"][^\'"]{0,40}[\'"]\\s*,\\s*[^\\$]{1,20}?\\1\\s*\$\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*[\'"]\\?>[\'"]\\.base64_decode\\s*\\(\\s*[\'"](?:PD9waH|IDw\\/cGhw|PD8|IDw\\/)[^\'"]{9,300}(?:PT0gIlpldVMi|PSAiWmV1UyI|ICJaZXVTI|IlpldVMi)[^\'"]{200,1500}[\'"]\\s*\$\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*[^/]{1,9}\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"](?:aWYgKGlzc2V0|aWYoaXNzZXQ|IGlmIChpc3NldA)[^\'"]{1500,1900}(?:bWFpbCg|YWlsKA|aWwo)[^\'"]{20,300}[\'"]\\s*\$\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRp[^\'"]{200,999}[\'"]\\s*\$\\s*\\)\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?error_reporting\\s*\$[^\$]+\\);\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{0,40}[\'"]\\s*;\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"](?:Y2xhc3M|IGNsYXNz)[^\'"]{5000,9000}(?:IUBpbmNsdWRlX29uY2UoYg|ZighQGluY2x1ZGVfb25jZShi|KCFAaW5jbHVkZV9vbmNlKGI)[^\'"]{1,999}[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{999,3500}(?:PHRpdGxlPldvcmRwcmVzcyBDb250ZW50IEZpbGU|dGl0bGU\\+V29yZHByZXNzIENvbnRlbnQgRmlsZQ|aXRsZT5Xb3JkcHJlc3MgQ29udGVudCBGaWxl)[^\'"]+[\'"]\\s*\$\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*\\$\\{[\'"](?:G|\\\\x47)[^\'"]{1,29}[\'"]\\}\\[[\'"][^\'"]{1,19}[\'"]\\]\\s*=[^%]{15000,19000}\\]\\},FILTER_VALIDATE_IP,FILTER_FLAG_IPV4\\)\\)\\{if\$ip2long\\(\\$\\{\\$\\{[\'"](?:G|\\\\x47)[^\\?]{999,1500}\\$\\{[\'"](?:G|\\\\x47)[^\'"]{1,29}[\'"]\\}\\[[\'"][^\'"]{1,40}[\'"]\\]\\}=[\'"][\'"];\\}\\}\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*(\\$\\w{1,9})\\s*=\\s*chr\\s*\\(99\$\\s*\\.\\s*chr\$104\$\\s*\\.\\s*chr\\s*\$114\$\\s*;\\s*\\$\\w{1,9}\\s*=\\s*\\1\\s*\$\\d+\$\\.[^\'"]{9,600}\\$\\w{1,9}\\s*=\\s*\\$\\w{1,9}\\s*\$\\s*[\'"]\\s*["\'],\\s*\\$\\w{1,9}\\s*\$;\\s*@?\\$\\w{1,9}\\s*\$\\s*\$;\\s*(?:\\Z|\\?>)',
        '\\A\\s*(<\\?php\\s+)@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*[\'"]cd[ ]\\/tmp;\\s*wget\\s+-O\\s+(\\w{1,9})\\s+https?:\\/\\/[^;]{1,99};\\s*chmod\\s+777\\s+\\2[^>]{1,99}>\\s*\\/dev\\/null\\s*\\d>&\\d\\s*&[\'"]\\s*\$\\s*;?',
        '\\A\\s*(<\\?php\\s+)@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*str_rot13\\s*\\(\\s*[\'"]\\s*riny[^\\$]{1,9}\\$_\\w{1,6}\\[\\w{1,9}\\]\\s*\$\\s*;\\s*[\'"]\\s*\\)\\s*\\)\\s*;?',
        '\\A\\s*(<\\?php\\s+)[^)]{0,20}\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*[\'"]cd\\s*/tmp;\\s*(?:w?get|lwp-download|fetch|lynx|curl)\\s+[^\\w]{0,2}\\w{0,9}\\s*https?://[^;]+/([\\w]{1,40})(\\.txt)\\s*;\\s*perl\\s+(?:/tmp/)?\\2\\3\\s*;\\s*rm\\s+[^\\w]{1,2}\\w{1,2}\\s*\\2\\3\\s*;?[^)]{0,20}\$\\s*;?',
        '\\A\\s*<\\?php\\s*(\\$\\w{1,40})\\s*=\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[[^\\]]{1,40}\\];\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\1\\s*\$\\s*\\)\\s*\\{\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*base64_decode\\s*\\(\\s*\\1\\s*\$\\s*\\)\\s*;?\\s*\\}?\\s*(?:\\?>|\\Z)',
        '<!\\-\\-(\\w{4,9}\\-\\->)\\s*<script>\\s*var\\s*(\\w{1,9})\\s*=\\s*document\\.createElement\$\\s*["\']iframe[\'"]\\s*\$[^:]{9,60}src[\'"],\\s*[\'"]https?://[^/]{2,40}/[\\w]+\\.php[\'"]\\s*\\);[^/]{9,160}?\\2\\.style\\.\\w{4,5}\\s*=\\s*[\'"]-\\d+px[^!]{9,99}?getElementById\$[^\$]{1,40}\\)\\.appendChild\$\\2\$;\\s*</script>\\s*<!\\-\\-/\\1',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{9,300}(?:Y3VybF9leGVjKC|dXJsX2V4ZWMo|cmxfZXhlYyg)[^\'"]{1,30}(?:ZXZhbC|dmFsKA|YWwo)[^\'"]{1,20}[\'"]\\s*\$\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+@?eval\$gzinflate\\(base64_decode\\(base64_decode\\([\'"][^\'"]{999,2500}[\'"]\$\\)\\)\\);?\\s*\\?>\\s*\\Z',
        '\\A\\s*(<\\?php\\s+)[^\$]{1,99}\\s*(?:exec|shell_exec)\\s*\\(\\s*[\'"]\\s*if\\s+curl\\s*(?:127\\.0\\.0\\.1|localhost)\\s+-o\\s+/dev/null\\s+2>/dev/null;\\s+then curl\\s+-o\\s*-\\s*https?://[^\$]{1,99}\\)\\s*;?\\s*(?:echo\\s*\$?\\s*[\'"][^\'"]*[\'"]\\s*;?)?',
        '\\A\\s*<\\?php\\s+echo\\s+base64_decode\\s*\\([\'"][^\'"]{1,40}[\'"]\$;\\s*@include(?:_once)?\\s*\$\\s*[\'"]https?:\\/\\/[^\$]+[\'"]\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*(<\\?php\\s*)@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"](?:ZXJyb3JfcmVwb3J0aW5nKDAp)[^\'"]{999,3000}[\'"]\\s*\$\\s*\\)\\s*;?([^\\@]{1,20}\\@version[^\\@]{9,99}@package\\s*Joomla)',
        '(\\{)\\s*(\\$\\w{1,40})\\s*=\\s*@\\$_COOKIE\\[[^\\]]{1,40}\\]\\s*;\\s*if\\s*\$\\s*\\2\\s*\$\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*\\2\$\\s*@\\$_COOKIE\\[[^\\]]{1,40}\\]\\s*\$\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*\\2\$\\s*@\\$_COOKIE\\[[^\\]]{1,40}\\]\\s*\$\\s*;\\s*@?\\3\\s*\$\\s*.?[\'"](.).{0,40}\\5e\\w?.?[\'"]\\s*,\\s*\\4\\s*,\\s*[^\$]{1,40}\\s*\\)\\s*;?\\s*\\}',
        '\\A\\s*<\\?php\\s*@?error_reporting\\s*\$[^\$]+\\);\\s*(\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{0,40}[\'"]\\s*;)+\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"](?:Y2xhc3M|IGNsYXNz)[^\'"]{5000,9999}(?:aWYgKChpbmNsdWRl|ZiAoKGluY2x1ZGU|ICgoaW5jbHVkZQ)[^\'"]{1,2000}[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*[\'"]?>[\'"]\\.base64_decode\\s*\\(\\s*[\'"](?:PD9waH|IDw\\/cGhw|PD8|IDw\\/)[^\'"]{200,1000}(?:dW5saW5rKA|bmxpbmso|bGluayg)[^\'"]{200,1500}[\'"]\\s*\$\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]FZe1rsbKkkbf5UbnyIGZNJrA8JuZ7WRkZmY[^\'"]{4499,5000}[\'"]\\s*\$\\s*\\)\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php[ ]{200,}\\s*(?:\\$\\w{1,40}\\s*=\\s*array\\s*\$\\s*[^\$]+\\s*\\);\\s*){1,5}(\\$\\w{20,99})\\s*=\\s*[\'"](?:ZXZhb|IGV2YW)[^"\']+["\'];\\s*if\\s*\$\\s*\\!function_exists\\s*\\(\\s*[\'"](\\w{1,40})[\'"]\\s*\$\\s*\\)\\s*\\{\\s*function\\s*\\2\\s*\$[^\\?]{100,500}\\(\\s*\\$\\w{1,40}\\s*,[^\\?]+\\1\\s*\$\\s*;?\\s*\\}?\\s*(?:\\?>|\\Z)',
        '\\A\\s*(<\\?php\\s*)@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"]ZXJyb3JfcmVwb3J0aW5nKDApO[^\'"]{1,600}(?:PHRpdGxlPg|dGl0bGU|aXRsZT4|SFRUUF9SRUZFUg|VFRQX1JFRkVS|VFBfUkVGRVI)[^\'"]{1,600}[\'"]\\s*\$\\s*\\)\\s*;?',
        '\\A\\s*(<\\?php\\s*)@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{1,600}(?:QGN1cmxfc2V0b3B0|Y3VybF9zZXRvcHQ)[^\'"]{1,600}(?:ZXZhbA|dmFs|YWwo)[^\'"][^\'"]{1,600}[\'"]\\s*\$\\s*\\)\\s*;?',
        '<IfModule\\s+mod_rewrite\\.c>[^\\?]+?google\\|yahoo\\|msn\\|aol\\|bing[^\\*]+?index\\.php\\s+\\[L\\]\\s*</IfModule>',
        '(\\$\\w{1,40})=new\\s+\\w{1,40}\$\$;(\\$\\w{1,40})=new\\s+Loader\$\\1\$;\\1->set\$[\'"]\\w{1,40}[\'"],\\2\$;\\$\\w{1,40}=new\\s+DB\$[^\\}]{1,600}?\\}\\}if\\(file_exists\\([\'"](\\w{1,40}[\'"\\.ph]{5,9})[\'"]\$\\)\\{include(?:_once)?\\s*\$?[\'"]\\3[\'"]\$?;\\}',
        '\\A\\s*<\\?PhP\\s*EVaL\\s*\$\\s*BAsE64_DEcODe\\s*\\(\\s*[\'"][^\'"]{1,99}X3Bhc3Mg[^\'"]{1,99}dGlvbiA9ICdGaWxlc01hbic7Ci[^\'"]{99,999}(?:IDQwNCBOb3QgRm91bmQ|NDA0IE5vdCBGb3VuZA)[^\'"]+[\'"]\\s*\$\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+(\\$\\w{1,40})\\s+=\\s+[\'"][^\'"]{9999,}[\'"];@eval\$(?:gzinflate|gzuncompress)\\(base64_decode\\(\\1\$\\)\\);?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+/\\*[\\*]*\\*/\\s*@?eval\$base64_decode\\([\'"][^\'"]{1,9}ZnVuY3Rpb25fZXhpc3Rz[^\'"]{1,500}KCRHTE9CQUxTWy[^\'"]{1,999}[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]eNqlW.tvE9e2.leGqPc0hpDMjMceG5TT[^\'"]{8800,9999}[\'"]\$\\s*\\)\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '(<\\?php\\s*)@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"]\\w{0,40}(?:cnJvcl9yZXBvcnRpbmcoMCk|ZXJyb3JfcmVwb3J0aW5nKDAp)[^\'"]{1,300}(?:VFBfVVNFUl9BR0VOVC|VFRQX1VTRVJfQUdFTlQ|SFRUUF9VU0VSX0FHRU5U)[^\'"]{1,999}(?:cmVnX21hdGNo|cHJlZ19tYXRjaA|ZWdfbWF0Y2g)[^\'"]{1,999}(?:aXQoKTs|eGl0KCk7|ZXhpdCgp)[^\'"]{1,300}[\'"]\$\\s*\\)\\s*;',
        '(/)\\s*@?preg_replace\\s*\$\\s*.?[\'"](.).{0,40}\\2e\\w?.?[\'"]\\s*,\\s*[\'"][^\'"]+[\'"]\\s*,\\s*[\'"][\'"]\\s*\$\\s*;?\\s*(/)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*[\'"]\\?>[\'"]\\s*\\.\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{1,600}(?:Pgo8dGl0bGU|Cjx0aXRsZT4|PHRpdGxlPg|IDx0aXRsZT4)[^\'"]{1,1500}IFByaXYgU2hlbGw[^\'"]+[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '<\\?php[ ]{200,}(?:\\s*(?:\\$\\w{1,40})\\s*\\=\\s*(?:[\'"\\s\\.base64_dco]{13,99}|[\'"\\s\\.gzuncompres]{12,99})\\s*;){2}@?eval(/[^/]{0,40}/)\$\\1\\$\\w{1,40}\\1\\(\\1\\$\\w{1,40}\\([\'"][^\'"]+[\'"](?:\\s*\$\\s*){1,6};?\\s*(?:\\?>|\\Z)',
        '\\A\\s*(<\\?php\\s*)\\{\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]+[\'"]\\s*;\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\\s*\\(){0,5}\\2(?:\\s*\$\\s*){1,6};?\\s*\\}',
        '\\A\\s*<\\?php\\s+@?preg_replace\\s*\$\\s*.?[\'"](.).{0,40}\\1(?:[\'"]\\s*\\.\\s*[\'"])?e\\w?.?[\'"]\\s*,[^\$,]+\\)\\s*\\)\\s*\\)\\s*\\s*;[^\\;]{0,40};\\s*(?:\\?>|\\Z)',
        '<script\\s+language\\s*=\\s*[\'"]php[\'"]\\s*>\\s*\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\\s*\\(){0,5}\\s*\\(?\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[[^\\]]{1,40}\\](?:\\s*\$\\s*){1,6};?\\s*</script>',
        '(<\\?php\\s*)if\\s*(?:\$\\s*md5)?\\s*\\(\\s*@?\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[^\\]]{1,40}\\]\\s*\$\\s*[^\\w]{2,3}\\s*[\'"][^\'"]*[\'"]\\s*\\)\\s*\$\\s*(\\$\\w{1,40})\\s*=\\s*@?\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[^\\]]{1,40}\\]\\s*\$\\s*\\.\\s*@?\\2\\s*\$\\s*@?\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[^\\]]{1,40}\\]\\s*\$\\s*;',
        '<\\?php\\s*@?eval\\s*\$\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]eNptll1vE0cUhv.KYKWqDSb[^\'"]{1499,1999}["\']\\s*\$\\s*\\)\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '(\\{)\\s*@?\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[^\\]]{1,40}\\s*\\]\\s*\$\\s*@?\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[^\\]]{1,40}\\s*\\]\\s*\\(\\s*[\'"][^\'"]*[\'"]\\s*,\\s*@?\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*(\\})',
        '(?:\\$\\w+\\s*=\\s*[\'"][\\w\\\\]+?[\'"]\\s*\\^\\s*[\'"][\\w\\\\]+?[\'"];\\s*)+\\$\\w+\$\\$\\w+\\s*,\\s*[\'"][\\w\\\\]+?[\'"]\\^[\'"][\\w\\\\]+?[\'"]\\s*,\\s*[\'"]\\w+[\'"]\$;(?://\\w{16,64})?',
        '<\\?php\\s*(\\$\\w{1,40})\\s*=\\s*file_get_contents\\s*\$\\s*[\'"][^\'"]*[\'"]\\s*\$\\s*;\\s*\\1\\s*=\\s*base64_decode\\s*\$\\s*\\1\\s*\$\\s*;\\s*file_put_contents\\s*\$\\s*[\'"]([^\'"]+)[\'"]\\s*,\\s*\\1\\s*\$\\s*;\\s*include\\s*\$\\s*[\'"]\\2[\'"]\\s*\$\\s*;\\s*unlink\\s*\$\\s*[\'"]\\2[\'"]\\s*\$\\s*;\\s*(?:|\\?>|\\Z)',
        '<\\?php\\s*//[\\#]{3}=[\\#]{3}\\s*error_reporting[^\\?]{4000,6000}?/[\\#]{3}=[\\#]{3}\\s*\\?>',
        'function\\s+(\\w{1,40})\$\$\\s*\\{\\s*if\\s*\$\\s*stripos\\s*\\(\\s*@\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*(\\w+)\\s*\\(\\s*\'[^\']*\'\\s*,\\s*\\d+\\s*\$\\s*\\]\\s*,\\s*\\2\\s*\$\\s*[\'"][^\'"]*[\'"]\\s*,\\s*\\d+\\s*\$\\s*\\)\\s*===\\s*false\\s*\\)\\s*\\{[^&]+add_action\\s*\$\\s*\\2\\s*\\(\\s*[\'"][^\'"]*[\'"]\\s*,\\s*\\w+\\s*\$\\s*,\\s*["\']\\1["\']\\s*\\)\\s*;',
        '(\\$\\w{1,40})\\s*=\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[[^\\]]+\\]\\s*;\\s*if\\s*\$\\s*!is_user_logged_in\\s*\\(\\s*\$\\s*\\)\\s*\\{\\s*(wp_set)_current_user\\s*\$\\s*\\1\\s*\$\\s*;\\s*\\2_auth_cookie\\s*\$\\s*\\1\\s*\$\\s*;\\s*\\}',
        '\\A\\s*<\\?php\\s+(?:\\s*@\\w{1,40}\$[^\$]{1,40}\\);\\s*){2,9}if\\s*\$?\\s*isset\\s*\\(\\s*\\$_(?:G|P|C|S|R)[^\\{]{1,600}\\{\\s*@?eval\\s*\\(\\s*base64_decode\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]*[\'"]\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\}\\s*exit\$?\$?;\\s*(?:\\?>|\\Z)',
        'if\\s*\$\\s*!function_exists\\s*\\(\\s*\'(wp_func_jquery)\'\\s*\$\\s*\\)\\s*\\{\\s*function\\s*\\1\\s*\$\\s*\$\\s*\\{\\s*\\$host\\s*=\\s*\'https?://\'\\s*;[^\\}]{1,999}(?:\\}\\s*if\\s*\$\\s*[^\\{]{1,40}\\s*\$\\s*\\{)?\\s*\\}?\\s*\\}?\\s*(add_action\$\'wp_)footer\'\\s*,\\s*\'\\1\'\$;\\s*\\}(?:\\s*else\\s*\\{\\s*\\2head\',\\s*\'\\1\'\\);\\s*\\}\\s*\\})?',
        'function\\s+(\\w{1,40})\$\$\\s*\\{[^=\\}]+(\\$\\w{1,40})\\s*=\\s*(\\$wpdb->)get_results\$[\'"][^\'"]*FROM\\s+\\3users[^\'"]*[\'"]\$;[^\\{]+foreach\\s*\$\\s*\\2[^\\}]+\\$\\w{1,40}\\s*>=\\s*8\\s*\$[^\\}]+(\\$\\w{1,40})\\[\\]\\s*=\\s*\\$\\w{1,40};\\s*\\}\\s*\\}\\s*return\\s+\\4\\;\\s*\\}\\s*(\\$\\w{1,40})\\s*=\\s*\\1\$\$;\\s*(?:print_?r?|echo)\$\\5\$;',
        '\\A\\s*<\\?php\\s*\\$\\{[\'"](?:G|\\\\x47)[^&]{999,6000}/\\\\x74(?:i|\\\\x69)(?:t|\\\\x74)(?:l|\\\\x6c)(?:e|\\\\x65)\\\\x3e[^`]+\\)\\);return\\$\\{\\$\\{[\'"](?:G|\\\\x47)[^\'"]{9,18}[\'"]\\}\\[[\'"][^\'"]+[\'"]\\]\\};\\}echo\\s*\$?\\s*[\'"][^;]*[\'"]\\s*\$?\\s*;\\s*(?:\\?>|\\Z)',
        '<script\\s*type\\s*=\\s*[\'"]text/javascript[\'"]\\s*>\\s*document\\.write\$\\s*[\'"]\\\\u00[^\'"]{999,5000}[\'"]\$\\s*<\\s*/script>\\s*<\\?php\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{1,999}c2l4X2dldHB3dWlkKC[^\'"][^\'"]{1,999}[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\$\\s*[\'"]\\?>[\'"]\\s*\\.\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{1,999}Y3NzL2ltYWdlcy9pLnR4dC[^\'"]{1,99}[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+@?eval\\s*\$\\s*[\'"]\\?>[\'"]\\s*\\.\\s*base64_decode\\s*\\(\\s*[\'"]PD9waHANCmhlYWRlcignTG9jYXRpb246IHRva2Vu[^\'"]{999,1999}[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '(<\\?php\\s*echo\\s*[^\'"]{1,40}\\s*;\\s*@)eval(\$\\$_POST\\[\\w+\\]\$;\\s*\\?>)',
        '(<\\?php\\s+)eval\$base64_decode\\([\'"]DQplcnJvcl9yZXBvcnRpbmcoMCk7[^\'"]{1,600}cmVmZXJl[^\'"]{1,999}eGl0[^\'"]{1,500}[\'"]\$\\);',
        '\\A\\s*(<\\?php\\s+)error_reporting\\s*\$0\$\\s*;(?:\\s*ini_set\\s*\$\\s*[\'"][^\'"]*[\'"]\\s*,\\s*[\'"][^\'"]*[\'"]\\s*\$\\s*;\\s*){1,2}if\\s*\$\\s*isset\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)[^\\{]{1,99}\\{\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{60000,}[\'"];\\s*\\2\\s*=\\s*ereg_replace\\([^\$]{1,40}\\s*\\2\\s*\\)\\s*;\\s*@?eval\$base64_decode\\(\\2\$\\);\\s*die\$\$;\\s*\\}',
        '(protected\\s+function\\s+send\$\\s*(\\$\\w{1,40})\\s*,\\s*(\\$\\w{1,40})\\s*\$\\s*\\{)\\s*[^\\}]{1,500}\\s*(\\$\\w{1,40})\\s*=\\s*(\\2|\\3)->getCcNumber\$\$;[^>]{1,200}\\5->getCcExpMonth\$\$;[^/]{200,400}(\\$\\w{1,40})\\s*=\\s*[\'"][\\w=]{4,40}[\'"];\\s*(\\$\\w{1,40})\\s*=\\s*base64_decode\$\\s*\\6\\s*\$;[^\\{]+if\\s*\$\\s*isset\\(\\4\$\\)\\s*\\{\\s*@?mail\$\\s*\\7\\s*,[^;]{1,40};\\s*\\}(\\s*\\})',
        'if\\s*\\(is_object\\(\\$_SESSION\\["__default"\\]\\["user"\\]\$\\s*&&\\s*!\$\\$_SESSION\\["__default"\\]\\["user"\\]->id\$\\)\\s*{echo\\s*"\\s*<script\\s*language=JavaScript\\s*id=onDate\\s*>\\s*</script>\\s*<script\\s*language=JavaScript\\s*src=[^>]+>\\s*</script>\\s*"\\s*;?\\s*\\}\\s*;?',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*is_file\\(\\s*[\'"]/[^\'"]+\\.php[\'"]\\s*\$\\s*\\)\\s*\\{\\s*include(?:_once)?\\s*\$\\s*[\'"]/[^\'"]+/wp\\-[\\w\\-]{1,20}\\.php[\'"]\\s*\$;\\s*\\}\\s*\\?>',
        '\\A\\s*<\\?(?:php)?\\s*if\$!function_exists\\([\'"]?\\w{1,40}[\'"]?\$\\)\\{function\\s+(\\w{1,40})\$\\$\\w{1,40}\$\\{\\$\\w+=array\$[^&]{999,3000}(\\$\\w{1,40})=[\'"]\\1[\'"];(\\$\\w{1,40})=\\2\\([^\$]{1,40}\\);(\\$\\w{1,40})=\\3\$[\'"][\'"],\\2\\(\\$\\w{1,40}\$\\);\\4\$\$;\\}?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"]JG[^\'"]{1,40}PWV4cGxvZGUo[^\'"]{16000,32000}O2V2YWwo[^\'"]{1,99}[\'"]\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '(\\{)\\s*@?copy\$\\s*["]https?://[^"\']+["]\\s*,\\s*["\'][^\\$][^.]+\\.php["\']\\s*\$;',
        '(?<!@)eval\\s*\$\\s*base64_decode\\s*\\("ZXZhbChiYXNlNjRfZGVjb2RlKCJaWFpoYkNoaVlYTmxOalJmWkdWamIyUmxLQ0[^\'"]{999,5000}[\'"]\$\\s*\\)\\s*;',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]DZa1DuzIFkU.Z.6VAzNpNEGbGduYPJmZ2V[^\'"]{3000,3400}[\'"]\\s*\$\\s*\\)\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+system\$[^\$]{1,99}\\)\\s*;\\s*system\$["\']mkdir\\s+[^\$]{1,40}/sok[\'"]\\)\\s*;\\s*system\$["\']mkdir\\s+[^\$]{1,40}com_jooomlas[\'"]\\)\\s*;(?:\\s*system\$[^\$]{1,99}\\)\\s*;\\s*){1,9}echo\\s*\$?\\s*[\'"][^\'"]*[\'"]\\s*\$?\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+[^\\$]*(?:\\$[0_O]{1,12}\\s*=\\s*[\'"]\\d+[\'"]\\s*;\\s*){2,5}(\\$[0_O]{1,12})\\s*=\\s*\$?[\'"][^\'"]{20,80}[\'"]\$?\\s*;\\s*(\\$[0_O]{1,12})\\s*=\\s*\\1[\\{\\[]\\d+[\\}\\]]\\.[^`]{34500,37000}@eval\$\\$[0_O]{1,12}\$;unset\$[^\$]{60,99}\\);exit\$\$;\\}\\}[\'"]\\);\\$\\{[\'"][^\'"]+[\'"]\\}\\[[\'"][^\'"]+[\'"]\\]\$\$;\\s*(?:\\?>|\\Z)',
        '(\\$GLOBALS\\[[^\\]]{1,40}\\])=Array\$base64_decode\\([^\\?]{999,3000}[\'"]<\\?php\\s*\\$\\w{1,9}\\[\\d+\\]\\s*\\?>[\'"]\$;\\1\\[\\d+\\]\$\\$\\w{1,9}\$;\\s*include(?:_once)?\\s*\$\\s*[\'"][^\'"]{1,40}\\.php[\'"]\\s*\$\\s*;\\s*@\\1\\s*\\[\\s*\\d+\\s*\\]\\s*\$\\s*[\'"][^\'"]{1,40}\\.php[\'"]\\s*\$\\s*;',
        'eval\$base64_decode\\(\'(?:JGY9|JGYgP)[^\'"]+?\'\$\\);',
        '(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"\\s]{20,80}[\'"];\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][\'"];\\s*foreach\$[^\$]{1,40}\\)\\s*\\{\\s*\\2\\s*\\.?=\\s*\\1\\[[^\\?]{999,1500}\\s*(\\$\\w{1,40})\\s*=\\s*\\$\\w{1,40}\$[\'"\\s\\.creat_funio]{20,190}\\s*\$;\\s*(\\$\\w{1,40})\\s*=\\s*\\3\\s*\$[^\$]{1,40}\\)\\s*\\)\\s*;\\s*\\4\$\$;\\s*exit\$\$;\\s*\\}',
        '\\A\\s*<\\?php\\s+@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\\s*\$[\'"]whoami[\'"]\$;\\s*\\?>(?:\\s*[^\\?]{0,40}\\s*<\\?php\\s+phpinfo\\s*\$\$;\\s*\\?>)?\\s*\\Z',
        '\\A\\s*<\\?php\\s+@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*["\']ZWNobyc8Zm9ybSBhY3Rpb249IiIgbWV0aG9kPSJwb3N0[^\'"]{1,500}KEBjb3B5[^\'"]{1,500}[\'"]\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?(?:php)?\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"]aWYoJGF1dGg[^\'"]{9999,15000}[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+\\$\\w{1,40}\\s*=\\s*array\\s*\$\\s*(?:[\'"][^\'"]{20,80}[\'"],?){99,150}\$;\\s*@?eval\\s*\$\\s*[\'"]\\\\x65\\\\x76(?:\\\\x61|\\\\x69)\\\\x6C[^\'"]{99,999}(?:\\\\x29){4}\\\\x3B[\'"]\\s*\$\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\\s*\\s*\$\\s*base64_decode\\s*\\([\'"](?:aWYgKCRfR0VUWy|aWYgKCRfUE9TVF)[^\'"]{99,3000}[\'"]\$\\s*\\)\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+@?eval\$\\s*[\'"]\\?>[\'"]\\s*\\.\\s*(?:gzuncompress|gzinflate)?\\s*\\.?\\s*\\(?\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{1,40000}[\'"](?:\\s*\$\\s*){1,6};\\s*\\?>\\s*<\\?php\\s*\\/\\*[^\\*]{1,99}\\*/\\s*\\?>',
        '\\A\\s*<\\?php\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{20,40}[\'"];\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST)\\[[^\\]]{1,40}\\]\\s*\$\\s*\\)\\s*\\{\\s*if\\s*\$\\s*md5\\s*\\(\\s*\\$_(GET|POST)\\[[^\\]]{1,40}\\]\\s*\$\\s*[^\\w]{2,3}\\s*\\1\\s*\\)\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\$_\\2\\[[^\\]]{1,40}\\]\\s*\$\\s*\\);\\s*exit;\\s*\\}[^\\}]{1,99}\\}\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"](?:QGV2YWwoJF9QT1NUW|ZXZhbCgkX1BPU1R)[^\'"]{1,99}[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+(?:(?:print|echo)\\s*[^;]{1,99}?\\s*;)?\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[^\\]]{1,40}\\s*\\]\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[^\\]]{1,40}\\s*\\]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]eNq1WvtvE9e2.leG[^\'"]+[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*error_reporting\$0\$;\\s*if\\s*\$\\s*!\\s*defined\\s*\\(\\s*[\'"]WP_OPTION_KEY[\'"]\\s*\$\\s*\\)\\s*\\{\\s*function\\s*\\w{1,40}[^`]{29000,33000}\\$this-\\s*>\\s*\\w{1,40}\\s*=\\s*(\\$\\w{1,40})\\s*;\\s*\\1\\s*%\\s*=\\s*\\$\\w{1,40}\\s*;\\s*return\\s*\\1\\s*;\\s*\\}\\s*\\}\\s*(?:\\?>|\\Z)',
        '\\$\\{[\'"](?:G|\\\\x47)(?:L|\\\\x4c)[^]]{9,49}\\]=[\'"][^\'"]{3,12}[\'"];\\$\\{\\$\\{[\'"](?:G|\\\\x47)(?:L|\\\\x4c)[^]]{9,49}\\]\\}=[\'"][^\'"]{99,500}\\\\x31\\\\x30\\\\x34\\\\x2e\\\\x31\\\\x33\\\\x31\\\\x2e\\\\x31\\\\x35\\\\x34\\\\x2e\\\\x31\\\\x35\\\\x34[^\'"]+[\'"];@?exec\$[\'"](?:p|\\\\x70)(?:e|\\\\x65)(?:r|\\\\x72)(?:l|\\\\x6c)[^\'"]{1,99}[\'"]\$;',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$[\'"]\\?>[\'"]\\s*\\.\\s*base64_decode\\([\'"]PD9waHANCnNlc3Npb25fc3Rhcn[^\'"]{999,1500}[\'"]\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*[^\\$]{1,600}(\\$\\w{0,9}pass)\\s*=\\s*[\'"][\'"]*[\'"];\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_POST\\s*\\[\\s*([^\\}]{1,40})\\s*\\][^\\{]+\\{\\s*@?mail\\s*\\(\\s*[\'"][^\'"]*[\'"]\\s*,\\s*[\'"][^\'"]*[\'"]\\s*,\\s*__FILE__\\s*\\.\\s*[\'"][^\'"]*[\'"]\\s*\\.\\s*\\1\\s*\\.\\s*[\'"][^\'"]*[\'"]\\s*\\.\\s*\\$_POST\\s*\\[\\s*\\2\\s*\\]\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '\\A\\s*<\\?php\\s*/\\*[^`]{3000,5000}?\\*/\\s*@?eval\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\\s*\\(){0,5}\\s*rawurldecode\\s*\\(\\s*[\'"][^\'"]+[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]eNqtW.tzE2W..[^\'"]+[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?(?:php)?\\s*(?:(?:/(?:\\*|/)[^\\n/]{0,20}(?:/|\\n))|\\s+)\\s*\\$[O0]{6,12}=urldecode\$[\'"]%[^\'"]{1,200}[\'"]\$;(?:\\s*\\$[O0]{6,12}\\.?=(?:\\$[O0]{6,12}\\{?\\d*\\}?\\.?){2,10};){2,9}\\s*\\$_\\w{1,20}=__FILE__;\\s*\\$\\w{1,40}=[\'"][^\'"]{60000,}[\'"];\\s*@?eval\$\\$[O0]{6,12}\\([\'"]JF9[^\'"]{1,999}[\'"]\$\\);\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*\\$[0_oO]{1,9}\\s*=\\s*[\'"]?__FILE__[\'"]?\\s*;\\s*\\$[0_oO]{1,9}\\s*=\\s*[\'"][^\'"]+[\'"]\\s*;\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\\s*\\(){0,5}\\s*\\(?\\s*[\'"][^\'"]+[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+[^\\$]{1,200}\\s*(\\$\\w{1,9}(?:code|payload|evi?l))\\s*=\\s*[\'"][^\'"]{30000,60000}[\'"]\\s*;\\s*\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\\s*\\(){0,5}\\s*\\(?\\s*\\1(?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*(<\\?php\\s+)(?:\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$\\s*\\$_POST\\s*\\[\\s*[^\\]]{1,40}\\s*\\]\\s*\$\\s*;\\s*){1,9}(\\$\\w{1,40})\\s*=\\s*@?mail\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*(?:,\\s*\\$\\w{1,40}\\s*)?\$\\s*;\\s*if\\s*\$\\s*\\2\\s*\$\\s*\\{[^\\}]{1,40}\\}\\s*else\\s*[^\\}]{1,40}\\}',
        '\\A\\s*<\\?php[^\\$]{1,600}(?:\\s*\\$\\w{1,40}\\s*=\\s*(?:strrev)?\\s*\$?\\s*(?:[\'"(?:\\s\\.base64_dco]{15,40}|[\'"\\s\\.aceglpr_]{15,40})\\s*\$?\\s*;){1,2}\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]+[\'"]\\s*;[^\\?]+,\\s*[^\\$]{1,199}\\1[^;]+;\\s*exit\$\$\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*(\\$\\w{1,40})\\s*=\\s*str_i?replace\\s*\$\\s*[\'"][^\'"]{1,40}[\'"]\\s*,\\s*[\'"][^\'"]{0,40}[\'"]\\s*,\\s*[\'"]\\w{20,80}[\'"]\\s*\$\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{999,25000}[\'"]\\s*;\\s*@?eval\\s*\$\\s*\\1\\s*\\(\\s*\\2\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '(\\$\\w{1,40})\\s*=\\s*[\'"]\\w{20,80}[\'"]\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*str_i?replace\\s*\$\\s*[\'"][^\'"]{1,40}[\'"]\\s*,\\s*[\'"][^\'"]{0,40}[\'"]\\s*,\\s*\\1\\s*\$\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\\}]{999,25000}\\}[^\\$]{0,40}\\s*(\\$\\w{1,40})\\s*=\\s*\\2\\s*\$\\s*\\3\\s*\$\\s*;\\s*trigger_error\\s*\$\\s*\\4\\s*,[^\$]{1,40}\\s*\\)\\s*;',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*[\'"]\\?>[\'"]\\s*\\.\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{1,40}LyogV1NPI[^\'"]{9999,}[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*[^x]{1,600}preg_replace\$\\s*[\'"](?:\\\\\\w{2,3}){5,40}[\'"]\\s*,\\s*[\'"]\\\\(?:x65|145)\\\\(?:x76|166)\\\\(?:x61|141)\\\\(?:x6c|154)[^,]+,[^\$]{1,9}\\);\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+(\\$\\w{1,40})\\s*=\\s*[\'"]DQov(?:Kioq){1,40}KlwNCnwqICAgIFZCQSBTSEVM[^\'"]{60000,}[\'"];\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*\\1\\s*\$\\s*\\);\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+\\/\\*[^\\*]{0,16}\\*/\\s*@?eval\$\\s*[\'"]\\?>[\'"]\\s*\\.\\s*(?:gzuncompress|gzinflate)\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{20000,40000}[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*\\$\\{[\'"][^\\*]{99,999}@?preg_replace\\s*\$\\s*.?[\'"](.).{0,40}\\1(?:e|\\\\(?:x65|101))\\w?.?[\'"]\\s*,[^\$]+\\);\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*\\$\\{[\'"][^%]{30000,50000},sprintf\$[\'"]%[^\\^]+preg_match\\(\\s*[\'"].\\^[^\\$]{1,9}\\$\\{\\$\\{[\'"](?:\\\\(?:x47|107)|G)[^%]+[\'"]\\s*;\\s*\\}\\s*exit\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\\w{1,40};\\s*[^:]{1,600}://[^/]{1,40}/[^`]{9000,15000}];for\\((\\$[O_0]{1,40})\\s*=\\s*0;\\1<\\$[O_0]{1,40};\\$[O_0]{1,40}\\+\\+\$\\{(\\$[O_0]{1,40})\\s*\\.=\\s*\\$[O_0]{1,40}\\[\\$[O_0]{1,40}\\[[^\\]]{1,9}\\]\$0,\\$[O_0]{1,40}\$];}return\\s*\\2;}\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?(?:php)?\\s*(?:(?:/(?:\\*|/)[^\\n/]{0,20}(?:/|\\n))|\\s+)\\s*\\$[O0]{6,12}=urldecode\$[\'"]%[^\'"]{1,200}[\'"]\$;(?:\\s*((\\$GLOBALS\\[)[\'"][O0]{6,12}[\'"]\\])\\.?=\\.?(?:(?:\\1\\{\\d+\\})?\\.?\\$[O0]{6,12}\\{?\\d*\\}?\\.?){2,10};){1,8}[^\\)]{20,80}@?eval\$\\2[\'"][O0]{6,12}[\'"]\\]\\([\'"][^\'"]{400,3000}[\'"]\$\\s*\\);(?:\\w{1,40};)?\\?>',
        '\\A\\s*<\\?php\\s*[^\\?]{1000,60000}\\s*\\?>\\s*((<\\?php\\s+/\\*\\*\\s+\\*\\s+@package\\s+Joomla\\.Site))',
        '\\A\\s*<\\?php\\s+@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"]aWYoIWRlZmluZWQoIlBIUF9FT0w[^\'"]{10000,60000}[\'"]\$\\);\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{1,40}cGhwX3VuYW1lKCk[^\'"]+[\'"]\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*\\$\\w{0,9}_pass\\s*=\\s*[\'"]\\w{1,40}[\'"]\\s*;\\s*(?:\\?>\\s*<\\?php\\s*)?\\s*@?eval\\s*\$[\'"][^\'"]{0,20}[\'"]\\s*\\.\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]+[\'"]\$\\s*\\)\\s*;\\s*\\?>',
        '\\A\\s*<\\?php\\s*[^\\$]{1,40}(?:(?:\\s*\\$\\w{1,9}\\s*=(?:\\s*\\.?\\s*chr\$\\d+\$)+;)|(?:\\s*(\\$\\w{1,9})\\s*=\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[^\\]]{1,40}\\]\\s*;\\s*)){3,9}\\s*\\$\\w{1,9}\\s*\$[^;]{1,40}\\1\\s*\$\\s*\\)\\s*;\\s*@?include(?:_once)?\\s*\$\\s*(\\$\\w{1,9})\\s*\$\\s*;\\s*@?\\$\\w{1,9}\$\\s*\\2\\s*\$\\s*;\\s*(?:\\?>|\\Z)',
        '<\\?php\\s+@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"]aWYobWQ1KCRfUE9TVFsncGFzc3[^\'"]+[\'"]\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*(\\$\\w{1,40})\\s*=\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]*[\'"]\\s*\\]\\s*;\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\\s*\\(){0,5}\\s*\\1(?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '<\\?\\s*\\$GLOBALS\\[\'_\\d+_\'\\]=Array\$base64_decode\\((\\s*\'[\\w=]+\'\\s*\\.?)+\$\\);\\s*\\?><\\?\\s*function\\s*(_\\d+)\$(\\$\\w+)\$\\{(\\$\\w+)=Array\$(\\s*\'[\\w=]+\'\\s*\\.?,?)+\$;return\\s*base64_decode\$\\4\\[\\3\\]\$;}\\s*\\?><\\?php\\s*\\$password=\\2\$\\d+\$;\\$GLOBALS\\[\'_\\d+_\'\\]\\[\\d+\\]\$\\2\\(\\d\$,\\2\$\\d\$,\\2\$\\d\$\\);\\s*\\?>',
        'if\\s*\$strpos\\(\\$_SERVER\\[\'REQUEST_URI\'\\]\\s*,\\s*\'[^\']+\'\$\\s*!==\\s*false\\)\\s*{\\s*error_reporting\$0\$;\\s*ini_set\$\'display_errors\',\\s*0\$;\\s*set_time_limit\$0\$;.+add_filter\$ \'wp_title\',\\s*\'\\w+\'\\s*\$;\\s*}\\s*}',
        '<\\?php\\s*\\$\\w{1,40}\\s*="[^"]{200,}"\\s*;\\s*(\\$\\w{1,40}\\s*=\\s*str_replace\\s*\$\\s*[\'"][^;]+;\\s*)+preg_replace\\(\\s*[\'"][^;]+;\\s*\\?>',
        '\\$GLOBALS\\[\'\\w+\'\\];global\\$\\w+;\\$\\w+=\\$GLOBALS;\\${[\'"](\\\\x[a-f0-9A-F]+)+[\'"]}\\[[\'"]\\w+[\'"]\\]="(\\\\x[a-f0-9A-F]+)+";.+?\\]\${eval\$\\$\\w+\\[\\$\\w+\\[["\']\\w+["\']\\]\\[\\d+\\]\\]\$;}exit\$\$;}',
        '<\\?php\\s*eval\$base64_decode\\("IGVycm9yX.+="\$\\);',
        'error_reporting\$0\$;ini_set\$"display_errors", 0\$;\\$localpath=getenv\$"SCRIPT_NAME"\$;\\$absolutepath=getenv\$"SCRIPT_FILENAME"\$;\\$root_path=substr\$\\$absolutepath,0,strpos\\(\\$absolutepath,\\$localpath\$\\);include_once\$\\$root_path\\."/SESS_\\w{32}\\.php"\$;',
        '\\$var= \\$_SERVER\\[\'PHP_SELF\'\\];\\s*\\$form =<<<HTML\\s*<form enctype="multipart/form-data" action="\\$var" method="POST">\\s*<input name="uploadFile" type="file"/><br/>\\s*<input type="submit"\\s+value="Upload"\\s*/>\\s*</form>\\s*HTML;\\s*if \$!empty\\(\\$_FILES\\[\'uploadFile\'.+?print\\s*"OK";\\s*}\\s*else\\s*{\\s*print\\s*\\$form;\\s*}',
        '<\\?php\\s*error_reporting\\(0\$;ini_set\$"display_errors", 0\$;\\$localpath=getenv\$"SCRIPT_NAME"\$;\\$absolutepath=getenv\$"SCRIPT_FILENAME"\$;\\$\\w+=substr\$\\$\\w+,0,strpos\\(\\$absolutepath,\\$localpath\$\\);include_once\$\\$root_path\\."/\\w+.zip"\$;\\s*\\?>',
        'set_time_limit\$0\$;\\s*ignore_user_abort\$\$;\\s*if\\s*\$\\s*filesize\\(\\s*"\\.htaccess"\\s*\$\\s*>\\s*\\d+\\s*\\)\\s*{\\s*\\$\\w+\\s*=\\s*fopen.+?\$\\s*sys_get_temp_dir\\(\$\\s*\\.\\s*"/\\$\\w+"\\s*\\);\\s*}',
        'RewriteRule\\s+\\^\$\\[A-Za-z0-9-\\]\\+\$\\.html\\$\\s+\\w+\\.php\\?hl=\\$1\\s+\\[L\\]',
        '<\\?php\\s*\\$\\w+\\s*=\\s*file_get_contents\$\\s*"https?[^"]+"\\s*\$;\\s*\\$\\w+\\s*=\\s*fopen\$\\s*"\\w+\\.php"\\s*,\\s*"w\\+"\\s*\$;\\s*fwrite\$\\s*\\$\\w+\\s*,\\s*\\$\\w+\$;\\s*fclose\$\\s*\\$fo\\s*\$;\\s*(\\?>)?',
        'if\\s*\$\\s*md5\\(\\s*@?\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*\\w+\\s*\\]\$\\s*==\\s*\'\\w+\'\\s*\\)\\s*\\s*\$\\s*\\$_=\\s*@\\$_REQUEST\\[\\s*\\w+\\s*\\]\$\\s*\\.\\s*@?\\$_\$\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*\\w+\\s*\\]\\s*\$;',
        '\\$\\w{1,40}=\\$_(GET|POST|COOKIE|REQUEST|SERVER);\\s*\\$\\w+\\s*=\\s*\\$\\w+\\[\\s*\\w+\\s*\\];\\s*if\\s*\$\\s*\\$\\w+\\s*\$\\s*{\\s*\\$\\w+=\\s*\\$\\w+\\s*\$\\$\\w+\\s*\\[\\s*\\w+\\s*\\]\\s*\$;\\s*\\$\\w+\\s*=\\s*\\$\\w+\\s*\$\\s*\\$\\w+\\s*\\[\\s*\\w+\\s*\\]\\s*\$;\\s*\\$\\w+\\s*=\\s*\\$\\w+\\s*\$""\\s*,\\s*\\$\\w+\\s*\$;\\s*\\$\\w+\\s*\$\\s*\$;\\s*}',
        '\\$\\w{1,40}\\s*=\\s*\'\\w+\';\\s*if\$\\s*isset\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*\'\\w+\'\\s*\\]\$\\)\\s*{\\s*if\\s*\$\\s*md5\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*\'\\w+\'\\s*\\]\$\\s*===\\s*\\$\\w+\\s*\\)\\s*@?eval\$\\s*base64_decode\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*\'\\w+\'\\s*\\]\\s*\$\\s*\\);\\s*exit;\\s*}\\s*if\$\\s*isset\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*\'\\w+\'\\s*\\]\\s*\$\\s*\\){\\s*phpinfo\$\\s*\$;\\s*}',
        '@?array_filter\$\\s*/\\*\\w+\\*/\\s*array\\(\\s*/\\*\\w+\\*/@?\\$_(GET|POST|COOKIE|REQUEST|SERVER){\\s*(/\\*\\w+\\*/)?"\\w+"/\\*\\w+\\*/}\$\\s*,\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER){\\s*/\\*\\w+\\*/[\'"]\\w+[\'"]/\\*\\w+\\*/\\s*}\\s*/\\*\\w+\\*/\\s*\\);',
        '@?filter_var\\s*\$\\s*\\$_(GET|POST|REQUEST|SERVER|COOKIE){\\s*(/\\*\\w+\\*/)?[\'"]\\w+[\'"]/\\*\\w+\\*/\\s*}\\s*,\\s*FILTER_CALLBACK\\s*,\\s*array\\(\\s*(/\\*\\w+\\*/)?[\'"]\\w+[\'"]\\s*=>\\s*@?\\$_(GET|POST|REQUEST|SERVER|COOKIE){\\s*(/\\*\\w+\\*/)?\\w+(/\\*\\w+\\*/)?\\s*}\\s*\$\\s*\\);',
        'if\\s*\$\\s*isset\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[["\']\\w+["\']\\]\$\\)\\s*{(/\\*\\w+\\*/)?@?extract\$\\$_(GET|POST|COOKIE|REQUEST|SERVER)\$;\\s*(/\\*\\w+\\*/)?@?die\$\\$\\w+\\(\\$\\w+\$\\);\\s*(/\\*\\w+\\*/)?}',
        'if\\s*\$\\s*isset\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\$\\s*\\)\\s*{\\s*(\\s*/\\*\\w+\\*/)?@?preg_replace\$\\s*[\'"]/\\(\\.\\*\$/e\'\\s*,\\s*@?\\$_REQUEST\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*,\\s*[\'"][\'"]\\s*\\);\\s*(/\\*\\w+\\*/)?\\s*}',
        'if\\s*\$\\s*strpos\\(\\s*strtolower\\(\\s*\\$_SERVER\\[\\s*\'REQUEST_URI\'\\s*\\]\\s*\$\\s*,\\s*\'\\w+\'\\s*\\)\\s*\\)\\s*{\\s*include\\s*\$\\s*getcwd\\s*\\(\\s*\$\\s*\\.\\s*\'/\\w+\\.php\'\\s*\\);\\s*exit;\\s*}',
        '\\$query\\s*=\\s*isset\$\\$_SERVER\\[\'QUERY_STRING\'\\]\$\\?\\s*\\$_SERVER\\[\'QUERY_STRING\'\\]:\\s*\'\';\\s*if\\s*\$false\\s*!==\\s*strpos\\(\\$query,\\s*\'[\\w-]+\'\$\\)\\s*{\\s*__\\w+_\\w+\$\$;.+?stream_context_create\$\\$options\$;\\s*\\$contents\\s*=\\s*@file_get_contents\$\\$url,\\s*false,\\s*\\$context\$;\\s*}\\s*}\\s*}\\s*return\\s*\\$contents;\\s*}',
        '\\$user_agent_to_filter\\s*=\\s*array\$\\s*\'\\#Ask.+?\\$ch\\s*=\\s*curl_init\\(\\s*\$;\\s*curl_setopt\$\\$ch,\\s*CURLOPT_URL,\\s*"https?://.+?\\?useragent=\\$_SERVER\\[\\s*HTTP_USER_AGENT\\s*\\]&domain=\\$_SERVER\\[\\s*HTTP_HOST\\s*\\]"\$;\\s*\\$result\\s*=\\s*curl_exec\$\\s*\\$ch\\s*\$;\\s*curl_close\\s*\$\\s*\\$ch\\s*\$;\\s*echo\\s*\\$result;\\s*}',
        '\\$\\w{1,40}\\s*=\\s*getenv\$"SCRIPT_NAME"\$;\\s*\\$\\w+\\s*=\\s*getenv\$"SCRIPT_FILENAME"\$;\\s*\\$\\w+\\s*=\\s*substr\$\\$\\w+,\\s*0,\\s*strpos\\(\\$\\w+,\\s*\\$\\w+\$\\);\\s*\\$\\w+\\s*=\\s*\\$\\w+\\s*\\.\\s*\'/xm1rpc\\.php\';\\s*if\\s*\$!file_exists\\(\\$\\w+\$\\s*\\|\\|\\s*file_exists\$\\$\\w+\$\\s*&&\\s*\$filesize\\(\\$\\w+\$\\s*<\\s*3000\\)\\s*\\|\\|\\s*file_exists\$\\$\\w+\$\\s*&&\\s*\$time\\(\$\\s*-\\s*filemtime\$\\$\\w+\$\\s*>\\s*60\\s*\\*\\s*60\\s*\\*\\s*1\\)\\)\\s*{\\s*file_put_content.+?\\$enc1\\s*=\\s*\\$enc2\\s*=\\s*\\$enc3\\s*=\\s*\\$enc4\\s*=\\s*"";\\s*}\\s*while\\s*\$\\$i\\s*<\\s*strlen\\(\\$\\w+\$\\);\\s*return\\s*\\$\\w+;\\s*}',
        '<\\?(php)?\\s*@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w*\'\\]\\s*\$str_rot13\\s*\\(\'\\w*\\s*\\(\\s*\\$_\\w*\\["\\w*"\\]\\s*\$;\'\\s*\\)\\s*\\);\\s*\\?>',
        '\\$\\w{1,40}="create.+?return\$[^}]+};for\\(\\$\\w+=-\\d+;\\+\\+\\$\\w+<\\d+;\\$\\w+\\(\'\',\'}\'\\.\\$\\w+\\[\\s*\\$\\w+\\s*\\]\\s*\\.\\s*\'{\'\$\\);};unset\$\\$\\w+\$;',
        '\\$\\w+\\s*=\\s*"\\w+"\\s*;\\s*\\$\\w+\\s*=\\s*strtolower\\s*\$(?:\\s*\\$\\w+\\[\\s*\\d+\\s*\\]\\s*\\.?)+\$\\s*;.+?eval\\s*\$\\s*\\$\\w+\\s*\\w+\\s*\\(\\s*\\$\\s*\\{\\s*\\$\\w+\\s*\\}\\s*\\[\\s*\'\\w+\'\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\}',
        'if\$\\s*!empty\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\$\\){\\s*extract\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\$;\\$(\\s*\\w+\\s*)\\s*=\\s*\\$\\w+\$\\s*\'\'\\s*,\\s*\\$\\w+\\(\\$\\w+\\(\\s*"\\w+"\\s*,\\s*""\\s*,\\s*\\$\\w+\$\\s*\\)\\s*\\);\\s*\\$\\1\$\\s*\$;\\s*}',
        '\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'\\w+\'\\s*\\]\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'\\w+\'\\s*\\]\\(\'\'\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'\\w+\'\\s*\\]\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\'\\w+\'\\]\\s*\$\\s*\\)\\s*\\);',
        '<\\?php\\s*(\\$\\w+\\s*=\\s*"[a-zA-Z0-9/=_]+";\\s*\\$\\w+\\s*=\\s*(str_replace|\\$\\w+)\$\\s*"\\w+"\\s*,\\s*""\\s*,\\s*"\\w+"\\s*\$;\\s*)+\\$\\w+\\s*=\\s*"\\w+";\\s*\\$\\w+\\s*=\\s*\\$\\w+\\s*\$\\s*\'\'\\s*,\\s*\\$*.+?\\$\\w+\\(\$;',
        '<\\?php\\s*(\\$\\w+\\s*=\\s*"[a-zA-Z_=/0-9\\?]+";\\s*)+\\s*(\\$\\w+\\s*=\\s*(str_replace|\\$\\w+)\\s*\$\\s*"\\w+"\\s*,\\s*""\\s*,\\s*"\\w+"\$;\\s*)+\\$\\w+\\s*=\\s*\\$\\w+\\s*\$\\s*\'\'\\s*,\\s*\\$\\w+\\s*\\(\\s*\\$\\w+\\s*\\(\\s*\\$\\w+\\("[^"]+"\\s*,\\s*""\\s*,\\s*.+?\\$\\w+\\(\$;',
        '<\\?php\\s+function\\s+\\w+\$\\$\\w+\${\\s*\\$\\w+\\s*=\\s*\'[base64decode_\\.\']+\';\\s*\\$\\w+\\s*=\\s*gzinflate\$\\$code\\(\\$\\w+\$\\);\\s*for\$\\$i=0;\\$i<strlen\\(\\$\\w+\$;\\$i\\+\\+\\)\\s*{\\s*\\$\\w+\\[\\$i\\]\\s*=\\s*chr\$ord\\(\\$\\w+\\[\\$i\\]\$-1\\);\\s*}\\s*return\\s+\\$\\w+;\\s*}eval\$\\w+\\("[^"]+"\$\\);\\?>',
        '<\\?php\\s*echo\\s*\'<b><br><br>\'\\.php_uname\$\\s*\$.+echo\\s*\'<b>Upload[^<]+</b><br><br>\';\\s*}\\s*}\\s*\\?>',
        '<\\?php\\s*add_action\$\\s*\'wp_head\'\\s*,\\s*\'\\w+\'\\s*\$;\\s*function\\s+\\w+\$\$\\s*{\\s*if\\s*\$\\s*md5\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\\s*\$\\s*==\\s*\'\\w+\'\\s*\\)\\s*{\\s*require\$\\s*\'wp-includes/registration\\.php\'\\s*\$;\\s*if\\s*\$\\s*!username_exists\\(\\s*\'\\w+\'\\s*\$\\s*\\)\\s*{\\s*\\$user_id\\s*=\\s*wp_create_user\$\\s*\'\\w+\',\\s*\'\\w+\'\\s*\$;\\s*\\$\\w+\\s*=\\s*new\\s+WP_User\$\\s*\\$user_id\\s*\$;\\s*\\$user->set_role\$\\s*\'\\w+\'\\s*\$;\\s*}\\s*}\\s*}\\s*\\?>',
        'error_reporting\$E_ALL\$;\\s*\\$\\w+\\s*=\\s*\'\';\\s*\\$\\w+\\s*=\\s*\'RewriteEngine On.+if\\s*\$file_exists\\(\'index\\.php\'\$\\)\\s*{\\s*file_put_contents\$\'index\\.php\'\\s*,\\s*str_replace\\(array\\(\\$\\w+,\\$\\w+\$,\\s*\'\'\\s*,\\s*file_get_contents\$\'index\\.php\'\$\\)\\);\\s*}',
        '<\\?php\\s*\\$\\w+\\s*=\\s*"[assertevl"\\.]+"\\s*;\\s*\\$\\w+\$\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\["\\w+"\\]\$;',
        '<\\?php\\s*\\$password=.+?if\\s*\$!empty\\s*\\(\\$_FILES\\[\'\\w+\'\\]\$\\)\\s*{\\s*move_uploaded_file.+?<input type="submit" name="login" value="go!" /\\s*></form>\\s*<\\?php\\s*}\\s*\\?>',
        '<\\?php\\s*if\$\\s*isset\\(\\s*\\$_(REQUEST|GET|POST|COOKIE|SERVER)\\["\\w+"\\]\\s*\$\\s*\\)\\s*{\\s*echo\\s*"[^"]+";\\s*}\\s*\\$f\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["\\w+"\\];\\s*\\$id=\\$f;\\s*\\$current\\s*=\\s*file_get_contents\$"[^"]+"\$;\\s*file_put_contents\$\\$\\w+\\s*,\\s*\\$\\w+\$;',
        '<\\?php\\s+@?eval\$\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\["\\w+"\\]\$;\\?>',
        '/\\*[^*]+\\*/\\s*(\\$\\w+\\s*=\\s*\'[^\']+\'\\s*\\^\\s*\'[^\']+\'\\s*;\\s*){3,10}\\$\\w+\\s*=\\s*\\$\\w+\$\'\',\\$\\w+\\(\\$\\w+\\(\'[^\']+\'\\^\'[^\']+\'\$\\)\\);\\s*\\$\\w+\$\\s*\$;',
        'if\\s*\$\\s*\\$_REQUEST\\["\\w+"\\]\\s*\$\\s*{\\s*@assert\$\\s*base64_decode\\(\\s*\\$_REQUEST\\[\\s*"\\w+"\\s*\\]\$\\);\\s*//[\\w\\s]+\\s*echo\\s*"[\\w\\s]+";\\s*exit\$\\s*\$;\\s*}',
        'if\$isset\\(\\$_(GET|POST|COOKIE|REQUEST)\\["\\w+"\\]\$\\){@\\$_(GET|POST|COOKIE|REQUEST)\\["\\w+"\\]\$stripslashes\\(\\$_(GET|POST|COOKIE|REQUEST)\\["\\w+"\\]\$\\);};',
        '<IfModule\\s+mod_rewrite\\.c>\\s*RewriteCond\\s+%{HTTP_USER_AGENT}\\s+\$google\\|yahoo\\|msn\\|aol\\|bing\$ \\[OR\\]\\s*RewriteCond\\s+%{HTTP_REFERER}\\s+\$google\\|yahoo\\|msn\\|aol\\|bing\$\\s*RewriteRule \\^\\.\\*\\$\\s+index\\.php\\s+\\[L\\]\\s*<\\/IfModule>',
        'RewriteEngine\\s+on\\s*RewriteCond\\s+%{HTTP_USER_AGENT}\\s+android\\|avantgo\\|bada.+?zeto\\|zte\\\\-\\)\\s*\\[NC\\]\\s+RewriteRule\\s*\\^\\$\\s+http://.+?\\[R,L\\]',
        '<\\?php\\s*\\$\\w+\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\];\\s*if\\s*\$\\$\\w+\\s*!=\\s*""\$\\s*{\\s*\\$\\w+=base64_decode\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;\\s*@eval\$"\\\\\\$\\w+\\s*=\\s*\\$\\w+;"\$;\\s*}\\s*\\?>',
        'if\$isset\\(\\$_REQUEST\\["(\\w+)"\\]\$\\)\\s*\\$_REQUEST\\["\\1"\\]\$\\$_REQUEST\\["\\w+"\\]\$;',
        'if\\s*\$\\$_SERVER\\[\'QUERY_STRING\'\\]\\s*==\\s*\'index\'\$\\s*{\\s*echo\\s*\'<form\\s*action=""\\s*method=post\\s*enctype=multipart/form-data><input\\s*type=file\\s*name=uploadfile><input\\s*type=submit\\s*value=Upload></form>\';\\s*\\$uploaddir\\s*=\\s*\'\';\\s*\\$uploadfile\\s*=\\s*\\$uploaddir\\.basename\$\\$_FILES\\[\'uploadfile\'\\]\\[\'name\'\\]\$;\\s*if\\s*\$copy\\(\\$_FILES\\[\'uploadfile\'\\]\\[\'tmp_name\'\\],\\s*\\$uploadfile\$\\)\\s*{\\s*echo\\s*"<h3>OK</h3>";\\s*exit;\\s*}else{\\s*echo\\s*"<h3>NO</h3>";\\s*exit;\\s*}\\s*exit;\\s*}',
        '\\$GLOBALS\\[\'_(\\d+)_\'\\]=Array\$base64_decode\\(.*?if\\(isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[_(\\d+)\\(\\d+\$\\]\\)\\){\\$_\\d+=\\$GLOBALS\\[\'_\\1_\'\\]\\[\\d+\\]\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[_\\2\\(\\d+\$\\]\\);\\$GLOBALS\\[\'_\\1_\'\\]\\[\\d+\\]\$\\$_\\d+,\\$_\\d+\$;}echo \\$_\\d+;exit;}',
        'error_reporting\$0\$;\\s*ini_set\$\\s*"display_errors"\\s*,\\s*0\$\\;\\s*include_once\$\\s*sys_get_temp_dir\\(\\s*\$\\s*\\.\\s*"/SESS_[a-f0-9]{32}"\\);',
        '\\$url\\s*=\\s*".*?";\\s*if\\s*\$isset\\(\\$_SERVER\\[\'HTTP_REFERER\'\\]\$\\s*AND\\s*!isset\$\\$_COOKIE\\["\\w+"\\]\$\\)\\s*{\\s*setcookie\$"\\w+",\\s*"1",\\s*time\\(\$\\+\\d+\\);\\s*\\$urls\\s*=\\s*array\$"google\\.",\\s*"yandex\\.",\\s*"yahoo\\.",\\s*"aol\\.",\\s*"msn\\.",\\s*"rambler\\.",\\s*"mail\\.",\\s*"ya\\.",\\s*"bing\\.",\$;\\s*for\\s*\$\\$i=0;\\s*\\$i\\s*<\\s*count\\(\\$urls\$;\\s*\\$i\\+\\+\\)\\s*if\\s*\$strpos\\(\\$_SERVER\\[\'HTTP_REFERER\'\\],\\s*\\$urls\\[\\$i\\]\$!==false\\)\\s*exit\$\'<script>document\\.location\\.href\\s*=\\s*"\'\\.\\$url\\.\'";</script>\'\$;\\s*}',
        '<\\?(php)?\\s*\\$\\w+\\s*=\\s*@?\\$_SERVER\\["HTTP_USER_AGENT"\\].+?@eval\$\\s*\\$\\w+\\[\\w+\\]\\s*\$;\\s*echo\\s*"[^"]+";\\?>',
        'error_reporting(0);\\s*ini_set(\\s*"display_errors"\\s*,\\s*0)\\;\\s*include_once(sys_get_temp_dir()\\."/SESS_[a-f0-9]+");',
        'eval\$strrev\\(file_get_contents\\(\'[\\-\\w.]+\'\$\\)\\);',
        '\$\\$\\w+\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*\'\\w+\'\\s*\\]\$\\s*&&\\s*@preg_replace\$\'/\\w+/e\'\\s*,\\s*\'@\'\\s*\\.\\s*base64_decode\\(\\s*"[\\w=+/]+"\\s*\$\\s*\\.\'\\s*\$\\s*\\$\\w+\\s*\$\'\\s*,\\s*\'\\w+\'\\s*\\);',
        'arr2html\$\\$_REQUEST\\[\'\\w+\'\\]\$;',
        '\\$(\\w+)="create_";global\\s+\\$(\\w+);\\s*\\$\\2=array\$\'\\$\\2[\\d+]=array_pop(\\$\\2);\\$(\\w+)=\\3\\(\\d+\$;\\$\\2[\\d+]=\\$\\3\$\\$\\2[\\d+]\$;.?\\$\\2[\\d+]=gzuncompress\$.+?\$;if\$function_exists\\(\\$\\1\\.=\'function\'\$&&!function_exists\$\'\\3\'\$\\){\\s*function\\s+\\3\$\\$\\w+,\\$\\w+=\\d+\${global\\s+\\$\\2;.?;\\$\\1.?;unset\$\\$\\2\$;',
        '<\\?php\\s*if\$!\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\${\\s*header\$\'HTTP/1\\.1 404 Not Found\'\$;\\s*exit\$\$;.+?}\\s*\\?>',
        '//\\#\\#\\#=CACHE START=\\#\\#\\#.*?//\\#\\#\\#=CACHE END=\\#\\#\\#',
        '<\\?php\\s*eval\$"(\\\\x?[\\w]+){6,}.+(\\\\x?[\\w]{3,})"\$;\\s*\\?>$',
        '<\\?php\\s*\\$\\w+\\s*=\\s*Array\$(\'\\w+\'=>\'\\w+\',?\\s*){20,}\\s*\$;\\s*function\\s*\\w+\$\\$\\w+,\\s*\\$\\w+\${\\$\\w+.+?base64_decode.+eval\$\\w+\\(\\$\\w+,\\s*\\$\\w+\$\\);\\?>',
        '(\\$\\w+\\s*=\\s*(chr\$\\s*(\\d+|ord\\(["\']\\w+["\']\$)\\s*[\\^\\+\\-/\\*]\\s*(\\d+|ord\$["\']\\w+["\']\$)\\s*\\)\\.?)+;\\s*){2,}.+?exit\$\\${\\w+\\(',
        '(\\$\\w+)="base64_decode";assert\\(\\1\\(\'[\\w=]+\'\$\\);',
        'error_reporting\$0\$;\\s*set_time_limit\$0\$;\\s*if\\s*\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]==\'1\'\${echo\\s*\'200\';\\s*exit;}\\s*if\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]==\'\\w+\'\$eval\$base64_decode\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\);\\s*if\$md5\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$==\'\\w+\'\\)eval\$base64_decode\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\);',
        'if\\s*\$\\$mode==\'upload\'\$\\s*{\\s*if\$is_uploaded_file\\(\\$_FILES\\["filename"\\]\\["tmp_name"\\]\$\\)\\s*{\\s*move_uploaded_file\$\\$_FILES\\["filename"\\]\\["tmp_name"\\],\\s*\\$_FILES\\["filename"\\]\\["name"\\]\$;\\s*echo \\$_FILES\\["filename"\\]\\["name"\\];\\s*}\\s*}',
        '<html>\\s*<head>\\s*<meta http-equiv="Content-Type" content="text/html; charset=windows-utf-8">\\s*<title>\\w+</title>\\s*</head>\\s*<body>\\s*<\\?php\\s*print \'<h1>.*?</h1>\';\\s*echo ".*?";.*?echo\\s*\\$_SERVER\\[\'REMOTE_ADDR\'\\];\\s*echo\\s*"<form method=\\\\"post\\\\"\\s*enctype=\\\\"multipart/form-data\\\\">.*?if\\s*\$\\s*@is_uploaded_file\\(\\s*\\$_FILES\\["\\w+"\\]\\["\\w+"\\]\\s*\$\\)\\s*{\\s*.*?move_uploaded_file\$\\$_FILES\\["\\w+"\\]\\["tmp_name"],.*?\\$_FILES\\["\\w+"\\]\\["name"\\]\$;.*?echo\\s*"<a\\s*href=\\\\"\\$\\w+\\\\">\\$\\w+</a>";\\s*.*?\\$\\w+\\s*=\\s*\\$_SERVER\\[\'SCRIPT_FILENAME\'\\];\\s*touch\$\\s*\\$\\w+\\s*\$;\\s*\\?>\\s*</body>\\s*</html>',
        '(\\$\\w+)=[\'|"](\\w+)\\.zip[\'|"];\\s*(\\$\\w+)\\s*=\\s*file_get_contents\$[\'|"][^\'|^"]+[\'|"]\$;\\s*file_put_contents\$\\1,\\s*\\3\$;.*?pclzip\\.lib\\.php.*(\\$\\w+)\\s*=\\s*new\\s*PclZip\$\\1\$;\\s*if\\s*\$\\4->extract\\(\$\\s*==\\s*0\\)\\s*{\\s*die\$"Error\\s*:\\s*"\\.\\4->errorInfo\\(true\$\\);\\s*}',
        '(\\$\\w+)\\s*=\\s*scandir\$\\$_SERVER\\[\'DOCUMENT_ROOT\'\\]\$;\\s*for\\s*\$(\\$\\w+)=0;\\2<count\\(\\1\$;\\2\\+\\+\\)\\s*{\\s*if\$stristr\\(\\1\\[\\2\\],\\s*\'php\'\$\\)\\s*{\\s*(\\$\\w+)\\s*=\\s*filemtime\$\\$_SERVER\\[\'DOCUMENT_ROOT\'\\]."/".\\1\\[\\2\\]\$;\\s*break;\\s*}\\s*}\\s*touch\$dirname\\(__FILE__\$,\\s*\\3\\);touch\$\\$_SERVER\\[\'SCRIPT_FILENAME\'\\],\\s*\\3\$;\\s*@\\$_REQUEST\\[\'\\w+\'\\]\$str_rot13\\(\'riny\\(\\$_ERDHRFG\\["\\w+"\\]\$;\'\\)\\);\\s*if\$\\s*!\\s*defined\\(\\s*\'DATALIFEENGINE\'\\s*\$\\s*\\)\\s*{\\s*die\$\\s*"Hacking\\s*attempt!"\\s*\$;\\s*}\\s*if\$\\s*isset\\(\\s*\\$view_template\\s*\$\\s*and\\s*\\$view_template\\s*==\\s*"rss"\\s*\\)\\s*{\\s*}\\s*elseif\$\\s*\\$category_id\\s*and\\s*\\$cat_info\\[\\$category_id\\]\\[\'shot_tpl\'\\]\\s*!=\\s*\'\'\\s*\$\\s*\\$tpl->load_template\$\\s*\\$cat_info\\[\\$category_id\\]\\[\'shot_tpl\'\\]\\s*.\\s*\'.tpl\'\\s*\$;\\s*else\\s*\\$tpl->load_template\$\\s*\'\\w+.tpl\'\\s*\$;\\s*',
        '(\\$\\w+)\\s*=\\s*[\'|"][assert]+(\\|\\|\\|\\w+\\|\\|\\|)[assert]+[\'|"];\\s*(\\$\\w+)\\s*=\\s*[\'|"][base64_decode]+(\\2)[base64_decode]+[\'|"];\\s*(\\$\\w+)\\s*=\\s*str_replace\$[\'|"]\\2[\'|"],[\'|"]+,\\1\$;\\s*(\\$\\w+)\\s*=\\s*str_replace\$[\'|"]\\2[\'|"],[\'|"]+,\\3\$;\\s*(\\$\\w+)\\s*=\\s*[\'|"][\\w=]+\\2[\\w+=]+\';\\s*\\$\\w+\\s*=\\s*str_replace\$[\'|"]\\2[\'|"],[\'|"]+,\\7\$;\\s*\\1\$\\3\\(\\7\$\\);',
        '<\\?php\\s*/\\*\\s*\\w+\\s*\\*/\\s*\\?><\\?php\\s*(\\$\\w+)\\s*=\\s*"[^"]+";\\s*(\\$\\w+)\\s*=\\s*base64_decode\$\\1\$;\\s*(\\$\\w+)\\s*=\\s*\'\';\\s*for\\s*\$\\$\\w+\\s*=\\s*0;\\s*\\$\\w+\\s*<\\s*strlen\\(\\2\$;\\s*\\$\\w+\\+\\+\\)\\s*{\\s*\\3\\s*\\.=\\s*chr\$ord\\(\\2\\[\\$\\w+\\]\$\\s*\\^\\s*ord\$\'x\'\$\\);\\s*}\\s*eval\$\\3\$\\s*\\?>\\s*<\\?php\\s*/\\*\\s*\\w+\\s*\\*/\\s*\\?>',
        'if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'(\\w+)\'\\]\$\\){ \\$(\\w+) = base64_decode\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\1\'\\]\$; @eval\$\\$\\2\$; }',
        '<\\?php\\s*error_reporting\$0\$;\\s*(\\$\\w+)=array\$\$;\\s*if \$strlen\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'(\\w+)\'\\]\$>0\\){\\1=explode\$\' :: \',urldecode\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\2\'\\]\$\\);}\\s*if \$strlen\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'(\\w+)\'\\]\$>0\\){array_push\$\\1,\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\3\'\\]\$;}\\s*(\\$\\w+)=\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\];\\s*(\\$\\w+) = urldecode\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;\\s*foreach \$\\1 as (\\$\\w+)\$.*?\\$\\w+=fwrite\$\\$\\w+,\\5\$;.*?\\?>',
        '<\\?php\\s*\\$\\w+\\s*=\\s*"[preg_replace\\.\\"]+";\\s*@?\\$\\w+\$\\s*"/\\[\\w+\\]/e"\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["\\w+"\\],"\\w+"\$;\\s*\\?>',
        '<\\?php\\s*\\$\\w+\\s*=\\s*base64_decode\$\'.+?;@?\\$c\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?\\w+[\'"]?\\]\$;\\s*\\?>',
        '<\\?php\\s*if\$strpos\\(strtolower\\(\\$_SERVER\\[\'REQUEST_URI\'\\]\$,\'essay\'\\)\\){include\$getcwd\\(\$\\.\'/config-info\\.php\'\\);\\s*exit;}\\s*\\?>',
        'if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\){\\s*(\\$\\w+) = \\$_SERVER\\[DOCUMENT_ROOT\\];\\s*(\\$\\w+) = <<<\'EOD\'\\s*if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\){if\$isset\\(\\$_FILES\\[\'(\\w+)\'\\]\$\\){(\\$\\w+)=getcwd\$\$\\.\'/\';(\\$\\w+)=\\$_FILES\\[\'\\3\'\\];@move_uploaded_file\$\\5\\[\'tmp_name\'\\], \\4\\.\\5\\[\'name\'\\]\$;.*?<form method="POST" enctype="multipart/form-data"><input type="file" name="\\3"/><input type="Submit"/></form><\\?php }}\\s*EOD;\\s*(\\$\\w+) = <<<\'EOD\'\\s*<\\?php if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\){if\$isset\\(\\$_FILES\\[\'(\\w+)\'\\]\$\\){(\\$\\w+)=getcwd\$\$\\.\'/\';(\\$\\w+)=\\$_FILES\\[\'\\3\'\\];@move_uploaded_file\$\\5\\[\'tmp_name\'\\], \\4\\.\\5\\[\'name\'\\]\$;.*?<form method="POST" enctype="multipart/form-data"><input type="file" name="\\3"/><input type="Submit"/></form><\\?php }} \\?>\\s*EOD;\\s*(\\$\\w+) = array\$(\\1\\."/[a-z0-9\\-_\\s\\/]+\\.php"?,?\\s*)+\$;\\s*foreach\$\\10 as (\\$\\w+)\${\\s*(\\$\\w+) = file_get_contents\$\\12\$;\\s*if \$stripos\\(\\13, \'\\w+\'\$ == false\\){\\s*if\$preg_match\\(\'/\\\\\\?>\\(\\\\s\\+\$\\?\\$/i\', \\13\\) == false\\){\\s*\\13 \\.= \\2;\\s*file_put_contents\$\\12, \\13\$;\\s*}else{\\s*(\\$\\w+) = \'/\\\\\\?>\$\\\\s\\+\$\\?\\$/i\';\\s*(\\$\\w+) = \'\\?>\';\\s*\\13\\s*= preg_replace\$\\14, \\15, \\13\$;\\s*\\13 \\.= \\6;\\s*file_put_contents\$\\12, \\13\$;\\s*}\\s*}\\s*}\\s*}',
        '<\\?php\\s*/\\*[^*]{1,5000}\\*/\\s*@eval\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;\\s*\\?>',
        '<\\?php\\s*\\$\\w+\\s*=\\s*["base64\\s\\._decode"]+;\\s*assert\$\\$\\w+\\(\'[a-zA-Z0-9\\d\\./]{500,}\'\$\\);\\s*\\?>',
        'if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\){if\$isset\\(\\$_FILES\\[\'(\\w+)\'\\]\$\\){(\\$\\w+)=getcwd\$\$\\.\'/\';(\\$\\w+)=\\$_FILES\\[\'\\1\'\\];@move_uploaded_file\$\\3\\[\'tmp_name\'\\], \\2\\.\\3\\[\'name\'\\]\$;.*?<form method="POST" enctype="multipart/form-data"><input type="file" name="\\1"/><input type="Submit"/></form><\\?php }}',
        '<\\?(php)?\\s*(eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[^\\]]+\\s*\\]\\s*\$\\s*;',
        '<\\?php\\s*(\\$.\\s*=\\s*[\\wchr\$\$\\d+\\./\\*;\\s"\']+)+\\$.\$[chr\\(\$\\d\\.,\\s*\\$abc]+;\\s*$',
        '((\\$\\w+=\'.\';)+\\$\\w+=(\\$\\w+\\.?)+;)+eval\$\\$\\w+\\(\\$\\w+\\(\\$\\w+\\(\\$\\w+\\(\'[^\']+\'\$\\)\\)\\)\\);',
        'if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\)echo\\s+shell_exec\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\)echo\\s+eval\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;',
        '<\\?php if\$!isset\\(\\$GLOBALS.+?};}\\s*\\$\\w+="[a-zA-Zx\\\\\\d]+";\\s*\\$\\w+=substr\\(\\$\\w+,\\([\\d\\-\\+\\*/]+\$,\$[\\d\\-\\+\\*/]+\$\\);\\s*\\$\\w+\$\\$\\w+,\\s*\\$\\w+,\\s*NULL\$;\\s*\\$\\w+=\\$\\w+;\\s*\\$\\w+=\$[\\d\\-\\+\\*/]+\$;\\s*\\$\\w+=\\$\\w+-\\d+;\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*!isset\\(\\s*\\$GLOBALS.+\\$\\w{1,40}\\s*=\\s*substr\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\\(\\s*\\d+\\s*[\\-+/^]\\s*\\d+\\s*\$\\s*,\\s*\$\\s*\\d+\\s*[\\-+/^]\\s*\\d+\\s*\$\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*NULL\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\$\\s*\\d+\\s*[\\-+/^]\\s*\\d+\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}-1\\s*;\\s*\\?>',
        '<\\?if\$\\$_(GET|POST|COOKIE|SERVER|REQUEST).+\\$sh==\'127\\.0\\.1\\.\\d+\'\${\\s*header\$\'HTTP/1\\.1 203\'\$;exit;}}header\$\'HTTP/1\\.1 201\'\$;exit;}header\$\'HTTP/1\\.1 302 Found\'\$;header\$\'Location: [^\']+\'\$;\\?>',
        '\\$\\w{1,40}=\'\\w+\$\\!\\w+\\("\\w+"\$\\).*?;return\\s+\\$module->content\\.html;\\}',
        '<\\?php\\s*echo"\\w+";error_reporting\$0\$;\\s*if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$ && md5\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'com\'\\]\$\\s*==\\s*\'\\w+\'\\s*&&\\s*isset\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\)\\s*\\$kk\\s*=\\s*strtr\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\],\\s*\'-_,\',\\s*\'\\+/=\'\$;eval\$base64_decode\\(\\$\\w+\$\\);\\s*echo"\\w+";\\s*\\?>',
        '<\\?php\\s*(/\\*[^\\*]+?\\*/)?\\s*\\$GLOBALS\\[\'\\w+\'\\]\\s*=\\s*"\\w+";(\\s*//.+?$)?\\s*\\$\\w+="[create_function\\.\\"\\s]+";\\$\\w{1,40}=\\$\\w+\$\'[\\$evalx\',\\.(\\"\\?>gzinfltbs64dcode_);]+\\$\\w+\\(".+"\$;\\s*(\\?>)?',
        '<\\?\\s*\\$ip = getenv\$"REMOTE_ADDR"\$;.+?\\$headers \\.= \\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'eMailAdd\'\\]\\."\\\\n";.+?header\$"Location:.+?\\?>',
        '<\\?php\\s*\\$\\w+\\s*=\\s*\\$_FILES\\[\'\\w+\'\\]\\[\'\\w+\'\\];\\s*move_uploaded_file\\(\\$_FILES\\[\'\\w+\'\\]\\[\'\\w+\'\\],\\s*\\$\\w+\$;\\s*if\\s*\$isset\\s*\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'main\'\\]\$\\)\\s*{\\s*echo\\s*\'<form method\\s*=\\s*"post".*?</form>\';\\s*}\\s*\\?>',
        '<\\?php\\s+\\$\\w+\\s*=.+?\\$\\w+\\s*=\\s*explode\$chr\\(\\(\\d+[\\-\\+\\*\\/]\\d+\$\\),\\s*\'(\\d+,?)+\'\\);\\s*\\$\\w+\\s*=\\s*\\$cenghfgqo\$"",erjcqwd\\(\\$\\w+,\\$\\w+,\\$\\w+\$\\);\\s*\\$\\w+=\\$\\w+;\\s*\\$\\w+\$""\$;\\s*\\$\\w+=\$\\d+[\\-\\+\\/\\*]\\d+\$;\\s*\\$\\w+=\\$\\w+-\\d+;\\s*\\?>\\s*',
        '\\$\\w{1,40}=\'base64_decode\';\\$\\w+=\\$\\w+\$\\$_[POST|GET]+\\[\'\\w+\'\\]\$;file_put_contents\$\'\\w+\',\'<\\?php\\s*\'\\.\\$\\w+\$;include\$\'\\w+\'\$;unlink\$\'\\w+\'\$;',
        '/\\*\\w+\\.php\\s*\\*/\\s*@require_once\$.*?\$;\\s*/\\*\\w+\\.php\\s*\\*/',
        '\\$_[O0]*="[a-f0-9]{32}";\\$_[O0]*=str_rot13\$.*?eval\\(strrev\\(\'.*?\'.*?eval\\(_[0O]*\\(_[0O]*\\(".*"\$,\\$_[0O]*\\)\\);eval\$_[0O]*\\(\\$_[0O]*\$\\);\\$\\w+=\'.*?\';',
        '\\$[O0]+\\s*=\\s*urldecode\$"[^"]+"\$;.{100,400}eval\$\\$[O0]+\\(".{100,1000}"\$\\);\\s*',
        '<\\?php\\s*\\$\\w+\\s*=\\s*file_get_contents\$\\s*"http://.+?"\\s*\$;\\s*if\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["\\w+"\\]=="\\w+"\${\\s*eval\$\\$\\w+\$;\\s*exit;\\s*}\\s*\\?>\\s*',
        '<\\?php\\s*preg_replace\$"/\\.\\*/e","(\\\\x[a-fA-F0-9]+){5,}.+",""\$;\\s*(\\?>)?\\s*$',
        'if\$isset\\(\\$_(GET|POST|COOKIE)\\[\'\\w+\'\\]\$\\){\\$str = \\$_(GET|POST|COOKIE)\\[\'\\w+\'\\]; \\$\\w+[\\/\\*/\\-]*\$[/\\*\\/\\-]*\\$_(GET|POST|COOKIE)\\[\'\\w+\'\\][/\\*\\/\\-]*\$;}',
        'eval\$base64_decode\\("CmV[A-Za-z0-9\\+\\/\\=]+"\$\\);',
        '\\$\\w{1,40}\\s*=\\s*"\\w+"\\s*;\\s*\\$\\w+\\s*=\\s*strtoupper\\s*\$\\s*(\\s*\\$\\w+\\[\\d+\\]\\s*\\.?\\s*)+\$\\s*;\\s*if\$\\s*isset\\s*\\(\\s*\\${\\s*\\$\\w+\\s*}\\s*\\[\\s*\'\\w+\'\\s*]\\s*\$\\s*\\)\\s*{\\s*eval\\s*\$\\s*\\$\\s*{\\s*\\$\\w+\\s*}\\s*\\[\\s*\'\\w+\'\\s*\\]\\s*\$;\\s*}',
        '\\$\\w{1,40}\\s*=\\s*"\\w+"\\s*;\\s*\\$\\w+\\s*=\\s*strtolower\\s*\$\\s*(\\s*\\$\\w+\\[\\d+\\]\\s*\\.?\\s*)+\$\\s*;\\s*.+?eval\\s*\$\\s*\\$\\w+\\s*\\(\\s*\\${\\s*\\$\\w+\\s*}\\s*\\[\\s*\'\\w+\'\\s*\\]\\s*\$\\s*\\);\\s*}',
        '<form\\s+enctype=multipart/form-data\\s+method=post>\\s*<input\\s+name=fileMass\\s+type=file>.+?@copy\$\\$_FILES\\[fileMass\\]\\[tmp_name\\],\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[path\\]\\.\\$_FILES\\[fileMass\\]\\[name\\]\$;\\s*}};\\s*\\?>',
        '<\\?php \\$a = str_replace\$x,"","\\w+"\$;\\$a\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["\\w+"\\]\$; \\?>',
        '<\\?php\\s*eval\$gzinflate\\(str_rot13\\(base64_decode\\(\'[^\']{5000,}\'\$\\)\\)\\);\\s*\\?>\\s*',
        'if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\w+\\]\$\\){echo\\s*\'<form .+?echo\'\\+\';}else{echo\'-\';}}}',
        '<\\?php print\'<form enctype=multipart/form-data.+?\\)\\){if\$is_uploaded_file\\(\\$_FILES.+?\$;}}exit;\\?>\\s*$',
        '<\\?php.\\$[a-zA-Z]{10}\\w*=.*false;if\$isset.*chr\\(\\d.*\\="\$\\);exit\$\$;$',
        '<\\?php\\s*if\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\${echo\\s*\'\\w+\';}else{\$\\$www=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\s*&&\\s*@preg_replace\$\'/ad/e\',\'@\'\\.str_rot13\\(\'riny\'\$\\.\'\$\\$www\$\'\\s*,\\s*\'\\w+\'\\s*\\);\\s*}\\?>\\s*',
        '\\$\\w{1,40}\\s*=\\s*Array\$\'[asert\\.\\\']+\'\$;@\\$\\w+\\[chr\$\\d+\$\\]\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[[asert\\.\\\']+\'\\]\$;',
        'if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\']\$\\)\\s*copy\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\],\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;else',
        '<\\?\\s*if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\)\\s*preg_replace\$\'/\\w+/e\', \\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\],\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;\\?>\\s*',
        'if \$isset\\(\\$_REQUEST\\["\\w+"\\]\$\\) {(/\\*\\w+\\*/)?@extract\$\\$_REQUEST\$;/\\*\\w+\\*/@die\$\\$\\w+\\(\\$\\w+\$\\);(/\\*\\w+\\*/)?}',
        '/\\*\\s*TEST-TRACK-LINE\\s*\\*/\\s*\\$\\w+.+?/\\*\\s*/TEST-TRACK-LINE\\s*\\*/\\s*',
        '@preg_replace\$"/\\[\\w+\\]/e"\\s*,\\s*\\$_(COOKIE|POST|GET|REQUEST|SERVER)\\s*\\[\\s*\'\\w+\'\\s*\\]\\s*,\\s*"\\w+"\\s*\$;',
        '@extract\\s*\$\\s*\\$_REQUEST\\s*\$;\\s*@die\\s*\$\\s*\\$\\w+\\(\\s*\\$\\w+\\s*\$\\s*\\);',
        'if\\s*\$isset\\(\\$_COOKIE\\["\\w+"\\]\$\\)\\s*@\\$_COOKIE\\["\\w+"\\]\$\\$_COOKIE\\["\\w+"\\]\$;',
        '/\\*\\s*.{32}\\s*\\*/\\s*function xmail\\s*\$\$\\s*{\\s*\\$a=func_get_args\$\$;\\s*file_put_contents\$\'.+?mail\\(\\s*\\$a\\[0\\],\\s*\\$a\\[1\\],\\s*\\$a\\[2\\],\\s*\\$a\\[3\\]\\s*\$;}\\s*function x.+?\\^\\s*\'0\';}\\s*return\\s*\\$o;}',
        '\\$\\w{1,40}\\s*=\\s*".{32}";\\s*if\$isset\\(\\$_REQUEST\\[\'\\w+\'\\]\$\\)\\s*{\\s*\\$\\w+\\s*=\\s*\\$_REQUEST\\[\'\\w+\'\\];\\s*eval\$\\$\\w+\$;\\s*exit\$\$;\\s*}\\s*if\$isset\\(\\$_REQUEST\\[\'\\w+\'\\]\$\\)\\s*{\\s*\\$\\w+\\s*=\\s*\\$_REQUEST\\[\'\\w+\'\\];\\s*\\$\\w+\\s*=\\s*\\$_REQUEST\\[\'\\w+\'\\];\\s*\\$\\w+\\s*=\\s*fopen\$\\$\\w+,\\s*\'w\'\$;\\s*\\$\\w+\\s*=\\s*fwrite\$\\$\\w+,\\s*\\$\\w+\$;\\s*fclose\$\\$\\w+\$;\\s*echo\\s*\\$\\w+;\\s*exit\$\$;\\s*}',
        '<\\?php\\s*\\$a=isset\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'null_prime\'\\]\$;\\s*\\$c="[^"]+";.+?strrev\$\\$c\$\\)\\);fclose\$\\$f\$; die; }\\s*\\?>\\s*',
        '<\\?php\\s*(if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["\\w+"]\$\\)\\s*\\$\\w+ = base64_decode\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["\\w+"\\]\$;\\s*else\\s*{\\s*echo "indata_error";\\s*exit;\\s*}\\s*)+if\$mail\\(\\$\\w+,\\$\\w+,\\$\\w+,\\$\\w+\$\\)\\s*echo "sent_ok";\\s*else\\s*echo "sent_error";\\s*\\?>',
        'if \$\\$_FILES\\[\'F1l3\'\\]\$ {move_uploaded_file\$\\$_FILES\\[\'F1l3\'\\]\\[\'tmp_name\'\\], \\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'Name\'\\]\$; Exit;}',
        '<\\?\\s*if \$\\$_FILES\\[\'F1l3\'\\]\$ {move_uploaded_file.+echo \'You are forbidden!\';\\s*}\\s*\\?>',
        '\\$gif=file\$dirname\\(__FILE__\$\\.\'/images/\\w+\\.gif\',2\\);\\$gif=\\$gif\\[\\d+\\]\$"",\\$gif\\[\\d+\\]\\(\\$gif\\[\\d+]\$\\);\\$gif\$\$;',
        '\\$\\w{1,40}\\s*=\\s*@\\$_COOKIE\\[\'\\w+\'\\];\\s*if\\s*\$\\$\\w+\$ {\\s*\\$\\w+\\s*=\\s*\\$\\w+\$@\\$_COOKIE\\[\'\\w+\'\\]\$;\\s*\\$\\w+=\\$\\w+\$@\\$_COOKIE\\[\'\\w+\'\\]\$; \\$\\w+\$"/\\w+/e",\\$\\w+,\\w+\$;}',
        '<\\?\\s*set_time_limit\$\\d+\$;\\s*error_reporting\$0\$;\\s*\\$\\w+\\s+=\\s*\'[^\']+\';\\s*eval\$gzinflate\\(str_rot13\\(base64_decode\\(\\$rhs\$\\)\\)\\)\\;\\s*\\?>',
        '\\$urls\\s*=\\s*array\\s*\$.+?\$;\\s*\\$URL\\s*=\\s*\\$urls\\[rand\$0,\\s*count\\(\\$urls\$\\s*-\\s*1\\)\\];\\s*header\\s*\$"Location:\\s*\\$URL"\$;',
        'if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\w+\\]\$\\){\\s*\\$d=substr\$8,1\$;foreach\$array\\((\\d+,)+.+?eval\\(\\$d\$;\\s*}',
        '<\\?php\\s*\\$\\w{1,20}\\s*=\\s*Array\$\'\\w\'=>.+sprintf\\(\\w{1,20}\\(\\$\\w{1,20}\\s*,\\s*\\$\\w{1,20}\$\\);(\\?>)?',
        '\\$_REQUEST\\[.\\]\\s*\\?\\s*eval\$\\s*base64_decode\\(\\s*\\$_REQUEST\\[.\\]\\s*\$\\s*\\)\\s*:\\s*exit;',
        '<\\?php\\s*\\$\\w{1,40}=".+";eval/\\*\\*/\$strrev\\(str_replace\\(".","",\\$\\w+\$\\)\\);\\?>',
        '<\\?php\\s*if\$preg_match\\((chr\\(\\d+\$\\.)+.+if\$\\$\\w+===false\$continue;\\$\\w+=str_repeat.+base64_decode\$\'[a-zA-Z0-9\\+/=]+\'\$,.+?\\$\\w+\\)\\);break;}}}\\?>',
        '<\\?\\s*\\$_="";\\$_\\[\\+""\\]=\'\';\\$_="\\$_.*\\$_}\\[\'__\'\\]\\);\\?>',
        '<\\?php\\s*\\$_\\w+="(\\\\x[A-Fa-f0-9]{2}){1,500}";\\$_\\w+\$"(\\\\x[a-fA-F0-9]{2}){1,500}",".+?",\'\\.\'\$;\\?>',
        '<\\?php\\s*\\$\\w{1,40}=\'\\#\\#\\#.+\\\'\\)\\);\';\\s*\\$\\w+=str_replace\$\'\\#\', \'\', \\$\\w+\$;\\$\\w+=create_function\$\'\',\\$\\w+\$;\\$\\w+\$\$;\\s*\\?>',
        '<\\?php\\s*(?:/\\*.{0,1000}?\\*/\\s*)?eval\$gzinflate\\(base64_decode\\(\'[a-zA-Z0-9/+=]{5000,}\'\$\\)\\);\\s*\\?>',
        '<\\?php\\s+//\\w{0,2100}\\s*eval\$base64_decode\\("[a-zA-Z0-9/\\+=]+"\$\\);\\s*\\?>',
        '<\\?php\\s+function (\\w+)\$\\$file_url,.+?file_get_contents\\(\\$file_url\$;\\1\$\'https://dl\\.dropboxusercontent\\.com.+?unlink\\(\\$_SERVER\\[\'SCRIPT_FILENAME\'\\]\$;\\?>',
        '<\\?php\\s*@eval\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w{1,5}\'\\]\$;\\s*\\?>',
        '\\$\\w{1,40}\\s*=\\s*"\\w+";\\s*preg_replace\$"(\\\\x?[a-f0-9A-F]{2,3})+"\\s*,"(\\\\x?[a-fA-F0-9]+)+"\\s*,"(\\\\x?[a-fA-F0-9]+)+"\$;',
        '<\\?php\\s*if\\s*\$!isset\\(\\$_REQUEST\\[\'\\w+\'\\]\$\\) header\$"HTTP.+?"\$;\\s*@preg_replace\$\'.\\(\\.\\*\$.e\',\\s*@\\$_REQUEST\\[\'\\w+\'\\],\\s*\'\'\\);\\s*\\?>',
        '<\\?php\\s*@?(eval|assert)\\s*(/\\*[^*]{1,5000}\\*/\\s*)?\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*[^]]+\\]\$;\\s*(\\?>)?',
        '<\\?php\\s?if\\s?\$\\s?md5\\s?\\(\\s?\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["password"\\]\\s?\$\\s?==\\s?"[0-9a-z]{32}"\\s?\\)\\s?\\{\\s?preg_replace\\s?\$\\s?"\\\\.*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["code"\\].*;\\s?\\}\\s?\\?>',
        'if\\s*\\(\\s*isset\\(\\s*\\$_REQUEST\\[\\s*"\\w+"\\s*\\]\\s*\$\\s*\\)\\s*{.*?@?extract\$\\$_REQUEST\$;@?die\$\\$\\w+\\(\\$\\w+\$\\);.*?}',
        'if\\s*\$\\s*isset\\(\\s*\\$_REQUEST\\[\\s*"\\w+"\\s*\\]\\s*\$\\s*\\)\\s*{.*?@?preg_replace\$\'/\\(\\.\\*\$/e\'\\s*,\\s*@?\\$_REQUEST\\[\'\\w+\'\\],\\s*\'\'\\s*\\);.*?}',
        '//istart\\s.+?function\\s+decrypt_url.+?//iend',
        '<\\?php\\s*\\$version\\s*=\\s*"\\d+\\.\\d+";.+?if\$@file_put_contents\\(\\$.+?@include_once\\(.+?@unlink\\(.+?404 Not Found.+\\?>',
        'eval\\(base64_decode\\(@\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'[a-zA-Z0-9]+\'\\]\$\\);',
        'if\$\\(md5\\(@\\$_COOKIE\\[ssid\\]\$=="\\w{32}"\\)\\)\\{error_reporting\$0\$;@array_map\$.*\$;\\}',
        '//\\#\\+=\\+\\#\\+.+?//\\#\\+=\\+\\#\\+',
        '<\\?php\\s*eval\$gzinflate\\(base64_decode\\(\'[a-zA-Z0-9+/\\s]+AQ==\'\$\\)\\);\\s*\\?>',
        '<\\?php\\s*eval\$gzinflate\\(str_rot13\\(base64_decode\\(\'[a-zA-Z0-9+/\\s]+AQ==\'\$\\)\\)\\);\\s*\\?>',
        'preg_replace\$"\\\\x2f(\\\\x..)+"\\s*,\\s*"(\\\\x..)+",""\$;',
        '<\\?php\\s*preg_replace\$"/\\w+/e"\\s*,\\s*"e["\'.va]+l\\(\'"\\.\\$_REQUEST\\[\'\\w+\'\\]\\."\'\$"\\s*,\\s*"[a-zA-Z\\s0-9_]+"\\);\\s*\\?>',
        '\\$.\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST);\\s*@\$\\$.\\[\\d\\]\\s*!=\\s*\\$.\\[\\d\\]\$\\s*\\?\\s*@\\$.\\[\\d\\]\$\\$.\\[\\d\\]\$\\s*:\\s*\$int\$\\$.;',
        '<\\?php\\s*\$\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\s*&&\\s*@preg_replace\$\\s*\'/ad/e\'\\s*,\\s*\'@\'\\s*\\.\\s*str_rot13\\(\\s*\'riny\'\\s*\$\\s*\\.\\s*\'\$\\$\\w+\$\'\\s*,\\s*\'add\'\\);\\s*\\?>\\s*',
        'class\\s*(\\w{1,40})\\s*{\\s*public\\s*function\\s*__construct\$\$\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*@?(\\$_COOKIE\\[[\'"])\\w{1,40}[\'"]\\];\\s*if\\s*\$\\s*\\2\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\2\\s*\$\\s*@?\\3\\w{1,40}[\'"]\\]\\s*\$;\\s*[^\\}]{1,200}\\s*\\}\\s*\\}\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*new\\s*\\1\\s*;',
        '\\A\\s*<\\?php\\s*\\$[a-z]{4,15}\\s*=\\s*[^\\n]{6000,11000}\\s*=\\s*explode\$chr\\s*\\([^\\?]{1000,3000};\\s*(\\$[a-z]{4,15})=\\(\\d+-\\d+\$;\\s*\\$[a-z]{4,15}\\s*=\\s*\\1\\s*-\\s*1;\\s*\\?>',
        '\\A\\s*<\\?php\\s+/\\*.{99,600}/\\s*\\$\\w{1,40}=[\'"][^;]{40,80}[\'"];/\\*\\w{1,9}\\*/\\$.+\\$\\w{1,40}\\s*=\\s*[\'"](a|c|e|g|l|p|r|_|\\\\160|\\\\162|\\\\137|\\\\145|\\\\154|\\\\141|\\\\143|\\\\147){3,9}[\'"];\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\.\\$\\w{1,40}\\.\\$\\w{1,40};\\$\\w{1,40}\$\\$\\w{1,40},\\s*\\$\\w{1,40}\\(\\$\\w{1,40}\$,[\'"][\'"]\\);\\s*(\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+(\\$\\w{1,40})\\s*=\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)[^\'"]{1,40}[\'"]\\s*;\\s*[^`]{1,600}file_get_contents\\s*\$\\s*\\1(?:\\s*\$\\s*){1,5};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\$\\s*base64_decode\\([\'"]ZWNobyAnPGNlbnRlcj48YSBocmVmPWh0dHA6Ly93d3cuZmIuY29tL3llYWhhY2tlci[^\'"]+[\'"]\\s*\$\\s*\\);\\s*\\?>',
        '\\A\\s*<\\?(?:php)?\\s+(\\$\\w{1,40})\\s*=\\s*([\'"])[^\\}]{1,400}\\2;\\s*(\\$\\w{1,40})\\s*=(?:\\s*\\.?\\s*\\1\\[\\d+\\]){90,150}\\s*;[^\\?]{420,600}(\\$\\w{1,40})\\s*=\\s*\\3\\s*;[^\\?]{1,200}\\4\\)\\);\\$\\w{1,40}\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+(\\$GLOBALS\\[[\'"][^\'"]{1,40}[\'"]\\])=Array\$base64_decode\\([^`]{20000,25000}false;\\}if\\(!empty\\((\\$\\w{1,40})\$\\)\\{if\$\\1\\[\\d+\\]\\(\\$\\w{1,40},\\2\$\\)\\{(\\$\\w{1,40})=false;\\}\\}return\\s+\\3;\\}\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+\\$GLOBALS\\[[^`]{2200,2700}\\}\\}(\\$\\w{1,40})\\s*=\\s*[\'"\\s\\.creat_funio]{21,60}\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*\\1\$[^;]{40,100};[\'"]\$;\\2\$[\'"][^\\?]{60000,}[\'"]\$;\\?>',
        '\\$\\w+\\s*=\\s*"\\w+"\\s*;\\s*\\$\\w+\\s*=(?:\\s*\\$\\w+\\[\\d+\\]\\s*\\.?){3,};\\s*\\$\\w+\\s*=\\s*\\$\\w+\\s*\$(?:\\s*\\$\\w+\\[\\d+\\]\\s*\\.?){3,}\$\\s*;.+?eval\\s*\$\\s*\\$\\{\\s*\\$\\w+\\s*\\}\\s*\\[\\s*\'\\w+\'\\s*\\]\\s*\$\\s*;\\s*\\}',
        '\\A\\s*<\\?php\\s+function\\s*(\\w{1,40})\$\\$\\w{1,40}\$\\{\\$\\w{1,40}=Array\$[\'"]Ly4vZQ[=]{0,2}[\'"],[^\\}]{80,150}\\}\\s*preg_replace\\(\\1\\(\\d+\$,[^\\?]{5000,}\\1\$\\d+\$\\);\\s*\\?>',
        '\\A\\s*<\\?php\\s+@?eval\$gzuncompress\\(base64_decode\\([\'"]eNqlfGlzE1e37l/puHJPbOKYnjRB[^\'"]{13000,13800}[\'"]\$\\)\\);\\s*(?:\\?>|\\Z)',
        '\\A\\s*(<\\?php\\s)\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{1,40}[\'"];\\s*(\\$\\w{1,40})\\s*=\\s*md5\\s*\$\\s*\\2\\s*\$\\s*;\\s*[^\\?]{1000,5000};\\s*\\}\\s*function\\s+\\w{1,40}\\s*\$\\s*\\3\\s*\$\\s*\\{\\s*[^\\*]{500,1500}(?:\\.(\\$\\w{1,40})\\.base64_decode\$[\'"][^\'"]{1,40}[\'"]\$){2}\\;\\s*\\}',
        '\\A\\s*<\\?php\\s+@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"]aWYoQCRf[^\']{1,600}[\'"]\\s*\$\\s*\\);\\s*\\?>\\s*(<[^>]{0,40}(?:php|html))',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*isset\\(\\s*\\$_POST\\[[\'"]?[^\\]]{1,40}[\'"]?\\]\\s*\$\\s*\\)\\s*else\\s*\\{?\\s*echo\\s*\$?\\s*[\'"][^\'"]{0,40}[\'"]?<script\\s*src\\s*=\\s*https?://[^>]{3,40}(?:images|css|uploads|includes)/\\w{1,40}\\.php\\s*>[^\\?]{1,100}\\s*(?:\\?>|\\Z)',
        '\\A\\s*(<\\?php\\s)\\s*\\$[O0]{4,12}\\s*=\\s*base64_decode\\s*\\(\\s*[\'"][^\'"].{1,60}[\'"]\\s*\$\\s*;\\s*(\\$[O0]{4,12})\\s*=.{58,558}\\s*;\\s*@?eval\\s*\$\\s*\\2\\s*\\(\\s*[\'"][^"\']{1,10000}["\']\\s*\$\\s*\\)\\s*;\\s*(?:\\?>\\s*<\\?php)?\\s+/\\*\\*',
        'error_reporting\$0\$;\\s*if\\s*\$isset\\s*\\(\\$_REQUEST\\[[\'"](\\w{1,40})[\'"]\\]\$\\s*&&\\s*md5\$\\$_REQUEST\\[[\'"]\\1[\'"]\\]\$\\s*==\\s*[\'"]\\w{1,40}[\'"]\\s*&&\\s*isset\\s*\$\\$_REQUEST\\[[\'"](\\w{1,40})[\'"]\\]\\s*\$\\)\\s*eval\\s*\$ base64_decode\\s*\\(\\$_REQUEST\\[[\'"]\\2[\'"]\\s*\\]\\s*\$\\s*\\);',
        '\\A\\s*<\\?php\\s+if\\s*\$\\s*(?:md5\\()?\\s*\\$_POST\\[[\'"]?\\w{1,40}[\'"]?\\]\\s*\$?\\s*[^\\w]{1,2}=\\s*[\'"]\\w{1,40}[\'"]\\)\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*\\$_POST\\[[\'"]?\\w{1,40}[\'"]?\\];\\s*@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\\s*\$\\s*stripslashes\\s*\\(\\s*\\1\\s*\$\\s*\\);\\s*\\}\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+(\\$\\w{1,40})\\s*=\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)\\w{1,40}[\'"]\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*file_get_contents\\s*\$\\s*\\1\\s*\$;\\s*@?(?:eval|assert|system)\\s*\$\\s*(?:[\'"]\\s*\\?>)?[^\\?]{1,99}\\s*(?:\\?>|\\Z)',
        '<\\?php\\s*@?eval\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]IGlmICggaXNzZXQoICRfQ09PS0lFWy[^\'"]{1,500}[\'"]\\s*\$\\s*\\)\\s*;\\s*\\?>(?:\\s*)?',
        '\\A\\s*<\\?(?:php)?[ ]{200,}@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\\s*\\(){0,5}\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?\\w{1,10}[\'"]?\\](?:\\s*\$\\s*){1,6};\\s*\\?>\\s*(<\\?|\\Z)',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*echo\\s*[\'"]\\s*<\\s*form\\s*action\\s*=\\s*[\'"][^\'"]{0,40}[\'"]\\s*method\\s*=\\s*[\'"]post[\'"][^\\}]{1,300}\\s*\\{\\s*echo\\s*[\'"][^\'"]{0,39}up![^\'"]{0,39}[\'"]\\s*;\\s*\\}\\s*\\}\\s*exit\\s*;\\s*\\}',
        '/\\*edition:\\d+\\.\\d+\\*/\\s*(\\$\\w{1,40})\\s*=\\s*[\'"]eNpN[^;]{3000,5000}[\'"]\\s*;\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\\s*\\(){0,5}\\s*\\1(?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\}(?:\\s*(passthru|exec|shell_exec|popen|system|eval|assert)\\s*\$\\s*[\'"][^\'"]{10,90}[\'"]\\s*\$;){2,5}(?:\\s*unlink\\s*\$\\s*[\'"][^\'"]{10,90}[\'"]\\s*\$;){2,5}\\s*\\Z',
        'file_put_contents\$[\'"]\\w{1,12}\\.php[\'"],\\s*[\'"]<\\?php\\s*[^`]{1,200}\\s*\\{?\\s*eval\\(\\$_POST\\[[\'"]\\w{1,12}[\'"]\\]\$;\\}?\\?>[\'"]\\);\\s/\\*[\'"]\\);',
        'file_put_contents\\s*\$\\s*[\'"]([^\'"]{1,40})[\'"]\\s*,\\s*base64_decode\\s*\\(\\s*file_get_contents\\s*\\(\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)\\w{1,40}[\'"]\\s*\$\\s*\\)\\s*\\)\\s*;\\s*include\\s*\$\\s*[\'"]\\1[\'"]\\s*\$\\s*;',
        '<\\?(?:php)?\\s+[^\\$]{1,200}\\s*(\\$\\w{1,40})\\s*=\\s*[\'"]7T37W\\+O2sr/f77v/g\\+[^\\?]{12000,15000}\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\\s*\\(){0,5}\\s*\\1(?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        'if\\s*\$\\s*\\$_SERVER\\[[\'"]REQUEST_METHOD[\'"]\\]\\s*===\\s*[\'"](?:GET|POST)[\'"]\\s*\$\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*array_shift\$\\s*\\$_POST\\s*\$;\\s*(\\$\\w{1,40})\\s*=\\s*create_function\$[\'"\\s]{2,5},\\s*gzinflate\\(\\s*base64_decode\\(\\s*\\1\\s*\$\\s*\\)\\s*\\);\\s*\\2\$\$;\\s*\\}',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*isset\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]\\w{1,40}[\'"]\\]\\s*\$\\s*\\)\\s*\\{[^\\{]{1,600}if\\s*\$\\s*\\$_POST\\[[\'"]?[^\'"]{0,40}[\'"]?\\]\\s*==\\s*[\'"][^\'"]{0,40}[\'"]\\s*\$\\s*\\{\\s*if\\s*\$\\s*@?copy\\s*\\(\\$_FILES\\[[\'"]\\w{1,40}[\'"]\\][^\\?]{100,200}\\s*\\}\\s*\\}\\s*\\}\\s*\\?>\\s*(<\\?php)',
        '\\A\\s*<\\?php(?:\\s*\\$\\w{1,40}\\s*=\\s*\\$_POST\\[[\'"]?[^\'"]{1,40}[\'"]?\\];){2,4}\\s*\\$\\w{1,40}\\s*=\\s*mail\\(\\s*\\$\\w{1,40},\\s*\\$\\w{1,40},\\s*\\$\\w{1,40},\\s*\\$\\w{1,40}\$;\\s*if\\s*\$\\s*\\$\\w{1,40}\$\\s*\\{\\s*[^\\}]{1,80}\\s*\\}\\s*else\\s*\\{\\s*[^\\}]{1,80}\\s*\\}\\s*(?:\\?>|\\Z)',
        '<\\?(?:php)?\\s*include\$\\$_SERVER[^\\}]{100,600}->Authorize\\([^\$]{1,40}\\);\\s*header\$[\'"]location:[^\'"]{1,40}[\'"]\$;\\s*die\$\$;\\s*\\}\\s*else\\s*\\{[^\\}]{1,600}\\s*\\}\\s*(?:\\?>|\\Z)',
        '<\\?php\\s*if\\s*\$\\s*md5\\s*\\(\\s*@?\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?\\w{1,40}[\'"]?]\$\\s*==\\s*[\'"]\\w{1,40}[\'"]\\)\\{\\s*\\}\\s*\\?>',
        '(<\\?php\\s*)\\$GLOBALS\\[[^`]{1000,3000}file_put_contents\$[\'"]\\.\\./uploads/index\\.php\',\'index\\.php[\'"]\$;\\s*if\$0\\^0\$&&array_sum\$\\$\\w{1,40},\\$\\w{1,40},\\$\\w{1,40}\$\\)dir\$\\$\\w{1,40},\\$\\w{1,40},\\$\\w{1,40},\\$\\w{1,40}\$;\\s*echo\\s*[\'"]\\w{1,40}[\'"];',
        '<\\?php\\s*\\$(\\w{1,40})\\s*=\\s*[\'"](PGgyPjxkaXYgc3R5bGU9InBvc2l0aW9uOiBhYnNvbHV0ZT)[^\'"]{100,600}[\'"];\\s*echo\\s+base64_decode\$\\s*\\$\\1\\s*\$;\\s*\\?>\\s*<\\?php\\s+\\s*echo\\s+base64_decode\$[\'"]\\2[^\'"]{100,600}[\'"]\$;\\s*\\?>',
        '<\\?php\\s*(?:\\s*\\$\\w{1,40}\\[\\d+\\]\\s*=\\s*[\'"][^\'"]{100,200}[\'"];){30,40}\\s*(?:\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{0,40}[\'"];)?\\s*for\\s*\$\\s*(\\$\\w{1,40})\\s*=\\s*\\d+;\\s*\\1\\s*<\\s*count\\(\\s*(\\$\\w{1,40})\\s*\$;\\s*\\1\\+\\+\\s*\\)\\s*\\{\\s*(\\$\\w{1,40})\\s*\\.?=\\s*base64_decode\$\\s*\\2\\[\\1\\]\\s*\$;\\s*\\}\\s*@?eval\$\\3\$;\\s*\\?>',
        '\\A\\s*<\\?php\\s*echo\\s*[\'"][^\'"]{0,40}[\'"]\\.php_uname\$\$\\.[\'"][^\'"]{0,40}[\'"];\\s*[^\\?]+if\\s*\$\\s*\\$_POST\\[[\'"][^\'"]{0,40}up[^\'"]{0,40}[\'"]\\]\\s*[^\\w]=\\s*[\'"][^\'"]{0,40}[\'"]\\s*\$\\s*\\{\\s*if\\s*\$\\s*@?copy\\s*\\([^\$]{1,80}\\)\\s*\\)\\s*\\{\\s*[^\\}]{1,40}\\}\\s*\\}\\s*\\?>',
        '(//\\#\\#\\#==\\#\\#\\#)[^\\\\#]{1000,6000}\\}\\}\\}\\}if\$@\\$_REQUEST\\[[^\'"]{1,40}\\(\\w{1,40}\$\\]\\s*==\\s*\\w{1,40}\$\\w{1,40}\$\\)\\$_REQUEST\\[[^\'"]{1,40}\$\\w{1,40}\$\\]\$\\$GLOBALS\\[[\'"][^\'"]{1,40}[\'"]]\\[\\w{1,40}\\]\\(\\$_REQUEST\\[[^\'"]{1,40}\\(\\w{1,40}\$\\]\\s*\\)\\s*\\)\\s*;\\s*\\}\\s*echo\\s*\\$\\w{1,40};\\s*\\}\\s*\\1',
        '(</body>\\s*</html>)\\s*<\\?php\\s*echo\\s*[\'"]<form\\s+action\\s*=\\s*[\'"][^\'"]{0,40}[\'"]\\s+method\\s*=\\s*[\'"]post[\'"][^\\?]{200,400}\\}\\s*\\}\\s*(?:\\?>)?\\s*\\Z',
        '<\\?php(?:\\s*\\$[O0_]{1,40}\\s*=\\s*[\'"]\\w{1,40}[\'"];){1,3}[^`]{36000,37000}@?eval\$\\s*\\$[O0_]{1,40}\\s*\$;\\s*unset\$\\s*\\$[O0_]{1,40}\\s*,\\$\\w{1,40},(?:\\s*\\$[O0_]{1,40}\\s*,?){5,10}\$;\\s*exit\$\$;\\s*\\}\\s*\\}\\s*[\'"]\\s*\\);\\$\\{\\s*[\'"][^\'"]{1,40}[\'"]\\}\\[[\'"][^\'"]{1,40}[\'"]\\]\$\$;\\s*\\?>',
        '<\\?php\\s*if\\s*\$\\s*@?isset\\(\\s*(\\$_POST)\\[[\'"]?\\w{1,40}[\'"]?\\]\\s*\$\\s*\\)\\s*\\{\\s*[^\\?]{1,}\\s*@?touch\$\\$_SERVER\\[[\'"]?DOCUMENT_ROOT[\'"]?\\]\\s*\\.\\s*base64_decode\\s*\\(\\1\\[[\'"]?\\w{1,40}[\'"]?\\]\$\\s*,\\s*strtotime\$[\'"]-\\d+\\s*\\w{0,5}[\'"]\$\\);\\s*die\$[^\$]{1,40}\\);\\s*\\}\\s*(?:\\?>|\\Z)',
        '\\A\\s*\\w{0,40}\\s*<\\?php\\s*\\$\\w{1,40}\\s*=\\s*getcwd\$\$;\\s*if\\s*\$\\s*isset\\(\\s*\\$_FILES\\[[\'"]?(\\w{1,40})[\'"]?\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*basename\$\\s*\\$_FILES\\[[\'"]\\w{1,40}[\'"]\\]\\[[\'"]\\w{1,40}[\'"]\\]\\s*\$;\\s*if\\s*\$move_uploaded_file\\(\\$_FILES\\[[\'"]?\\1[\'"]?\\][^\\j]{1,300}</form>[\'"];\\s*\\?>',
        '<\\?php\\s*if\\s*\\(\\s*@?(\\$_SERVER)\\[[\'"](HTTP_X_)\\w{1,40}[\'"]\\]\$\\s*\\{\\s*echo\\s*[\'"][^\'"]{1,40}[\'"];\\s*if\\s*\$\\s*@?\\1\\[[\'"]\\2\\w{1,40}[\'"]\\]\$\\s*\\{\\s*file_put_contents\\s*\$\\s*@?\\1\\[[\'"]\\2\\w{1,40}[\'"]\\],\\s*@?\\1\\[[\'"]\\2\\w{1,40}[\'"]\\]\\s*\$;\\s*\\}\\s*\\}\\s*(?:\\?>|\\Z)',
        '<\\?php\\s*if\\s*\$\\s*@?md5\\(\\s*\\$_POST\\[[\'"]?\\w{1,40}[\'"]?\\]\$\\s*==\\s*[\'"]\\w{1,40}[\'"]\\)\\s*\\{\\s*\\$\\w{1,40}=\\$_POST\\[[\'"]?\\w{1,40}[\'"]?\\];\\s*@?eval\$stripslashes\\(\\$\\w{1,40}\$\\);\\s*die;\\s*\\}\\s*\\?>',
        '\\AOptions\\s+FollowSymLinks\\s+MultiViews\\s+Indexes\\s+ExecCGI.{20,100}AddHandler\\s*cgi-script\\s*.\\w{1,5}\\Z',
        '\\ARewriteEngine\\s+On\\s*RewriteBase\\s+/\\w+\\s*RewriteCond %{REQUEST_FILENAME}\\s+!-..+?\\s*RewriteRule \\^\$\\.\\*\$\\s+index\\.php\\?id=\\$1\\s*\\Z',
        '\\A\\s*RewriteEngine\\s*On\\s*RewriteRule\\s*\\^\\.\\*\\$\\s*http://.+?\\.php\\s*\\[R=301\\]\\s*\\Z',
        'RewriteCond\\s+%{HTTP_USER_AGENT}\\s+android\\s+\\[NC\\]\\s*RewriteRule\\s+\\^\$\\.\\*\$\\$\\s+https?://[a-zA-Z0-9_\\-\\.]+\\.(xyz|info|pw)/\\w+\\s+\\[L\\s*,\\s*R=302\\]',
        'RewriteRule\\s+\\^\$\\[A-Za-z0-9-\\]\\+\$\\.html\\$\\s+\\w+\\.php\\?fw=\\$1\\s+\\[L\\]',
        'RewriteEngine\\s+on\\s*RewriteCond\\s+%{HTTP_USER_AGENT}\\s+android\\s+\\[.+?windows-media-player\\)\\s+\\[NC\\]\\s*RewriteRule\\s+\\^\$\\.\\*\$\\$\\s+https?://[\\S]+\\s+\\[L,R=302\\]',
        'RewriteEngine On\\s*RewriteRule\\s+\\^\$\\.\\*\$,\$\\.\\*\$\\$ \\$2\\.php\\?rewrite_params=\\$1&page_url=\\$2',
        '<\\s*IfModule\\s*mod_rewrite\\s*\\.\\s*c\\s*>\\s*Options\\s*\\+FollowSymLinks\\s*RewriteEngine\\s*on\\s*RewriteBase\\s*/\\w+\\s*RewriteRule\\s*\\^c\\s*\$\\\\d\\+\$\\[-/\\].+?</IfModule>',
        '\\#\\s*BEGIN\\s*W0RDPRESS\\s*\\#<IfModule\\s*mod_rewrite\\s*\\.\\s*c>\\s*\\#RewriteEngine\\s*On\\s*\\#RewriteBase\\s*/\\s*\\#RewriteCond\\s*%\\s*\\{\\s*REQUEST_FILENAME\\s*\\}\\s*!-f\\s*\\#RewriteCond\\s*%\\s*\\{\\s*REQUEST_FILENAME\\s*\\}\\s*!-d\\s*\\#RewriteRule\\s*\\.\\s*/index\\s*\\.\\s*php\\s*\\[\\s*L\\s*\\]\\s*\\#</IfModule>\\s*\\#\\s*END\\s*WordPress',
        '\\A\\s*<\\?php\\s+if\\s*\$\\s*@?\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)[^`]{1,600}/form>[\'"];\\s*if\\s*\\(\\s*@?\\$_POST\\[[^\\]]{1,40}\\]\\s*[^\\w]{1,3}\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$\\s*\\{\\s*if\\s*\$\\s*@?copy\\s*\\(\\s*\\$_FILE[^\\?]{1,200}\\s*\\}\\s*\\}\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+/\\*\\*[^`]{1,600}\\*/\\s*function\\s+(\\w{1,40})\\(\\s*(\\$phone)\\s*\$\\s*\\{\\s*(\\$main)\\s*=\\s*\\2\\s*\\^\\s*\$\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$\\s*;\\s*[^\\}]+\\$\\w{1,40}\\s*\$\\s*\\3\\s*\\([^;]{1,40}\\s*;\\s*\\}\\s*\\1\\s*\\(\\s*[^\$]{1,40}\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+function\\s+(\\w{1,40})\$[^\\?]{999,2000}\\s*(\\$\\w{1,40})\\s*=\\s*\\1\\s*\\(\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)\\w{1,40}[\'"]\\s*\$\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*fopen\$\\s*\\$\\w{1,40}\\s*,\\s*[\'"](?:a|w)\\+?[\'"]\\s*\$\\s*;\\s*fwrite\$\\s*\\3\\s*,\\s*\\2\\s*\$;[^\\?]{1,400}\\s*(?:\\?>|\\Z)',
        '(<\\?php)\\s*@?(?:eval|assert)\\s*\$\\s*\\$_(?:POST|GET|COOKIE|REQUEST|SERVER)\\[[\'"]?\\w{1,40}[\'"]?\\]\\s*\$;',
        '\\A\\s*<\\?php\\s+(\\$\\w{1,40})\\s*=\\s*([\'"])\\s*\\1\\s*[^\\?]{1,120}\\s*\\2;(\\s*\\1\\.?=\\s*\\2\\s*[^\\?]{1,120}?\\2;\\s*){1,9}\\s*[^@]{1,99}(\\$\\w{1,40})\\s*=\\s*@?\\$\\w{1,40}\\s*\$\\s*[\'"][\'"]\\s*,\\s*\\1\\s*\$\\s*;\\s*@?\\s*\\4\$\$;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\$(?:\\s*(?:gzinflate|base64_decode|strrev|str_rot13)\\(\\s*){1,4}[\'"]=8u///5557/ss//xBzBpXjJ5/nVhIuMLepXM09DIgR[^\'"]{60000,}[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '<\\?php\\s*if\\s*\$isset\\(\\$_REQUEST\\[\\w+\\]\$\\)\\s*\\{\\s*stripslashes\$\\$_REQUEST\\[\\w+\\]\\(\\$_REQ.+?\\?>',
        '\\${"\\\\x\\d+\\\\x.+;\\$\\{\\${.+]}\\["\\w"\\]\$;}}',
        '(<\\?php)\\s*eval\\s*\$\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{1,10000}[\'"]\\s*\$\\s*\\)\\s*\\)\\s*;\\s*(?:\\?>\\s*<\\?php\\s*)?(\\s+/\\*\\*\\s+\\*)',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?\\w{1,40}[\'"]?\\]\\s*\$\\s*\\{\\s*if\\s*\$\\s*md5\\s*\\(\\s*\\$_\\1\\[[\'"]?\\w{1,40}[\'"]?\\]\$\\s*[^\\w]{1,2}=\\s*[\'"]\\w{1,40}[\'"]\\)\\s*\\{\\s*@?(?:eval|assert|system|exec)\\s*\$\\s*base64_decode\\(\\s*\\$_\\1\\[[\'"]?\\w{1,40}[\'"]?\\]\\s*\$\\s*\\);\\s*\\}\\s*\\}\\s*\\?>',
        '\\A\\s*<\\?php\\s+(?:echo|print)\\s*\$?\\s*[\'"][\\!\\s\\-\\w\'"\\^]{1,40}[\'"]\\s*\$?\\s*;\\s*\\?>(?:\\s*<\\?php\\s+(?:system|chmod)\\s*\$\\s*(?:[\'"]?(?:chmod|\\w{1,40}\\.php|\\d{3,4})\\s*[\'"]?\\s*,?){2,3}\\s*\$\\s*;\\s*\\?>){2}',
        '\\A\\s*<\\?php\\s*[^\\$]{0,150}\\$\\w{1,9}\\s*=\\s*[\'"][^\'"]*[\'"];\\s*eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]HJ3HjuvcckZf5cLwwAYHzAmGAVOMYs5p8oM55yCST2[^\'"]{20000,55000}[\'"]\\s*\$\\s*\\)\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php[^\$]{0,150}eval\\s*\\(\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]eJzsffl3G8eR8M.0e.4fRhOuAJogLt6kQIn3IV4iSOoiH94AGBAQA[^\'"]{9999,38000}[\'"]\\s*\$\\s*\\)\\s*\\);?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(?:G|P)[^\\(]{1,15}preg_replace\\s*\\([^\$]+[\'"](?:\\\\x65|e)(?:\\\\x76|v)(?:\\\\x61|a)(?:\\\\x6c|l)(?:\$|\\\\x28)(?:g|\\\\x67)(?:z|\\\\x7a)(?:i|\\\\x69)[^\'"]{9,28}(?:\\\\x62|b)(?:a|\\\\x61)(?:s|\\\\x73)(?:e|\\\\x65)(?:\\\\x36|6)(?:\\\\x34|4)[^\'"]{5,35}[\'"][^\$]{999,25000}\\);\\s*\\}?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*eval\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"][^;]{1,15}(?:Z290bw|b3Rv|IGdvdG8)[^;]{9999,24000}(?:ZXZhbA|dmFs|IGV2YWw)[^;]{9,99}(?:aHRtbHNwZWNpYWxjaGFyc19kZWNvZGUodXJsZGVjb2RlKGJhc2U2NF9|dG1sc3BlY2lhbGNoYXJzX2RlY29kZSh1cmxkZWNvZGUoYmFzZTY0Xw|bWxzcGVjaWFsY2hhcnNfZGVjb2RlKHVybGRlY29kZShiYXNlNjRf)[^;]{9,600}[\'"]\$\\s*\\);\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+(\\$\\w{1,9})\\s*=\\s*[\'"]\\w{32}[\'"];[^\\$]{0,20}(\\$\\w{1,9})\\s*=\\s*[\'"]\\w{32}[\'"];[^\\$]{0,20}if\\s*\$\\s*md5\\s*\\(\\s*\\$_GET\\[[^\\]]+\\]\\s*\$\\s*[^\\w]{2,3}\\s*(?:\\1|\\2)\\s*&&\\s*md5\\s*\$\\s*\\$_GET\\[[^\\]]+\\]\\s*\$\\s*[^\\w]{2,3}\\s*(?:\\1|\\2)\\s*\\)\\s*\\{\\s*@?eval\\s*\$\\s*\\$_[^\$]+\\)\\s*;?\\s*\\}?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]BcFJkqowAADQu.Squ1xAlLG6eiEiCjIaBnHzC0kY[^\'"]{400,999}[\'"]\\s*\$\\s*\\)\\s*\\);\\s*\\?>',
        '\\A\\a*<\\?php\\s*@?eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]DZRFDu2IAQSvMrvMxAszKcrCz8yMm8jMzD59.gVa3VJV.1Ve6fB3[^\'"]{999,3000}[\'"]\\s*\$\\s*\\)\\s*\\);\\s*(?:\\Z|\\?>)',
        '\\A\\s*<\\?php\\s*(?:/\\*[^.]{1,25}\\*/\\s*)?eval\\s*\$\\s*[\'"]\\?>[\'"]\\s*\\.\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]eJzlvX1XGzcTOPo3PaffQWz9dO3GGNskbWowgRBI[^\'"]{999,26000}[\'"]\\s*\$\\s*\\)\\s*\\);\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*base64_decode\\s*\\([\'"](?:ZXZhbChnemluZmxhdGUoc3RyX3JvdDEzKGJhc2U2NF9kZWNvZGU|IGV2YWwoZ3ppbmZsYXRlKHN0cl9yb3QxMyhiYXNlNjRfZGVjb2Rl|QGV2YWwoZ3ppbmZsYXRlKHN0cl9yb3QxMyhiYXNlNjRfZGVjb2Rl|ZXZhbCggZ3ppbmZsYXRlKCBzdHJfcm90MTMoIGJhc2U2NF9kZWNvZGU)[^?]{99,2000}[\'"]\$\\);\\s*\\?>',
        '\\A\\s*<\\?php\\s+(\\$[O_0]{2,12})=[\'"][\'"]*["\'];\\s*(\\$[O_0]{2,12})=\$[\'"][\\w\\-\\*\\^%&]{9,40}[\'"]\$;\\$[O_0]{2,12}=\\2[\\[\\{]\\d+[\\]\\}]\\.[^%]{25000,30000}\$\\$[O_0]{2,12},\\$[O_0]{2,12}\$;exit\$[^\\w]{1,9}runsuccess[^\\w]{1,9}\$;\\}[\'"]\\);\\$\\{[\'"](?:\\\\x47|G)[^\'"]{1,40}[""]\\}\\[[^\\]]+\\]\$\$;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+session_start\$\$;[^\\$]{0,600}\\$\\w{1,20}\\s*=\\s*(pack\$\\s*[\'"][nvchslvq]\\*[\'"]\\s*,[^\$]{1,40}\\))\\s*;\\s*(\\$GLOBALS)\\s*=\\s*array\$\\s*([\'"]\\w[\'"])\\s*=>\\s*\\1\\s*,[^\\{]{300,600}\\s*(\\$_SESSION)[^%]{60,200}\\%\\w[\'"]\\s*,\\s*\\2\\[\\3\\]\\([\'"]\\w\\*[\'"],\\4\\[[\'"]\\w[\'"]\\](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\#(\\w{4,7}\\#)\\s*if\\s*\$\\s*empty\\s*\\(\\s*(\\$\\w{1,5})\\s*\$\\s*\\)\\s*\\{\\s*\\2\\s*=\\s*[\'"]<(script)\\s+type\\s*=\\s*[\\\\\'"tcpservi/jxa]+[^;]+;\\w{1,5}\\s*=\\s*[\'"\\\\+document]+;\\s*(\\w{1,5})\\s*=\\s*[\'"\\\\+split]+;[^:]{9,200}eval[^/]{9,99}[\'"][\\w]{999,7000}\\\\[\'"]\\[\\4\\][^<]+\\);\\s*\\}\\s*<\\/\\3>[\'"];\\s*echo\\s+\\2;\\s*\\}\\s*\\#/\\1',
        'if\\s*\$\\s*!\\s*function_exists\\s*\\(\\s*[\'"](sorry_function)[\'"]\\s*\$\\s*\\)\\s*\\{\\s*function\\s*\\1\\s*\$\\s*[^=]{40,90}\\s*\\$[^\\(]{400,1400}\\}\\s*\\}\\s*add_filter\\s*\\(\\s*[\'"][^\'"]{1,40}[\'"]\\s*,\\s*[\'"]\\1[\'"]\\s*\$\\s*;\\s*\\}',
        '\\A\\s*<\\?php\\s*\\$\\{[\'"](?:G|\\\\x47)[^\'"]{1,40}[\'"]\\}[^:]{99,999}(?:h|\\\\x68)(?:t|\\\\x74){2}(?:p|\\\\x70)(?:s|\\\\x73)?://[^!]{99,600}if\\s*\$\\s*strcasecmp\\s*\\(\\s*\\$_SERVER[^?]{99,5000}curl_exec\\s*\\(\\$\\{\\$\\{[\'"](?:G|\\\\x47)[^\'"]{1,40}[\'"]\\}\\[[^\\]]{1,40}\\]\\}\$;[^;]{0,99};?\\}?exit\$\\d*\$;?\\s*(?:\\Z|\\?>)',
        '\\A\\s*<\\?php\\s*eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]1VVtT9swEP7c.gpTVSSVutFSNAYF1gk6aRL7AIwPCCbjJBfq[^?]{300,999}[\'"]\\s*\$\\s*\\)\\s*\\)\\s*;?\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+(\\$\\w{1,40})\\s*=\\s*[\'"][\\w\\.\\-]{1,40}\\.(?:jpg|gif|ico)[\'"]\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*curl_init\$[\'"]https?://[^\'"]{1,99}\\.php[\'"]\\s*\$\\s*;[^>]{1,600}>[\'"]@?\\1[\'"][^=]{1,99}\\$\\w{1,40}\\s*=\\s*curl_exec\$\\2\$;[^\\?]{1,99}(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*/\\*\\w{1,40}\\*/\\s*\\?>\\s*<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*[^\\{]{1,200}\\{\\s*return\\s*\\$\\w{1,40}\\.\\$\\w{1,40}.\\$\\w{1,40};\\s*\\}[^\\{]{15000,30000}[\'"],\\$\\w{1,40}\\)\\.[\'"][^\'"]*[\'"]\\);\\s*(\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*error_reporting\$(?:0|false)\$;\\$\\w{1,40}=[\'"][^\'"]{1,99}[\'"];(\\$\\w{1,40})=array\$[^\\{]{9999,30000}\\{\\s*(\\$\\w{1,40})\\s*=\\1\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*;\\s*(\\$\\w{1,40})\\s*\\.\\s*=\\s*\\$\\w{1,40}\\s*\\[\\s*\\2\\s*\\]\\s*;\\s*\\}\\s*\\3\\s*\\(\\s*[\'"](?:\\\\\\w{1,3})+[\'"]\$;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+function\\s+(\\w{1,40})\\s*\$\\s*\\$\\w{1,40},\\s*\\$\\w{1,40}\\s*\$\\s+\\{\\s*\\$\\w{1,40}\\s*=\\s*(?:(?:gzinflate|base64_decode|strrev|str_rot13|gzuncompress|urldecode|rawurlencode)\\s*\$\\s*){2,5}[\'"][^\'"]{40,99}[\'"](?:\\s*\$\\s*){1,5};\\s*[^\\?]{9999,20000}\\$\\w{1,40}\\s*=\\s*[\'"]\\1[\'"]\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php(?:\\s*\\$\\w{1,40}\\s*=\\s*["\'][^\\^]{1,40}\\^[^\\;]{1,40};\\s*){2,5}(\\$\\w{1,40})\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*[\'"][\'"],(?:\\s*\\$\\w{1,40}\\s*\\(\\s*){1,4}[\'"][^)]+\$\\)\\);\\1\$\$;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+Error_Reporting\$(?:0|false)\$;\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{9999,15000}[\'"];\\s*@?preg_replace\\s*\$\\s*.?[\'"](.).{0,40}\\1(?:e|\\\\x65|\\\\145)\\w?.?[\'"]\\s*,\\s*[\'"][^,]+,[^\$]+\\);\\s*return[^\\;]*\\;\\s*(?:\\?>|\\Z)',
        '(<\\?php\\s+)(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{1,40}[\'"];\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\^\\s*\\2\\s*;\\s*(\\$\\w{1,40})\\s*=[^\$]{600,999}(\\$\\w{1,40})\\s*=\\3\\([\'"][\'"],\\s*[\'"][^\'"]{500,999}[\'"]\\s*\\^\\s*\\4\\s*\$\\s*;\\s*\\5\\s*\$\\s*\$\\s*;',
        '\\A\\s*(<\\?php\\s+)function\\s+(\\w{1,20})\$\\$\\w{1,40}\$\\{\\$\\w{1,9}\\s*=\\s*array\$[^`]{1,999}\\s*if\\(\\s*@?\\$_POST\\[\\2\\(\\d+\$\\][^\\w]{1,3}\\2\$\\d+\$\\)\\{if\$@?copy\\((?:\\s*\\$_FILES\\[\\2\\(\\d+\$\\]\\[\\2\$\\d+\$\\],?\\s*){1,2}\\)\\)(\\{echo)\\s*\$?\\2\\(\\d+(\$;\\})else\\3\\s*\$?\\2\\(\\d+\\4\\};\\};',
        '\\A\\s*(<\\?php\\s+)[^\\$]{1,600}(\\$\\w{1,40})\\s*=\\s*(?:false|0)\\s*;\\s*foreach\\s*\\(\\s*\\$_COOKIE\\s*as\\s*\\$\\w{1,40}\\s*=>\\s*(\\$\\w{1,40})\$\\s*\\{\\s*\\2\\s*=\\s*\\3\\s*;\\s*[^\\?]{999,5000}\\s*\\;\\s*\\}\\s*return\\s+\\$buffer;\\s*\\}',
        'if\\s*\$\\s*(isset)\\s*\\(\\s*\\$_(COOKIE|REQUEST)\\[[^\\]]{1,40}\\]\\s*\$\\s*\\)\\s*(\\$\\w{1,40})\\s*=\\s*\\$_\\2\\[[^\\]]{1,40}\\];\\s*elseif\\s*\$\\s*\\1\\(\\s*\\$_(COOKIE|REQUEST)\\[[^;]{9,49};\\s*if\\s*\\(\\s*\\1\\s*\\(\\s*\\3\\s*\$\\s*\\)\\s*\\{\\s*@?eval\\s*\$(?:\\s*(?:str_rot13|base64_decode)\\s*\\(\\s*){1,2}\\3(?:\\s*\$\\s*){1,3};\\s*die\$\$\\s*;\\s*\\}',
        '\\A\\s*<\\?php[^\\$]{1,600}\\s*\\$\\w{0,9}pass\\s*=\\s*[\'"]\\w{20,40}[\'"]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*[^;]{1,99};\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_POST\\[[^\\]]{1,40}\\][^\\?]{500,999}\\}\\s*@?(?:eval|assert)\\s*\\((?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\\s*\\(){0,5}[\'"][^\'"]+[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*(?:error_reporting\$0\$;)?\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\\s*\\(){0,5}\\s*[\'"](?:eNp9Wf.TE1W2.1cu|eNqNWflTE9n2.1d|ZXJyb3JfcmVwb3J0aW5nKDApOyAkeyJH)[^\$]+[\'"](?:\\s*\\)\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*(?:error_reporting\$0\$;)?\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\\s*\\(){0,5}\\s*[\'"](?:.Mw.ff..fnv..nq|UkFKPqkH3JF|rWjHzfqdkptPE|eF7svWl34kjSKPy|eNqde.uPJFl15)[^\$]+[\'"](?:\\s*\\)\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*\\$\\w{0,9}_pass\\s*=\\s*[\'"]\\w{1,40}[\'"]\\s*;\\s*(?:\\?>\\s*<\\?php\\s*)?\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\\s*\\(){0,5}\\s*[\'"][^\'"]{999,25000}[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*(?:error_reporting\$0\$;)?\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\\s*\\(){0,5}\\s*[\'"](?:eNpTiT83sfPs1pOH|eNpdkcFrE0EYxf|eNplUkFrE0EY|jVRtb9s4DP4eIP)[^\'"]*[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*@?eval\$[\'"]\\?>[\'"]\\s*\\.\\s*base64_decode\\s*\\(\\s*[\'"]PD9waHAgDQoNCg0KDQp[^\'"]+[\'"]\\s*\$\\s*\\)\\s*;\\s*(?:\\?>|\\Z)',
        '(?<!@)preg_replace\\s*\$\\s*.?[\'"](.).{0,40}\\1e\\w?.?[\'"]\\s*,[\'"]\\\\[^,]{999,60000}\\s*,\\s*[^\$]{1,40}\\s*\\)\\s*;',
        '\\A\\s*<\\?php\\s*\\$\\w{1,40}\\s*=\\s*[^;]{0,20};\\s*\\$\\w{1,40}\\s*=\\s*[^;]{20,80};\\s*\\$\\w{1,40}\\s*=\\s*\\w{1,40}\$\$\\s*;\\s*[^\\?]{60000,}function\\s*\\w{1,40}\\s*\$\\s*\$\\s*\\{(?:\\s*\\$\\w{1,40}\\s*=[\'"][^\'"]{20,80}[\'"]\\s*;\\s*){2}return\\s*[\'"](?:\\s*\\{\\s*\\$\\w{1,40}\\s*\\}\\s*){2}[\'"]\\s*;\\s*\\}\\s*(?:\\?>|\\Z)',
        '\\A\\s*(<\\?php\\s+)[^\\$]{1,99}\\s*\\$wp_auth(?:\\w{1,9})?\\s*=\\s*[\'"]\\w{20,40}[\'"];\\s*if\\s*\$\\s*!\\s*function_exists\\s*\\(\\s*["\']slide[^<]+(?:<script[^\\.]+(?:\\.onclasrv|\\.mobisla)[^>]+>\\s*</script>\\s*){1,3}[^`]{999,3000},[\'"]slider_option_footer[\'"]\$;\\s*\\}\\s*\\}\\s*\\}\\s*\\}',
        '\\A\\s*<\\?php\\s*[^\\{]{1,600}try\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\$\\s*[\'"][^\'"]{1,5000}[\'"]\\s*\$\\s*;\\s*function\\s+scan\\s*\$[^\\?]{999,3000}=\\s*explode\\s*\\([\'"]<\\?php[\'"],[^\\?]+\\?\\s*[\'"]https?[\'"][^\\?]+unlink[^;]{1,40};\\s*\\}\\s*catch\\s*\\(\\s*Exception\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*[^\\}]{1,40}\\s*\\}\\s*\\?>',
        '\\A\\s*<\\?php\\s*[^$]{0,600}(?:\\s*\\$\\w{1,40}\\s*=\\s*[^\\;]{1,40};\\s*){1,3}@?\\$\\w{1,40}\\s*\$\\s*.?[\'"](.).{0,40}\\1e\\w?.?[\'"]\\s*,\\s*[\'"][^\\^]+\\^[^,]+,\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$\\s*;\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s*(\\$\\w{1,40})\\s*=\\s*\\$_SERVER\\s*\\[\\s*[\'"]DOCUMENT_ROOT[\'"]\\s*\\]\\s*\\.\\s*[\'"][^\'"]{1,40}\\.php[\'"]\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*fopen\\s*\$\\s*[\'"]?\\1[\'"]?\\s*,\\s*[\'"](?:a|w)\\+?[\'"]\\s*\$\\s*;\\s*fwrite\\s*\$\\s*\\2\\s*,\\s*base64_decode\\s*\\(\\s*[\'"][^\'"]{200,999}[\'"]\\s*\$\\s*\\)\\s*;\\s*fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*(?:\\?>|\\Z)',
        '\\$(?:auth)?_?pass\\s*=\\s*[\'"][^\'"]{20,40}[\'"];\\s*if\\s*\$\\s*[^;]{1,200};\\s*(\\$\\w{1,40})\\s*=\\s*[\'"]\\\\[^;]{1,200}[\'"];\\s*if\\s*\\(\\s*(?:!|@)?preg_replace\\s*\\(\\s*.?[\'"](.).{0,40}\\2(?:e|\\\\x65)\\w?.?[\'"]\\s*,\\s*\\1\\s*,\\s*[\'"][\'"]*[\'"]\\s*\$\\s*\\);(?:\\s*die\\s*\$\\s*[^\$]*\\s*\\)\\s*;)?',
        '(\\$\\w{1,40})\\s*=\\s*get_option\\s*\$\\s*[\'"]_site_transie\\w{30,50}[\'"]\\s*\$;\\s*\\1\\s*=\\s*base64_decode\\s*\$\\s*str_rot13\\s*\\(\\s*\\1(?:\\[[^\\]]{1,40}\\])?\\s*\$\\s*\\);\\s*if\\s*\$\\s*[^\\{]{29,99}\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*create_function\\(\\s*[\'"][\'"]\\s*,\\s*\\1\\s*\$;\\s*@?\\2\$\$;\\s*\\}',
        '\\A\\s*<\\?php\\s+[^\\$]{9,49}\\s*\\?>\\s*<form\\s+method\\s*=\\s*[\'"]POST[\'"][^\\?]{69,99}?</form>\\s*<\\?php\\s*(?:echo)?\\s*\$?\\s*@?copy\\(\\s*\\$_FILES\\[[\'"][^\'"]{1,40}[\'"]\\]\\[[\'"][^\'"]{1,40}[\'"]\\],[^;]{9,60};\\s*(?:\\?>|\\Z)',
        '\\A\\s*<\\?php\\s+echo\\s*\\(?\\s*[\'"]\\s*<title>[^\\$]{199,600}\\s*if\\s*\\(\\s*@?\\$_POST\\[[^\\]]{1,40}\\]\\s*[^\\w]{1,3}\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$\\s*\\{\\s*if\\s*\$\\s*@?copy\\s*\\(\\s*\\$_FILE[^\\?]{1,400}\\s*\\}\\s*\\}\\s*(?:\\?>|\\Z)',
        '\\$ip\\s*=\\s*(?:getenv\\(|\\$_SERVER\\[)[\'"]REMOTE_ADDR[\'"](?:\$|\\]);\\s*.{0,600}\\s*(\\$data)\\s*\\.?=\\s*[\'"][-\\s\\w]{10,90}\\\\n[\'"]\\s*;(?:\\s*\\1\\s*\\.?=\\s*[\'"](Email|Password|IP(?:Address)?)[^\\n]{1,60}([\'"]?\\\\n[\'"]|[\'"]/[\'"]);){2,3}\\s*\\1\\s*\\.?=\\s*[\'"][-\\s\\w]{10,90}\\\\n[\'"]\\s*;',
        'error_reporting\$(?:0|Null|False)\$;\\s*preg_replace\\s*\$\\s*[\'"](.).{0,40}\\1e\\w?[\'"]\\s*,"eval\\([\'"]//',
        '<html>\\s*<head>\\s*<title>\\s*Webmail\\s+\\|?\\s*Update\\s*<',
        '\\A\\s*<\\?(?:php)?[ ]{200,}if\\s*\\(\\s*!\\s*isset\\s*\\(\\s*\\$_[^\\?]{40,150}\\s*\\?>\\s*<\\?(?:php)\\s*\\$\\{[^\\?]{60000,64000}[\'"],[\'"](?:\\\\x2e|\\.)[\'"]\\s*\$;\\s*\\?>\\s*\\Z',
        'if\\s*\$\\s*function_exists\\s*\\(\\s*[\'"]shell_exec[\'"]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*shell_exec\\s*\$\\s*\\$\\w{1,40}\\s*\$;\\s*return\\s*\\$\\w{1,40};\\s*\\}\\s*return\\s*[^;]{1,40};\\s*\\}\\s*function\\s*command\$\$\\s*\\{',
        '<title>\\s*[\\|]{0,2}\\s*InboX\\s+Mass\\s+Mailer',
        '\\A\\s*<\\?(?:php)?\\s*\\$[O0]{6,12}\\s*=\\s*urldecode\$[\'"]%[^\'"]{1,200}[\'"]\$;(?:\\s*\\$[O0]{6,12}\\.?=(?:\\$[O0]{6,12}\\{\\d+\\}\\s*\\.?\\s*){2,10};){2,9}\\s*@?eval\$\\$[O0]{6,12}\\([\'"](JE8w|JE9P|JDAw|JDBP)[^\'"]{1000,25000}[\'"]\$\\s*\\);\\s*(?:/\\*[^\\?]{1,40}\\*/)?\\s*\\?>\\s*\\Z',
        '<title>\\s*Cmd\\s+by\\s+ghz',
        '\\A\\s*(<\\?php)\\s*error_reporting\$[^\$]{1,9}\\);\\s*\\$\\w{1,40}\\s*=\\s*getcwd\$\$;\\s*\\$\\w{1,40}\\s*=\\s*php_uname\$\$;\\s*\\$\\w{1,40}\\s*=\\s*phpversion\$\$;\\s*(\\$\\w{1,40})\\s*=\\s*ini_get\$[\'"][^\'"]{1,40}[\'"]\$;\\s*if\\s*\$\\s*\\2\\s*[^\\w]{1,2}=\\s*[\'"][\'"]\\s*\$\\s*\\{\\s*[^\\}]{1,40}\\s*\\}\\s*(?:print|echo)\\s*[^;]{1,600};',
        '\\A\\s*<\\?php\\s+call_user_func\\s*\$\\s*create_function\\s*\\(\\s*[\'"][\'"],\\s*[\'"][^\'"]{30000,40000}["\'](?:\\s*\$\\s*){1,3};\\s*[\'"](?:\\s*\\)\\s*){1,3};\\s*(\\?>|\\Z)',
        '\\}\\s*elseif\\s*\$\\s*function_exists\\([\'"]shell_exec[\'"]\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*@?shell_exec\$\\$cmd\$;\\s*return\\s*\\$\\w{1,40};\\s*\\}\\s*\\}\\s*function\\s+perms\$\\$\\w{1,40}\$\\s*\\{',
        '(\\$\\w\\d)\\s*=\\s*fopen\$[\'"][^\'"]{1,40}[\'"],\\s*[\'"](?:a|w)\\+?[\'"]\\s*\$;\\s*(?:fputs|fwrite)\$\\1,(\\$\\w\\d)\$;\\s*mail\$\\$\\w\\d,\\$\\w\\d,\\2,\\$\\w\\d\$;\\s*header\$[\'"]Location:',
        'visitor_country\\(\$;\\s*(\\$(?:msg|message))\\s*\\.?=\\s*[\'"][^\'"]{1,40}[\'"]?(\\\\n[\'"]);\\s*\\1\\s*\\.?=\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\.\\s*\\$_POST\\[[\'"]email[\'"]\\]\\s*\\.\\s*[\'"]?\\2;\\s*\\1\\s*\\.?=\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\.\\s*\\$_POST\\[[\'"]password[\'"]\\]\\.[\'"]?\\2;',
        '\\A\\s*GIF8\\d[^`]{2000,6000}?<\\?php',
        '<title>\\s*Sign\\s*in\\s*to\\s*your\\s*Microsoft\\s*account\\s*</title>',
        '\\$subject\\s*=\\s*[\'"]\\s*\\w{1,40}\\s*\\[\\s*[\'"]\\s*\\.\\s*getRealIpAddr\\s*\$\\s*\$\\s*\\.\\s*[\'"]\\s*\\]\\s*[\'"]\\s*;\\s*\\$headers\\s*=\\s*[\'"]\\s*From:\\s*New\\s+ID\\s+Scan',
        '\\$\\w{1,40}\\s*=\\s*[\'"]a:1:{s:13:"administrator";b:1;}[\'"];\\s*if\\s*\$\\s*isset\\(\\s*\\$_GET\\[[\'"][^\'"]{1,40}[\'"]\\]\\s*\$\\s*\\)\\s*\\{\\s*echo\\s*[\'"][\'"];\\s*\\}',
        'function\\s+\\w{1,40}\\s*\$[^\$]{0,40}\\)\\s*\\{\\s*if\\s*\$\\s*!\\s*defined\\s*\\(\\s*[\'"]WP_OPTION_KEY[\'"]\\s*\$\\s*\\)\\s*\\{\\s*[^\\}]{1,200}\\s*\\}\\s*\\}\\s*if\\s*\$\\s*class_exists\\s*\\(\\s*[\'"]JFactory[\'"]\\s*\$',
        'gcc\\s+-o\\s+(exploits)\\s+\\w{1,40}\\.c;\\s*chmod\\s+\\+x\\s+\\1;\\s*\\./\\1;',
        'mysql_error\$\$;\\s*\\}\\s*\\}\\s*(?:else)?if\\s*\$\\s*isset\\s*\\(\\s*\\$_REQUEST\\[[\'"]?([^\'"]{1,40})[\'"]?\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$_REQUEST\\[[\'"]?\\1[\'"]?\\]\\s*\\.?=\\s*\\$\\w{1,40}\\s*\\.\\s*\\$_REQUEST\\[[\'"]?[^\'"]{1,40}[\'"]?\\];\\s*if\\s*\$\\s*@?unlink\\(\\s*\\$_REQUEST\\[[\'"]?\\1[\'"]?\\](?:\\s*\$\\s*){1,5}\\{',
        '\\$filter\\s*=\\s*[\'"][^\'"]{0,40}[\'"];\\s*\\$\\w{1,40}\\s*=\\s*[\'"]\\s*From\\s*:\\s*kay\\s*<\\s*mailist@mailist\\.com\\s*>\\s*[\'"];',
        '\\$message;\\s*\\}\\s*\\?>\\s*<\\?php\\s+system\$\\s*[\'"]chmod\\s+\\d+\\s+(\\w{1,40})\\.php[\'"]\\s*\$;\\s*\\?>\\s*<\\?php\\s+chmod\$\\s*[\'"]\\1\\.php[\'"]\\s*,\\s*\\d+\\s*\$;\\s*\\?>',
        '<title>\\s*(?:Priv8|Private)?\\s*(?:Mister|Mr)\\s+Spy\\s*</',
        '(\\$message)\\s*\\.?=\\s*[\'"](?:CC|Card)\\s+number\\s*:\\s*[\'"]\\.\\$_POST\\[[\'"]\\w{1,40}[\'"]\\]\\s*\\.?\\s*[\'"]?\\\\n[\'"];\\s*\\1\\s*\\.?=\\s*[\'"](?:Exp|expiration)\\s*month/year/cvv\\s*code\\s*:\\s*[\'"]\\.\\$_POST\\[[\'"]\\w{1,40}[\'"]\\]',
        '(\\$urlz)\\s*=\\s*lrtrim\$\\s*\\1\\s*\$;\\s*(\\$\\w{1,40})\\s*=\\s*lrtrim\$\\s*\\2\\s*\$;\\s*(?:\\$\\w{1,40}\\s*=\\s*\\$_POST\\[[\'"]\\w{1,40}[\'"]\\];)?\\s*(\\$message)\\s*=\\s*urlencode\$\\s*\\3\\s*\$;\\s*\\3\\s*=\\s*ereg_replace\$[\'"]%',
        'if\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"][^\'"]{1,40}[\'"]\\]\\s*[^\\w]{1,2}=\\s*[\'"]?[^\'"]{0,40}[\'"]?\\s*\$\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*file_get_contents\\s*\$\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)\\w{1,40}[\'"]\\s*\$;',
        '(\\$\\w{1,40})\\s*=\\s*EMAIL;\\s*(?:\\$\\w{1,40}\\s*=\\s*)?@?mail\\s*\$\\s*\\1\\s*,\\s*[^\$]{1,120}\\s*\\)\\s*;\\s*(?:\\?>)?\\s*<script\\s*type\\s*=\\s*[\'"]text/javascript[\'"]>\\s*[^\\&]{1,200}&rand\\s*=\\s*\\d+InboxLightaspxn',
        '(\\$message)\\s*\\.?=\\s*[^;]{0,80}[\'"]\\s*CPassword:\\s*[\'"]\\s*\\.\\s*\\$_POST\\[[\'"](?:password|pass|passwd)[\'"]\\][^;]{1,40};\\s*\\1\\s*\\.?=\\s*[^\\{]{1,40}\\{\\$geoplugin->',
        'if\\s*\$\\s*\\$_POST\\[[\'"][^\'"]{1,40}[\'"]\\]\\s*==\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*[\'"]wget\\s*https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)\\w{1,40}',
        '\\A\\s*GIF8(?:9|7)\\w?[^\\s]{0,2}\\s*[^`]{0,99}\\s*<\\?php',
        '<title>\\s*.{0,5}\\s*Rebels\\s+Mailer',
        'apple\\/cssisma\\/Anonisma\\.css',
        '\\$opt\\("/\\d+/e',
        'stylesheet[^/]{1,40}href[^/]{1,40}\\.?/cssisma[^\\?]{1,200}Anonisma',
        '<TITLE>\\s*dis\\s+Shell\\s+Commander',
        'mail\\(\\$emailusr,\\s*(\\$subj),\\s*(\\$data)\$;\\s*mail\$\\$cc,\\s*\\1,\\s*\\2\\s*\$;\\s*header\$[\'"]Location:[^\'"]{1,40}\\.scotiabank\\.com/[^\'"]{1,40}[\'"]\\s*\$\\s*;\\s*\\?>',
        '\\$ip\\w{0,20}\\s*=\\s*\\$_SERVER\\[[\'"]REMOTE_ADDR[\'"]\\];\\s*\\$(?:from_)?shellcode\\s*\\.?=\\s*[\'"]?[^\$]{0,20}gethostbyname\\s*\\(',
        'for\\s*\\(\\s*(\\$\\w{1,40})\\s*=\\s*\\d+;\\s*\\1\\s*<\\s*\\$\\w{1,40}\\s*;\\s*\\1\\+\\+\\s*\$\\s*\\{\\s*[^\\}]{1,400}flush\\s*\$\\s*\$;\\s*\\$\\w{1,40}\\s*=\\s*new\\s+PHPMailer\\s*\$\\s*\$;',
        'base64_decode\\s*\$\\s*[\'"]Y1BhbmVsIENyYWNrZXIg',
        '<title>\\s*ZETHA\\s+WEB\\s*SHELL',
        '\\$(fone)\\s*=\\s*\\$_POST\\[[\'"]\\1[\'"]\\];\\s*\\$(emailaddr)\\s*=\\s*\\$_POST\\[[\'"]\\2[\'"]\\];\\s*\\$(emailpass)\\s*=\\s*\\$_POST\\[[\'"]\\3[\'"]\\];\\s*\\$(token)\\s*=\\s*\\$_POST\\[[\'"]\\4[\'"]\\];',
        '\\$ip\\s*=\\s*\\$_SERVER\\[[\'"]?REMOTE_ADDR[\'"]?\\];\\s*\\$email\\s*=\\s*\\$_POST\\[[\'"]?\\w{1,40}[\'"]?\\];\\s*(\\$(?:pass|password|passwd))\\s*=\\s*\\$_POST\\[["\']?\\w{1,40}[\'"]?\\];\\s*\\1\\w\\s*=\\s*\\$_POST\\[["\']?\\w{1,40}[\'"]?\\];[^\\?]{100,600}fwrite\\(\\$\\w{1,40},\\s*\\$data\\s*\$;',
        '"[\\\\#-=\\[]{10,12}Priv(8|ate)\\s*PayPal\\s*Scam',
        '<title>\\s*[:]{0,2}\\s*Mailer\\s+Inbox\\s+-?\\s*Dejector',
        '\\$subj(?:ect)?\\s*=\\s*[\'"]Kumasiivertigo\\s*ALiBaBa',
        '\\$headers\\s*=\\s*[\'"]From:\\s*Office[\'"];\\s*\\$str=array\$(\\$send)\$;\\s*foreach',
        '<title>\\s*PHP\\s*Jackal',
        '(\\$bilsmg) \\.?=\\s*[\'"]card\\s*num(?:ber)?\\s*:?\\s*[\'"]\\.\\$_POST\\[[\'"]\\w{1,40}[\'"]\\]\\s*\\.?\\s*[\'"]?\\\\n[\'"];\\s*\\1\\s*\\.?=\\s*[\'"]\\w{1,40}\\s*:?\\s*[\'"]\\.\\$_POST\\[[\'"]ccv2?(?:\\-code)?\'\\]\\s*\\.?\\s*[\'"]?\\\\n[\'"];',
        'Kakak\\s+._.\\s*\\.?</font><br\\s*/>[\'"];\\s*\\}\\s*else(?:if)?\\s*\\{',
        '<title>\\s*w4l3XzY3\\s+Mailer',
        'fwrite\$\\s*(\\$\\w{1,4}),\\s*[\'"]\\s*(login|userid|username|email)\\s*:?[\'"]\\s*\\.\\s*\\$\\w{1,40}\\s*\$;\\s*fwrite\\s*\$\\s*\\1[^\\$]{1,40}fwrite\\(\\s*\\1,\\s*[\'"]\\s*(pass|passwd|password)\\s*:?[\'"]\\s*\\.\\s*\\$\\w{1,40}\\s*\$;',
        '\\$headers\\s*\\.?=\\s*[\'"]From:\\s*[^\'"]{0,40}Spam[^\'"]{0,40}[\'"];',
        'Password\\s*:\\s*[\'"]\\.\\$\\w{1,40}\\.[\'"]\\s*[=]{1,40}\\s*\\w{0,20}\\s*FACEBOOK\\s*\\w{0,20}\\s*[=]{1,40}\\s*Email\\s*:\\s*[\'"][^\'"]{1,40}[\'"]\\s*Password\\s*:\\s*[\'"][^\'"]{1,40}[\'"]',
        '<title>\\s*Safe\\s+Mode\\s+Shell',
        '\\)\\)\\s*{\\s*echo\\s*PHP_OS\\.\\$',
        'if\\s*\$\\s*\\$\\w{1,40}\\s*[^\\w]{1,2}=\\s*[\'"]CheckCrd[\'"]\$\\s*\\{\\s*(?:\\?>\\s*<\\?php)?\\s*function\\s+work.hard\$\\$\\w{1,40}\$\\s*\\{',
        'ZGVmYXVsdF91c2VfYWpheCA9IHRydWU',
        '<title>\\s*Sign\\s+In\\s*</title>\\s*[^>]{1,40}(?:signin_?files|images)/\\w{1,40}\\.ico[\'"]',
        '\\A\\s*<\\?php\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*[\'"][^\'"]{1,144}[\'"]\\s*\$;\\s*(?:\\?>\\s*<\\?php)?\\s*phpinfo\$\$;\\s*\\?>\\s*\\Z',
        'PD9waHAgaWYoIWlzc2V0KCRfQ09PS0lFWyJtb2R4',
        'JE8wTzAwMD0ibkZ1Zmt',
        'Ly9OTHRScS9mcjJYRzZhM3FPd3l',
        'VnXO8\\$1_HU8nnjePnU8P8\\$e_njsP8\\$V',
        'Ly9OTmhOOVUrMkRuVUkrTm9mdnhWV2RRV',
        'ZXJyb3JfcmVwb3J0aW5nKDApO2lmKGlzc2V0KCRfUkVR',
        'eNq1fflvU2f677/iieaqQDPhb',
        'DRmNurHxXATBjbLkSGpOQnIzco',
        'ZXJyb3JfcmVwb3J0aW5nKDcpOw0KQ',
        'eNp9Vm1rG1cW/iu3orRSIpx508iy',
        'eNqVWvtTFFfa/lc6VGoDSrC7p',
        'eNq9fflzI9XV9r/S05CRBLas',
        'Z2xvYmFsICRVU0VSOwokVVNFUi0',
        '6SgzwTnp6V5jAu8DDpIWHwHvz',
        'Pz48P3BocCAkX0Y9X19GSUxFX18',
        'aWYoITApJE8wMDBPME8wMD0kT09',
        'aWYoaXNzZXQoJF9HRVRbIjB4Il0',
        'aWYoITApJE8wMDBPME8wMD0kT09',
        'JElJSUlJSUkxMTFsST0nb2JfZW5',
        'eval\$gzuncompress\\(base64_decode\\(\'eNqtWVlv21YWfm6B\\+Q9MYIR',
        '\\$\\w{1,12}\\s*\\.\\s*=\\s*[\'"][^\'"]{0,20}Social\\s+Security[^\'"]{0,20}\\s*[\'"]\\s*\\.?\\s*\\$_POST\\s*\\[\\s*[\'"]ssn[\'"]\\s*\\]\\s*\\.\\s*[^;]{1,40}\\s*;',
        '\$;eval\$base64_decode\\("aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJod',
        '\\$O00OO0\\{30\\};eval\\(\\$O00O0O\\("JE8wTzAwMD0iVFF3cVJQTGR0ZkZEeHVZeUVJVktXQ2tyY0poTlNaSGlib3Z',
        '<title>\\s*(?:Priv8|Private)\\s+Mailer',
        'system\\([\'"]unset\\s+HISTFILE;\\s*unset\\s+SAVEHIST;\\s*[^\\$]{1,200}\\s*system\\(\\s*\\$\\w{1,40}\\s*\$;\\s*[^\\?]{0,100}\\s*\\?>\\s*\\Z',
        '<\\?php\\s*\\$\\w{1,40}\\s*=__FILE__\\s*;\\s*\\$\\w{1,40}\\s*=\'P2lCP1ouWg1WDVYkcnNXTUVlWU0\\+Uz4iMi5NMnluUVluWFk5TCI7DVYkLy5NMnluUVlucnNXTXRlbi4\\+Uz4iMTE8QVBrUExVQTFBMFt',
        '\\$d?doss(?:tr)?;\\s*\\}\\s*while\\s*\$\\s*\\w{1,40}\\s*\$\\s*\\{\\s*\\$[o0]{5,60}\\s*=\\s*@?include(?:_once)?\\s*\$?\\$[o0]{5,60}\$?;\\s*if\\s*\$\\s*\\$[o0]{5,60}\\s*==\\s*[\'"][^\'"]{0,60}[\'"]\\s*\$\\s*\\{\\s*\\$[o0]{5,60}\\+\\+;',
        'curl_getinfo\$\\s*\\$\\w{1,40},\\s*CURLINFO_CONTENT_TYPE\\s*\$\\s*\\);\\s*(\\$\\w{1,40})\\s*=\\s*preg_replace\$[\'"]\\#\\^\\.\\*\\?\\\\<html\\#si[\'"],\\s*[\'"]<html[\'"],\\s*\\1\\s*\$;\\s*\\$\\w{1,40}\\s*=\\s*\\1;\\s*\\$\\w{1,40}\\s*=\\s*\\$_SERVER\\[[\'"]?SCRIPT_NAME[\'"]?\\];',
        '<title>\\s*[\\s:]{0,4}g(?:0|o)nz\\s*[\\s:]{0,4}\\s*PHP\\s+MAILER',
        '(\\$\\w{1,40})\\s*=\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?\\w{1,40}[\'"]?\\];\\s*(\\$\\w{1,40})\\s*=\\s*[\'"]\\w{1,40}\\.txt[\'"];\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*==\\s*[\'"]?\\w{0,40}[\'"]?\\s*\$\\s*\\{\\s*die;\\s*\\}\\s*else\\s*\\{\\s*@?unlink\\s*\$\\s*\\2\\s*\$;\\s*\\$sym(?:link)?\\s*=\\s*\\1;',
        'EOF\\s*<html>\\s*<head>[ ]{200,}<script>\\s*window\\.location\\s*=\\s*[\'"][^\'"]{1,100}[\'"]\\s*;\\s*</script>\\s*</head>\\s*<body>\\s*<[^>]{1,40}>\\$\\w{1,40}</[^>]{1,40}>\\s*</body>\\s*</html>\\s*EOF;?\\s*\\}\\s*else\\s*\\{\\s*\\$GLOBALS[^\\w][^\\}]{1000,2000}\\}\\s*(?:\\?>)?\\s*\\Z',
        '\\A\\s*<\\?php\\s*(?:/\\*\\s*\\*/)?\\s*\\$ip\\w{0,10}\\s*=\\s*\\$_SERVER\\[[\'"]?REMOTE_ADDR[\'"]?\\];\\s*\\$ip\\w{0,10}\\s*=\\s*array\$\\s*[\'"]\\s*\\^?\\d+\\.\\d+\\.(?:\\*|\\d+)\\.(?:\\*|\\d+)\\s*[\'"]\\s*,[^\$]{800,1800}\\s*\\);\\s*[^\\?]{300,350}\\$blocked_words\\s*=\\s*array\$',
        '\\A\\s*\\(new\\s*Function\\(\\(function\\(s\$\\{var\\s*d=\\{\\},a=\$s\\+""\$\\.split\$""\$,cc=a\\[0\\],o=cc,r=\\[cc\\],c=256,p;for\$var\\s+i=1;i<a\\.length;i\\+\\+\$\\{var\\s+cd=a\\[i\\]\\.charCodeAt[^%]{200,300}%r\\.length\\)\\)\\}\\)\\.join\$[\'"]{2}\$\\}\\)\$atob\\("[^"]{20000,}"\$,.+"\\)\\)\\)\\)\\)\\)\$\$;',
        'window\\.miner\\.stop\\s*==\\s*[\'"]function[\'"]\\)\\s*window\\.miner\\.stop\$\$;',
        ',\\s*basename\$\\$_FILES[^\\$]{1,40}\\$_POST\\[[\'"]?(\\w{1,40})[\'"]?];[^`]{1,400}<input\\s+name\\s*=\\s*[\'"]\\1[\'"][^>]{1,40}value\\s*=\\s*[\'"]\\.php[\'"]\\s*/>',
        '<pre>[\'"];\\s*system\\([\'"][^\'"]{1,40}[\'"]\\s*\\.\\s*\\$_FILES\\[[\'"]([^\'"]{0,40}up[^\'"]{0,40})[\'"]\\]\\[[\'"][^\'"]{1,40}[\'"]\\]\\s*\\.\\s*[\'"]\\s*[\'"]\\s*\\.\\s*\\$\\w{1,40}\\s*\\.\\s*[\'"]/[\'"]\\s*\\.\\$_FILES\\[[\'"]\\1[\'"]\\]',
        '<title>\\s*(?:Sign\\s+In\\s*-)?\\s*DocuSign\\s*</title>',
        'if\\s*\\(crawlerDetect\\(\\$_SERVER\\[[\'"]?HTTP_USER_AGENT[\'"]?\\]\$\\)\\s*\\{\\s*header\$[\'"]HTTP/1\\.\\d\\s+404\\s+Not\\s+Found[\'"]\$;\\s*die\$[\'"][^\'"]{1,100}[\'"]\$;\\s*\\}\\s*\\$IP_Connected\\s*=\\s*\\$_SERVER\\[[\'"]?REMOTE_ADDR[\'"]?\\];',
        'exit\\s*\$\$;\\s*\\}?\\s*if\\s*\$\\$_POST\\[[\'"]?[^\\?]{1,40}[\'"]?\\]\$\\s*@?eval\$\\$_POST\\[[\'"]?[^\\?]{1,40}[\'"]?\\]\$;\\s*if\\s*\$\\s*\\$_POST\\[[\'"]?[^\'"]{0,20}up[^\'"]{0,20}[\'"]?\\]\\s*[^\\w]=\\s*[\'"][^\'"]{0,40}[\'"]',
        '<br/>Mr Secretz</center>',
        '<title>\\s*Mr\\s*Secretz\\s+Shell',
        '<title>\\s*View\\s*Document\\s*-\\s*Sign\\s+In</title>\\s*</head>\\s*<script\\s*type="text/javascript">\\s*(?:\\s*<title>Yahoo\\s+Update</title>',
        '<title>\\s*Sign\\s+in\\s*</title>.{350}\\s*<\\s*script type\\s*=\\s*[\'"]\\s*text/javascript\\s*[\'"]>\\s*function unhideBody\$\$',
        '<title>Yahoo</title>\\s*<\\s*meta http-equiv\\s*=\\s*[\'"]refresh[\'"]\\s*content\\s*=\\s*[\'"]\\d+;\\s*url\\s*=\\s*https://yahoo\\.com[\'"]\\s*>',
        '<title>\\s*Sign\\s+in\\s*-\\s*Google\\s+Drive</title>\\s*<style>',
        'charset\\s*=\\s*UTF-8[\'"]>\\s*<title>\\s*Google\\s+Drive\\s*-\\s*Google\\s+Drive\\s*</title',
        '<html>\\s*<head>\\s*<meta\\s*http-equiv=[\'"]Content-Type[\'"]\\s*content=[\'"]text/html;\\s*charset=UTF-8[\'"]>\\s*<title>\\s*Google\\s+Drive\\s*</title>\\s*<script\\s*language=[\'"]javascript[\'"]>',
        '\\A\\s*<!DOCTYPE html>\\s*',
        '\\$default_action\\s*=\\s*[\'"]FilesMan[\'"];\\s*\\$default_use_ajax\\s*=\\s*true;',
        '<title>GaLers\\s+xh3LL\\s+Backd00r</title>',
        ';class\\s*Smarty3\\s*{\\s*private\\s*static\\s*\\$file_with_ip',
        'exec\$"cat /etc/passwd',
        '\\.\\s*/sss\\s*\\.\\s*pl\\s*<\\s*local_host\\s*>\\s*<\\s*local_port\\s*>\\s*\\[\\s*auth_login\\s*\\(\\s*:auth_pass\\s*\$\\s*\\]',
        '<title>Navicat HTTP Tunnel Tester</title>',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\)\\s*\\$mailTo\\s*=\\s*base64_decode\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*;.+if\$mail\\(\\$MailTo\\s*,\\s*\\$MessageSubject\\s*,\\s*\\$MessageBody\\s*,\\s*\\$MessageHeader\\s*\$\\s*\\)',
        'Upload\\s*is\\s*<b>\\s*<color>\\s*WORKING',
        'Sindbad\\s*File\\s*Manager\\s*Version',
        'if\\s*\$\\s*file_exists\\(\\s*"config/settings\\.inc\\.php"\\s*\$\\s*or\\s*\$\\s*"\\.\\./config/settings\\.inc\\.php"\\s*\$\\s*or\\s*\$\\s*"\\.\\./\\.\\./config/settings\\.inc\\.php"\\s*\$',
        '<\\?php\\s*@set_time_limit\\s*\$\\s*\\d+\\s*\$\\s*;\\s*@ignore_user_abort\\s*\$\\s*\\d+\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\w+\\s*\$\\s*\$\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*==\'[^\']*\'\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*base64_encode\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*function\\s*\\w+\\s*\$\\s*\$\\s*\\{\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\}\\s*else\\s*\\{\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\.\\s*\'[^\']*\'\\s*\\.\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\\d+\\s*\\]\\s*;\\s*\\}\\s*else\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\.\\s*\'[^\']*\'\\s*\\.\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\}\\s*\\}\\s*return\\s*\\$\\w{1,40}\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*urldecode\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*.+?\\s*;\\s*eval\\s*\$\\s*\\$\\w{1,40}\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*;\\s*\\?>',
        '<\\?php\\s*eval\$gzuncompress\\(base64_decode\\(\'eNp1VW1r21YU/it3JjA7mMSSLCmyyYqXOJ4zj5R4rEl2h7iWrl4aWfKk60YmjFFox',
        '\\$\\w{1,40}\\s*=\\s*base64_decode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*strrev\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*substr\\s*\$\\s*md5\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*,\\s*0\\s*,\\s*strlen\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\\s*md5\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\.\\s*\\$\\w{1,40}\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\'gzinflate\'\\s*;',
        '<title>Cardiman\\s+Asooooh',
        '\\$\\w{1,40}\\s*=\\s*file_get_contents\$\\$\\w+\$;\\s*}\\s*elseif\$!in_array\\([\'"]exec[\'"]\\s*,\\s*explode\\(\\s*[\'"],[\'"]\\s*,\\s*ini_get\\(\\s*[\'"]disable_functions[\'"]\\s*\$\\s*\\)\\s*\\)\\s*\\)\\s*{\\s*exec\$\\s*"wget\\s*-O\\s*-\\s*\'"\\s*\\.\\s*\\$\\w+\\s*\\.\\s*"\'"\\s*,\\s*\\$\\w+\$;',
        '\\$headers\\s*=\\s*"From:\\s*MafioZo0',
        '\\$ADconn\\s*=\\s*new\\s*adLDAP;\\s*if\$\\$ADconn->existingUser\\(\\$user\\[\'username\'\\]\$\\){\\s*section\$"Active\\s*Directory",2\$;\\s*content\$\$;',
        'makehide\$\'action\', \'backconnect\'\$;\\s*p\$\'<p>\'\$;\\s*p\$\'Your IP:\'\$;\\s*makeinput\$array\\(',
        '<title>\\w+</title><form\\s+enctype=multipart/form-data\\s+method=post><input\\s+name=\\w+\\s+type=file><input\\s+type=submit\\s+name=\\w+>\\s*<br><br><input\\s+name=path\\s+type=text\\s+value=<\\?php\\s+echo\\s+@getcwd\\(\$;\\s*\\?>/>',
        '<\\?php\\s*echo\$\\s*htmlentities\\(\\s*\\$_GET\\[\\s*\'symlinktarget\'\\s*\\]\\s*\$\\s*\\);\\s*\\?>\\s*</b>\\s*<br>\\s*<input\\s*type="checkbox"\\s*name="relative"\\s*value="yes"\\s*id="checkbox_relative',
        'if\\s*\$\\s*\\$pass\\s*==\\s*\'\\w{32}\'\\s*\$\\s*\\{\\s*if\\s*\$\\s*!\\$\\w{1,40}\\s*=\\s*fopen\\s*\\(\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\{\\s*exit\\s*;\\s*\\}\\s*if\\s*\$\\s*fwrite\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*"[^"]*"\\s*\$\\s*==\\s*FALSE\\s*\\)\\s*\\{\\s*exit\\s*;\\s*\\}',
        'PhpFileAdmin.+?<a\\s*href="index\\.php\\?dir=<\\?=\\$_GET\\[\'dir\']\\?>">',
        'elseif\\s*\$\\s*isset\\(\\s*\\$_COOKIE\\[\\s*\'\\w+\'\\s*\\]\\s*\$\\s*&&\\s*!empty\$\\s*\\$_COOKIE\\[\\s*\'\\w+\'\\s*\\]\\s*\$\\s*\\)\\s*{\\s*echo\\s*htmlentities\$\\s*\\(\\s*string\\s*\$',
        'list\$\\s*\\$tobuf\\s*,\\s*\\$from\\s*,\\s*\\$subject\\s*,\\s*\\$messagefile\\s*\$=\\s*explode\\s*\$\\s*\':::\'\\s*,\\s*\\$conar\\s*\$;',
        '<\\?php\\s*@\'\\$\\s*\\w+=\\d+\\s*\\w+=',
        ';\\s*\\$[O0_]+="[^"]*"\\s*;\\s*\\$\\w{1,40}="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\\.\\s*\\$\\w{1,40}\\s*\\.\\s*\\$\\w{1,40}\\s*\\.\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*\\.\\s*"[^"]*"\\s*;\\s*',
        'else\\s*\\{\\s*echo\\s*"indata_error"\\s*;\\s*exit\\s*;\\s*\\}\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)',
        '<title>D\\.R\\.S\\s+Dz</title>',
        'list\\(\\$tobuf,\\$from,\\$frompwd,\\$fromname,\\$subject,\\$message\$= split \$\':::\',\\s*\\$conar\$;\\s*\\$toar = split\$\'\\\\\\|\\\\\\|\',\\$tobuf\$;\\s*foreach \$\\$toar\\s*as\\s*\\$to\$\\s*{\\s*list\$\\$fromlogin,\\$fromhost\$=split\$\'@\',\\$from\$;',
        'base64_decode(\'UHJvcGVydHkgb2YgUmV2aXNpdW0uY29t\')',
        'static\\s*public\\s*function\\s*\\w+\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\w+\\s*\$\\s*["\'][^"\']*=["\']\\s*\$\\s*;\\s*return\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}',
        '}\\s*if\$\\w+::\\w+\\(\\w+\\("[a-zA-Z0=9/]+=="\$',
        '<\\?php\\s*@\'\\$\\s*\\w+=\\d+\\s*\\w+=\\d+\\s*x3=',
        'OK\\s*COK\\s*SUKSESS',
        'fopen\\s*\$\\s*["\'][^\'"]*["\']\\s*,\\s*[\'"][^"\']*[\'"]\\s*\$\\s*;\\s*\\}\\s*fwrite\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*rawurldecode\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\$\\s*\\)\\s*;\\s*fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*@?include\\s*\$\\s*"[^"]*"\\s*\$\\s*;',
        '\\$\\w{1,40}-\\s*>\\s*\\w+\\s*=@file_get_contents\\s*\$\\s*\\$\\w{1,40}-\\s*>\\s*\\w+\\s*,\\s*false\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}-\\s*>\\s*\\w+\\s*===\\s*false\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*[^;]+\\s*;',
        '\\{\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*1\\s*,\\s*\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\w+\\s*\$\\s*array\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\\d+\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*\$\\s*,\\s*\\$\\w{1,40}\\s*,\\s*1\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\\.\\s*=\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\\.\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*\\}',
        'basename\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*"[^"]*"\\s*\$\\s*==\\s*"[^"]*"\\s*\\)\\s*&&\\s*in_array\\s*\$\\s*strtok\\s*\\(\\s*"[^"]*"\\s*\$\\s*,\\s*array\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*\$\\s*\\)\\s*&&\\s*\$\\s*empty\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*',
        '\\}\\s*else\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*==\\s*"php"\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*\\}\\s*else\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*==\\s*"aspx"\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*\\}\\s*else\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;',
        '<\\?php\\s*header\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*@set_time_limit\\s*\$\\s*\\d+\\s*\$\\s*;\\s*define\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\d+\\s*\\.\\s*0\\s*\$\\s*;\\s*define\\s*\$\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*\$\\s*;\\s*if\\s*\$\\s*file_exists\\s*\\(\\s*PASSWORD_FILE\\s*\$\\s*\\)\\s*\\{\\s*@unlink\\s*\$\\s*PASSWORD_FILE\\s*\$\\s*;\\s*\\}\\s*',
        'if\\s*\$\\s*!class_exists\\s*\\(\\s*\'[^\']*\'\\s*,\\s*false\\s*\$\\s*\\)\\s*:\\s*class\\s+\\w+\\s*{.+?const\\s*SCRIPT_SRC\\s*=\\s*\'data:text/javascript;base64,.+?MRT_ALL_TRAFFIC',
        '<\\?php\\s*//=+//\\s*//=+\\+\\+\\+Dhanush\\+\\+\\+=+//\\s*//=+//\\s*//=+\\+\\+\\+Coded\\s*By\\s*Arjun\\+\\+\\+===//\\s*//=+//\\s*//=+\\+\\+\\+An\\s*Indian\\s*Hacker\\+\\+\\+=====//\\s*//=+//\\s*//====\\s*Ashvin-2069/Oct-2012\\s*====//\\s*//\\s*Set\\s*Username\\s*&\\s*Password\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*//\\s*Malware\\s*Site\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*//\\s*"[^"]*"\\s*Base64\\s*encoded\\s*"[^"]*"\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*eval\\s*\$\\s*"[^"]*"\\s*\\.\\s*gzuncompress\\s*\\(\\s*base64_decode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\?>',
        '<\\?php\\s*/\\*\\s*PHP\\s*Encode\\s*by\\s*http://Www\\s*\\.\\s*PHPJiaMi\\s*\\.\\s*Com/\\s*\\*/error_reporting\\s*\$\\s*\\d+\\s*\$\\s*;\\s*ini_set\\s*\$\\s*"[^"]*"\\s*,\\s*0\\s*\$\\s*;\\s*if\\s*\$\\s*!defined\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\{\\s*define\\s*\$\\s*\'[^\']*\'\\s*,\\s*__FILE__\\s*\$\\s*;\\s*if\\s*\$\\s*!function_exists\\s*\\(.+?\\?>',
        'if\\s*\\(\\s*file_exists\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\{\\s*if\\s*\$\\s*file_exists\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*scandir\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*foreach\\s*\$\\s*\\$\\w{1,40}\\s*as\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*if\\s*\$\\s*\\(\\s*is_dir\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*AND\\s*\$\\s*\\$\\w{1,40}\\s*!==\\s*"[^"]*"\\s*\$\\s*AND\\s*\$\\s*\\$\\w{1,40}\\s*!==\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\{\\s*if\\s*\$\\s*file_exists\\s*\\(\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\{',
        'if\\s*\$\\s*\\w+::\\w+\\s*\\(\\s*\\w+\\s*\\(\\s*[\'"][^\'"]*["\']\\s*\$\\s*\\)\\s*\\|\\|\\w+::\\w+\\s*\$\\s*\\w+\\s*\\(\\s*["\'][^\'"]*["\']\\s*\$\\s*\\)\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=[\'"][^"\']*[\'"]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\$\\s*[^(]+\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\$\\s*[^(]+\$\\s*;\\s*\\$\\w{1,40}\\s*=[\'"][^"\']*[\'"]\\s*;\\s*return\\s*\\$\\w{1,40}-\\s*>\\s*\\w+\\s*\$\\s*\$\\s*;\\s*\\}\\s*return\\s*\\$\\w{1,40}-\\s*>\\s*\\w+\\s*\$\\s*\$\\s*;\\s*\\}',
        '\\{\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*=\\s*md5\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\}\\s*if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*==\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*setcookie\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*time\\s*\\(\\s*\$\\s*\\+\\s*3600\\s*\\)\\s*;',
        'require\\s*__DIR__\\s*\\.\\s*\'[^\']*\'\\s*;\\s*\\$\\w{1,40}\\s*=\\s*new\\s*Clue\\\\Psocksd\\\\App\\s*\$\\s*\$\\s*;\\s*\\$\\w{1,40}-\\s*>\\s*run\\s*\$\\s*\$\\s*;',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*<\\s*<\\s*<\\s*S\\s*\\#\\s*BEGIN\\s*W0RDPRESS\\s*\\#\\s*<\\s*IfModule\\s*mod_rewrite\\s*\\.\\s*c\\s*>\\s*\\#RewriteEngine\\s*On\\s*\\#RewriteBase\\s*/\\s*\\#RewriteCond\\s*%\\s*\\{\\s*REQUEST_FILENAME\\s*\\}\\s*!-f\\s*\\#RewriteCond\\s*%\\s*\\{\\s*REQUEST_FILENAME\\s*\\}\\s*!-d\\s*\\#RewriteRule\\s*\\.\\s*/index\\s*\\.\\s*php\\s*\\[\\s*L\\s*\\]\\s*\\#\\s*<\\s*/IfModule\\s*>\\s*\\#\\s*END\\s*WordPress',
        'if\\s*\$\\$query\\s*===\\s*\'checker-page\'\$\\s*{\\s*if \$\\s*_fetch_url\\(\\s*_get_rev\\(\\s*\$\\s*\\)\\s*>\\s*0\\)\\s*{',
        'by_rEpErOk</font>',
        '(\\$\\w{10,40}\\s*=\\s*\\d+;\\s*){10,}.+?array_push\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*if\\s*\$\\s*count\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\$\\s*>\\s*tV12hsJy_\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\d+\\s*\$\\s*\\)\\s*array_shift\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\$\\s*;\\s*\\}\\s*\\}\\s*else\\s*\\{\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*=\\s*microtime\\s*\$\\s*true\\s*\$\\s*;\\s*\\}\\s*\\}',
        'Configs\\s+Grabber\\s+By\\s+AnonCoders\\s+Team',
        'function\\s+sessionStart\$\\$session\$\\s*{\\s*if\$!empty\\(\\$session\$\\)\\s*return\\s*eval\$\\$session\$;\\s*}',
        'if\\s*\$\\s*me_file_put_contents\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*@chmod\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*0444\\s*\$\\s*;\\s*echo\\s*"[^"]*"\\s*;\\s*\\}\\s*;\\s*\\}\\s*\\}\\s*else\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*==\\s*\'[^\']*\'\\s*\$\\s*\\{\\s*if\\s*\$\\s*file_exists\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*echo\\s*me_file_get_contents\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}\\s*else\\s*\\{\\s*echo\\s*"[^"]*"\\s*;\\s*\\}',
        'md5\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*_\\d+\\s*\\(\\s*\\d+\\s*\$\\s*\\]\\s*\\)\\s*===\\s*__PASSWORD__\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$\\s*filemtime\\s*\\(\\s*__FILE__\\s*\$\\s*,\\s*filemtime\\s*\$\\s*dirname\\s*\\(\\s*__FILE__\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\\s*basename\\s*\$\\s*\\$\\w{1,40}\\s*\\[\\s*_\\d+\\s*\\(\\s*\\d+\\s*\$\\s*\\]\\s*\\[\\s*_\\d+\\s*\$\\s*\\d+\\s*\$\\s*\\]\\s*\\)\\s*;\\s*if\\s*\$\\s*move_uploaded_file',
        'if\\s*\\(\\s*!empty\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*=\\s*array\\s*\$\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*if\\s*\$\\s*!empty\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*\\.\\s*=\\s*" AND \\#__content\\.title LIKE',
        'fp\\s*=\\s*@fsockopen\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\d+\\s*\$\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*@fclose\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*connect3\\s*\$\\s*\\$\\w{1,40}\\s*\\.\\s*\'[^\']*\'\\s*\\.\\s*urlencode\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\}\\s*exit\\s*;',
        '\\$_SESSION\\[\'_ip_\'\\];\\s*//+\\s*\\$LOGS\\s*=\\s*"\\["\\s*\\.\\s*date\$\\s*\'Y-m-d[^;]+;\\s*file_put_contents\\(\\s*\'[^\']+\'\\s*,\\s*\\$LOGS\\s*\\.\\s*PHP_EOL\\s*,\\s*FILE_APPEND\\s*\$;',
        'if\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*=="[^"]*"\\s*\\|\\|\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*=="[^"]*"\\s*\$\\s*print\\s*json_encode\\s*\$\\s*selfTest\\s*\\(\\s*\$\\s*\\)\\s*;\\s*elseif\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*=="[^"]*"\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*json_decode\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*true\\s*\$\\s*;\\s*print\\s*json_encode\\s*\$\\s*alexusMailer\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\}\\s*else\\s*\\{\\s*print\\s*json_encode\\s*\$\\s*array\\s*\\(',
        '\\$\\w{1,40}\\s*=\\s*\\$dir\\.DIRECTORY_SEPARATOR;\\s*chmod\\(\\$\\w+\\.DIRECTORY_SEPARATOR\\.\'index\\.php\', 0644\$;\\s*\\$\\w+\\s*=\\s*fopen\$\\$\\w+\\.DIRECTORY_SEPARATOR\\.\'index\\.php\'\\s*,\\s*"r"\$;',
        '<\\?php\\s*error_reporting\\s*\$\\s*\\d+\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*[\'"]jquery[\'"]\\s*;\\s*\\$\\w{1,40}\\s*=\\s*[\'"]var',
        '\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*@\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*\$\\s*\\)\\s*\\)\\s*\\)\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\\s*@\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*,\\s*\'[^\']*\'\\s*\\)\\s*;',
        '\\*/\\s*(\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*){3,}\\$\\w+\\s*=\\s*"(\\\\\\d+){3,}";\\s*((\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*){3,}|/\\*)',
        '\\$\\w{1,40}\\s*=\\s*explode\$\\s*\'\\|\',(\\s*base64_decode\\(){3,}\\s*\\$\\w+\\s*(\$\\s*)+;',
        '\\$\\w{1,40}\\s*=\\s*new\\s*PclZip\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}-\\s*>\\s*extract\\s*\\(\\s*\$\\s*==\\s*\\d+\\s*\\)\\s*\\{\\s*die\\s*\$\\s*"[^"]*"\\s*\\.\\s*\\$\\w{1,40}-\\s*>\\s*errorInfo\\s*\\(\\s*true\\s*\$\\s*\\)\\s*;\\s*\\}\\s*else\\s*\\{\\s*die\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*\\}\\s*\\?>',
        '<\\s*title\\s*>\\s*<\\s*\\?\\s*=\\$Z118_title\\s*\\.\\s*"[^"]*"\\s*\\.\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*\\?><\\s*/title\\s*>',
        'wget\\s+https?://[^/]+/xmrig_lin64\\s+-o\\s+/tmp/',
        'echo\\s+"Uploader\\s+By\\s+Psyco',
        '<\\?php\\s+//\\s+HacKerD\\s+By\\s+aDriv4',
        'register_shutdown_function\$array\\(\'\\w+\',\'\\w+\'\$\\);\\$\\w{1,40}=\\$\\w{1,40}\\?;\\}if\$!file_exists\\(\\$\\w{1,40}\\?\$\\)\\{@assert\$str_replace',
        '<title>Mister\\s+Spy</title>',
        'LOGIN\'\\s*=>\\s*\\$_POST\\[\'login\'\\]\\s*,\\s*\'ACTIVE\'\\s*=>\\s*\'Y\',\\s*\'GROUP_ID\'\\s*=>\\s*array\\([^)]+\$,\\s*\'PASSWORD\'\\s*=>\\s*\\$_POST\\[\'pwd1\'\\],',
        'bad_list\\.txt"\\s*,\\s*"a"\\s*\\);\\s*fwrite\$\\$\\w+,\\s*\\$check\\."\\\\n"\$;\\s*\\$\\w+\\s*=\\s*fopen\\s*\$\\s*"good_list\\.txt',
        '(\\$func\\d\\s*=\\s*strrev\\(str_replace\\(\'[^\']+\',\'\',\'[^\']+\'\$\\);\\s*){3,}',
        'user\\.\'/etc/\'\\.\\$t\\.\'/shadow\',\'ab',
        '\\$htaccess\\s*=\\s*"https://pastebin\\.com/raw/\\w+";\\s*\\$file\\s*=\\s*file_get_contents\$\\$htaccess',
        '<br>\\[\\+\\]\\s*Uname:\'\\.php_uname\\(\$',
        'urltoredirect\\s*=\\s*\\$new_request->request\$"http://"\\s*\\.\\s*\\$servurl\\s*\\.\\s*"\\?clientid="\\.urlencode\\(\\$clientid\$\\."&ineednewurltoredirect',
        '\\$cachetime\\s*=\\s*\\d+;\\s*if\\s*\$\\(file_exists\\(\\$target\$\\)\\s*&&\\s*\$time\\(\$\\s*-\\s*\\$cachetime\\)\\s*>\\s*filemtime\$\\$target\$\\)\\s*\\{\\s*\\$string\\s*=\\s*file_get_contents',
        '\\$engines\\)\\s*\\{\\s*if\\s*\$preg_match\\(\\s*"/\\$engines/"\\s*,\\s*\\$_SERVER\\[\\s*\'HTTP_USER_AGENT\'\\s*\\]\\s*\$\\s*\\)\\s*echo\\s*file_get_contents\$\\$target',
        'if\\s*\\(\\s*is_bitch\\(\\s*\\$_SERVER',
        'SCAM\\s+PAYPAL\\s+V.{10,100}SHADOW\\s+Z118',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*chr\\(.{400,600};include\\(\\$\\w{1,40}\$;\\$\\w{1,40}\$\\$\\w{1,40}\$;\\s*\\Z',
        '<\\?php\\s*echo\\s*\'RxR\\s+HaCkEr',
        '\\$file\\s*=\\s*\\$exec_path\\.\\$drop_name;\\s*drop_file\$\\$file\\s*,\\s*\\$\\w{1,40}\$;\\s*\\}\\s*@chmod\$\\$file\\s*,\\s*0777\$;',
        'file_put_contents\$\\$path\\s*,\\s*\\$this->get_backdoor_code',
        '<\\?php\\s*\\$auth_pass=\'.{32}\';preg_replace\\("/\\.\\*/',
        'ccc=str_rot13\\(gzinflate\\(base64_decode\\(\\$code_',
        'HacKerD By aDriv4',
        'error_reporting\\(0\$;\\$c_=\'[^\']+\';\\$c0=\'[^\']+\';\\$c1=\'[^\']+\';\\$c2=\'',
        'if\$\\$_POST\\[\'success\'\\]\\s*==\\s*\\$msg\\[\'delScript\'\\]\$\\s*@unlink\$__FILE__\$;\\s*LocalRedirect',
        'else{file_put_contents\$\\$c9\\.\'/\\.htaccess\',file_get_contents',
        '<TITLE>Backdoor shell',
        'sh\\s+-c\\s+\\./cnrig\\s+-a\\s+cryptonight\\s+-o',
        '<\\?php\\s*\\$[O0_]{1,40}=\'[^\']+\';\\s*\\$[O0_]{1,40}=\\d+;\\s*\\$[O0_]{1,40}=\'index\\.php.{30000,}range\\(1,\\$p\$;\\s*\\}\\s*\\$numbers\\s*=\\s*range\$1,\\$p\$;\\s*shuffle\$\\$numbers\$;\\s*return\\s*array_slice\$\\$numbers,0,\\$n\$;\\s*\\}\\s*\\?>',
        '\\Amy \\$\\w{1,40};\\$\\w{1,40}.=\\$_\\s*while\$<DATA>\$;\\s*eval\$unpack\\(\'u\\*\'\\s*,\\s*\\$\\w{1,40}\$\\);\\s*__DATA__',
        'port_c="I2luY2x1ZGUgPHN0ZGlvLm',
        'HTTP_HOST"\\)\\.\' - FaTaL Shell',
        '\\A<\\?php\\s+\\$\\w{1,40}\\s*=\\s*\\d+;\\s*function\\s*\\w{1,40}\$\\$\\w{1,40}, \\$\\w{1,40}\$\\{\\$\\w{1,40}\\s*=\\s*\'\';.{2000,4000};echo/\\*[^*]{1,100}\\*/\$\\w{1,40}\\(\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\$\\)\\s*;\\s*\\?>',
        '<title>ex0shell',
        'function\\s+DxFiles_UploadHere',
        'feshow="shell_exec"',
        '<title>Dive\\s+Shell',
        'made_by="Bl0od3r";',
        '<center>\\.:Cyber Shell',
        'array\$"find all suid files',
        ':: 3FEShell',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*getenv\\("REMOTE_ADDR"\$;\\s*include\\s*\'antibots\\.php\';\\s*\\$message\\s*\\.=\\s*"--',
        '<\\?\\s*\\$adddate=date\$"D M d, Y g:i a"\$;\\s*\\$ip\\s*=\\s*getenv\$"REMOTE_ADDR"\$;\\s*\\$country\\s*=\\s*visitor_country\$\$;',
        '\\$login\\s*=\\s*\\$_SESSION\\[\'clientemail\'\\];\\s*\\$passwd\\s*=\\s*\\$_POST\\[\'passwd\'\\];\\s*\\$own\\s*=',
        '\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*\\$\\w{1,40}\\s*=\\s*str_ireplace\\s*\$\\s*"[^"]*"\\s*,\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=.{3000,30000}\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*user_error\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*E_USER_ERROR\\s*\$\\s*;',
        '<option value="cat /etc/passwd">',
        'mailto:\'>P0Uy@_\\$3r\\/3R',
        'mydir->close\$\$;\\s*@chmod\$"\\$deldir",0777\$;\\s*echo\\s+@rmdir\$\\$deldir\$',
        '<b>\\.::\\[Shell functions\\]::\\.</b>',
        'create_symlink\':\\s*if\\s*\$!empty\\(\\$_POST\\[\'destination\'\\]\$\\)\\s*\\{\\s*\\$dest\\s*=\\s*relative2absolute\$\\$_POST',
        '\\$file\\s*=\\s*"N-Cool-\\$date\\.sql\\.gz";\\s*\\$gzip\\s*=\\s*TRUE;\\s*\\$silent\\s*=\\s*TRUE;',
        '\\$s_pass\\s*=\\s*"\\w{32}";\\s*//\\s*password\\s*\\(.{1,100}\$\\s*eval\$"\\?>"\\.gzinflate\\(base64_decode\\(',
        '@eval\\(gzinflate\\(base64_decode\\(\\$code\$\\)\\);\\s*\\?>\\Z',
        '<head>\\s*<title>azrail\\s+1\\.',
        'fold in folder\\.SubFolders \'-->FOLDERz',
        '\\.Visible=true;\\s*Bin_H2_Title\\.InnerText="File Manager',
        'HTTP_HOST"\\)\\.\'\\s*-\\s*Antichat\\s*Shell</title>',
        'case\\s*\'exesys\':\\s*\\$content\\s*\\.=\\s*\\$shell->exesysform\$\$;',
        'elseif\$strtolower\\(\\$cmd\$\\s*==\\s*"etcpasswdfile"\\)\\s*\\{\\s*\\$pw\\s*=\\s*file\$\'/etc/passwd/\'\$;',
        'curl_setopt\$\\$ch\\s*,\\s*CURLOPT_URL\\s*,\\s*"file:file:///',
        'fm_redirect\\(\\s*FM_SELF_URL\\s*\\.\\s*\'\\?p=\'\\s*\\.\\s*urlencode\\(FM_PATH\$\\s*\\);',
        'RxR\\s+HaCkEr\\s*<\\?\\s*\\$cwd',
        '<\\?php\\s*if\$\\s*\\$_GET\\["\\w{1,40}"\\]\\s*==\\s*"\\w{1,40}"\\s*\$\\s*\\{\\s*if\$\\s*@copy\\(\\$_FILES\\[\'file\'\\].{1,400}</form>\'\\s*;\\s*\\}\\s*\\?>\\Z',
        'div\\s+id="content"><textarea\\s+rows="20%"\\s+cols="50%">\\\\\'\\.\\$[O0_]{5,20}\\.\\\\\'</textarea',
        ';set_time_limit\\(0\$;array_walk\$\\$_COOKIE,"enumerator"\$;array_walk\$\\$_POST,"enumerator"\$;function enumerator\$\\$value,\\$key\$\\{\\$\\{',
        ',CURLOPT_USERAGENT,\\\'WHR\\\'\\);\\$\\{',
        'putincache\$\\$urlhash\\."::::"\\.codedata',
        ';\\$\\w{1,40}=\'[^\']+\'\\^\'[^\']+\';\\w{1,40};',
        '\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\(\\s*null\\s*\\.\\s*\\$\\w{1,40}\\s*\\(',
        'function check_commands\\s*\\(\$\\s*\\{\\s*if\\s*\$\\s*array_key_exists\\s*\\(\\s*\'delete\'\\s*,\\s*\\$_REQUEST\\s*\$\\s*\\)\\s*\\{\\s*unlink\$\\s*__FILE__\\s*\$;',
        '\\A<\\?php\\s*\\$\\w{1,40}="[^"]{30000,}";eval\$base64_decode\\("[^"]+"\$\\);return;\\s*\\?>\\Z',
        '<title>W3LL\\s+M!N!\\s+SH3LL</title>',
        '<\\s*meta\\s*http-equiv\\s*="[^"]*"\\s*content\\s*="[^"]*"\\s*/\\s*>\\s*<\\s*title\\s*>\\s*\\#[a-z]+\\#\\s*<\\s*/title\\s*>\\s*<\\s*meta\\s*name\\s*="keywords"\\s*content\\s*="\\#[a-z]+\\#"\\s*/\\s*>\\s*<\\s*meta\\s*name\\s*="description"\\s*content\\s*="\\#[a-z]+\\#"\\s*/\\s*>',
        'chdir\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*get_rand_touch\\s*\$\\s*\$\\s*;\\s*writeTo\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*base64_decode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*,\\s*false\\s*\\)\\s*;\\s*touch\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;',
        '\\$\\w{1,40}\\s*=\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*;\\s*if\\s*\$\\s*in_array\\s*\\(\\s*"wp-config\\.php"\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*file_put_contents\$',
        '<\\?php\\s/\\*\\s*--\\s*enphp.+}\\{\\d+\\}\\(E_ALL\\^E_NOTICE\$;\\$_SERVER{',
        'global\\s*\\$\\w{1,40}\\s*;\\s*if\\s*\$\\s*!isset\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\$\\w{1,40}\\s*=\\s*new\\s*dolly_plugin\\s*\$\\s*\$\\s*;',
        'echo\\s+mail\$\\$to,\\$them,\\$mss,\\$head\$\\?_\\d+\$\\d+\$:_\\d+\$\\d+\$',
        '}\\s*=\\s*@unserialize\$\\s*sh_decrypt\\(\\s*@base64_decode\\(\\s*\\${\\s*\\$\\w+\\s*}\$\\s*,\\s*\\${\\s*\\${\\s*"[^"]+"\\s*}',
        'if\\s*\$\\s*!class_exists\\s*\\(\\s*\'[^\']*\'\\s*,\\s*false\\s*\$\\s*\\)\\s*:\\s*class\\s*bb_pres\\d+\\s*\\{\\s*public\\s*static\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*public\\s*static\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;.+data:text/javascript;base64',
        '\\$\\w{1,40}\\s*=\\s*Array\$\\s*[^;]+;\\s*\\$\\w+\\[chr\\(\\s*\\d+\\s*\$\\s*]\$bd\\(\\s*[\'"][^\'"]+[\'"]\\s*\$\\s*\\);\\s*\\$\\w+\\[\\s*chr\$\\s*\\d+\\s*\$\\s*\\]\$\\s*\\w+\\(\\s*[\'"][^\'"]+[\'"]\\s*\$\\s*\\);',
        'class\\s+bb_press2.+?const\\s*SCRIPT_SRC\\s*=\\s*\'data:text/javascript;base64,',
        '<\\?(php)?\\s*\\$auth_pass\\s*=\\s*"[^"]*";\\s*\\$GLOBALS\\[\'_\\d+_\'\\]=Array\$base64_decode\\([\'"]',
        '\\#!/usr/bin/perl\\s+-w\\s*my\\s+\\$Password="\\w+";\\s*\\$\\w+\\s*=\\s*[\'"](\\d+;)',
        '<title>(cPanel\\s+)?Turbo\\s+Force',
        '\\$\\w{1,40}\\s*=\\s*@?getcwd\\s*\\(\\s*\$\\s*;\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*@chdir\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*@?getcwd\\s*\$\\s*\$\\s*;',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*===\\s*true\\s*\\)\\s*\\{\\s*Check\\s*\$\\s*\$\\s*;\\s*exit\\s*;\\s*\\}\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*===\\s*true\\s*\\)\\s*\\{\\s*Send\\s*\$\\s*\$\\s*;\\s*exit\\s*;\\s*',
        '\\$\\w{1,40}\\s*="[^"]*"\\s*;\\s*echo\\s*\\$\\w{1,40}\\s*;\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*=\\$\\w{1,40}\\s*;\\s*\\$\\w{1,40}\\s*=\\s*isset\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*"[^"]*"\\s*\\]\\s*\$\\s*',
        '\\$GLOBALS\\[\'Alfa_Protect_Shell\'\\]',
        '<\\?php\\s*/\\*\\s*WSO\\s*\\[\\s*2\\s*\\.\\s*\\d+\\s*\\]',
        '\\$\\w{1,20}\\s*=\\s*\\$\\w{1,20}\\s*\$\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\s*\\[\\s*\\$\\w{1,20}\\s*\\]\\s*\$\\s*;\\s*@?eval\\s*\$\\s*\\$\\w{1,20}\\s*\$\\s*;\\s*\\}\\s*else\\s*\\{',
        'preg_split\$"//",\\$\\w+,-1,PREG_SPLIT_NO_EMPTY\$;\\$\\w+=implode\$"",array_reverse\\(\\$\\w+\$\\);};\\$\\w+=__FILE__;',
        '\\.(\\$\\w{1,10}\$){6,}["\'](\\\\x[A-Fa-f0-9]{2}){10,1100}["\']\$',
        '\\$code\\s*=\\s*\'\\s*<\\?php\\s*\\$user_agent_to_filter = array\$ \\\\\'\\#Ask\\\\s\\*Jeeves',
        '<\\?php\\s*\\$\\w+\\s*=\\s*[\'"]\\w{32}[\'"];\\s*\\$\\w+\\s*=\\s*[\'"]\\#df5[\'"];\\s*\\$\\w+\\s*=\\s*[\'"]FilesMan[\'"];',
        'chr\\(\\d+\$[^/]+?@\\$\\w{1,30}\$\\s*@\\$\\w{1,30}\\(\\s*[\'"][^\$]{1000,}\\)\\)\\)?;',
        '\\$wpautop\\s*=\\s*pre_term_name\$\\s*\\$wp_kses_data\\s*,\\s*\\$wp_nonce\\s*\$;.*\\$shortcode_unautop\$\$;',
        'function arr2html\$\\$array,\\s*&\\$arr\\s*=\\s*\'\\s*\',\\$ztabhtml=\'\',\\$zheaderarray=\'\'\$\\s*{\\s*\\$array\\s*=\\s*"as"\\s*\\.\\s*\\$_REQUEST\\[\'array\'\\];\\s*\\$sort\\s*=\\s*array\$\\$_REQUEST\\[\'sort\'\\]\$;',
        '(\\$\\w{1,40}\\s*=\\s*\'[^\']{1,200}\';\\s*){10,}\\$\\w{1,40}=str_replace\$\'[^\']{1,50}\',\'\',(\\$\\w{1,40}[\\s\\.\$]+){10,};',
        '";\\s*eval\\s*/\\*[^*]+\\*/\\s*\$\\w{1,30}\\s*\\(\\s*\\$\\w{1,30}\\s*,\\s*\\$\\w{1,30}\\s*\$\\s*\\);\\s*\\?>',
        '\\$\\w{1,30}\\s*=\\s*str_ireplace\$\\s*"\\w{1,30}"\\s*,\\s*""\\s*,\\s*"[^"]+"\\s*\$;\\s*\\$\\w{1,30}\\s*=\\s*"[^"]+"\\s*;\\s*function\\s+\\w{1,30}\$\\s*\\$errno\\s*,\\s*\\$errstr\\s*,\\s*\\$errfile\\s*,\\s*\\$errline\\s*\$\\s*{\\s*array_map\$\\s*create_function\\s*\\(\\s*\'\'\\s*,\\s*\\$errstr\$\\s*,\\s*array\\s*\$\\s*\'\'\\s*\$\\s*\\);\\s*}\\s*set_error_handler\$\\s*\'\\w{1,30}\'\\s*\$;\\s*\\$\\w{1,30}\\s*=\\s*\\$\\w{1,30}\$\\s*\\$\\w{1,30}\\s*\$\\s*;\\s*(user|trigger)_error\$\\s*\\$\\w{1,30}\\s*,\\s*E_USER_ERROR\\s*\$;',
        'case\\s*["\']update["\']\\s*:\\s*if\\s*\$\\s*file_put_contents\\s*\\(\\s*__FILE__\\s*,\\s* base64_decode\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\)\\s*echo\\s*[\'"]OK[\'"];',
        '\\$\\w{1,40}\$\\$\\w+\\(\\$\\w+\\(\\$\\w+\\(\\$\\w+\$\\)\\)\\);\\s*/\\*\\s*GNU\\s+GENERAL\\s+PUBLIC\\s+LICENSE',
        'mail\$\\$_POST\\[\'email\'\\]\\s*,\\s*\\$_POST\\[\'subject\'\\]\\s*,\\s*\\$_POST\\[\'content\'\\]\\s*,\\s*\\$headers\$;\\s*}\\s*\\?>\\s*<title>BOOM</title>',
        'if\$mail\\(\\$_POST\\[\'email\'\\], \\$_POST\\[\'subject\'\\], \\$_POST\\[\'content\'\\], \\$headers\$\\) {\\s*echo "Bravo!";\\s*}\\s*else\\s*{\\s*echo "Failed to send email\\.";\\s*}',
        'mail\$\\$_POST\\[\'email\'\\]\\s*,\\s*\\$_POST\\[\'subject\'\\]\\s*,\\s*\\$_POST\\[\'content\'\\]\\s*,\\s*\\$headers\$;\\s*echo "Bravo!";\\s*}\\s*\\?>\\s*<title>BOOM</title>',
        '\\$leaf\\[\'version\'\\]="2\\.7";\\s*\\$leaf\\[\'website\'\\]="leafmailer\\.pw";',
        'if\$PLATFORM\\s*==\\s*WORDPRESS\$\\s*{\\s*if\$strpos\\(\\$file\\s*,\\s*\'wp-content\'\$\\s*===\\s*false\\s*&&\\s*strpos\$\\$file\\s*,\\s*\'wp-admin\'\$',
        '\\$GLOBALS\\[\'_\\d+_\'\\]=Array\$base64_decode\\(.+?\\[-\\] SOCKET ERROR\\[fsock\\]: {\\$_\\d+\\[path\\]} \\[\\{\\$_\\d+\\}\\] {\\$_\\d+}";}\\$_\\d+=FALSE;}}if\\(\\$_\\d+===FALSE\${if\$\\$_\\d+\${print _\\d+\$\\d+\$;}\\$_\\d+=FALSE;}return \\$_\\d+;}',
        '\\$req_uri\\s*=\\s*\'http://\'\\.\\$req_uri\\."\\?req="\\.urlencode\$\\$full_uri\$\\."&gzip="\\.\\$is_gzip\\."&host=\\$host&ip=\\$ip&rip=\\$reverse_ip&ua=\\$ua&ref=\\$ref";',
        '<title>PHP-FILES\\.ME</title>',
        '\\$\\w{1,40}=gzinflate\$base64_decode\\(\\$\\w+\$\\);\\s*for\$\\$i=0;\\$i<strlen\\(\\$\\w+\$;\\$i\\+\\+\\)\\s*{\\s*\\$\\w+\\[\\$i\\]\\s*=\\s*chr\$\\s*ord\\(\\$\\w+\\[\\$i]\$\\s*-1\\s*\\);\\s*}\\s*return\\s*\\$\\w+;\\s*}\\s*eval\$\\w+\\(',
        'path_throwgh_files.+burlywood',
        '\\$strFileBody=GetFileContent\\(\\$strUrl\$;\\s*\\$strFileBody=str_replace',
        'checksuexec\\s+"\\.escapeshellarg\$\\$_SERVER\\[\'DOCUMENT_ROOT\'\\]\\.\\$_SERVER\\[\'REQUEST_URI\'\\]',
        '\\$auth_pass\\s*=.+;eval\\("\\\\x65',
        'if\\s*\\(\\s*isset\\(\\s*\\$_(GET|POST|REQUEST|COOIE|SERVER)\\[\\s*"test_url"\\s*\\]\\s*\$\\s*\\)\\s*{\\s*echo\\s+"file test okay";\\s*}\\s*\\$\\w{1,10}="\\w+";\\s*\\$\\w{1,10}=\'\\w+\';\\s*\\$\\w{1,10}="\\w+";',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|REQUEST|SERVER)\\[\\s*"test_url"\\s*\\]\\s*\$\\s*\\)\\s*{\\s*echo\\s*"[^"]+";\\s*}.+PCLZIP_READ_BLOCK_SIZE',
        'function\\s*refercheck\$\\$refer\\s*=\\s*""\$\\s*{\\s*return\\s*preg_match\$"/\\(google\\.co\\.jp\\|yahoo\\.co\\.jp\\|bing\$/si", \\$refer\\);\\s*}',
        'function\\s+WSOstripslashes\$\\$array\$\\s*{\\s*return is_array\$\\$array\$\\s*\\?\\s*array_map\$[\'"]WSOstripslashes[\'"]\\s*,\\s*\\$array\$\\s*:\\s*stripslashes\$\\$array\$;\\s*}\\s*\\$_POST\\s*=\\s*WSOstripslashes\$\\$_POST\$;\\s*\\$_COOKIE\\s*=\\s*WSOstripslashes\$\\$_COOKIE\$;',
        ';\\s*\\$default_use_ajax\\s*=\\s*false;\\s*\\$default_charset\\s*=.+print\\s*eval\$',
        'function\\s+pushUploaders\\(\$\\s*{\\s*global\\s*\\$uploaderStatusHandle;\\s*\\$data\\s*=\\s*readFileOpt\$CACHE_UPLOADER_DB\$;',
        '<h1>"\\.ucfirst\$\\$key\$\\."</h1><br>\\s*<br>"\\.\\$templateimage\\."<br><br>\\s*"\\.\\$mapinpages\\."\\s*"\\.\\$pageparse\\."<br>\\s*"\\.\\$links1\\."',
        'function\\s+evalEndClean\$&\\s*\\$p\$ {\\s*\\$t = gzuncompress\$base64_decode\\(\\$p\$\\);\\s*\\$t = str_replace\$array\\("<\\?php",\'\\?>\'\$,\'\',\\$t\\);\\s*eval\$\\$t\$;\\s*unset\$\\$p\$;unset\$\\$t\$;',
        '//\\w{3,20}\\s*function\\s+request_url_data\$\\$url\$\\s*{\\s*\\$site_url\\s*=.+?print\\s+\\$decoded;\\s*}\\s*}//\\w{3,20}',
        ']}=Array\$"\\w+"=>@phpversion\\(\$,"\\\\x\\d+\\\\x\\d+"=>"\\\\x\\d+\\.\\\\x\\d+-1",\\);echo\\s*@serialize\$\\${\\$\\w+\\}\$;}elseif\$\\${\\${',
        'function\\s+__get_template\\(\$\\s*{\\s*\\$root_path\\s*=\\s*__get_root\$\$;\\s*\\$tpl_path\\s*=\\s*\\$root_path\\."/SESS_\\w{32}',
        '\\$map_index_sitemap_uri\\s*=\\s*sprintf\$\'%s%ssitemap_%d\\.xml\'\\s*,\\s*\\$currentUrl\\s*,\\s*"\\$dir/"\\s*,\\s*\\$sini\$;\\s*\\$map_sitemap_genuri_href\\s*=\\s*sprintf\$\\s*\\$map_sitemap_genuri_link_format\\s*,\\s*\\$currentUrl',
        'if\\s*\\(file_exists\\(\\s*"(\\.\\./)+\\w+\\.php\\.suspected"\\s*\$\\s*\\)\\s*rename\$\\s*"(\\.\\./)+\\w+\\.php\\.suspected"\\s*,\\s*"(\\.\\./)+\\w+\\.php"\\s*\$;',
        'function\\s*is_from_search\$\\$http_referer\$\\s*{\\s*\\$flag\\s*=\\s*false;\\s*\\$http_referer_str\\s*=\\s*\'google\\.co\\.jp\\|yahoo\\.co\\.jp\\|bing',
        '__create_initial_settings[^\\#]+\\#google.+?__obfuscate_write',
        ';eurt\\s*=\\s*xaja_esu_tluafed\\$',
        '\\$\\w{1,40}\\s*=\\s*"\\w+";\\s*\\$\\w+\\s*\\s*\\.=\\s*"\\w+";\\s*@\\$\\w+\$\\$\\w+\\(\\\'[a-zA-Z0-9/=+]{100,200}',
        '<\\?php\\s*if\\s*\\(isset\\s*\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\)\\s*{\\s*\\$\\w+="Fil.+?\\s*\\$default_use_ajax\\s*=\\s*true',
        'proftpd.+?eval\$\\$_[GET|POST|COOKIE|REQUEST|SERVER]+\\[[\'"]\\w+[\'"]\\]\$',
        'FakeSender\\s*by\\s*POCT',
        '\\$\\w{1,40}=\'[^\']+\'\\^\'[^\']+\';\\s*\\$\\w+=\'[^\']+\';\\s*(\\$\\w+=\'[^\']+\'|\\$\\w+=\\d+);',
        '\\$\\w{1,40}=@gzinflate\$\\$\\w+\$\\){\\$\\w+=create_function\$\'\',\\$\\w+\$;unset\$\\$\\w+,\\$\\w+\$;\\$\\w+\$\$;}}',
        'if\$\\$\\w+=@gzinflate\\(\\$\\w+\$\\)\\{if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\)@setcookie\$\'\\w+\', \\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;\\$\\w+=create_function',
        '}}}}if\$\\$q=="this-is-the-test-of-door"\${\\$page="DOORWAYISWORKTITLE',
        '<\\?php\\s*(\\$\\w+) = \\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\];\\s*echo (\\$\\w+) = isset\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'(\\w+)\'\\]\$\\?base64_decode\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\3\'\\]\$:\'\';\\s*(\\$\\w+) = \'\';\\s*foreach\$array\\(\\1\$ as (\\$\\w+)\\){\\s*\\4\\.=\\5;\\s*}\\s*ob_start\$\\4\$;\\s*if\$\\2\${\\s*echo \\2;\\s*}\\s*ob_end_flush\$\$;',
        'if\\s*\$isset\\(\\$_FILES\\[\'\\w+\'\\]\\[\'name\'\\]\$\\)\\s*{\\s*\\$abod\\s*=\\s*\\$filedir\\.\\$userfile_name;\\s*@move_uploaded_file\$\\$userfile_tmp,\\s*\\$abod\$;\\s*echo"<center><b>Done\\s*==>\\s*\\$userfile_name</b></center>";\\s*}\\s*}\\s*else{',
        '}}else{\\$\\w+=@\\$_SERVER\\[((""|chr\$\\d+\$|"\\w")\\.?){10,}];',
        '\\$__=hex2ascii\$\\$_+\$;\\s*\\$.="\\$_+";\\s*\\$.=[eval\\."\'\\s]+\$\\$.\$\';\\s*assert\$\\$.\$;',
        '\';\\$\\w+=str_rot13\$\'fge_ebg13\'\$;\\$\\w+=\\$\\w+\$\'onfr64_qrpbqr\'\$;\\$\\w+=\\$\\w+\$\'[^\']+\'\$;eval\$\\$\\w+\\(\\$\\w+\\(\\$\\w+\\(\\$\\w+\$\\)\\)\\)',
        '<\\?php\\s*\\$\\w+=strrev\$"edoced_46esab"\$;\\$\\w+="[^"]+";eval\$\\$\\w+\\(\\$\\w+\$\\);\\s*$',
        '<\\?error_reporting\$0\$;(\\$\\w+=(urldecode\$)?\\$_COOKIE\\[\'\\w+\'\\]\$?;\\s*){10,}',
        '\\$\\w{1,40}\\s*=\\s*\'[assert\\\'\\.\\s]+\';\\s*\\$\\w+\\s*=\\s*sprintf\$\'[\\!\\(\$evalbase64_decode\\s\\.\\\']+\$"%s"\$\\)\'\\s*,\\s*\\$\\w+\\);\\s*\\$\\w+\$stripslashes\\(\\$\\w+\$\\);',
        '\\$default_action=[FilesMan\'\\.]+;\\s*\\$color=[\'\\#df5\\.]+;\\s*\\$default_use_ajax=true;',
        '\\$\\w{1,40}\\s*=\\s*\\$\\w+\$\\s*""\\s*,\\s*\\$\\w+\\(\\s*\\$\\w+\\(\\s*array\\(\\$\\w+\\{\\d+\\}\\s*,\\s*"\\\\n"\\s*\$,\\s*"",\\s*"[^"]+"\\s*\\)',
        '\\$\\w{1,40}\\s*=\\s*\'[\\.preg_replace\\\']+\';\\s*\\$call_user_func_array\$\\s*\\$\\w+\\s*,\\s*array\\(\'/\\[\\w+\\]/\\w+\'\\s*,\\s*\\$_REQUEST\\["\\w+"\\]\\s*,\\s*"[^"]+"\\s*\$\\);@\\w+\$\\s*\\$_REQUEST\\s*\$;',
        '(/\\*[^\\*]+\\*/\\$\\w+=\'[^\']+\';){30,}',
        '\\$login="\\w+";\\s*\\$\\w+=str_rot13\$"\\w+"\$;\\s*\\$\\w+\\s*=\\s*str_rot13\$\'\\w+\'\$;\\s*\\$\\w+="\\w{32}";\\s*eval\$\\$mdh\\(\\$md\\(strrev\\(\'',
        'error_reporting\\(0\$;\\s*\\$\\w+\\s*=\\s*"\\w{32}";\\s*\\$\\w+\\s*=\\s*basename\$__FILE__\$;\\s*\\$\\w+\\s*=\\s*"\\w{32}";\\s*if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\)\\s*{if\$strlen\\(\\$\\w+\$\\s*==\\s*32\\)',
        '<\\?php\\s*error_reporting\$0\$;\\s*if \$!isset\\(\\$_COOKIE\\[\'\\w+\'\\]\$\\)\\s*deny\$\$;\\s*\\$cookieData',
        '\\$\\w{1,40}\\s*=\\s*Array\$\\s*(\'\\w\'\\s*=>\\s*\'\\w\'\\s*,?\\s*){26,80}\$;\\s*eval(/\\*[^\\*]{0,40}\\*)?/\$\\s*\\w{1,40}\\(\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\$\\s*\\);',
        'assert_options\$ASSERT_WARNING,0\$;\\s*\\$\\w+=\'[0-9a-fA-F]+\';.*?chr\$hexdec.*?\\$\\w+=\'eval\\(\\$\\w+\$\';\\s*assert\$\\$\\w+\$;',
        'eval\$stripslashes\\(array_pop\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\$\\)\\)',
        '(\\$\\w+\\d+\\{\\d+\\}\\s*\\.?\\s*){10,}.+?\\$\\w+\\s*=\\s*\\$\\w+\$\\s*""\\s*,\\s*\\$\\w+\\(\\$\\w+\\s*\\(\\s*array\\(\\$\\w+\\d+\\{\\d+\\}\\s*,\\s*"\\\\n"\$,\\s*"",\\s*".+?\\)\\s*\\)\\s*\\);\\s*\\$\\w+\$\$;',
        'php_uname()\$\$\\.\'<br></b>\';\\s*echo\\s*\'<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">\'.*?if\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'_upl\'\\]\\s*==\\s*"Upload"\\s*\$\\s*\\{\\s*if\$\\@copy\\(\\$_FILES\\[\'file\'\\]\\[\'tmp_name\'\\],\\s*\\$_FILES\\[\'file\'\\]\\[\'name\'\\]\$',
        'function\\s*\\w+\$\\$\\w+,\\$\\w+,\\$\\w+\$\\{\\$\\w+="base64_decode.*?curl_init.*?"/wp\\\\-login\\\\\\.php.*?/\\\\/administrator\\\\//".*?phpmyadmin/i".*?define\$"___NOTSELF___\',1\$;.*?include_once.*?\\*/\\}\\}\\}',
        '<\\?\\s*eval\$gzuncompress\\(base64_decode\\(\'.{22000,25000}\'\$\\)\\);',
        '\\$\\w{1,40}\\s*=\\s*1;\\s*\\$\\w+\\s*=\\s*get_userdata\$\\$\\w+\$;\\s*\\$\\w+\\s*=\\s*\\$\\w+->\\w+;\\s*wp_set_current_user\$\\$\\w+\\s*,\\s*\\$\\w+\$;\\s*wp_set_auth_cookie\$\\$\\w+\$;\\s*do_action\$\'wp_login\'\\s*,\\s*\\$\\w+\$;',
        ',\\$\\w+\\s*,\\$\\w+\\s*\\);\\$\\w+\\s*=\\$\\w+\\s*\$["\'].+?["\'],\\$\\w+\\s*,\\$\\w+\\s*\$;\\$\\w+\\s*=\\$\\w+\\s*\$\\$\\w+\\s*,\\$\\w+\\s*\$;\\$\\w+\\s*\$\\$\\w+\\s*\$;\\s*\\?>',
        '<font color="red">pwn pwnd owned hacked</font>',
        'error_reporting\$round\\(\\d+\$\\);mb_internal_encoding\$_\\w+\\(\\d+\$\\);mb_regex_encoding\$_\\w+\\(\\d+\$\\);mb_http_output\$_\\d+\\(\\d+\$\\);mb_http_input',
        ';\\s*eval\$\\$GLOBALS\\[\'\\w+\'\\]\\[\\d+\\]\\(\\$GLOBALS\\[\'\\w+\'\\]\\[\\d+\\]\\(\\$\\w+\$\\)\\);\\?>',
        '<\\?php\\s*eval\$gzinflate\\(base64_decode\\("DZZH',
        'if\\s*\\(\\$upload\\s*&&\\s*\\$user\\s*&&\\s*wp_check_password\\(\\$passwd,\\s*\\$user->data->user_pass,\\s*\\$user->ID\$\\s*&&\\s*is_super_admin',
        'touch\$dirname\\(__FILE__\$,\\s*\\$time\\);\\s*touch\$\\$_SERVER\\[\'SCRIPT_FILENAME\'\\],\\s*\\$time\$;\\s*chmod\$\\$_SERVER\\[\'SCRIPT_FILENAME\'\\],\\s*0\\d+\$;\\s*eval\$base64_decode\\(',
        'Array\\((\'.\'=>\'.\'\\s*,?\\s*)+\$;\\s*eval/(\\*\\w+\\*/)?\$\\s*\\w+\\s*\\(\\s*\\$\\w+\\s*,\\s*\\$\\w+\\s*\$\\s*\\);\\s*\\?>\\s*$',
        '<title>Pro\\s*Mailer\\s*V2</title>',
        '\\$fullurl\\s*=\\s*""\\s*\\.\\s*\\$\\w+\\s*\\.\\s*"<br><p>Emails:<br><TEXTAREA.*?>"\\s*\\.\\s*\\$\\w+\\s*.\\s*"</TEXTAREA></p><p>Engenharia:<br><TEXTAREA.*?>"\\s*\\.\\s*\\$mensagem\\[\\d+\\]."</TEXTAREA>',
        '<title>Hacked by NG689Skw</title><center>',
        '\\$result\\s*=\\s*dns_get_record\$\\s*\\$domain\\s*\\.\\s*"\\.multi\\.uribl\\.com"\$;',
        '\';@\\$\\w+\$[eval\\."]+\\(\'(\\\\x[a-fA-F0-9]{2}){10,1100}\'\$;"\\);\\s*$',
        'if\$smtp_mail\\(\\$email,\\s*\\$subject,\\s*\\$message,\\s*\\$Header,\\s*\\$from_email\$\\)\\s*{\\s*echo\\s*"good";\\s*}\\s*else\\s*{\\s*echo\\s*"Some error occured";\\s*}\\s*\\?>',
        '(mail\$(\\$\\w+,\\s*\\$\\w+,\\s*\\$\\w+(,\\s*\\$header)?\$)|(stripslashes\$\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$\\));(\\s*})?)\\s*if\$\\$\\w+\$\\s*{\\s*echo\\s*\'\\w+\';\\s*}\\s*else\\s*{\\s*(echo)?\\s*\'\\w+\\s*:\\s*\'',
        '<\\?php\\s*\\$\\w+\\s*=\\s*stripslashes\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;\\s*\\$\\w+\\s*=\\s*stripslashes\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;\\s*\\$\\w+\\s*=\\s*stripslashes\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$;\\s*\\$\\w+\\s*=\\s*mail\$stripslashes\\(\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$\\);\\s*if\$\\$\\w+\${echo\\s*(trim\$)?\'\\w+\'\$?;}\\s*else\\s*{echo\\s*\'\\w+\\s*:\\s*\'\\.\\$\\w+;}',
        '\\$\\w{1,40}\\s*=\\s*\\$\\w+\$\'[^\']+\'\$;\\s*\\$\\w+=\\$\\w+\$\\$\\w+\\(\$\\);\\$\\w+\$\$;\\s*\\$\\w+\$\\$\\w+,"\\$\\w+\\(',
        '@move_uploaded_file.+?echo"<center><b>Done ==> \\$userfile_name</b></center>',
        'if\\(isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["\\w+"\\]\$\\)\\s*\\$to = \\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["\\w+"\\];\\s*else\\s*{\\s*echo "404 error";\\s*exit;\\s*}\\s*if\$\\s*\\$curl\\s*=\\s*curl_init\\(\$\\s*\\)\\s*{',
        'if \$!empty \\(\\$hostname\$ \\) {\\s*\\$output = "";\\s*@exec \$"nslookup\\.exe -type=MX \\$hostname\\.", \\$output\$;\\s*\\$imx=-1;',
        '<?php\\s*(\\$\\w+\\s*=\\s*stripslashes\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["\\w+"\\]\$;\\s*){3,}\\$result\\s+=\\s+mail\$stripslashes\\(\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$\\);\\s*if\$\\$result\${echo \'thank you\';}',
        '\\$result\\s*=\\s*mail\$stripslashes\\(\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$\\);\\s*if\$\\$result\${\\s*echo\\s*\'\\w+\';\\s*}else{\\s*echo\\s*\'\\w+\\s*:\\s*\'\\s*\\.\\s*\\$result;\\s*}',
        '\\$message\\s*=\\s*stripslashes\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["body"\\]\$;\\s*set_time_limit\\s*\$\\d+\$;\\s*@ignore_user_abort\\s*\$true\$;\\s*\\$to_ar = explode\$\',\',\\s*\\$to\$;',
        'if\$\\$vas\${echo\\s*\'lessloss\';}else{echo\\s*\'cramdam\\s*:\\s*\'.\\$v',
        'else\\s*{\\s*\\$result\\s*=\\s*mail\$stripslashes\\(\\$to\$\\s*,\\s*stripslashes\$\\$subject\$\\s*,\\s*stripslashes\$\\$message\$\\);\\s*}\\s*if\$\\$result\${echo\\s*\'good\';}else{echo\\s*\'error\\s*:\\s*\'\\.\\$result;}',
        '<\\?php\\s+mb_http_input\$"iso-8859-1"\$;.*?B L E S S E D S I N N E R .*?<\\/DIV>.+<\\/div>.+?<\\/form>',
        'echo "<html><head>.*?Safe mode:</span>.*?\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\\'\\w+\\\'\\]\\s*===\\s*\\\'uploadFile\\\'\\).*?echo \\"</body><\\/html>\\";',
        '//PING.*?sav.php\\?p=\\w+&url=.*?\\@ob_start\$\\\'obCacheStart\\\'\$;',
        '\\$GLOBALS\\[\'\\w+\'\\]=Array\$(base64_decode\\((\\\'[A-Za-z0-9\\/\\=]*\\\'\\s*\\.*)+\$\\,*)+.*?\\[\\d+\\]\$\\$_\\w+\$,\\$GLOBALS\\[\'\\w+\'\\]\\[\\d+\\]\$\\$\\w+\$\\);}\\s*\\?>',
        'class PluginJoomla.+\\$\\w+\\s*=\\s*@?\\$_COOKIE\\[\\\'\\w+\\\'\\]\\;\\s*.*\\$\\w+\\s*=\\$\\w+\$@?\\$_COOKIE\\[\\\'\\w+\\\']\$\\;.+\\$\\w+\\s*=\\s*new\\s*PluginJoomla;',
        '\\$mcdata=array\$\$;\\$mcdata\\[0\\]=base64_decode\$\'[.a-zA-Z0-9_/=]+\'\$;array_filter\$\\$mcdata, base64_decode\\(\'[.a-zA-Z0-9_/=]+\'\$\\);\\?>',
        'file_put_contents\$\'\\w+\',\'<\\?php \'\\.\\$m\$;include\$\'\\w+\'\$;\\s*$',
        '<\\?php\\s*if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\w+\\]\$\\)\\s*{\\$\\w+="[^"]{2000,}";',
        '\\.(chr\$\\d+\$\\."[a-zA-Z0-9/\\\\ ]*?"\\.){5,}',
        'if\\s*\$isset\\(\\${\\$s\\d+}\\[\'\\w+\'\\]\$\\)\\s*{\\s*eval\$\\${\\$s\\d+}\\[\'\\w+\'\\]\$;\\s*}\\s*}elseif\$isset',
        'if \\(\\$whattime\\s*==\\s*"goodtime" \\|\\|\\s*empty\\(\\$settings\$\\) {',
        '<title>Bypass\\s*shell</title>',
        'if \$md5\\(\\$_COOKIE\\[\'i\'\\]\$ == \'.{32}\'\\)\\s*{\\s*function file_download\$\\$filename, \\$mimetype=\'application/octet-stream\'\$ {',
        '<\\?php if\$md5\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["ms\\-load"\\]\$==".{32}"\\){\\s*\\$p=\\$_SERVER\\["DOCUMENT_ROOT"\\];',
        '\\$a\\s*=\\s*[\\.\\sbase64decode_"]+;\\s*assert\$\\$a\\(',
        '\\$GLOBALS\\[\'\\w+\'\\]\\(\\$\\w+\\[(\\$\\w\\d+\\[\\d+\\]\\.)+\\$\\w\\d+\\[\\d+\\]\\]\$;\\s*\\$\\w+\\+\\+\\)\\s*{\\s*\\$\\w+\\s*=\\s*array\$\\s*(\\$\\w\\d+\\[\\d+\\]\\.?)+\\s*=>\\s*\\$\\w+,\\s*(\\$\\w\\d+\\[\\d+\\]\\.?)+\\s*=>\\s*"",',
        '<\\?php\\s*if\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\${echo\\s*\'\\w+\';\\s*}\\s*else\\s*{\\s*\$\\s*\\$www=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\s*&&\\s*@preg_replace\$\\s*\'/ad/e\'\\s*,\\s*\'@\'\\s*\\.\\s*str_rot13\\(\\s*\'riny\'\\s*\$\\s*\\.\\s*\'\$\\s*\\$www\\s*\$\'\\s*,\\s*\'add\'\\s*\\);\\s*}\\s*$',
        '"User-Agent:\\s*\\$template"\\s*\\."\\|\\$pathToDor"\\s*\\."\\|\\$pathOnMyHost"',
        '<\\?php\\s*\\$\\w+=([.]?chr\$\\d+\$[.;])+\\s*eval\$\\$\\w+\\(\\$_REQUEST\\[\\w+\\]\$\\);\\s*$',
        '}elseif\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'eval\'\\]\${\\s*\\$qV\\s*=\\s*"stop_";',
        '\\$\\w{1,40}\\.=\\$\\w+\$\\$\\w+\\(\\$\\w+\$&0xFF\\);}eval\$\\$\\w+\$;exit\$\$;\\s*$',
        '(\\$\\w+ = (\\d+|"\\w+"|""|true|false);){5}\\$\\w+ = "base64_decode";(\\$\\w+ = (\\d+|"\\w+"|""|true|false);){5}',
        '}exit;if\$\\$GLOBALS\\[\'_\\d+_\'\\]\\[\\d+\\]\\(_\\d+\\(\\d+\$,_\\d+\$\\d+\$\\)!==false\\)\\$GLOBALS\\[\'_\\d+_\'\\]\\[\\d+\\]\$\\$_\\d+,\\$_\\d+\$;}else{\\$GLOBALS\\[\'_\\d+_\'\\]\\[\\d+\\]\$_\\d+\\(\\d+\$\\);echo _\\d+\$\\d+\$;}exit;}\\s*\\?>\\s*$',
        'preg_replace\$\\$\\w+.\\$\\w+,"(\\\\x[a-zA-Z0-9]+){3,}.{3000,}\\?>',
        'if\\s*\\(isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'check\'\\]\$\\) {\\s*echo "ok";\\s*}\\s*else\\s*{\\s*if\$\\s*\\$curl\\s*=\\s*curl_init\\(\$\\s*\\)\\s*{',
        '<html>.+?<title>utf</title>.+?echo "<h1>Welcome</h1>\\\\n";.+touch\$\\$newfile,\\s*\\$time\$;.+</html>',
        'file_put_contents\$str_rot13\\("[^"]+"\$, file_get_contents\$str_rot13\\("uggc://[^"]+"\$\\)\\);.+@\\$strings\$str_rot13\\(file_get_contents',
        '\\$folder = str_replace\\(\\$_SERVER.+ http_build_query.+function http_parse_headers.+\\$s \\.= \\$m\\[2\\]\\.\\$m\\[3\\];',
        'GLOBALS\\[\'_\\d+_\'\\]\\[1\\]\\(\\$_REQUEST,\\$_1\$;\\$_1=\\$GLOBALS\\[\'_\\d+_\'\\]\\[\\d+\\]\$\$;while\$round\\([^\$]+\\)-round\$[^\$]+\\)\\)\\$GLOBALS\\[\'_\\d+_\'\\]\\[\\d+]\$\\$_REQUEST,\\$_REQUEST\$;.+echo \\$_\\d+;\\s*\\?>',
        'riny\$tmhapbzcerff\\(onfr64_qrpbqr\\(\'',
        '<\\?php\\s*error_reporting\\(0\$;\\s*ignore_user_abort\$true\$;\\s*set_time_limit\$0\$;\\s*function str_1replace\$\\$needle',
        'if \\(strpos\\(\\$check_result,\'BLOCK\'\$ !== false \\|\\| strpos\$\\$check_result,\'FOUND\'\$ !== false \\|\\| strpos',
        '\\$wp_enc_file\\s*=\\s*\'<\\?php eval\$"\\?>"\\s*\\.\\s*base64_decode\\("\'\\.\\$wp_code\\.\'"\$\\);\\s*\\?>\';',
        '<\\?\\s*\\$lin=\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["link"\\];\\s*switch \$\\$lin\$ {',
        '\\$return = smtpmail\$\\$smtp_host, \\$smtp_port, \\$smtp_login, \\$smtp_passw, \\$email_polucha, \\$telo_pisma, \\$headers\$;',
        '\\$file_path = dirname\$__FILE__\$ \\. \'/\' \\. basename\$\\$_FILES\\["file"\\]\\["name"\\]\$;\\s*move_uploaded_file\$\\$_FILES\\["file"\\]\\["tmp_name"\\], \\$file_path\$;\\s*\\$file_name = basename\$\\$file_path\$;',
        '<\\?php\\s*if\$\\s*empty\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*\'ineedthispage\'\\s*\\]\\s*\$\\s*\\)\\s*{\\s*ini_set\$\\s*\'display_errors\'\\s*,\\s*"Off"\\s*\$\\s*;\\s*ignore_user_abort\$1\$',
        'return\\s*\\$c0\\[\\$c_\\];}\\$GLOBALS\\[\'_\\d+_\'\\]\\[0\\]\$a_\\(0\$,a_\$1\$,a_\$2\$\\);\\s*}',
        '<\\?php\\s*echo md5\$\\d+\$\\."<form\\s*method=post\\s+enctype=multipart/form-data><input type=file name=filename>',
        '<\\?php\\s*(\\$\\w+\\s*=\\s*stripslashes\$base64_decode\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\$\\);\\s*)+\\$\\w+\\s*=\\s*mail\$stripslashes\\(\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$,\\s*stripslashes\$\\$\\w+\$\\);\\s*if.+?{echo\\s*\'\\w+ :\\s*\'\\s*\\.\\s*\\$ejfkqexizs;}',
        '\\$GLOBALS\\[\'_\\d+_\'\\]\\[\\d+\\]\$\\$default_charset,\\$auth_pass,\\$color,\\$default_charset\$',
        '<\\?php\\s+\\$\\w+=\'base.+?\$\\s*str_replace\\(.+@?setcookie\\s*\\([\'"]\\w+[\'"]\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST).+</form>',
        '\\$sess\\s*=\\s*md5\\(\\s*@\\$_COOKIE\\[ssid\\]\$;',
        'class\\s+PlgSystemXcalendarJoomlaBase',
        '<\\?\\s*function _\\d+\$\\$i\${\\$\\w+=Array\$.+?wso_version.+eval\\(gzuncompress\\(base64_decode\\(.+==\'\$\\)\\);\\s*\\?>',
        '<\\?\\s*function _\\d+\$\\$i\${\\$\\w+=Array\$(\'[a-zA-Z0-9/\\+=]+\',?)+\$;.+\\$default_action=.+\\)\\)\\)\\); \\?>',
        'print\\s*"<h1>\\w+</h1>\\\\n";\\s*echo "Your IP: ";\\s*echo \\$_SERVER\\[\'REMOTE_ADDR\'\\];.+move_uploaded_file.+touch.+</html>',
        '<title>Sender Anonym Email :: FLoodeR :: SpameR</title>',
        '\\$i=strpos\$\\$im,\'\\[UPD_CONTENT-\'\$;',
        'global \\$\\w+; \\$\\w+=array\$\'\\$\\w+\\[0\\]=array_pop\\(\\$\\w+\$;\\$\\w+=\\w+\$\\d+,\\d+\$;.+create_\';if\$function_exists.+?\$\\);};unset\$\\$\\w+\$;',
        '\\[3ran\\]\\s*\\*/\\s*if\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["mailto"\\]\$\\)',
        '\\$sh_name = base64_decode\$\\$sh_id\$\\.\\$sh_ver;',
        '<\\?php\\s*\\$r6\\s*=\\s*pow\$2,6\$;\\s*\\$stringus\\s*=',
        '@\\$\\w+\$\'\\#\\#e\'\\s*,\\s*"\\\\x[^"]+"\\s*,\\s*\'\'\$;',
        'charCode\$\\$\\w+\$;\\s*function charCode\$\\$\\w+\${\\s*\\$\\w+\\s*=\\s*array\$.+?\\$\\w+\\[\\d+\\];return\\s+EvAl\\(\\$\\w+\$;\\s*}',
        '<\\?php\\s*\\$(\\w+)=".+?";eval\$\\$\\1\\("[\\w+/=]+"\$\\);',
        '<\\?php\\s*eval\$gzinflate\\(base64_decode\\("DZ.+\$\\)\\);\\s*\\?>',
        'if\\s*\$isset\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[str_rot13\\(pack\\("H\\*",\\s*"\\w+"\$\\)]\\)\\)\\s*{\\$_',
        'else\\s*{\\s*ClosingDelicateHolesButton\\s*(\\s*);\\s*}',
        '}\\s*function [a-z0-9]{10,}\$\${}\\sfunction [a-z0-9]{10,}\$\${\\$.+?array\$\\d+,\\d+',
        '<\\?php\\s*\\$a\\s*=\\s*".+?";\\s*assert\\(\\$a\\(',
        '=Array\\(".+?"=>@phpversion\\(\$,"sv"=>".+?",\\);echo\\s*@serialize\$\\${\\${',
        '=\\s*\\$\\w+\\("",\\s*\\$\\w+\\(\\$\\w+\\("\\w+",\\s*"",\\s*\\$\\w+\\.\\$\\w+\\.\\$\\w+\\.\\$\\w+\$\\)\\);\\s*\\$\\w+\$\$;\\s*\\?>',
        '==\\s*FALSE\\)\\s*{\\s*break;\\s*}\\s*if\\s*\$\\$\\w+\\s*==\\s*\\d+ \\|\\|\\s*\\$\\w+\\s*===\\s*\\d+\\s*\\|\\|\\s*\\$\\w+\\s*===\\s*\\d+\\s*\$\\s*{\\s*\\$\\w+\\[\\$\\w+\\]\\[',
        '<\\?php\\s*\\$target_urls\\s*=\\s*array.+?\\$n\\s*=\\s*mt_rand\$0,count\\(\\$target_urls\$-1\\);.+?\\$rand_url;\\?>\\s*">\\s*',
        'function\\s+Check25Port\$\$\\s*{\\s*\\$res\\s*=\\s*TRUE;\\s*\\$s\\s*=\\s*socket_create\$AF_INET,\\s*SOCK_STREAM,\\s*SOL_TCP\$;\\s*if\$@socket_connect\\(\\$s,\\s*\'gmail-smtp-in',
        '\\$\\w{1,40}\\s*=\\s*\\w+;\\$\\w+\\s*=\\s*"\\w+";\\$\\w+\\s*=\\s*true;\\$\\w+\\s*=\\s*\\d+;\\$\\w+\\s*=\\s*true;\\$\\w+\\s*=\\s*false;\\$\\w+\\s*=\\s*implode',
        'code\';\\$vvv=\\$vvv\\(str_replace\\("\\\\n"',
        '\\$imgData\\s*=\\s*@\\$p2\\(@\\$p1\\(\\$imgData\$\\);',
        '\\$\\w{1,40}\\s*=\\s*system\$"wget\\s+http:.+?;chmod\\s+\\d+\\s+\\w+;\\./\\w+"\$;\\s*echo\\s+\\$\\w+;\\s*system\$"rm\\s+\\w+"\$;',
        'if \$md5\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'multipart\'\\]\$==\\$multipart\\.\\$part\\){',
        '<\\?php\\s+eval/\\*\\*/\$"eval\\(gzinflate\\(base64_decode\\(.+?\$\\)\\);"\\);\\s*\\?>',
        ';file_put_contents\$\\$_7\\[\'.\'\\]\\[\'\\w+\'\\],\\$_\\d+,FILE_APPEND\\|LOCK_EX\$;}if',
        'define\$\'ALREADY_RUN_\\w*\',\\s1\$;.*eval',
        'preg_replace\$\\"\\\\043\\\\056\\\\052\\\\043\\\\145',
        'var_dump\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST),\\s*\\$_GET,\\s*\\$_COOKIE,\\s*\\$_FILES\$;\\s*\\$output = ob_get_clean\$\$; \\$fp = fopen',
        'if\$strpos\\(\\s*\'fff\'.\\$file,\'home\'\$>0 or strpos\$\'fff\'\\.\\$file,\'admin',
        'chmod\\(\\s*dirname\\(__FILE__\$.+?{\\$a=Array\$"/\\.\\*/e.+?_\\d+\\(\\d+\$\\);',
        '<\\?php\\s*if\\s*\$\\$_FILES\\[\'F1l3\'\\]\$ {move_uploaded_file.+? forbidden!\'; } \\?>',
        'function\\s*check_cookie.+?android == true\\)check_cookie\$\\$android_redirect\$;elseif \$\\(\\$iphone.+?\\$aaa = false;',
        'fwrite\\(\\$fp,"\\\\xEF\\\\xBB\\\\xBF"\\.iconv\\(\'gbk\',\'utf-8//IGNORE',
        '<title>VaRVaRa\\s*Searcher</title>',
        'if\\(!empty\\(\\$_FILES\\[\'\\w*\'\\]\\[\'\\w*\']\$\\sAND\\s\$md5\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'nick\'\\]\$\\s==\\s\'\\w{32}\'\\)\\)\\s{',
        '\\$user_agent\\s*=\\s*"ConBot";',
        'if\$isset\\(\\$_COOKIE\\[\\\'\\w{11}\\\'\\]\\X*fsockopen',
        'function\\s*xr\\(\\$text,\\$key\${\\$out="";for\$\\$i=0;\\$i',
        '\\beval\\(\\s*\\$_g\\(\\s*\\$_b\\(\\$_r',
        'function\\s+WSOsetcookie',
        '<\\?php\\s+eval\\(\\s*eval\\("\\\\\\$_',
        '\\beval\\(\\s*"return\\s+eval\\(\\\\\\"\\$code\\\\\\"\$;"\\)\\s+\\?>',
        'move_uploaded_file\\s*/\\*;\\*/',
        '\\$k="ass"\\."ert"',
        '_POST\\[\$chr\\(\\d+\$.chr\$\\d+\$\\)',
        '\\$default_charset.*=\\.*\\$dc\\.\\$dc2',
        'rand_url\\s*=\\s*\\$target_urls\\[$n',
        'DIRECTORY_SEPARATOR\\s*\\.\\s*\\$[A-Za-z0-9]+;\\s*if\\s*\$@\\$GLOBALS\\[\'[a-z0-9]+\'\\]\\(\\$[A-Za-z0-9]+',
        '"\\.\\$[\\w]{1,40}\\s*;\\s*\\$[\\w]{1,40}\\((\\$[\\w]{1,40}\\[\\d+\\]\\s*\\.?){4,}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*"\\d+"\\s*\$;',
        'disk_free_space\$\\s*dirname\\(__FILE__\$\\) , disk_free_space',
        '\\beval\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[pass',
        '\\$color\\s*=\\s*"\\#df5";',
        'sprintf\\s*\\(\\s*"%c"\\s*,\\s*\\$\\w{1,40}\\s*\\^\\s*ord\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\$\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*;\\s*for',
        'User-Agent: SEoDOR-Client \$pathOnMyHost-\\$pathOnMyHost',
        'if\\s*\\(preg_match\\("/zh-c/i", \\$lang\$==false\\|\\|preg_match\$"/zh-c/i",s\\*\\$lang\$==0\\s*\\)\\s*{\\s*echo\\s*"<script',
        '<title>::\\s+Priv8\\s+vHost\\s+Config\\s+Grabber',
        ';lets_jump\$\\$\\{\\$\\w{1,40}},\\$\\{\\$\\w{1,40}\\}\$;\\}\\$\\{\\$\\{',
        ';\\$\\{\\$\\w{1,40}\\}\\.=pack\$"[^"]{1,20}?",0x00000000,0x00000000,0x00000000,strlen\\(\\$\\{\\$\\{"',
        'register_shutdown_function\\s*\\(\\s*\'[^\']*\'\\s*\$\\s*;\\s*\\}\\s*\\}\\s*\\}\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*new\\s*Ratel\\s*;\\s*\\$\\w{1,40}-\\s*>\\s*init\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\}',
        '\\$\\w{1,40}\\s*=\\s*\$\\s*mktime\\s*\\(\\s*\$\\s*-\\$\\w{1,40}\\s*\\)\\s*;\\s*if\\s*\$\\s*\\$\\w{1,40}\\s*\\|\\|\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*return\\s*array\\s*\$\\s*\'NO\'\\s*,\\s*\\$\\w{1,40}\\s*,\\s*implode\\s*\\(\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;\\s*\\}\\s*else\\s*\\{',
        'my\\s*\\$\\w{1,40}\\s*;\\s*\\$\\w{1,40}\\s*\\.\\s*=\\$\\w{1,40}\\s*while\\s*\$\\s*<\\s*DATA\\s*>\\s*\$\\s*;\\s*eval\\s*\$\\s*unpack\\s*\\(\\s*\'[^\']*\'\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*;',
        '\\{if\$\\$o\$\\$o\\.=\';\\s*\';\\$o\\.=\\$n\\.\'=\'\\.addslashes\$\\$v\$;}\\$h\\.=\'Cookie:',
        'if\\s*\$file_exists\\(\\$htaccessPath\$\\)\\s*{\\s*chmod\$\\s*\\$htaccessPath\\s*,\\s*0777\$;\\s*if\\s*\$is_writable\\(\\$htaccessPath\$\\)\\s*{\\s*\\$htaccessData\\s*=\\s*file_get_contents\$\\$htaccessPath\$;\\s*\\$htaccessTime\\s*=\\s*filemtime\$\\$htaccessPath\$;',
        '\\$expy\\s*=\\s*\\$_POST\\[\'expy\'\\];\\s*\\$cvv\\s*=\\s*\\$_POST\\[\'cvv\'\\];\\s*\\$ip\\s*=\\s*\\$_SERVER\\[\'REMOTE_ADDR\'\\];',
        '\\)\\s*;\\s*foreach\\s*\$\\s*\\$blocked_words\\s*as\\s*\\$word\\s*\$\\s*\\{\\s*if\\s*\$\\s*substr_count\\s*\\(\\s*\\$hostname\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*>\\s*0\\s*\\)\\s*\\{\\s*header\\s*\$',
        '<title>Ekin0x Shell',
        '\\$\\w{1,40}\\s*=\\s*JOkEr7\\(\'https://www\\.paypal\\.com/',
        '<\\?php\\s*include\\s*\'check_is_bot\\.php\'\\s*;\\s*if\\s*\\(\\s*empty\\s*\\(\\s*\\$is_bot\\s*\$\\s*\\)\\s*\\{\\s*echo',
        '\\$install_code\\s*=\\s*str_replace\\s*\$\\s*\'{\\$PASSWORD}\'\\s*,\\s*\\$install_hash\\s*,\\s*base64_decode\\s*\\(\\s*\\$install_code\\s*\$\\s*\\);',
        '<title>IndoXploit</title>',
        '\\&nbsp\\&nbsp\\&nbsp\\&nbsp\\&nbspCant\\s+Edit\\s+>>',
        '====\\+\\+\\+Coded\\s+By\\s+Izladen\\+\\+\\+===',
        '</script>";exit;}}}function\\s+\\w{1,40}\$\${\\$\\w{1,40}=\'http://\';if\$\\$_SERVER\\["SERVER_PORT"\\]!="80"\${\\$\\w{1,40}\\.=\\$_SERVER\\["HTTP_HOST"\\]\\.":"\\.\\$_SERVER\\["PHP_SELF"\\];}else{\\$\\w{1,40}\\.=\\$_SERVER\\["HTTP_HOST"\\]',
        '}\\s*if\\s*\$\\s*\\$_POST\\s*\$\\s*\\{\\s*file_put_contents\\s*\$\\s*MAILER_CONFIG_FILE\\s*,\\s*json_encode\\s*\\(\\s*\\$\\w{1,40}\\s*=\\s*\\(\\s*object\\s*\$\\s*\\$_POST\\s*\\)\\s*\\)\\s*;',
        '\\$\\w{1,40}\\s*=\\s*"[^"]*"\\s*\\.\\s*\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\\.\\s*\'[^\']{0,2000}\'\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;',
        '<b>Black\\s*Space\\s*Mailer\\s*201',
        'if\\s*\$\\s*\\$_GET\\s*\\[\\s*\'google\'\\s*\\]\\s*!="[^"]*"\\s*\$\\s*\\{\\s*echo\\s*\'[^\']*\'\\s*\\.\\s*\\$_GET\\s*\\[\\s*\'google\'\\s*\\]\\s*\\.\\s*\'[^\']*\'\\s*;\\s*exit\\s*;\\s*\\}',
        'die\$file_get_contents\\(\\$urlSQLServerPage',
        '\\$rcard\\s*=\\s*\\$m->getRandcards\\(\\s*\\$id\\s*,\\s*\\$idsum\\s*\$;',
        'header\$"\\s*location:\\s*ufl\\.php\\?id="\\s*\\.\\s*\\$first\\[0\\]\$;',
        '<title>Web\\s*Login\\s*Service\\s*-\\s*University\\s*of\\s*Florida</title>',
        '<title>Mail\\s+form\\s+HTML\\s+v\\d+[^<]+</title>',
        '\\$\\w{1,40}\\s*=\\s*strlen\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\'[^\']*\'\\s*;\\s*for\\s*\$\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*;\\s*\\$\\w{1,40}\\s*<\\s*\\$\\w{1,40}\\s*;\\s*\\$\\w{1,40}\\+\\+\\s*\$\\s*\\$\\w{1,40}\\s*\\.\\s*=\\s*chr\\s*\$\\s*ord\\s*\\(\\s*\\$\\w{1,40}\\s*\\[\\s*\\$\\w{1,40}\\s*\\]\\s*\$\\s*\\^\\s*\\$\\w{1,40}\\s*\\)\\s*;\\s*eval\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;',
        'if\\s*\$\\s*!isset\\s*\\(\\s*\\$_GET\\s*\\[\\s*\'.\'\\s*\\]\\s*\$\\s*\\)\\s*exit\\s*;\\s*\\$\\w{1,40}\\s*=\\s*file_get_contents\\s*\$\\s*\\$_GET\\s*\\[\\s*\'.\'\\s*\\]\\s*\$\\s*;\\s*echo\\s*\$\\s*\'<pre>\'\\s*\$\\s*;\\s*echo\\s*htmlspecialchars\\s*\$\\s*\\$\\w{1,40}\\s*\$\\s*;',
        'if\\s*\$\\s*strstr\\s*\\(\\s*\\$_SERVER\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*"[^"]*"\\s*\$\\s*\\)\\s*\\{\\s*echo\\s*"[^"]*"\\s*;\\s*\\}\\s*foreach\\s*\$\\s*\\$_COOKIE\\s*as\\s*\\$\\w{1,40}\\s*=\\s*>\\s*\\$\\w{1,40}\\s*\$\\s*\\{',
        '(\\$\\w{1,50})\\s*=\\s*\'[^\']*\'\\s*;\\s*\\$\\w{1,50}\\s*=\\s*str_replace\\s*\$\\s*\'[^\']*\'\\s*,\\s*\'[^\']*\'\\s*,\\s*\\$\\w{1,50}\\s*\$\\s*;\\s*@\\$\\w{1,50}\\s*\$\\s*\\$\\w{1,50}\\s*\\(\\s*\\1\\s*\$\\s*\\)\\s*;',
        'list\\s*\$\\s*\\$tobuf\\s*,\\s*\\$from\\s*,\\s*\\$subject\\s*,\\s*\\$messagefile\\s*\$\\s*=\\s*split\\s*\$\\s*\':::\'\\s*,\\s*\\$conar\\s*\$\\s*;',
        '\\$global_version\\s*=\\s*array_walk\\s*/\\*',
        '\\\\x\\w\\w"\\]}=@?unserialize\$sh_decrypt\\(@?base64_decode\\(\\${\\$',
        '=@gzuncompress\\s*\\(\\s*@base64_decode\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\)\\s*\\{\\s*setcookie\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*setcookie\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}=\\s*create_function',
        'echo\\s*"<form\\s*action\\s*=\\s*\'"\\s*\\.\\s*\\$current\\s*\\.\\s*"&mode=copy&src="\\s*\\.\\s*\\$src\\s*\\.\\s*"\'\\s*method\\s*=\\s*\'POST\'>',
        '\$isset\\(\\$_POST\\[\'execl\'\\]\$\\)\\s*{\\s*echo\\s*\\$_POST\\[\'execl\'\\]\\s*\\.\\s*\'<br>\'\\s*;\\s*echo\\s*myshellexec\$\\$_POST\\[\'execl\'\\]\$;\\s*}\\s*if\\s*\$isset\\(\\$_POST\\[\'pcntl_exec\'\\]',
        'elseif\\s*\\(\\s*\\$current_blog\\s*===\\s*\'active\'\\s*\$\\s*\\{\\s*file_put_contents\\s*\$\\s*\\$destination\\s*,\\s*\\$blog_id\\s*\$\\s*;\\s*\\}',
        ';\\$this->tm_class_name_div=\\$\\{\\$\\{"\\\\x\\w{2}',
        '<title>Your\\s*University\\s*Grant\\s*Information</title>',
        '<HEAD><TITLE>IDBI\\s*Bank\\s*-',
        '\\$pager\\s*=\\s*new\\s*ADODB_Pager\$\\s*\$;\\s*\\$pager->render_pagelinks\$\\s*\$;\\s*\\Z',
        'do_passreturn\$\\$_POST\\[\'path\'\\],\\$_POST\\[\'code\'\\],\\$_POST\\[\'return\'\\]',
        '\\$\\w{1,40}\\s*=\\s*date\\("D M d, Y g:i a"\$;\\s*\\$ip\\s*=\\s*getenv\$\\s*"REMOTE_ADDR"\\s*\$;\\s*\\$username\\s*=\\s*\\$_POST\\[\\s*[\'"][^"\']+[\'"]\\s*\\];\\s*\\$password',
        'fwrite\$\\$fp,"\\\\xEF\\\\xBB\\\\xBF"\\.\\$body',
        'eval\\(\\s*\\$gzc\\(\\s*\\$b64\\(\\s*\\$r13',
        '\\A\\s*<\\?php\\s*GIF8(7|9)?\\w?[^\\s]{0,2}\\s*[^\\;]{0,80};',
        '<title>\\s*PHP\\s+Shellecho\\s+offender',
        '\\$short\\s*=\\s*make_bitly_url\\s*\\(\\s*[\'"]\\s*https?://wps\\.bank\\.login\\.it',
        'value="<\\?\\s*passthru\\("pwd"\$;\\s*\\?>',
        '\\$(?:auth)?_?pass\\s*=\\s*[\'"]\\w{24,40}[\'"];\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{50000,}[\'"];\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$',
        '<\\?(?:php)?\\s*@?eval\\s*\\(\\s*base64_decode\\s*\\(\\s*[^\\w]{1,3}DQogJHdlYiA9ICRfU0VSVkVSWyJIVFRQX0hPU1QiXTsNCiAkaW5qID0g[^\'"]{1,600}[^\\w]{1,3}\\s*\$\\s*\\)\\s*;\\s*(?:\\?>)?\\s*\\Z',
        '=@\\$_COOKIE;\\s*\\$',
        'include(?:_once)?\\s*[\'"\$][^\'"\\(]{0,20}cssisma[^/]{0,20}/\\w{1,40}\\.php[\'"\\(];',
        '\$;\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\$\\s*"[^"]*"\\s*,\\s*\\$\\w{1,40}\\s*\\(\\s*\\w+\\s*\\(\\s*\\$\\w{1,40}\\s*\\(\\s*\\$\\w{1,40}\\s*\$\\s*,\\s*"[^"]*"\\s*\\)\\s*\\)\\s*\\)\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\$\\s*;\\s*(?://?[^/]{0,150}/?\\s*)?\\Z',
        'Popping\\s*root\\s*shell[^\\w]{1,40}Don[^\\w]t\\s*forget\\s*to\\s*restore\\s*/tmp/bak',
        '\\}\\s*elseif\$\\s*\\$\\w{1,40}\\s*[^\\w]{1,2}=\\s*[\'"](cvv)[\'"]\\s*\\|\\|\\s*\\$_REQUEST\\[[\'"]?\\1[\'"]?\\]\$\\s*\\{\\s*[^\\[]{1,200}\\s*\\$\\w{1,40}\\s*=\\s*trim\$\\$rows\\[[\'"]?(number|cardnumber|cn|ccn|cnumber)[\'"]?\\]\$;\\s*\\$\\1',
        '<meta\\s+name\\s*=\\s*[\'"]description[\'"]\\s*content\\s*=\\s*[\'"]Wells\\s+Fargo\\s*:\\s*Provider\\s+of\\s+banking\\s*,',
        '@ob_end_clean\$\$;\\s*\\}\\s*elseif\\s*\$\\s*@?is_resource\\s*\\(\\s*\\$\\w{1,40}\\s*=\\s*@?popen\\(\\s*\\$\\w{1,40},\\s*[\'"]\\w[^\\w]?[\'"]\\s*\$\\s*\\)\\s*\\)\\s*\\{\\s*\\$res',
        '<title>\\s*Indoxploit',
        '\\A\\s*<\\?(?:php)?\\s+function\\s+long2str\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\{[^\\?]{50000,};\\s*@?eval\\s*\$\\s*\\w{1,9}_decrypt\\(\\s*base64_decode\\(\\s*\\$\\w{1,40}\\s*\$,\\s*[\'"]\\w{1,40}[\'"]\\s*\\)\\s*\\)\\s*;\\s*(?:\\?>)?\\s*\\Z',
        '(\\$\\w{1,40})\\s*=\\s*file_get_contents\\s*\$\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)\\w{1,40}[\'"]\\s*\$;\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\\s*\\(){0,5}\\s*[^\\$]{1,40}\\s*\\1\\s*(?:\\s*\$\\s*){1,6};',
        'if\\s*\$\\s*isset\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"][^\'"]{1,40}[\'"]\\]\\s*\$\\s*\\)\\s*\\{\\s*exit\\s*\$[\'"]?[^\'"]{0,40}[\'"]?\$;\\s*\\}\\s*else(?:if)?\\s*\\{\\s*header\$[\'"]HTTP/1\\.0\\s+404\\s+Not\\s+Found[\'"]\$;\\s*exit\$[\'"]?[^\'"]{0,40}[\'"]?\$;\\s*\\}\\s*[^\\?]{1,40}\\?>\\s*\\Z',
        '<title>\\s*Andro\\s*Ghost\\s*69',
        '\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[.p1.\\]\\); else @unlink\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[',
        '\\$\\w{1,40}\\s*=\\s*getcwd\\(\$;\\s*(\\$\\w{1,40})\\s*\\=\\s*[\'"\\s\\.base64_dco]{13,40}\\s*;\\s*\\$\\w{1,40}\\s*=\\s*[\'"]/app/code/core/Mage[\'"];\\s*\\$\\w{1,40}\\s*=\\s*\\1\$[\'"][^\'"]{1,40}[\'"]\$;',
        '\\beval\$\\s*x\\(\\$x',
        '-\\s*Process\\s*Faker\\s*,[^\\n]{1,200}\\s+Options:\\s+-s\\s+string\\s+Fake\\s+name\\s+process',
        '\\A\\s*<\\?(?:php)?\\s*error_reporting\\((?:0|false)\$;[^>]{1000,3000}\\s*(\\$\\w{1,40})\\s*=\\s*curl_exec\$\\s*(\\$\\w{1,40})\\s*\$;\\s*curl_close\$\\s*\\2\\s*\$;\\s*@?eval\$\\s*\\1\\s*\$;\\s*\\};\\s*die\$\$;\\s*\\?>\\s*\\Z',
        '/(?:\\*|/)\\s*PastiGanteng\\s*(?:\\w{1,40}\\.\\d+)?\\s+Shell',
        '<title>\\s*nShell\\s+\\w?\\d+\\.\\d+',
        '\\A(\\s*<\\?php\\s*(\\/\\*[^\\*]{100,600}\\*/)?\\s*error_reporting\$(0|false)\$;\\s*ini_set\$\\s*[\'"]max_execution_time[\'"]\\s*,\\s*(0|false)\$;\\s*eval\$\\s*base64_decode\\([\'"][^\\?]{1000,2500}break;\\s*\\}\\s*\\}\\s*\\}\\s*eval\\(\\s*gzinflate\\(\\s*base64_decode\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\);\\s*\\?>){3}',
        '(\\$\\w{1,40})\\s*=\\s*(?:chr\$\\d+\$\\.?){1,5};\\s*(\\$\\w{1,40})\\s*=\\s*file_get_contents\$[\'"]php://input[\'"]\$;\\s*\\2\\s*=\\s*CB_XORm\$\\2,\\s*\\1,\\s*\\d+\\*\\d+\$;\\s*if\\s*\$\\s*strncmp\\(\\s*[\'"][^\'"]{1,40}["\'],\\s*\\2\\s*,\\s*\\d+\\s*\$\\s*==\\d+\\s*\\)\\s*\\{',
        '\\};\\s*WriteToFile\$[\'"]\\s*\\.\\s*[^\\.]{1,40}\\.html[\'"],\\s*[\'"][\'"]\$;\\s*Auth\$\$;\\s*if\\s*\$\\s*\\(\\s*@?\\$_COOKIE\\[[\'"][^\'"]{1,40}[\'"]\\]\$\\s*[^\\w]=\\s*md5\$\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*die\\s*\$\\s*FileToString\\(\\s*[\'"]\\s*\\.\\s*[^\\.]{1,40}\\.html[\'"]\$\\);\\s*Main\$\$;\\s*\\?>\\s*\\Z',
        'my\\s+\\$botshell\\s*=\\s*[\'"][^\'"]{1,60}[\'"];',
        ';\\s*if\\s*\$\\s*isset\\s*\\(\\s*(\\$_FILES)\\[[\'"]?([^\'"]{1,40})[\'"]?\\]\\s*\$\\s*\\)\\s*\\{\\s*if\\s*\$\\s*@?copy\\s*\\(\\s*\\1\\[[\'"]?\\2[\'"]?\\][^\\(]{200,300}php_uname\\(\\s*[^\$]{0,40}\\s*\\)',
        '<title>\\s*SST\\s*Sheller',
        '<title>\\s*:\\s*:\\s*Inbox\\s*:\\s*:\\s*Unlimited\\s*</title>\\s*<\\?\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(',
        '<title>\\s*Hacked\\s+by\\s+(?:Dr\\.SiLnT\\s*HilL|your\\s+HaxorsteinBD|Mo[E3]Gza|KIWIL0736|AssasinCyber)',
        '<title>\\s*Blackhat\\s*Code\\s+Backdoor',
        '\\$ip\\s*=\\s*(?:getenv\\(|\\$_SERVER\\[)[\'"]REMOTE_ADDR[\'"](?:\$|\\]);\\s*[^\\?]{200,600}Social\\s*Security\\s*Number\\s*:\\s*\\$ssn',
        '@array_diff_ukey\$\\s*@array\\(\\(string\$\\$_REQUEST',
        'return\\s*RC4::Encryp',
        '\\A\\s*GIF8\\d\\w?[^\\s]{0,2}\\s*[^\\?]{0,80}\\s*<\\?\\s*@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\\s*\$',
        '\\}\\s*if\\s*\\(\\s*function_exists\\(\\s*[\'"]add_filter[\'"]\\s*\$\\s*\\)\\s*add_filter\$\\s*[\'"]all_plugins[\'"]\\s*,\\s*[\'"]fourofour_pp[\'"]\$;\\s*return\\s*1;\\s*\\?>\\s*\\Z',
        '<title>\\s*[\\[]{0,1}\\s*RileyWilder\\s*(?:\\\'\\s*s)?\\s*Mailer',
        '(\\$\\w{1,4})\\s*=\\s*fopen\$\\s*[\'"][^\'"]{1,40}[\'"]\\s*,\\s*[\'"](?:a|w)\\+?[\'"]\\s*\$;\\s*(?:fwrite|fputs)\$\\s*\\1,\\s*(\\$(?:message|\\w\\d))\\s*\$;\\s*mail\$\\s*\\$\\w{1,40},\\s*\\$\\w{1,40},\\s*\\2\\s*(?:,\\$\\w{1,40}\\s*)?\$;\\s*header\\s*\$\\s*[\'"]Location\\s*:[^\$]{1,100}\\);\\s*(?:exit\$\$;)?\\?>',
        '<\\?(?:php)?\\s*\\$ipv?\\s*=\\s*(?:getenv\$|\\$_SERVER\\[)[\'"]REMOTE_ADDR[\'"](?:\$|\\])\\s*;\\s*(?:\\$\\w{1,40}\\s*\\.?=\\.?\\s*[^;]{1,80}\\s*;\\s*){0,3}\\s*\\$(?:mensaje|message)\\s*\\.?=\\s*[\'"](pass|passwd|password)[^\\w]{1,40}\\$_POST\\[[\'"]?\\w{0,20}\\1[\'"]?\\]\\.?[\'"]?\\\\n[\'"];',
        '\\{(\\s*\\$\\w{1,40}\\s*=\\s*[\'"](\\.\\./){1,7}[\'"];){7}\\s*\\$\\w{1,40}\\s*=\\s*file_get_contents\\s*\$\\$\\w{1,40}\\s*\\.\\s*[\'"]wp-config\\.php[\'"]\$;',
        '<title>\\s*(?:Magic|MySQL|Peterson|indoxploit|CIH\\.)\\s*[^\\?]{0,15}\\s*(?:Web)?Shell',
        '<title>\\s*File\\s*</\\s*[^\\?]{1,200}<form\\s+method\\s*=\\s*[\'"]post[\'"][^\\?]{1,200}<\\?php\\s*if\\s*\$\\s*is_uploaded_file\\(\\s*(\\$_FILES\\[)([\'"][^\'"]{1,40}[\'"])(\\]\\[[\'"][^\'"]{1,40}[\'"])\\]\\s*\$\\s*\\)\\s*\\{\\s*move_uploaded_file\$\\1\\2\\3\\],\\s*\\1\\2(\\]\\[[\'"][^\'"]{1,40}[\'"]\\])\\s*\$\\s*;\\s*\\$file\\s*=\\s*\\1\\2\\4',
        '\\$sex\\s*\\.=\\s*[^\\n]{40,100}\\s*@mail\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*(\\$\\w{1,40})\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*fopen\\s*\$\\s*[\'"][^\'"]{1,20}\\.html[\'"]\\s*,\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$\\s*;\\s*fwrite\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\1',
        '<title>\\s*s72\\s*Shell[^\\w]',
        '<title>\\s*Symlink(?:_|\\s)\\s*Sa\\s+\\w?\\d+\\.\\d+',
        '(\\$\\w{1,4})\\s*=\\s*fopen\\(\\s*\\$\\w{1,4}\\s*,\\s*[\'"](a|w)\\+?[\'"]\$;\\s*fwrite\$\\s*\\1\\s*,\\s*[^\$]{1,20}(\\$bilsmg)[^\\)]{1,20}\\s*\\)\\s*;\\s*fclose\$\\1\$;\\s*(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{1,40}[\'"];\\s*@?mail\\s*\$\\s*\\4\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\3\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;',
        '\\$((?:email|login|user|username)\\w?)\\s*=\\s*\\$_POST\\[[\'"]\\1[\'"]\\];\\s*\\$((?:pass|password|passwd)\\w?)\\s*=\\s*\\$_POST\\[[\'"]\\2[\'"]\\];\\s*[^\\+]{1,400}\\$message\\s*=\\s*[\'"]\\s*[^\\}]{1,200}(FACEBOOK|GOOGLE)',
        '\\$from\\s*=\\s*[\'"][^\'"]{1,40}[\'"]\\s*;\\s*\\$((?:yahoo|gmail|outlook|aol|office365|adobe)(?:user|username|login))\\s*=\\s*\\$_POST\\[[\'"]\\1[\'"]\\];\\s*\\$((?:yahoo|gmail|outlook|aol|office365|adobe)(?:pass|password|passwd))\\s*=\\s*\\$_POST\\[[\'"]\\2[\'"]\\];',
        '<\\?pHp\\s*if\\s*\$file_exists\\s*\\(([\'"]/tmp/[^/]+/sess_[^\'"]{1,40}[\'"])\$\\)\\s*@?include(?:_once)?\\s*\$\\1\$;\\s*else\\s*echo\\s*\$?[\'"]?[^\'"]{0,40}[\'"]?\$?;\\s*\\$\\w{1,40}\\s*=\\s*"https?://"\\.getenv\$"SERVER_NAME"\$\\.getenv\$"SCRIPT_NAME"\$;',
        '<title>\\s*[-:\\[]{1,3}\\s*GreenwooD\\s*[-:\\]]{1,3}\\s*WinX\\s+Shell',
        '\\$ip\\s*=\\s*getenv\$[\'"]REMOTE_ADDR[\'"]\$\\s*;\\s*\\$(country)\\s*=\\s*\\w{0,40}\\1\$\$;\\s*\\$(region)\\s*=\\s*\\w{0,40}\\2\$\$;\\s*\\$(city)\\s*=\\s*\\w{1,40}\\3\$\$;(?:\\s*\\$\\w{1,40}\\s*=\\s*date\$[\'"][^\'"]{1,40}[\'"]\$;)?\\s*\\$\\w{1,40}\\s*=\\s*\\$_POST\\[[\'"]username[\'"]\\];\\s*\\$\\w{1,40}\\s*=\\s*\\$_POST\\[[\'"]password[\'"]\\];',
        'copy\$\\s*\\$\\w{1,9}\\s*\\.\\s*\\$\\w{1,9}\\s*,\\s*\\$\\w{1,9}\\s*\\.\\s*\\$\\w{1,9}\\s*\$\\s*;\\s*\\}\\s*\\}\\s*function\\s+system_custom\\s*\$\\s*\\$\\w{1,40}\$\\s*\\{\\s*\\$[^\\\\}]{1,40}\\s*if\\s*\$[^\\(]{1,40}\\(\\s*[\'"]exec[\'"]',
        '<title>\\s*nsT\\s*View',
        '\\$shell_mode\\s*\$\\s*\\{\\s*\\?>\\s*[^\\?]{1,99}\\s*<title>\\s*<\\?php\\s+echo\\s*\$?\\s*[\'"]?\\s*\\$shell_title;',
        'class\\s*\\=\\s*[\'"]tit[\'"]>\\s*Mailer\\s*Inbox',
        'makebotlist\\s*\\(\\s*(\\$BotList)\\s*\$\\s*\\{\\s*if\\s*\$\\s*!file_exists\\(\\s*\\1',
        'LD_PRELOAD=\\s*\\./libworker.so',
        '>\\s*Da(?:3|s)s\\s*(?:HaCkEr)?\\s*File\\s+Manager\\s*(?:Version)?\\s*<',
        '=num_macros\\(\\s*\\${\\s*\\${',
        'fopo\\.com\\.ar',
        '<\\s*title\\s*>\\s*404-server!+\\s*<\\s*/title\\s*>',
        ';\\s+eval\\s*\\(\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*[\'"]Dc/JcoIwAADQz1GHQ2WH6SkIqOwBZLt0BBKkBIKyjX59[^\'"]{360}[\'"]\\s*\$\\s*\\)\\s*\\)\\s*;\\s*\\?>\\s*\\Z',
        '@eval\$\\$r9f35db4\\(',
        'mail\\(stripslashes\\(\\$strr1\$, stripslashes\$\\$strr2\$',
        '\\A\\s*<\\?php\\s+(?:\\$\\w{1,40}\\s*=\\s*[\'"](?:gzinflate|base64_decode|strrev|str_rot13|gzuncompress|urldecode|rawurlencode)[\'"]\\s*;\\s*){3,5}[^}]{200,400}header\$[\'"]HTTP/1\\.0\\s+404\\s+Not\\s+Found[\'"]\$;[^\\?]{400,600}<\\s*form',
        '\\A\\s*<\\?(?:php)?\\s+/\\*\\s*\\*\\s*MySQL\\s+Web\\s+Interface\\s+By',
        '<td>\\$\\s*execute\\s*a cmd</td>',
        '\\A\\s*X5O.{25}EICAR-STANDARD-ANTIVIRUS-TEST-FILE[^\\s]{1,9}\\s*\\Z',
        '\\A\\s*[^\\w]?PNG.{3000,6000}?<\\?php',
        'Usage:\\s*\\w{1,40}\\s*\\[\\s*OPTIONS\\s*\\]\\s*Options:\\s*-a,\\s*--algo\\s*=\\s*ALGO\\s*specify\\s+the\\s+algorithm\\s+to\\s+use\\s*cryptonight',
        ';eval\$base64_decode\\(gzuncompress\\(base64_decode\\(\\$\\w+\$\\)\\)\\);\\?>',
        '<\\?php\\s*\\$\\w{1,40}\\s*=\\s*\'[^\']*\'\\s*;\\s*include_once\\s*\$\\s*"config\\.php"\\s*\$\\s*;\\s*\\?>\\s*<!DOCTYPE\\s*html',
        '<html>\\s*<head>\\s*<script>\\s*window\\s*\\.\\s*top\\s*\\.\\s*location\\s*\\.\\s*href\\s*="[^"]*"\\s*\\+\\s*"[^"]*"\\s*;\\s*</script>\\s*</head>\\s*<body>\\s*<script>\\s*document\\s*\\.\\s*write\\s*\$\\s*\'<img[^)]+\$\\s*;\\s*</script>\\s*</body>',
        '^\\s*<\\s*head\\s*>\\s*<\\s*meta\\s*name\\s*="[^"]*"\\s*content\\s*="[^"]*"\\s*>\\s*<\\s*meta\\s*http-equiv\\s*="[^"]*"\\s*content\\s*="\\d+\\s*;\\s*URL=https?://[^"]*"/\\s*>\\s*<\\s*/head\\s*>\\s*$',
        '<title>\\s*SexCrime\\s*-\\s*Shell',
        '\\$backdoor\\s*=\\s*base64_decode\$[\'"][^\'"]{400,600}[\'"]\$;\\s*\\$deface\\s*=\\s*base64_decode\$',
        '<td>Hati\\s+Mantan\\s*[^\'"]{1,10}[\'"];\\s*[^\\$]{1,40}\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?[^\'"]{1,40}[\'"]?\\]',
        '=>\\s*[\'"]tools[\'"],\\s*\\/\\*\\s*available:(\\s*(ls|search|upload|cmd|eval|sql|mailer|encoders|tools|processes|sysinfo),?\\s*){9,11}\\s*\\*/',
        '@eval\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[cmd\\]\$',
        '\\A\\s*<\\?(?:php)?\\s*(?:\\$\\w{1,40}\\s*=\\s*[\'"]\\w{24,40}[\'"];)?\\s*(\\$\\w{1,40})\\s*\\=\\s*[\'"\\s\\.aceglpr_]{13,40}\\s*\\;\\s*\\1\\s*\$\\s*[\'"](.).{0,40}\\2e\\w?[\'"]\\s*,[^\$]{30000,50000}(?:\\s*\\)\\s*){1,5};[^;]{1,40};\\s*\\?>\\s*\\Z',
        '\\A\\s*<\\?php\\s+[^\\?]{1,400}@system\$[\'"][^\'"]{0,40}wget\\s+https?://\\d+\\.\\d+\\.\\d+\\.\\d+/\\w{1,40}\\s+-O\\s*(\\w{1,40});[^\\.]{1,40}\\./\\1\\s*>\\s*/dev/null[^;]{0,40}\\Z',
        '\\$_COOKIE\\s*=\\s*WSOstripslashes',
        'if\\s*\\(\\s*\\$reqPwd\\s*!==\\s*vpsp_pwd\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=',
        'foreach\$\\$\\w{1,40}\\s+as\\s+\\$\\w{1,40}=>(\\$pat)\$\\{\\s*if\$\\1\\s*==\\s*[\'"][\'"]\\s*&&\\s*\\$\\w{1,40}\\s*==\\s*\\d+\$\\{\\s*\\$\\w{1,40}\\s*=\\s*true;([^`]{2000,3500})<br\\s*/>[\'"];\\s*\\}\\s*\\}\\s*elseif\\s*\$\\s*\\$_POST\\[[\'"]type[\'"]\\]\\s*==\\s*[\'"]file[\'"]\\s*\$\\s*\\{\\s*if\$unlink\\(\\$_POST\\[[\'"]path[\'"]\\]\\s*\$\\s*\\)\\s*\\{',
        '\\]\$NULL\$;\\s*@\\$GLOBALS\\[',
        'myUpload->uploadFile\$\\s*\$',
        'is_readable\\s*\$\\s*[\'"]/etc/passwd[\'"]\\s*\$\\s*\\?[^\\?]{100,600}php_uname\$\$',
        '\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']{1,6}\'\\s*\\]\\s*\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']{1,6}\'\\s*\\]\\s*\$\\s*;',
        'Made by SexDog Pula',
        'base.\\.\$32\\*2\$',
        '\\}\\s*else\\s*\\{\\s*\\$v\\s*=\\s*new\\s+verifier\$\$;\\s*print_r\$\\$v->checkemails',
        '>Gantengers Crew<',
        '\\+\\+\\$o\\]\\]\$\\);}}eval\$\\$d\$',
        'mt_rand\$\\s*0\\s*,\\s*count\\(\\s*\\$not_android_urls\$-1\\)',
        '\\}\\);\\s*function\\s+refreshBotsOnline\$\$\\{\\s*\\$\$\\\\[\'"]\\#nav\\\\[\'"]\$\\.load\$\\\\[\'"]inc/\\w{1,40}\\.php\\\\[\'"]\$;\\s*setTimeout\$refreshBotsOnline,\\s*\\d+\$;\\s*\\}\\s*</script>',
        'Mailer\\s+by\\s+Sphinx</title>',
        '\\$_POST\\[([\'"]botID[\'"])\\]\\)\\)\\s*\\$id\\s*=\\s*filterString\$\\$_POST\\[\\1\\]\$;\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_POST\\[[\'"]track[\'"]\\]',
        'eval\\(\\$\\w{1,40}\\[\\$GLOBALS\\[',
        '\\$domain\\s*=\\s*\\$domains\\[\\s*array_rand\\(\\s*\\$domains\\s*,\\s*1\$',
        'POST\\s*=\\s*WSOstripslashes',
        '\\A\\s*<\\?php\\s*[^\\}]{1,600}\\s*\\}\\s*\\}\\s*define\$\\s*[\'"]startTime[\'"]\\s*,\\s*getTime\\(\$\\s*\\);\\s*if\\s*\$\\s*!function_exists\\s*\\(\\s*[\'"]shellexec[\'"]\\s*\$\\s*\\)\\s*\\{\\s*function\\s+shellexec\\s*\$\\s*\\$cmd\$\\s*\\{',
        '<\\?php\\s*(\\$\\w{1,40})\\s*=\\s*fopen\$__FILE__,\\s*[\'"]\\w[\'"]\$;\\s*fseek\$\\s*\\1,\\d+\$;\\s*(\\$c)\\s*=\\s*[\'"][\'"];\\s*while\\s*\$\\s*!feof\\(\\s*\\1\\s*\$\\s*\\)\\s*\\{\\s*\\2\\s*\\.?=\\s*fread\$\\s*\\1,\\d+\$;\\s*\\}\\s*@?(?:system|exec|passthru|shell_exec|popen|eval)\\s*\$\\s*bzdecompress\\(\\2\$\\);\\s*__halt_compiler\$\$;\\s*\\?>',
        '<%@page\\s[^\\!]{1,999}!\\s*(?:\\s*/\\*\\*.{1,200}\\*/\\s*)?(private\\s+static\\s+final\\s+String\\s+PW)\\s*=\\s*[\'"][^\'"]{1,40}[\'"];\\s*[^\\s]{0,40}\\s*\\1_SESSION_ATTRIBUTE\\s*=\\s*[\'"](?:JspSpy|supersuper)\\w{1,9}[\'"];',
        'sent\\s*=\\s*@?mail\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;(?:\\s*\\$\\w{1,40}\\s*=\\s*\\$\\w{1,40}\\s*\\+\\s*1\\s*;)?\\s*\\$\\w{1,10}spamm?ed\\s*=\\s*[\'"]spamm?ed[\'"]\\s*;',
        'mail\$\\s*\\$\\w{1,40},\\s*\\$\\w{1,40},\\s*(\\$message)\\s*\$;\\s*(\\$\\w{1,4})\\s*=\\s*fopen\$\\s*[\'"]\\w{1,40}\\.?\\w{1,10}[\'"]\\s*,\\s*[\'"](?:a|w)\\+?[\'"]\\s*\$;\\s*fputs\$\\s*\\2,\\s*\\1\$;(?:\\s*fclose\$\\s*\\2\\s*\$;)?\\s*header\\s*\$\\s*[\'"]Location\\s*:[^\$]{1,100}\\);\\s*(?:exit\$\$;)?\\?>',
        'stripslashes\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["l1"\\]\$;\\$',
        'eval\\s*\$base64_decode\\s*\\(\\s*[\'"]ZXZhbChiYXNlNjRfZGVjb2RlKC[^\']{20,10000}[\'"]\\s*\$\\s*\\)\\s*;(\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^;]{1,80};\\s*){0,3}(?://[^\\n]{1,40})?\\s*mail\$',
        '\\A\\s*\\#!/usr/bin/perl\\s*[^\\(]{1,40}\\s*opendir\\(\\s*my\\s(\\$\\w{1,40})\\s*,\\s*[\'"](/var/www/vhosts/)[\'"]\\s*\$;\\s*foreach\$\\s*sort\\s*readdir\\s*\\1\\s*\$\\s*\\{\\s*my\\s\\$\\w{1,40}\\s*=\\s*\\d+;\\s*\\$\\w{1,40}\\s*=\\s*\\d+\\s*if\\s*-d\\s*(\\$_);\\s*(\\$\\w{1,40})\\s*=\\s*\\3;(?:\\s*symlink\$[\'"]\\2[\'"]\\.\\4[^\$]+[\'"]\\)\\s*;)+\\s*\\}',
        'eval\$"\\\\x65\\\\x76\\\\x61\\\\x6C\\\\x28\\\\x67\\\\x7A\\\\x69\\\\x6E[^\$]{9999,}',
        '\\A\\s*<\\?php\\s+if\\s*\$\\s*!isset\\s*\\(\\s*\\$_SESSION\\[[^\\]]{1,40}\\]\\s*\$\\s*\\)\\s*\\{\\s*[^\\}]{1,99}\\s*\\$inj(?:e\\wtor)?\\s*=\\s*\\$_SERVER\\[[^\\]]{1,40}\\];[^/]{150,400}\\s*\\$inj(?:e\\wtor)?\\s*=\\s*gethostbyname\$\\s*\\$_SERVER\\[[^\\]]{1,40}\\]\\s*\$;\\s*@?mail\\s*\$',
        '\\[[\'"]?(cmd)[\'"]?\\]\\s*\$\\s*;\\s*@?system\\s*\$\\s*\\$\\1\\s*\$\\s*;\\s*echo\\s*\$?\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$?\\s*;\\s*if\\s*\$\\s*@?\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?\\1[\'"]?\\]\\s*[^\\w]{1,2}=\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$\\s*\\{\\s*\\?>\\s*</?pre>',
        '\\*\\s*\\*\\s*arkei\\s+stealer',
        '<title>\\s*[^\\w]{0,3}\\s*BYSCRA3ZY\\s*[^\\w]{0,3}\\s*</title>',
        '<title>\\s*jahat\\s*</title>[^\\)]{1,499}php_uname\$\$',
        '<title>\\s*[\\w\\^\\.\\|]{0,3}\\s+Private\\s+Shell\\s',
        '<title>\\s*Dr\\s+HeX\\s*</',
        '=\\s*stripslashes\$\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\["user_l"\\]\$',
        '<title>\\s*[\\w-]{0,9}\\s*(?:cpanel|whm)\\s+[^`]{0,9}\\s*(?:crac|brut)',
        '<title>\\s*Bienvenido\\s+a\\s+BancaNet\\s*[^\\.]{1,600}\\.banamex\\.com\\.mx/',
        '\\$headers\\s*=\\s*[\'"][^\'"]{0,40}DHL[\'"];\\s*(\\$\\w{1,40})\\s*=\\s*array\\s*\$\\s*(\\$\\w{1,40})\\s*\$\\s*;\\s*foreach\\s*\$\\s*\\1\\s*as\\s*\\2\\s*\$\\s*if\\s*\$\\s*mail\\s*\\(\\s*\\2\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*!=\\s*false\\s*\\)\\s*\\{\\s*header\\s*\$\\s*[\'"]Location:',
        '\\$\\w{1,40}\\s*=\\s*["\']\\s*Hacked\\s+by\\s+Moroccanwolf\\s*["\']\\s*;',
        'if\\(\\s*!\\$os_name\\s*=\\s*@?php_uname\\(\$\\)\\s*\\{\\s*if\\s*\$\\s*function_exists\\(\\s*[\'"]posix_uname[\'"]\\s*\$\\s*\\)\\s*\\{[^`]{600,1500}if\$!empty\\(\\$_POST\\[([\'"]?php[\'"]?)\\]\$\\)\\{\\s*ob_start\$\$;\\s*@?eval\$\\$_POST\\[\\1\\]\$;',
        '<title>\\s*[^/]{1,49}\\s+Edited\\s+By\\s+KingDefacer\\s*</title>',
        ']}=trim\$\\s*array_pop\\(\\${\\${"',
        '\\$\\w{1,40}\\s*=\\s*fsockopen\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*30\\s*\$\\s*;\\s*if\\s*\$\\s*!\\$\\w{1,40}\\s*\$\\s*\\{\\s*print(?:it|r)?\\s*\$\\s*[\'"][^\'"]{1,40}[\'"]\\s*\$\\s*;\\s*exit\\s*\$\\s*\\d?\\s*\$\\s*;\\s*\\}\\s*//\\s*Spawn\\s+shell\\s+process',
        '(\\$\\w{1,40})\\s*=\\s*@stream_socket_client\$\\s*[\'"]tcp://\\$\\w{1,40}:25[\'"],\\s*\\$\\w{1,40},\\s*\\$\\w{1,40},\\s*\\d+\$;\\s*else\\s*(return)\\s*-?\\d;\\s*if\\s*\$\\s*!\\s*\\$\\w{1,40}\$\\s\\s*{\\s*\\2\\s*\\d;\\s*}\\s*else\\s*{\\s*\\$\\w{1,40}\\s*=\\s*\\w{1,40}\$\\1\$;\\s*@fputs\$\\s*\\1,\\s*[\'"]EHLO\\s*\\$\\w{1,40}\\s*\\\\r\\\\n[\'"]\\s*\$;',
        '\\A\\s*\\#!/usr/bin/perl\\s*[^;]{1,200}use\\s+strict;\\s*undef\\s+\\$modules::Module::var;\\s*my\\s+\$\\$Password,[^\$]{1,200}\\$WinNT,\\$NTCmdSep,\\$UnixCmdSep',
        '\\$p=strpos\$\\s*\\$tx,\'{\\#\',\\$p2\\+2',
        '\\A\\s*<\\?php\\s*file_put_contents\\s*\\(\\s*[\'"]\\w+\\.php[\'"]\\s*,\\s*base64_decode\\s*\\(\\s*[\'"][^\\;]{1,200}[\'"]\\s*\$\\s*\\)\\s*;\\s*\\?>\\s*\\Z',
        '\\$headers\\s*\\.?=\\s*\\$_POST\\[[\'"](?:username|passwd|password|pass|user)[\'"]\\]\\.[\'"]\\\\n[\'"];\\s*if\\s*\$mail\\(\\$recipient,\\$subject,\\$message,\\$headers\$\\)\\s*\\{\\s*header\$"Location:\\s*[^\$]{1,40}\\);\\s*\\}\\s*else\\s*\\{\\s*echo\\s*[\'"][^\'"]{1,40}[\'"];\\s*\\}\\s*\\?>',
        '\\$ip\\s*=\\s*(?:getenv\$|\\$_SERVER\\[)[\'"]REMOTE_ADDR[\'"](?:\$|\\]);\\s*\\$from\\s*=\\s*[\'"]From:\\s*\\w{0,39}\\s*<?hacker@',
        '\\$ip[\'"]?;\\s*\\$from\\s*=\\s*[\'"]From:\\s*Banco\\s+Azteka',
        '@?fclose\\s*\$\\s*@?fwrite\\s*\\(\\s*@?fopen\\s*\\(\\s*[\'"][^\'"]{1,40}[\'"]\\s*,\\s*[\'"](a|w)\\+?[\'"]\\s*\$\\s*,\\s*\\$\\w{1,40}\\s*\\.\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\)\\s*\\)\\s*;(?:\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{1,40}[\'"]\\s*;){0,3}\\s*mail\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$headers\\s*\$',
        '(\\$headers)\\s*\\.?=\\s*[\'"][^\'"]{1,40}[\'"];\\s*mail\$[^\$]{1,40}(\\$\\w{1,40})\\s*\\);\\s*if\\s*\$\\s*mail\\(\\s*[^\$]{1,40}\\s*\\2\\s*,\\s*\\1\\s*\\)\\s*\\)\\s*\\{\\s*header\\s*\$\\s*[\'"]Location:[^\'"]{1,40}[\'"]\\s*\$\\s*;',
        '\\A\\s*<\\?php\\s+error_reporting\$0\$;\\s*set_time_limit\$0\$;\\s*@?ini_set\$\'memory_limit\',\\s*\'\\d+M\'\$;\\s*if\\s*\$[^\$]{1,20}\\$_SERVER\\[[\'"]HTTP_USER_AGENT[\'"]\\]\\)\\s*,\\s*\'\\w+\'\\)\\)\\s*\\{\\s*header\$[\'"]HTTP/1\\.1 301 Moved Permanently[\'"]\$;\\s*exit\$?\$?;\\s*\\}[^%]+\\}\\s*/\\*\\s+@hash:\\s+\\w{16,40}\\s+-\\s+\\w{1,9}\\s+\\*/\\s*\\Z',
        '\\A\\s*<\\?php\\s*\\$[0_O]{1,12}=[\'"][^\'"]*[\'"];\\s*\\$[0_O]{1,12}=[\'"]wp-admin[\'"];\\s*\\$[0_O]{1,12}=\$[^\$]{20,60}[^`]{40000,45000}\$\$;\\}unset\$\\$[0_O]{1,12},\\$[0_O]{1,12},\\$[0_O]{1,12},\\$[0_O]{1,12},\\$[0_O]{1,12}\$;exit\$\$;\\}\\}[\'"]\\);\\$\\{[\'"](?:\\\\x\\w{2}){1,12}[\'"]\\}\\[[^\\]]{1,99}\\]\$\$;\\s*(?:\\?>|\\Z)',
        '<title>\\s*unzip\\s*file\\s*by\\s*ahwak2000',
        'refresh[\'"]\\s*content=[\'"]\\d+;\\s*url=(http://(?:bestselect2019|fastsmartassist|globalmedsreward|goodfastquality|herbal(?:drugsvalue|genericinc)|luckybestmart|newhealthprogram|online(?:firsttrade|hotprice|smartmall)|organicfirstdeal|pure(?:first|organice)shop|the(?:aidoutlet|pillsupply))\\.[senbrut]{1,3})/?[\'"]\\s*>\\s*<script\\s*type=[\'"]text/javascript[\'"]>\\s*window\\.location\\.href\\s*=\\s*[\'"]\\1[^\\?]{80,300}\\s*</body>\\s*</html>\\s*\\Z',
        '\\#!/usr/bin/(?:ba|z|t)?sh\\s*USEFUL\\s*=\\s*\$[^\$]{1,99}\\)[^\\?]{999,2000}Cant\\s*Read\\s*\\[\\s*/etc/named\\.conf\\s*]\\\\c[\'"]\\s*fi\\s*echo\\s*-e\\s*[\'"][\'"]\\]\\}\\\\c[\'"]',
        '\\beval\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[.pass.\\]\$;\\s*exit\$\$;',
        'eval\$\\s*base64_decode\\(\\s*\\$o\\s*\$\\s*\\);\\s*\\?>',
        'AddType\\s+application/x-httpd-cgi\\s+\\.alfa',
        '!\\s*isset\\s*\$\\s*\\$_SESSION\\s*\\[\\s*([\'"]nst[\'"])\\s*\\]\\s*\$\\s*\\w{2,3}\\s*\\$_SESSION\\s*\\[\\s*\\1\\s*\\]\\s*[^\\w]{2,3}\\s*\\$\\w{1,40}\\s*\\)\\s*\\{\\s*die\\s*\$\\s*[\'"]\\s*<title>',
        '<\\?php\\s*@?include\\(\\s*[\'"]\\w{1,20}\\.php[\'"]\\s*\$;\\s*\\$ip\\w?\\s*=\\s*(?:getenv\$|\\$_SERVER\\[)[\'"]REMOTE_ADDR[\'"](?:\$|\\]);(\\s*\\$\\w{1,40}\\s*=\\s*\\$_POST\\[[\'"]CARD(?:TYPE|NUMBER|CVV2?)?\\w{1,10}[\'"]\\];){2}',
        'if\\s*\$\\$else_dot\$\\s*\\{\\s*\\$new_v_f=fopen\$[\'"]\\$f_creat_name\\.\\$else_dot[\'"],[\'"](?:w|a)\\+?[\'"]\$;\\s*\\}',
        '\\A\\s*<\\?php\\s*@?eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*str_rot13\\s*\\(\\s*[\'"]iIugH9gTRC5pMitCT9HmWj9tXHNmuAuhvHzNANRz9[^\'"]+[\'"](?:\\s*\$\\s*){1,6};\\s*\\?>\\s*<\\?php\\s*@?eval\\s*\$\\s*gzinflate\\s*\\(\\s*base64_decode\\s*\\(\\s*',
        'html_footer\\s*\\(\$\\s*\\{\\s*[^>]{1,99}<h\\d*>\\s*Coded\\s*by\\s*MizoZ',
        '\\{\\s*\\$\\w\\s*=\\s*Array\\s*\$(\\s*[\'"][^\'"]{1,40}[\'"],?\\s*){4}[\'"]aHR0cDovL2M4Ni50cnVlYmFia2EucnUv[\'"]',
        '<title>\\s*Facebook\\s*</title>\\s*<\\?php\\s*include(?:_once)?\\s*\\(?[\'"][^\\.]{1,99}\\.php[\'"]\$;',
        '\\}\\s*\\}\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*new\\s*(WebShell|backdoor)\$\$;\\s*(?:\\?>)?\\s*\\Z',
        '\\A\\s*<\\?php\\s+system\$[\'"]pwd[\'"]\$[^\$]{1,40}system\\([\'"]cat\\s+/etc/passwd[^\\?]{1,600}define\\([\'"][^\'"]{1,40}[\'"]\\s*,\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)\\w{1,40}[\'"]\\s*\$\\s*;',
        '\\$\\w{1,10}\\s*=\\s*\\$\\w{1,10}\\s*\\+\\s*1;\\s*\\$txtspamed\\s*=\\s*[\'"]\\w{1,40}[\'"];\\s*if\\s*\$\\s*!\\$\\w{1,40}\\s*\$\\s*\\{',
        '\\A\\s*<\\?php(?:\\s*@\\w{7,15}\$[^\$]{1,40}\\);){0,9}\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$(?:\\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\\s*\\(){0,5}\\s*\\$_\\1\\s*\\[\\s*[\'"][^\'"]{1,40}[\'"]\\s*\\](?:\\s*\$\\s*){1,6};\\s*\\}\\s*exit;\\s*(?:\\?>)?\\s*\\Z',
        '<title>\\s*HTTP\\s+404\\s+Not\\s+Found\\s*</title>[^`]{1,600}\\$\\w{1,40}\\s*=\\s*file_get_contents\$\\s*[\'"](?:\\.\\./){5,9}?wp-config\\.php[\'"]',
        'if\\s*\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[\\w{1,40}\\]\\s*==\\s*[\'"]stop[\'"]\\s*\$\\s*\\{\\s*(?:@|\\#)?shell_exec\\s*\$\\s*[\'"]killall\\s*bot\\.pl[\'"]\$;',
        '<title>\\s*[^\\w]{1,3}\\s*Trenggalek\\s+Mafia',
        '\\A\\s*<\\?php\\s*\\$\\w{1,9}\\s*=\\s*array\$[\'"][^@]+@(?:[\\w\\-\\.]+)\\.(?:[a-z]{2,5})[\'"]\$;\\s*(?:\\$\\w{1,9}=[\'"][^\']*[\'"];|\\$\\w{1,9}=array\$[^\$]+\\);){1,5}for\\s*\$(\\$\\w)=0;\\1<\\d;\\1\\+\\+\$\\s*\\{\\s*(\\$\\w{1,9})=\\$\\w{1,9}\\[\\1\\]\\s*;\\s*(\\$\\w{1,9})\\s*\\.=\\s*\\$\\w{1,9}\\[\\2\\]\\s*;\\s*\\}\\s*\\3\$[^\$]{1,400}[\'"]\\);\\s*\\?>\\s*\\Z',
        'for\\s*\$\\s*(\\$\\w)\\s*=\\s*0;\\s*\\1\\s*<\\s*strlen\\s*\\(\\s*\\$wp_file_descriptions\\[[\'"]md5_check\\.php[\'"]]\\s*\$;\\s*\\1\\s*=\\s*\\1\\s*\\+\\s*\\d+\\s*\\)\\s*\\$search\\s*\\.?=\\s*[\'"]%[\'"]\\s*\\.\\s*substr\\s*\$\\s*\\$wp_file_descriptions\\[[\'"]md5_check\\.php[\'"]]\\s*,\\s*\\1,\\s*\\d+\\s*\$;\\s*\\$wp_template\\s*=\\s*@?preg_replace\\s*\$',
        '(\\$message)\\s*\\.?=\\s*[\'"][\\$\\-\\s\\:+\\.=_\\w]{10,40}\\\\n[\'"]\\s*;\\s*@?mail\\([^\\;]{1,200}\$\\s*;\\s*\\}?\\s*(\\$\\w{1,12})\\s*=\\s*fopen\\s*\$\\s*[\'"][^\$]{1,40}[\'"]\\);\\s*fwrite\$\\2\\s*,\\s*\\1\\s*\$;\\s*fclose\$\\s*\\2\\s*\$\\s*;\\s*\\s*header\\s*\$\\s*[\'"]Location\\s*:[^\$]{1,100}\\);\\s*(?:exit\$\$;)?\\?>',
        '\\#!/usr/bin/(?:ba|z|t)?sh\\s*DIR=\\$1\\s*IFS=\\$[^\\&]{199,399}\\s*permnum=[\'"]0777[\'"]\\s*permhuman=[\'"]drwxrwxrw[\'"][^\\?]{500,}\\$permcolor\\\\[\'"]\\},\\s*done\\s*echo\\s*[\'"]\\{\\}\\][\'"]',
        '\\#!/usr/bin/perl\\s*[^\\?]{450,600};\\s*system\$\\s*decode_base64\\s*\\(\\s*\\$\\w{1,40}\\s*\\{\\s*[\'"]cmd[\'"]\\s*\\}\\s*\$\\s*\\)\\s*;\\s*print\\s*[\'"]</pre>[\'"]\\s*\\}\\s*\\}',
        '\\A\\s*<\\?php\\s*\\$(?:auth)?_?pass\\s*=\\s*[\'"]\\w{0,40}[\'"];\\s*[^\\$]{0,99}\\s*(?:\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{1,40}[\'"];)?\\s*\\$\\w{1,40}\\s*=\\s*[\'"]FilesMan[\'"];[^\\}]{1,200}header\$[\'"]HTTP/1\\.0\\s+404\\s+Not\\s+Found[\'"]\$;\\s*exit',
        ';\\s*(passthru|exec|shell_exec|popen|system|eval)\$\\s*[\'"]\\./findsock[^\\$]{1,40}\\$_SERVER\\[[\'"]REMOTE_ADDR[\'"]\\][^\\$]{1,40}\\$_SERVER\\[[\'"]REMOTE_PORT[\'"]\\]\\s*\$\\s*\\?>',
        '<(?:h\\d|title)>\\s*Moshkela\\s+Hacker',
        'cover\$\\s*[\'"]IndoXploit[\'"]\\s*\$;',
        'exit\\s*\$\\s*\$\\s*;\\s*\\}\\s*\\}\\s*if\\s*\$\\s*(\\$_POST)\\s*\\[\\s*(\'_evalText\')\\s*\\]\\s*\$\\s*@?eval\\s*\$\\s*\\1\\s*\\[\\s*\\2\\s*\\]\\s*\$\\s*;\\s*if\\s*\$\\s*\\1\\s*\\[\\s*\'_upl\'\\s*\\]\\s*[^\\w]{2,3}\\s*[\'"][^\'"]*[\'"]\\s*\$\\s*\\{\\s*if\\s*\$\\s*@copy\\s*\\(\\s*(\\$_FILES)\\s*\\[\\s*[^\$]+\\s*\\)\\s*\\)\\s*\\{[^\\}]+\\}\\s*else\\s*\\{[^\\}]+\\}\\s*\\}',
        'printf\$"Usage: findsock ip port',
        '<title>\\s*PHP\\s*.\\s*Mailer\\s*by\\s*iskorpitx',
        'IndoXploit\\s*\\$\\w{1,40}\\s*=\\s*[\'"][^\'"]{0,40}(?:aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3|aHR0cDovL3Bhc3RlYmluLmNvbS9yYXc)[^\'"]{0,40}[\'"]\\s*;',
        '(?:\\$(?:message|spam|bilsmg)\\s*\\.?=\\s*[\'"]\\s*(?:Password|Pass|PWD?)[^\\n]{1,60}([\'"]?\\\\n[\'"]|[\'"]/[\'"]);)[^\\?]{1,600}\\$headers\\s*\\.=\\s*\\$_POST\\[[\'"]eMailAdd[\'"]\\]',
        '<title>\\s*Don\\s+Cordoba\\s+Mailer',
        'if\\s*\\(\\s*mail\\s*\\(\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{(?:\\s*\\s*mail\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;){2,4}\\s*header\$\\s*[\'"]Location:',
        '\\$ip\\s*=\\s*(?:getenv\\(|\\$_SERVER\\[)[\'"]REMOTE_ADDR[\'"](?:\$|\\]);\\s*\\$\\w{1,40}\\s*=\\s*\\$_SERVER\\[[\'"]HTTP_USER_AGENT[\'"]\\];\\s*\\$\\w{1,40}\\s*=\\s*date\$[\'"][^\'"]{1,40}[\'"]\$;\\s*(\\$message)\\s*\\.?=\\s*[\'"]Email[^\\n]{1,40}\\\\n[\'"];\\s*\\1\\s*\\.?=\\s*[\'"]Password',
        '\\A\\s*<\\?php\\s+/\\*\\*\\s*\\*\\s*Smtp\\s*Auto\\s*Change\\s*Password\\s*By\\s*VvebOs',
        '\\$subject\\s*=\\s*[\'"][^\\$]{1,40}[\'"]\\.\\$ip\\.[""]\\\\n[\'"];\\s*\\{?\\s*@?mail\$[^\\;]{1,200}\$\\s*;\\s*\\}?\\s*\\s*header\\s*\$\\s*[\'"]Location\\s*:[^\$]{1,100}\\);\\s*(?:exit\$\$;)?\\?>',
        '@gzinflate\$\\s*@base64_decode\\(\\s*@str_replac',
        ';\\s*\\$\\{[\'"](?:G|\\\\x47)(?:L|\\\\x4c)(?:O|\\\\x4f)(?:B|\\\\x42)(?:A|\\\\x41)(?:L|\\\\x4c)(?:S|\\\\x53)[\'"]\\}\\[[\'"](?:z|r|_|\\\\x7a|\\\\x5f|\\\\x72){1,40}[\'"]\\]\\(\\$[zr_]{1,40},CURLOPT_USERAGENT,\\\\[\'"]WHR\\\\[\'"]\$;',
        'echo\\s*[\'"]<pre>[\'"];\\s*system\$\\$_REQUEST\\[\'c\'\\]\$;\\s*die;',
        '(\\$b374k)\\s*=\\s*@\\$\\w{1,40}\$[^\$]{20,99}\\)\\)\\);[\'"]\\);\\s*@\\1\$[\'"]',
        '\\A\\s*<\\?php\\s*\\$\\w{1,9}pass\\s*=\\s*[\'"][^\'"]{1,40}[\'"];[^\\<]{1,600}function\\s+masuk\\(\$\\s*\\{\\s*die\$[\'"]',
        '<html>\\s*<title>\\s*Symlink\\s*Bypass\\s*\\d+\\s*by\\s+hAxOr',
        '(\\$\\w{1,40})\\s*=\\s*[\'"][^\'"]{1,40}\\.html?[\'"]\\s*;\\s*(\\$\\w{1,4})\\s*=\\s*fopen\\(\\s*\\1\\s*,\\s*[\'"](?:a|w)\\+?[\'"]\\s*\$\\s*[^;]{0,39}\\s*;\\s*fwrite\$\\s*\\2\\s*,\\s*(\\$MESSAGE)\\s*\$;\\s*fclose\$\\2\$;\\s*@?mail\$\\$TO,\\$SUBJECT,\\3,\\$HEADER\$;',
        ';\\s*print\\s+"Flooded:\\s*\\$ip\\s*on\\s*port\\s*\\$rand',
        '<title>\\s*Fastest\\s+Zone-H\\s*Mass\\s+Deface\\s+Poster',
        '\\)\\s*\\)\\s*;\\s*\\}\\s*\\$\\w{1,40}\\s*=\\s*fopen\\s*\$\\s*[\'"]block-mail\\.txt[\'"],\\s*[\'"]r[\'"]\$;',
        '\\$ip\\s*=\\s*(?:getenv\$|\\$_SERVER\\[)[\'"]REMOTE_ADDR[\'"](?:\$|\\]);\\s*\\$datamasii\\s*=\\s*date\$[\'"][^\'"]{1,40}[\'"]\$;\\s*\\$(user|userid|login|email)\\s*=\\s*\\$HTTP_POST_VARS\\s*\\[\\s*[\'"]\\1[\'"]\\s*\\]\\s*;\\s*\\$(pass|password|pwd)\\s*=\\s*\\$HTTP_POST_VARS\\s*\\[\\s*[\'"]\\2[\'"]\\s*\\]\\s*;\\s*[^\\?]{1,600}\\s+@?mail\\s*\$',
        '\\|\\s*md5\\s*\\(\\s*\\$_GET\\[[\'"]?[^\'"]{1,10}[\'"]?\\]\\s*\$\\s*[^\\w]{1,2}=\\s*[\'"]\\w{24,40}[\'"]\\s*\\)\\s*die\\s*;\\s*function\\s+execute\$\\s*\\$\\w{1,40}\\s*\$\\s*\\{[^\\?]{100,300}\\s*(\\$\\w{1,40})\\s*=\\s*@?shell_exec\$\\$\\w\$;\\s*return\\s*\\1;\\s*\\}\\s*elseif',
        '\\A\\s*<\\?php\\s*(?:\\s*die\\s*\$\\s*)?@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\\(\\s*file_get_contents\\s*\\(\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)[^\'"]{1,40}[\'"](?:\\s*\$\\s*){1,6};\\s*(?:\\?>|\\Z)',
        '<title>\\s*Dark Shell\\s*</title>.*fsockopen',
        '\\$su\\s*=\\s*str_replace\$\'\\$name\'\\s*,\\s*\\$n\\s*,\\s*stripslashes\\(\\s*base64_decode\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*\'z2\'\\s*\\]\\s*\$\\s*\\)\\s*\\);',
        '\\$data = curl_get_from_webpage_one_time\$\\$url',
        '\\$weff_client\\s*=\\s*new\\s+TWeffClient\\(\$;',
        '\\$Content_mb=getHTTPPage\$\\$Remote_server\\."/index\\.(html|php)\\?host',
        'str_replace\\(\'define\\("PRENAME","\\d+"\$;\'\\s*,\\s*\'define\$"PRENAME"',
        '<title>\\s*Dark Shell\\s*</title>.+clearstatcache',
        '<\\?php\\s*\\$arrId\\s*=\\s*array\\((\'\\d+-\\d+\'\\s*,\\s*)',
        '\\$array\\s*=\\s*base64_decode\\(\\$array\$;\\s*@assert\$\\$array\$;',
        '\\$\\w{1,40}\\s*=\\s*"[^"]+";\\$\\w+\\s*=(\\s*\\$\\w{1,40}\\[\\d+\\]\\s*\\.?){5,};\\$\\w+\\s*=\\s*[^;]+;\\$\\w+\\s*=\\s*"[^"]+";\\$\\w+\\s*=\\s*\\$\\w+\\s*\\.\\s*"',
        'curl_setopt\\s*\$\\s*(\\$cu)\\s*,\\s*CURLOPT_RETURNTRANSFER\\s*,\\s*\\d\\s*\$\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*curl_exec\\s*\$\\s*\\1\\s*\$\\s*;\\s*curl_close\\s*\$\\s*\\1\\s*\$\\s*;\\s*@?\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\$\\s*\\2\\s*\$\\s*;\\s*\\}\\s*;\\s*die\\s*\$\\s*\$\\s*;\\s*\\?>\\s*\\Z',
        '\\{\\s*\\$\\w{1,4}\\s*=\\s*\\$\\w{1,4}\\[\\d+\\]\\s*;\\s*\\$\\w{1,4}\\s*=\\s*[\'"]moban[\'"]\\s*;\\s*\\}\\s*if\\s*\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[^\\]]{1,40}\\s*\\]\\s*\$\\s*\\{',
        'if\\s*\$\\s*\\$_GET\\[[\'"]?cmd[\'"]?]\\s*[^\\w]{1,2}=\\s*[\'"]eval[\'"]\$\\s*\\{\\s*@?eval\$\\$_POST\\[[\'"]?exec[\'"]?\\]\$;\\s*exit;\\s*\\}\\s*(?://[^\\n]{1,80})?\\s*if\\s*\$\\s*\\$_GET\\[[\'"]?cmd[\'"]?\\]\\s*==\\s*[\'"]GetArticleById[\'"]',
        'if\\s*\\(\\$mode_work\\s*==\\s*[\'"]cngbot[\'"]\\s*\$\\s*\\{',
        '\$\\s*[\'"]{0,1}DZe1r',
        'fopen\\(\\$s1\\.\'accesson\\.php',
        '\\./\\*-/\\*-\\*/"',
        'code\\.google\\.com/p/b374k-shell',
        '\\$\\w{1,40}\\s*=\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\'\\w+\'\\]\\s*\\(\\s*\'\'\\s*,\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*\'\\w+\'\\s*\\]\\s*\\(\\s*\\$_POST\\[\\s*\'\\w+\'\\s*\\]\\s*\$\\s*\\)\\s*;[^`]+?iterator_apply\\s*\$\\s*\\$\\w+\\s*,\\s*\\$\\w+,\\s*array\\s*\\(\\s*\\$\\w+\\s*\$\\s*\\)\\s*;',
        '\\$MESSAGE\\s*=\\s*wordwrap\$\\$MESSAGE,\\d+\$\\s*;\\s*[\\#]{50,80}\\s*\\$SUBJECT\\s*=\\s*["\']\$\\$\\w{1,40}\$\$(?:BILLING|LOGIN)\$\$\\$IP\$\$\\$(?:nama_negara|country)\$[\'"];',
        'echo\\swelcome\\sto\\sr57\\sshell',
        '[\\#]{2}\\s*ReCoded\\s*By\\s*Syechrul\\s*Imam',
        '\\A\\s*<\\?php\\s*\\$GLOBALS\\[[^\\%]{60000,}%[^\\?]{999,3000}\\?\\s*[^\\&]{1000,1500}\\.\\./wp-config\\.php',
        '\\A\\s*<\\?php\\s+if\$!function_exists\\("(\\w{1,40})"\$\\){function\\s\\w+\$\\$\\w+\$\\{\\$\\w+=base64_decode\$\\$\\w+\$;\\$\\w+=0;\\$\\w+=0;\\$\\w+=0;\\$\\w+=\$ord\\(\\$\\w+\\[1\\]\$<<8\\)\\+ord\$[^\\?]{1500,3000}\\?"\\.">"\\.\\$\\w+;return\\s\\$\\w+;\\}\\}\\}\\}eval\\(\\1\\("QAIAPD9waHAgABEkY29sb3Ig',
        '\\A\\s*<\\?php[ ]+system\\s*\\(\\s*[\'"]pwd[\'"]\\s*\$\\s*(?:\\?>)?\\s*\\Z',
        'phpversion\\s*\$\\s*\$\\s*;\\s*@?mail\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*@?mail\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*header\\s*\$\\s*[\'"]Location:[^\'"]{1,40}[\'"]\\s*\$\\s*;\\s*\\?>',
        '\\A\\s*<\\?php\\s*\\$\\w{1,40}\\s*=\\s*[\'"]find\\s[^;]{1,99}<head[\'"]{1,3};\\s*\\$\\w{1,40}\\s*=\\s*[\'"]<script\\s+src\\s*=\\s*[\'"]https?://[^\\?]{1,40}\\.js\\?',
        '<title>\\s*To0?olz\\s+\\d+\\s*-\\s*Cyb3r-dz',
        '\\$emailusr\\s*\\.?=\\s*[\'"][^@]{1,40}@protonmail\\.com[\'"]\\s*;\\s*\\{?\\s*@?mail\$[^\\;]{1,200}\$\\s*;\\s*\\}?\\s*\\s*header\\s*\$\\s*[\'"]Location\\s*:[^\$]{1,100}\\);\\s*(?:exit\$\$;)?\\?>',
        'mail\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*[\'"][^\'"]{0,40}[\'"]\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*print\\s*[\'"]OK(?:\\s*By\\s*King)?<br>[\'"]\\s*;\\s*flush\\s*\$\\s*\$\\s*;',
        '<title>\\s*Mailer\\s+By\\s+ME',
        '\\$(email|user|username|login)\\s*=\\s*\\$_POST\\[[\'"](email|user|username|login)[\'"]\\];\\s*\\$((?:\\1)?(?:pass|password|passwd))\\s*=\\s\\$_POST\\[[\'"]\\3[\'"]\\];\\s*\\$ip\\s*=\\s*(?:getenv\$|\\$_SERVER\\[)[\'"]REMOTE_ADDR[\'"](?:\$|\\]);\\s*\\$message\\s*=\\s*[\'"][^\\$]{0,250}facebook',
        '<title>\\s*[^\\w\\s]{0,3}\\s*T\\.C\\.T\\s*[^\\w\\s]{0,3}\\s*</',
        '\\#\\#\\s+\\w{1,40}\\s+(Priv8|Private)\\s+Webshell',
        '\\A\\s*<\\?php\\s*/\\*[^\\*]{0,99}Mini\\s+Shell\\.?\\s+(?:@\\s+c[o0]ded\\s+)?by\\s+:\\s+shutdown57',
        '(\\$\\w{1,40})\\s*=\\s*file_get_contents\\s*\$\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)\\w{1,40}[\'"]\\s*\$;\\s*[^\\}]{1,100}\\s*fwrite\$\\s*\\$\\w{1,4}\\s*,\\s*\\1\\s*\$;',
        '\\#\\s*Jakarta-Blackhat\\s*Hacker(?:`|\'|")s',
        'if\\s*\$\\s*!\\s*empty\\(\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?(?:\\w{1,40})[\'"]?\\]\\s*\$\\s*\\)\\s*include(?:_once)?\\s*\$\\s*\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\[[\'"]?(?:\\w{1,40})[\'"]?\\]\\s*\$;\\s*(\\$\\w{1,40})\\s*=\\s*getcwd\$\$;\\s*if\\s*\$\\s*strpos\\(\\s*\\1',
        '<\\?php\\s+\\$GLOBALS\\[[\'"]\\w{1,40}[\'"]\\]=Array\\([\'"][^\$]{200,600}[\'"]\\);function\\s*\\w{1,40}\$\\$\\w{1,40}\$\\{\\$\\w{1,40}=Array\$(?:[\'"][^\'"]{1,40}[\'"]\\s*,){0,5}\\s*[\'"]https?://stoligowo\\.ru/',
        ';@\\$fun\\(\\s*str_rot13\\(',
        '\\}\\s*Wordpress\\s*\\$\\w{1,40}\\s*=\\s*fopen\\([\'"]4O4\\.php[\'"],[\'"](a|w)\\+?[\'"]\$;',
        'if\\s*\$\\s*isset\\s*\\(\\s*@?\\$_GET\\[[^\\]]{1,40}\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*DirFilesR\\s*\$\\s*@?\\$_SERVER\\[[\'"]DOCUMENT_ROOT[\'"]]\\s*\$\\s*;',
        '\\A\\s*<\\?(?:php)?\\s*@?eval\\s*\$\\s*base64_decode\\s*\\(\\s*["\']ZXJyb3JfcmVwb3J0aW5nKDApOw0KJHNoX2[^\'"]{60000,}[\'"]\$\\);\\s*\\?>\\Z',
        '(\\$headers)\\s*\\.?=\\s*\\$_POST\\[[\'"]\\$ip[\'"]\\]\\.?[\'"]?\\\\n[\'"];\\s*mail\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\1\\s*\$\\s*;\\s*header\\s*\$\\s*[\'"]Location:[^\'"]{1,40}[\'"]\\s*\$\\s*;\\s*\\?>',
        '\\A\\s*<\\?php\\s*error_reporting\$\\d\$;[^\\?]{300,600}</form>[\'"];\\s*if\$\\$_POST\\[[\'"]?[^\'"]{1,40}[\'"]?]\\s*[^\\w]{1,2}=\\s*"home"\\s*\$\\s*\\{\\s*if\\s*\$\\s*@?copy\\(\\$_FILES\\[[\'"]?[^\'"]{1,40}[\'"]?\\][^\\?]{40,200}\\s*else\\s*\\{\\s*[^\\}]{1,40}\\s*\\}\\s*\\}\\s*exit;\\s*\\}\\s*\\?>\\s*\\Z',
        '\\$\\w{1,40}\\(\$;\\s*\\}\\s*\\}\\s*\\?>\\s*<html>\\s*<head><title>404\\s+Not\\s+Found',
        'implode\$".r.n",array\\("%1html%3","%1head%3",head\\(\$,"%2head%3","%1body%3',
        '<\\?php\\s+\\$Class_WP_Index\\s*=\\s*"',
        '<title>\\s*Bypass\\s*Root\\s*Path\\s*by\\s*Mauritania\\s*Attacker',
        '\\A\\s*<\\?(?:php)?\\s+[^\\{]{1,400}\\s*class\\s+pBot\\s*\\{\\s*var\\s*\\$',
        '<br>\\s*(?:\\[info\\])?\\s*Gaza\\s+HaCKeR\\s+Team\\s*<',
        ',\\s*[\'"]index\\.html\\.bak\\.bak[^\\?]{1,600}\\$is_(?:wp|wordpress)\\s*=\\s*(?:false|0);\\s*\\$is_(?:jm|joomla)\\s*=\\s*(?:false|0);',
        'DOCUMENT_ROOT[\'"]\\]\\s*\\.\\s*[\'"][^\'"]{1,40}[\'"]\\s*;\\s*(\\$\\w{1,40})\\s*=\\s*\\w{1,40}\\s*\$\\s*[\'"]https?://pastebin\\.com/(?:raw|download)(?:\\.php\\?i=|/)[^\'"]{1,40}[\'"]\\s*[^\'"]{1,40}[\'"](a|w)\\+?[\'"]\$\\s*;\\s*fwrite\\s*\$\\s*\\$\\w{1,40}\\s*,\\s*\\1\\s*\$\\s*;',
        '<TITLE>\\s*cgi-shell\\.py',
        '\\A\\s*<\\?php\\s*if\\s*\$\\s*\\!\\s*class_exists\\s*\\([^@]{250,600}const\\s*\\w{1,40}\\s*=\\s*[\'"][ ]{200,}\\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\\s*\\(\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[[^\\]]{1,40}\\]\\s*\$\\s*;\\s*[\'"]\\s*;',
        'my\\s*%\\w{1,9}\\s*=\\s*\$\$;\\s*my\\s*(\\$\\w{1,40})\\s*=\\s*[\'"]/etc/passwd[\'"];\\s*open\\s*\$\\s*PASSWD,\\s*[\'"]\\s*<\\s*\\1',
        '<title>\\s*Small\\s*Web\\s*Shell\\s*by',
        '\$\\s*,\\s*array\$\\s*\\$resf,\\s*\\$ltime,\\s*\\$delp\\s*\$,\\s*base64_decode\\s*\$\\s*[\'"][^\'"]{1000,5000}[\'"]\\s*\$\\s*\\);\\s*file_put_contents\\s*\$',
        '<title>\\s*Ani\\s*-\\s*Shell',
        ';\\s*[\\#]{5,200}\\s*\\$SUBJECT\\s*=\\s*[\'"]\\s*\\((AMAZON|ADOBE|AZURE)\$\\s*\$(BILLING|LOGIN)\$\\s*\$\\s*\\$IP\\s*\$\\s*\$\\s*\\$COUNTRYNAME\\s*\$\\s*[\'"]\\s*;',
        '<title>\\s*Katrina\\s+v\\d+\\.\\d+\\s*-\\s*Welcome\\s*Master',
        'if\\s*\$\\s*\\$params\\s*[^\\w]{1,2}=\\s*false\\s*\\|\\|\\s*substr\\(\\$_SERVER\\[[\'"]HTTP_USER_AGENT[\'"]\\],\\s*\\d+,\\s*\\d+\$\\s*[^\\w]{1,2}=\\s*[\'"]Spark[\'"]\\)\\s*\\{\\s*header\$[\'"]Status:\\s*404\\s*Not\\s*Found[\'"]\$;[^`]{2000,2500}botid\\s*=',
        '<title>\\s*Handanovix\\s*X_Shell\\s*GTA',
        '<title>\\s*C99\\s*(?:mad)?\\s*shell',
        '<title>\\s*Security007\\s+webshell',
        '\\}\\s*function\\s*comshelL\$\\s*(\\$\\w{1,40})\\s*,\\s*(\\$\\w{1,40})\\s*\$\\s*\\{\\s*(\\$\\w{1,40})\\s*=\\s*\\2->exec\\s*\$\\s*"cmd\\.exe\\s+/?\\w?\\s*\\1"\$;\\s*(\\$\\w{1,40})\\s*=\\s*\\3->StdOut\$\$;\\s*return\\s*\\4->ReadAll\$\$;\\s*\\}\\s*function',
        '\\A\\s*<\\?php\\s*\\$\\w{1,40}\\s*=\\s*[^;]{1,40};\\s*\\$\\w{1,40}\\s*=\\s*[\'"]?\\$?_SERVER[\'"]?;[^\\}]{1,200}\\}\\s*\\}\\s*(\\$\\w{1,40})\\s*=\\s*[\'"]curl_init[\'"]\\s*;\\s*[^{]+if\\s*\$\\s*is_callable\\(\\1\$\\s*\\)',
        '<title>\\s*AnonymousFox',
        '\\}\\s*else\\s*\\{\\s*if\\s*\$\\$_POST\\[[\'"]?[^\'"]{1,40}[\'"]?\\]\$\\s*\\{\\s*@?eval\$\\$_POST\\[[\'"][^\'"]{1,40}[\'"]\\]\$;\\s*\\}\\s*\\}\\s*\\}\\s*\\}\\s*add_filter\$\\s*[\'"]init[\'"],\\s*[\'"]wp_is_plugin_load[\'"]\$;\\s*\\}\\s*add_action\$\\s*[\'"]init[\'"],\\s*array\\(\\s*[\'"]Akismet[\'"],',
        '<title>\\s*EgY_SpIdEr\\s+ShElL',
        '\\A\\s*<\\?php\\s+if\\s*\\(\\s*isset\\s*\\(\\s*\\$_(?:GET|POST|SERVER|REQUEST)\\[[\'"]?[^\'"]{1,40}[\'"]?\\]\\s*\$\\s*\\)\\s*\\{\\s*[^;]{20,60};\\s*(\\$\\w{1,40})\\s*=\\s*(\\$_SERVER)\\[[\'"]HTTP_HOST[\'"]\\];\\s*(\\$inj)\\s*=\\s*\\2\\[[\'"]REQUEST_URI[\'"]\\];\\s*\\$\\w{1,40}\\s*=\\s*rawurldecode\$\\1\\.\\3\$;\\s*\\$\\w{1,40}\\s*=\\s*@?mail\\s*\$',
        '\\A\\s*<\\?php\\s+(\\$\\w{1,40})\\s*=\\s*[\'"].{100,200};\\s*\\$GLOBALS\\[[\'"][^\'"]{1,40}[\'"]\\]\\s*=\\s*\\1.{6000,8000}\\s*\\$GLOBALS\\[[\'"][^\'"]{1,40}[\'"]\\]\\(\\1,\\s*\\$GLOBALS\\[[\'"][^\'"]{1,40}[\'"]\\]\\(\\1,\\s*\\$\\w{1,40}\\[\\$\\w{1,40}\\]\$\\);\\s*\\?>',
        '<title>\\s*Sim\\s*Shell\\s*-?\\s*Simorgh',
        '\\$\\w{1,40}\\[\\w{1,40}\\]\\s*=\\s*[\'"][^\'"]{1,40}[\'"];(\\s*(system|shell_exec|exec|popen|passthru)\\s*\$\$\\s*;){3,5}',
        '\\};@?eval\$\\$[O0]{4,24}\\([\'"]QHNldF90aW1lX2xpbWl0KDM2MDApOw0KQGlnbm9yZV91c2VyX2Fib3',
        '(\\$message)\\s*=\\s*[\'"][^\'"]{0,40}OFFICE\\s+365\\s+[^\'"]{0,40}[\'"];\\s*[^\\?]{1,400}\\s*\\1\\s*\\.?=\\s*[\'"](Password|pwd|pass)',
        '\\A\\s*<\\?php\\s*\\$\\w{0,9}_pass\\s*=\\s*[\'"]\\w{20,40}[\'"]\\s*;(?:\\s*\\$\\w{1,40}\\s*=\\s*\\s*[\'"][^\'"]{1,40}[\'"]\\s*;)\\s*\\$\\w{0,9}title\\s*=\\s*[\'"]\\s*b374k',
        '\\]\\(""\\s*,\\s*@\\$_COOKIE\\[',
        '\\A\\s*(<\\?php\\s+)function\\s+\\w{1,40}\\(\\s*\\$\\w{1,40}\\s*\$\\s*\\{\\s*[^/]{200,300};\\s*@?eval\\s*\$\\s*\\$\\w{1,40}\\s*\\.\\s*[\'"]fZDdbtQwEIVfZS6q2pESlC3lZ4Ny1QYK6qp[^\$]{500,600}\\);\\s*/\\*[^\\*]{20,48}\\*/',
        '(,\\s*[\'"]\\^[^\'"]+[\'"]\\s*,\\s*){1,}["\']\\^[^\'"]+["\']\\s*,\\s*"[^"]*"\\s*\\)\\s*;\\s*if\\s*\$\\s*in_array\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*[\'"][^\'"]+[\'"]\\s*\\]\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*\\)\\s*\\{\\s*header\\s*\$\\s*\'HTTP/1\\.0 404 Not Found\'\\s*\$\\s*;\\s*exit\\s*\$\\s*\$\\s*;\\s*\\}\\s*else\\s*\\{\\s*foreach\\s*\$\\s*\\$\\w{1,40}\\s*as\\s*\\$\\w{1,40}\\s*\$\\s*\\{',
        '\\$g___g_\\s*=\\s*\\$',
        '\\)\\s*eval\$gzuncompress\\(base64_decode\\(\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[',
        '<title>\\s*\\[?Mister\\]?\\s*\\[?Spy\\]?\\s*Masse\\s*-\\s*S3ND3R',
        '(\\$message)\\s*\\.=\\s*[\'"][^\'"]{1,40}Office365[^;]{1,40}[\'"];\\s*\\1\\s*\\.?=\\s*[\'"]Email\\s*:\\s*[^;]{1,40}[\'"];\\s*\\1\\s*\\.?=\\s*[\'"](Password|Pass|Pwd)\\s*:[^;]{1,40}[\'"];\\s*[^`]{1,600}\\$send',
        '<title>\\s*[^\\<]{0,19}\\s*r57c99\\.com',
        'if\\s*\\(\\s*\\$_POST\\s*\\[\\s*[\'"]phoneNumber[\'"]\\s*\\]\\s*!=[\'"]\\s*[\'"]\\s*\\|\\|\\s*\\$_POST\\s*\\[\\s*[\'"]recEmail[\'"]\\s*\\]\\s*!=[\'"]\\s*[\'"]\\s*\$\\s*\\{\\s*\\$\\w{1,40}\\s*=\\s*mail\\s*\$\\s*[^\$]{1,40}\\s*\\$message\\s*,\\s*\\$headers\\s*\\)\\s*;',
        '(\\$\\w{1,40})\\s*=\\s*array\\s*\$\\s*(\\$\\w{1,40})\\s*,\\s*\\$ip\\s*\$\\s*;\\s*foreach\\s*\$\\s*\\1\\s*as\\s*\\2\\s*\$\\s*mail\\s*\$\\s*\\2\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*,\\s*\\$\\w{1,40}\\s*\$\\s*;\\s*\\$\\w{1,40}\\s*=\\s*fopen\\s*\$\\s*[\'"][^\'"]{1,40}[\'"]\\s*,\\s*[\'"](?:a|w)\\+?[\'"]\\s*\$\\s*;',
        '\\?>\\s*<\\?(?:php)?\\s*eval\$base64_decode\\([\'"][^\'"]{1000,3000}[\'"]\$\\);\\s*\\?>\\s*</title>',
        '\\$ip\\s*=\\s*(?:getenv\$|\\$_SERVER\\[)[\'"]REMOTE_ADDR[\'"](?:\$|\\]);\\s*.{0,600}\\s*(\\$(?:message|spam|bilsmg))\\s*\\.?=\\s*[\'"][\\[\\]<>\\!\\*\\&\\s\\:\\|+\\.=_\\w]{10,90}\\\\n[\'"]\\s*;(?:\\s*\\1\\s*\\.?=\\s*[\'"]\\s*(?!(Subscr|news))[^\\n]{1,60}([\'"]?\\\\n[\'"]|[\'"]/[\'"]);){1,12}\\s*\\1\\s*\\.?=\\s*[\'"][\\[\\]<>\\!\\*\\&\\-\\s\\:\\|+\\.=_\\w]{10,90}\\\\n[\'"]\\s*;',
        'else\\{print "preg_fail";\\}\\}else\\{print "preg_empty"',
        '(\\$\\w+)=\'base64_decode\';(\\$\\w+)=\'create_function\';if\$!empty\\(\\$_REQUEST\\[\'(\\w+)\'\\]\$\\){(\\$\\w+)=strrev\$\\$_REQUEST\\[\'\\3\'\\]\$;(\\$\\w+)=\\2\$\'\',\\1\\(\\4\$\\);\\5\$\$;}',
        '\\$_\\w{1,40}\\s*=\\s*basename\\s*\$\\s*trim\\s*\\(\\s*preg_replace\\s*\\(\\s*rawurldecode\\s*\\(\\s*"[^"]{1,200}"\\s*\$\\s*,\\s*\'\'\\s*,\\s*__FILE__\\s*\\)\\s*\\)\\s*\\)\\s*;',
        'base64_decode\$\'ZXJyb3JfcmVwb3J0aW5n\'\$,base64_decode\$\'Y3Vyb',
        '(\\$\\w+)=scandir\\(\\$_SERVER\\[\'DOCUMENT_ROOT\'\\]\$;for\$(\\$\\w+)=0;\\2<count\\(\\1\$;\\2\\+\\+\\){if\$stristr\\(\\1\\[\\2\\],\'php\'\$\\){(\\$\\w+)=filemtime\$\\$_SERVER\\[\'DOCUMENT_ROOT\'\\]\\."/"\\.\\1\\[\\2\\]\$;break;}}touch\$dirname\\(__FILE__\$,\\3\\);touch\$\\$_SERVER\\[\'SCRIPT_FILENAME\'\\],\\3\$;.*?(\\$\\w+)=new ZipArchive\$\$.*?\\4->extractTo\$\\$\\w+\$;.*?<form enctype="multipart/form-data" method="post" action=""><label><input class="\\w+" type="file" name="\\w+" /></label><br /><input type="submit" name="submit" class="\\w+" value="\\w+" /></form></body></html>',
        '(\\$\\w+)=\'preg_replace\';(\\$\\w+)=\'eval\$base64_decode\\("[^"]+"\$\\);.*?;(\\$\\w+)="/(\\w+)/e";\\1\$\\3,\\2,\'\\4\'\$;',
        '\\);\\$\\w+=\\$\\w+\$\'\',\\$\\w+\\(\\$\\w+\\("\\w+","",\\$\\w+\\.\\$\\w+\\.\\$\\w+\\.\\$\\w+\$\\)\\);\\$\\w+\$\$;',
        '(\\$\\w+)="assert";\\1\$[\'|"]eval\\(gzuncompress\\(base64_decode\\([\'|"][^\'|^"]+\'\$\\)\\);[\'|"]\\);exit;',
        '<\\?php\\s*goto\\s*\\w{1,40};\\w{1,40}.{24000,28000}goto\\s*\\w{1,40};\\w{1,40}:\\$\\w{1,40}\$\\$\\w{1,40}\\(\\$\\w{1,40}\\(\\$\\w{1,40}\\(\\$\\w{1,40}\$\\)\\)\\);\\?>',
        '\\]\\[\\d+\\]\$\\$_\\d+\$;include\$"\\{\\$_\\d+\\}\\w{1,40}\\.php"\$;\\$GLOBALS\\[\'_',
        '<\\?php\\s*if\\s*\$\\s*isset\\s*\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*(eval|assert)\\s*\$\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\$\\s*;\\s*exit\\s*;\\s*\\}\\s*\\?>',
        'if\\s*\$\\s*isset\\s*\\(\\s*\\$\\s*\\{\\s*["\'][^\'"]*["\']\\s*\\}\\s*\\[\\s*[\'"][^"\']*[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*=["\'][^"\']*["\']\\s*;\\s*\\$\\w{1,40}\\s*\$\\s*\'[^\']*\'\\s*,\\s*\\$\\s*\\{\\s*["\'][^"\']*["\']\\s*\\}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*,\\s*[\'"][^\']*[\'"]\\s*\$\\s*;\\s*exit\\s*;\\s*\\}',
        'if\$isset\\((\\$_(?:GET|POST|REQUEST|COOKIE)\\[\'\\w{1,40}\'\\])\$\\)\\{eval\$\\1\$;exit;\\}',
        'extract\$\\$_(?:GET|POST|REQUEST|COOKIE)\$&&\\$shall\$stripslashes\\(\\$\\w{1,40}\$\\s*\\)&&exit;',
        '<\\?php\\s*if\\s*\$\\s*!function_exists\\s*\\(\\s*\'(_[^\']*)\'\\s*\$\\s*\\)\\s*\\{\\s*\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*=\\s*Array\\s*\$\\s*\'[^\']*\'\\s*\$\\s*;\\s*.+?\\$\\w{1,40}\\s*\\[\\s*\'[^\']*\'\\s*\\]\\s*\\[\\s*\\d+\\s*\\]\\s*\$\\s*\\1\\s*\\(\\s*\\d+\\s*\$\\s*,\\s*\\$_(GET|POST|COOKIE|REQUEST)\\s*\\[\\s*\\1\\s*\$\\s*\\d+\\s*\$\\s*\\]\\s*,\\s*\\1\\s*\$\\s*\\d+\\s*\$\\s*\\)\\s*;\\s*exit\\s*;\\s*\\}\\s*\\}',
        '(\\$\\w{1,20}(\\[[\'"].[\'"]\\])?\\s*\\.\\s*){10,20}',
        '\\$\\s*(?:\\{[^{}]+\\}\\s*)+\$[^()]*\\$\\s*\\{',
        'array_filter\\(\\s*(/\\*.+?\\*/)?\\s*@{0,}array\\(\\s*(/\\*.+?\\*/)?@{0,}\\${"_(GET|POST|COOKIE|REQUEST|SERVER)',
        '\\$\\w+\\s*=\\s*\\$\\w+\\s*\\(\\s*\\$\\w+\\s*,\\s*\\$\\w+\\s*,\\s*\'\'\\s*\$;',
        '(\\$\\w+\\s*=\\s*([\'"]\\w*[\'"]|\\d+);\\s*){2,}\\$\\w+\\s*=\\s*array\\s*\$(["\'][a-zA-Z0-9/+=_]{2,}["\']\\s*(,\\s*)?){10,}?',
        '\\${\\s*\\w+\\s*\\(\\s*["\':][^\':"]+["\']\$\\s*}\\s*\$\\w+\\s*\\(',
        'if\\s*\\(\\s*file_put_contents\\s*\\(\\s*__FILE__\\s*,\\s*base64_decode\\(\\s*\\$_(GET|POST|COOKIE|SERVER|REQUEST)\\[\\s*[\'"]\\w+[\'"]\\s*\\]\\s*\$\\s*\\)\\s*\\)\\s*echo\\s*\'OK\';',
        '<iframe src="https?://[^"]+"\\s*frameborder="0%?"\\s*width="0%?"\\s*height="0%?"',
        '(\\$\\w{1,20}\\s*=\\s*(("[^"]+"|\'[^\']+\'|\\w{1,20})\\s*\\.?\\s*)+(\\^|\\&|\\|)\\s*(("[^"]+"|\'[^\']+\'|\\w{1,20})\\s*\\.?\\s*)+;\\s*){5,}',
        '\\b((pics|hot|online)|(cumshot|blowjob|uncensored|viagra|cialis|levitra|tramadol|nude|celebrity|porno?|gay|teens?|squirt|sexiest|sex|fuck|tits?|lesbian)\\b[\\s\\-]+){2,}',
        'new\\s*CoinHive\\.Anonymous',
        '<title>\\s*Navicat\\s*HTTP\\s*Tunnel\\s*Tester\\s*</title>',
        'default_action\\s*=\\s*\\\\[\'"]FilesMan',
        'default_action\\s*=\\s*[\'"]FilesMan',
        'IO::Socket::INET->new\$Proto\\s*=>\\s*"tcp"\\s*,\\s*LocalPort\\s*=>\\s*36000\\s*,\\s*Listen\\s*=>\\s*SOMAXCONN',
        '\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[\\s*[\'"]{0,1}p2[\'"]{0,1}\\s*\\]\\s*==\\s*[\'"]{0,1}chmod[\'"]{0,1}',
        'Captain\\s+Crunch\\s+Team',
        'by\\s+Grinay',
        'hacked\\s+by\\s+Hmei7',
        'system\\s+file\\s+do\\s+not\\s+delete',
        '\\$info \\.= \\(\\(\\$perms\\s*&\\s*0x0040\$\\s*\\?\$\\(\\$perms\\s*&\\s*0x0800\$\\s*\\?\\s*\\\\[\'"]s\\\\[\'"]\\s*:\\s*\\\\[\'"]x\\\\[\'"]\\s*\\)\\s*:\$\\(\\$perms\\s*&\\s*0x0800\$\\s*\\?\\s*\'S\'\\s*:\\s*\'-\'\\s*\\)',
        'WSOsetcookie\\s*\$\\s*md5\\s*\\(\\s*@?\\$_SERVER\\[\\s*\\\\[\'"]HTTP_HOST\\\\[\'"]\\s*\\]\\s*\$',
        'WSOsetcookie\\s*\$\\s*md5\\s*\\(\\s*@?\\$_SERVER\\[\\s*[\'"]HTTP_HOST[\'"]\\s*\\]\\s*\$',
        'wsoEx\\s*\$\\s*\\\\[\'"]\\s*tar\\s*cfzv\\s*\\\\[\'"]\\s*\\.\\s*escapeshellarg\\s*\\(\\s*\\$_POST\\[\\s*\\\\[\'"]p2\\\\[\'"]\\s*\\]\\s*\$',
        'eval\\s*\$?\\s*base64_decode\\s*\\(?\\s*@?\\$_',
        'filepath\\s*=\\s*@?realpath\\s*\\(\\s*\\$_POST\\s*\\[\\s*\\\\[\'"]filepath\\\\[\'"]\\s*\\]\\s*\$',
        'filepath\\s*=\\s*@?realpath\\s*\$\\s*\\$_POST\\s*\\[\\s*[\'"]filepath[\'"]\\s*\\]\\s*\$',
        'rename\\s*\$\\s*\\s*[\'"]{0,1}wso\\.php[\'"]{0,1}\\s*,',
        '\\$MessageSubject\\s*=\\s*base64_decode\\s*\\(\\s*\\$_POST\\s*\\[\\s*[\'"]{0,1}msgsubject[\'"]{0,1}\\s*\\]\\s*\$',
        'SELECT\\s+1\\s+FROM\\s+mysql\\.user\\s+WHERE\\s+concat\$\\s*`user`\\s*,\\s*\'@\'\\s*,\\s*`host`\\s*\$',
        'passthru\\s*\$?\\s*getenv\\s*\\(?\\s*[\'"]HTTP_ACCEPT_LANGUAGE',
        'passthru\\s*\\(?\\s*getenv\\s*\\(?\\s*\\\\[\'"]HTTP_ACCEPT_LANGUAGE',
        '{\\s*\\$\\s*{\\s*passthru\\s*\\(?\\s*\\$cmd\\s*\$\\s*}\\s*}\\s*<br>',
        'runcommand\\s*\$\\s*[\'"]shellhelp[\'"]\\s*,\\s*[\'"](GET|POST|SERVER|COOKIE|REQUEST|FILES)[\'"]',
        'ncftpput\\s*-u\\s*\\$ftp_user_name',
        '\\$login\\s*=\\s*@?posix_getuid\\(?\\s*\$?',
        '!@?\\$_REQUEST\\s*\\[\\s*[\'"]c99sh_surl[\'"]\\s*\\]\\s*\\)',
        'setcookie\$?\\s*[\'"]mysql_web_admin_username[\'"]\\s*\$?',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\$[\'"]\\$cmd\\s+1>\\s*/tmp/cmdtemp\\s+2>&1;\\s*cat\\s+/tmp/cmdtemp;\\s*rm\\s+/tmp/cmdtemp[\'"]\$;',
        '\\$fe\$[\'"]\\$cmd\\s+2>&1[\'"]\$',
        '\\$function\\s*\$?\\s*@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\s*\\[\\s*[\'"]{0,1}cmd[\'"]{0,1}\\s*\\]\\s*\$?',
        '\\$cmd\\s*=\\s*\$\\s*@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\s*\\[\\s*[\'"]{0,1}.+?[\'"]{0,1}\\s*\\]\\s*\$',
        'eva1[a-zA-Z0-9_]+Sir',
        '\\$ini\\s*\\[\\s*[\'"]{0,1}users[\'"]{0,1}\\s*\\]\\s*=\\s*array\\s*\$\\s*[\'"]{0,1}root[\'"]{0,1}\\s*=>',
        'proc_open\\s*\\(\\s*[\'"]{0,1}IHSteam',
        '[\'"]{0,1}httpd\\.conf[\'"]{0,1}\\s*,\\s*[\'"]{0,1}vhosts\\.conf[\'"]{0,1}\\s*,\\s*[\'"]{0,1}cfg\\.php[\'"]{0,1}\\s*,\\s*[\'"]{0,1}config\\.php[\'"]{0,1}',
        '\\s*{\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\s*\\[\\s*[\'"]{0,1}root[\'"]{0,1}\\s*\\]\\s*}',
        'preg_replace\\s*\\(?\\s*[\'"]{0,1}/\\.\\*/e[\'"]{0,1}',
        'eval\\s*\\(?\\s*file_get_contents\\s*\\(?',
        '@?setcookie\\s*\\(?\\s*[\'"]{0,1}hit[\'"]{0,1},\\s*1\\s*,\\s*time\\s*\\(?\\s*\$?\\s*\\+',
        'eval\\s*\$?@?\\s*stripslashes\\s*\\(?\\s*@?\\$_',
        'eval\\s*\\(?@?\\s*stripslashes\\s*\\(?\\s*array_pop\\s*\\(?\\s*@?\\$_',
        'fopen\\s*\\(?\\s*[\'"]{0,1}/etc/passwd[\'"]{0,1}',
        '\\$GLOBALS\\[[\'"]{0,1}____',
        'is_callable\\s*\\(?\\s*[\'"]{0,1}\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)[\'"]{0,1}\$?\\s+and\\s+!in_array\\s*\$?\\s*[\'"]{0,1}\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)[\'"]{0,1}\\s*,\\s*\\$disablefuncs',
        'file_get_contents\\s*\\(?\\s*trim\\s*\\(\\s*\\$.+?\\[\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]{0,1}.+?[\'"]{0,1}\\]\\]\$\\);',
        'wp_posts\\s+WHERE\\s+post_type\\s*=\\s*[\'"]{0,1}post[\'"]{0,1}\\s+AND\\s+post_status\\s*=\\s*[\'"]{0,1}publish[\'"]{0,1}\\s+ORDER\\s+BY\\s+`ID`\\s+DESC',
        'exec\\s*\$\\s*[\'"]ipfw',
        'strrev\\(?\\s*[\'"]{0,1}tressa[\'"]{0,1}\\s*\$?',
        'strrev\$?\\s*[\'"]{0,1}edoced_46esab[\'"]{0,1}\\s*\$?',
        'function\\s+urlGetContents\\s*\$?\\s*\\$url\\s*,\\s*\\$timeout\\s*=\\s*\\d+\\s*\$',
        'fwrite\\s*\$?\\s*\\$fpsetv\\s*,\\s*getenv\\s*\\(\\s*[\'"]HTTP_COOKIE[\'"]\\s*\$\\s*',
        'isset\\s*\$?\\s*\\$_POST\\s*\\[\\s*[\'"]{0,1}execgate[\'"]{0,1}\\s*\\]\\s*\$?',
        'UNION\\s+SELECT\\s+[\'"]{0,1}0[\'"]{0,1}\\s*,\\s*[\'"]{0,1}<\\? system\$\\\\\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[cpc\\]\$;exit;\\s*\\?>[\'"]{0,1}\\s*,\\s*0\\s*,0\\s*,\\s*0\\s*,\\s*0\\s+INTO\\s+OUTFILE\\s+[\'"]{0,1}\\$[\'"]{0,1}',
        '\\$GLOBALS\\[[\'"]{0,1}.+?[\'"]{0,1}\\]=Array\\s*\$\\s*base64_decode\\s*\\(\\s*[\'"]{0,1}.+?[\'"]{0,1}\\s*\$\\s*,\\s*base64_decode\\s*\$\\s*[\'"]{0,1}.+?[\'"]{0,1}\\s*\$',
        'preg_replace\\s*\$?\\s*[\'"]{0,1}/\\.\\*\\[.+?\\]\\?/e[\'"]{0,1}\\s*,\\s*str_replace',
        '\\$GLOBALS\\[\\s*[\'"]{0,1}.+?[\'"]{0,1}\\s*\\]\\[\\s*\\d+\\s*\\]\\(\\s*\\$_\\d+\\s*,\\s*_\\d+\\s*\\(\\s*\\d+\\s*\$\\s*\\)\\s*\\)',
        '\\$beecode\\s*=@?file_get_contents\\s*\$?[\'"]{0,1}\\s*\\$urlpurs\\s*[\'"]{0,1}\$?\\s*;\\s*echo\\s+[\'"]{0,1}\\$beecode[\'"]{0,1}',
        '\\$x\\d+\\s*=\\s*[\'"].+?[\'"]\\s*;\\s*\\$x\\d+\\s*=\\s*[\'"].+?[\'"]\\s*;\\s*\\$x\\d+\\s*=\\s*[\'"]',
        '<\\?php\\s+\\$_F\\s*=\\s*__FILE__\\s*;\\s*\\$_X\\s*=',
        'if\\s+\$?\\s*mail\\s*\\(\\s*\\$recp\\s*,\\s*\\$subj\\s*,\\s*\\$stunt\\s*,\\s*\\$frm',
        'if\\s+\\(\\s*strpos\\s*\\(\\s*\\$url\\s*,\\s*[\'"]js/mootools\\.js[\'"]\\s*\$\\s*===\\s*false\\s+&&\\s+strpos\\s*\$\\s*\\$url\\s*,\\s*[\'"]js/caption\\.js[\'"]{0,1}',
        'eval\\s*\\(?\\s*stripslashes\\s*\\(?\\s*array_pop\\(?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        'if\\s*\\(?\\s*isset\\s*\\(?\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\s*\\[\\s*[\'"]{0,1}\\w+[\'"]{0,1}\\s*\\]\\s*\$?\\s*\\)\\s*{\\s*\\$\\w+\\s*=\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\s*\\[\\s*[\'"]{0,1}\\w+[\'"]{0,1}\\s*\\];\\s*eval\\s*\$?\\s*\\$\\w+\\s*\$?',
        'preg_replace\\s*\$\\s*[\'"]/\\^\\(www\\|ftp\$\\\\\\./i[\'"]\\s*,\\s*[\'"][\'"],\\s*@\\$_SERVER\\s*\\[\\s*[\'"]{0,1}HTTP_HOST[\'"]{0,1}\\s*\\]\\s*\\)',
        'if\\s*\$!function_exists\\s*\\(\\s*[\'"]posix_getpwuid[\'"]\\s*\$\\s*&&\\s*!in_array\\s*\$\\s*[\'"]posix_getpwuid',
        '=\\s*preg_split\\s*\\(\\s*[\'"]/\\\\,\\(\\\\ \\+\$\\?/[\'"],\\s*@?ini_get\\s*\$\\s*[\'"]disable_functions',
        '\\$b\\s*\\.\\s*\\$p\\s*\\.\\s*\\$h\\s*\\.\\s*\\$k\\s*\\.\\s*\\$v',
        '\\(\\s*[\'"]INSHELL[\'"]\\s*',
        '(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\s*\\[\\s*[\'"]___[\'"]\\s*',
        'array_pop\\s*\\(?\\s*\\$workReplace\\s*,\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\s*,\\s*\\$countKeysNew',
        'if\\s*\\(?\\s*@?preg_match\\s*\\(?\\s*str',
        '@\\$_COOKIE\\[[\'"]{0,1}statCounter[\'"]{0,1}\\]',
        'fopen\\s*\\(?\\s*[\'"]http://[\'"]\\s*\\.\\s*\\$check_domain\\s*\\.\\s*[\'"]:80[\'"]\\s*\\.\\s*\\$check_doc\\s*,\\s*[\'"]r[\'"]',
        '@?gzinflate\\s*\\(\\s*@?base64_decode\\s*\\(\\s*@?str_replace',
        'file_put_contentz\\s*\\(?\\s*\\$',
        '&&\\s*function_exists\\s*\\(?\\s*[\'"]{0,1}getmxrr[\'"]{0,1}\$\\s*\\)\\s*{\\s*@getmxrr\\s*\$?\\s*\\$',
        '\\$postResult\\s*=\\s*curl_exec\\s*\\(?\\s*\\$ch',
        'function\\s+sql2_safe\\s*\\(',
        'exit\\s*\\(\\s*[\'"]{0,1}<script>\\s*setTimeout\\s*\\(\\s*\\\\[\'"]{0,1}document\\.location\\.href',
        'eval\\(\\s*stripslashes\\(\\s*\\\\\\$_REQUEST',
        '!touch\\([\'"]{0,1}\\.\\./\\.\\./language/',
        'Dc0RHa[\'"]',
        'header\\s*\\([\'"]Location:\\s*[\'"]\\s*\\.\\s*\\$to\\s*\\.\\s*urldecode',
        'if\\s*\\(\\s*stripos\\s*\\(\\s*\\$_SERVER\\[[\'"]{0,1}HTTP_USER_AGENT[\'"]{0,1}\\]\\s*,\\s*[\'"]{0,1}Android[\'"]{0,1}\$\\s*!==false\\s*&&\\s*!\\$_COOKIE\\[[\'"]{0,1}dle_user_id',
        'echo\\s+@file_get_contents\\s*\$\\s*\\$get',
        'default_action\\s*=\\s*[\'"]{0,1}FilesMan[\'"]{0,1}',
        'Mysterious\\s+Wire',
        'preg_replace\\s*\\(?\\s*[\'"]/\\.\\+/esi',
        'define\\s*\\(?\\s*[\'"]SBCID_REQUEST_FILE[\'"]\\s*,',
        '\\$tld\\s*=\\s*array\\s*\\(\\s*[\'"]com[\'"],[\'"]org[\'"],[\'"]net[\'"]',
        'Brazil\\s+HackTeam',
        'if\\(!empty\\(\\$_FILES\\[[\'"]{0,1}message[\'"]{0,1}\\]\\[[\'"]{0,1}name[\'"]{0,1}\\]\$\\s+AND\\s+\$md5\\(\\$_POST\\[[\'"]{0,1}nick[\'"]{0,1}\\]\$\\s*==\\s*[\'"]{0,1}',
        'time\$\$\\s*\\+\\s*10000\\s*,\\s*[\'"]/[\'"]\\);\\s*echo\\s+\\$m_zz;\\s*eval\\s*\$\\$m_zz',
        'return\\s*\\(\\s*strstr\\s*\\(\\s*\\$s\\s*,\\s*\'echo\'\\s*\$\\s*==\\s*false\\s*\\?\\s*\$\\s*strstr\\s*\\(\\s*\\$s\\s*,\\s*\'print\'',
        'set_time_limit\\s*\\(\\s*0\\s*\$;\\s*if\\s*\$!SecretPageHandler::checkKey',
        '@header\\([\'"]Location:\\s*[\'"]\\.[\'"]h[\'"]\\.[\'"]t[\'"]\\.[\'"]t[\'"]\\.[\'"]p[\'"]',
        'IrSecTeam',
        '\\$rBuffLen\\s*=\\s*ord\\s*\\(\\s*VC_Decrypt\\s*\\(\\s*fread\\s*\\(\\s*\\$input,\\s*1\\s*\$\\s*\\)\\s*\\)\\s*\\*\\s*256',
        'clearstatcache\$\\s*\$;\\s*if\\s*\$\\s*!is_dir\\s*\\(\\s*\\$fld\\s*\$\\s*\\)\\s*return',
        'content=[\'"]{0,1}no-cache[\'"]{0,1};\\s*\\$config\\[[\'"]{0,1}description[\'"]{0,1}\\]\\s*\\.=\\s*[\'"]{0,1}',
        'tmhapbzcerff',
        'file_get_contents\\s*\$?\\s*ADMIN_REDIR_URL\\s*,\\s*false\\s*,\\s*\\$ctx\\s*\$',
        'if\\s*\$\\s*\\$i\\s*<\\s*\\(\\s*count\\s*\\(\\s*\\$_POST\\[\\s*[\'"]{0,1}q[\'"]{0,1}\\s*\\]\\s*\$\\s*-\\s*1',
        'isset\\s*\$\\s*\\$_FILES\\[\\s*[\'"]{0,1}x[\'"]{0,1}\\s*\\]\\s*\$\\s*\\?\\s*\$\\s*is_uploaded_file\\s*\\(\\s*\\$_FILES\\[\\s*[\'"]{0,1}x[\'"]{0,1}\\s*\\]\\[\\s*[\'"]{0,1}tmp_name[\'"]{0,1}\\s*\\]\\s*\$\\s*\\?\\s*\$\\s*copy\\s*\\(\\s*\\$_FILES\\[\\s*[\'"]{0,1}x[\'"]{0,1}\\s*\\]',
        '\\$URL\\s*=\\s*\\$urls\\[\\s*rand\\(\\s*0\\s*,\\s*count\\s*\\(\\s*\\$urls\\s*\$\\s*-\\s*1\\s*\\)\\s*\\]',
        '@?move_uploaded_file\\s*\$\\s*\\$_FILES\\[\\s*[\'"]{0,1}message[\'"]{0,1}\\s*\\]\\[\\s*[\'"]{0,1}tmp_name[\'"]{0,1}\\s*\\]\\s*,\\s*\\$security_code\\s*\\.\\s*"/"\\s*\\.\\s*\\$_FILES\\[[\'"]{0,1}message[\'"]{0,1}\\]\\[[\'"]{0,1}name[\'"]{0,1}\\]\$',
        'eval\\s*\$?\\s*strrev\\s*\\(?\\s*str_replace',
        '\\$res=mysql_query\\([\'"]{0,1}SELECT\\s+\\*\\s+FROM\\s+`watchdog_old_05`\\s+WHERE\\s+page',
        '\\^downloads/\\(\\[0-9\\]\\*\$/\$\\[0-9\\]\\*\$/\\$\\s+downloads\\.php\\?c=\\$1&p=\\$2',
        'preg_replace\\s*\$\\s*\\$exif\\[\\s*\\\\[\'"]Make\\\\[\'"]\\s*\\]\\s*,\\s*\\$exif\\[\\s*\\\\[\'"]Model\\\\[\'"]\\s*\\]',
        'fclose\\(\\$f\$;\\s*echo\\s*[\'"]o\\.k\\.[\'"]',
        'function\\s+inject\$\\$file,\\s*\\$injection=',
        'execl\\([\'"]/bin/sh[\'"]\\s*,\\s*[\'"]/bin/sh[\'"]\\s*,\\s*[\'"]-i[\'"]\\s*,\\s*0\$',
        'find\\s+/\\s+-type\\s+f\\s+-perm\\s+-04000\\s+-ls',
        'if\\s*\$\\s*function_exists\\s*\\(\\s*\'pcntl_fork',
        'urlencode\\(print_r\\(array\\(\$,1\\)\\),5,1\\)\\.c\\),\\$c\\);}eval\$\\$d\$',
        'array_key_exists\\s*\$\\s*\\$fileRas\\s*,\\s*\\$fileType\$\\s*\\?\\s*\\$fileType\\[\\s*\\$fileRas\\s*\\]',
        'if\\s*\$\\s*fwrite\\s*\\(\\s*\\$handle\\s*,\\s*file_get_contents\\s*\\(\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        'if\\s*\\(\\s*\\$_POST\\[\\s*[\'"]{0,1}path[\'"]{0,1}\\s*\\]\\s*==\\s*[\'"]{0,1}[\'"]{0,1}\\s*\$\\s*{\\s*\\$uploadfile\\s*=\\s*\\$_FILES\\[\\s*[\'"]{0,1}file[\'"]{0,1}\\s*\\]\\[\\s*[\'"]{0,1}name[\'"]{0,1}\\s*\\]',
        'if\\s*\$\\s*\\$dataSize\\s*<\\s*BOTCRYPT_MAX_SIZE\\s*\$\\s*rc4\\s*\$\\s*\\$data,\\s*\\$cryptkey',
        ',\\s*array\\s*\\(\'\\.\',\'\\.\\.\',\'Thumbs\\.db\'\$\\s*\\)\\s*\\)\\s*{\\s*continue;\\s*}\\s*if\\s*\$\\s*is_file',
        '\$\\s*\\.\\s*substr\\s*\$\\s*md5\\s*\\(\\s*strrev\\s*\\(\\s*\\$',
        'assert\\s*\\(\\s*@?stripslashes',
        '[\'"]e/\\*\\./[\'"]',
        'echo[\'"]{0,1}<center><b>Done\\s*==>\\s*\\$userfile_name',
        'if\\s*\\(\\$key\\s*!=\\s*[\'"]{0,1}mail_to[\'"]{0,1}\\s*&&\\s*\\$key\\s*!=\\s*[\'"]{0,1}smtp_server[\'"]{0,1}\\s*&&\\s*\\$key\\s*!=\\s*[\'"]{0,1}smtp_port',
        'strpos\\(\\$ua,\\s*[\'"]{0,1}yandexbot[\'"]{0,1}\$\\s*!==\\s*false',
        'if\$CheckIPOperator\\(\$\\s*&&\\s*!isModem\$\$\\)',
        'url=<\\?php\\s*echo\\s*\\$rand_url;\\?>',
        'echo\\s*[\'"]answer=error[\'"]',
        '\\$post\\s*=\\s*[\'"]\\\\x77\\\\x67\\\\x65',
        'if\\s*\$detect_mobile_device\\(\$\\)\\s*{\\s*header',
        'IrIsT\\.Ir',
        '\\$letter\\s*=\\s*str_replace\\s*\$\\s*\\$ARRAY\\[0\\]\\[\\$j\\]\\s*,\\s*\\$arr\\[\\$ind\\]\\s*,\\s*\\$letter',
        'create_function\\s*\\(\\s*[\'"]\\$m[\'"]\\s*,\\s*[\'"]if\\s*\\(\\s*\\$m\\s*\\[\\s*0x01\\s*\\]\\s*==\\s*[\'"]L[\'"]',
        '\\$p\\s*=\\s*strpos\\(\\$tx\\s*,\\s*[\'"]{0,1}{\\#[\'"]{0,1}\\s*,\\s*\\$p2\\s*\\+\\s*2\$',
        '\\$user_agent\\s*=\\s*preg_replace\\s*\$\\s*[\'"]\\|User\\\\\\.Agent\\\\:\\[\\\\s \\]\\?\\|i[\'"]\\s*,\\s*[\'"][\'"]\\s*,\\s*\\$user_agent',
        'print\\("\\#\\s+info\\s+OK\\\\n\\\\n"\$',
        '\\]\\s*}\\s*=\\s*trim\\s*\$\\s*array_pop\\s*\\(\\s*\\${\\s*\\${',
        '\\]=[\'"]{0,1}ip[\'"]{0,1}\\s*;\\s*if\\s*\\(\\s*isset\\s*\\(\\s*\\$_SERVER\\[',
        'print\\s*\\$sock "PRIVMSG "\\.\\$owner',
        'if\\(/\\^\\\\:\\$owner!\\.\\*\\\\@\\.\\*PRIVMSG\\.\\*:\\.msgflood\\(\\.\\*\$/\\){',
        '\\[-\\]\\s+Connection\\s+faild',
        '',
        '[\'"]{0,1}From:\\s*[\'"]{0,1}\\.\\$_POST\\[[\'"]{0,1}realname[\'"]{0,1}\\]\\.[\'"]{0,1} [\'"]{0,1}\\.[\'"]{0,1} <[\'"]{0,1}\\.\\$_POST\\[[\'"]{0,1}from[\'"]{0,1}\\]\\.[\'"]{0,1}>\\\\n[\'"]{0,1}',
        'if\\s*\$\\s*is_dir\\s*\\(\\s*\\$FullPath\\s*\$\\s*\\)\\s*AllDir\\s*\$\\s*\\$FullPath\\s*,\\s*\\$Files\\s*\$;\\s*}\\s*}',
        '\\$p\\s*=\\s*strpos\\s*\$\\s*\\$tx\\s*,\\s*[\'"]{0,1}{\\#[\'"]{0,1}\\s*,\\s*\\$p2\\s*\\+\\s*2\$',
        'preg_match_all\$[\'"]{0,1}/<a href="\\\\/url\\\\\\?q=\\(\\.\\+\\?\$\\[&\\|"\\]\\+/is[\'"]{0,1}, \\$page\\[[\'"]{0,1}exe[\'"]{0,1}\\], \\$links\\)',
        '\\$url\\s*=\\s*\\$url\\s*\\.\\s*[\'"]{0,1}\\?[\'"]{0,1}\\s*\\.\\s*http_build_query\$\\$query\$',
        'print\\s+\\$sock\\s+[\'"]{0,1}NICK [\'"]{0,1}\\s+\\.\\s+\\$nick\\s+\\.\\s+[\'"]{0,1}\\\\n[\'"]{0,1}',
        'PRIVMSG\\.\\*:\\.owner\\\\s\\+\$\\.\\*\$',
        '\\$resultFUL\\s*=\\s*stripcslashes\\s*\$\\s*\\$_POST\\[[\'"]{0,1}resultFUL[\'"]{0,1}',
        '\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\\(\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\\s*\$',
        'if\\s*\$\\s*@?md5\\s*\\(\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[',
        'echo\\s+file_get_contents\\s*\\(\\s*base64_url_decode\\s*\\(\\s*@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        'fwrite\\s*\\(\\s*\\$fh\\s*,\\s*stripslashes\\s*\\(\\s*@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[',
        'if\\s*\\(\\s*mail\\s*\\(\\s*\\$mails\\[\\$i\\]\\s*,\\s*\\$tema\\s*,\\s*base64_encode\\s*\\(\\s*\\$text',
        '\\$gzip\\s*=\\s*@?gzinflate\\s*\\(\\s*@?substr\\s*\\(\\s*\\$gzencode_arg',
        'move_uploaded_file\\(\\$_FILES\\[[\'"]{0,1}elif[\'"]{0,1}\\]\\[[\'"]{0,1}tmp_name',
        'header\\([\'"]{0,1}s:\\s*[\'"]{0,1}\\s*\\.\\s*php_uname\\s*\\(\\s*[\'"]{0,1}n[\'"]{0,1}\\s*\$',
        'By\\s+WebRooT',
        '\\$OOO0O0O00=__FILE__;\\s*\\$OO00O0000\\s*=\\s*0x1b540;\\s*eval',
        '\\$mailer\\s*=\\s*\\$_POST\\[[\'"]{0,1}x_mailer[\'"]{0,1}\\]',
        'preg_match\$[\'"]/\\(yandex\\|google\\|bot\$/i[\'"],\\s*getenv\$[\'"]HTTP_USER_AGENT',
        'echo\\s+\\$ifupload=[\'"]{0,1}\\s*ItsOk\\s*[\'"]{0,1}',
        'fsockopen\\s*\\(\\s*\\$ConnectAddress\\s*,\\s*25',
        '\\$_SESSION\\[[\'"]{0,1}session_pin[\'"]{0,1}\\]\\s*=\\s*[\'"]{0,1}\\$PIN',
        '\\$url[\'"]{0,1}\\s*\\.\\s*\\$session_id\\s*\\.\\s*[\'"]{0,1}/login\\.html',
        'f\\s*=\\s*\\$q\\s*\\.\\s*\\$a\\s*\\.\\s*\\$b\\s*\\.\\s*\\$x',
        'if\\s*\\(md5\\(trim\\(\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[',
        'die\\s*\\(\\s*PHP_OS\\s*\\.\\s*chr\\s*\\(',
        'create_function\\s*\\([\'"][\'"]\\s*,\\s*\\b(eval|base64_decode|strrev|preg_replace|preg_replace_callback|urldecode|strstr|gzinflate|sprintf|gzuncompress|assert|str_rot13|md5|array_walk|array_filter)',
        '\\$headers\\s*=\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]{0,1}headers[\'"]{0,1}\\]',
        'file_put_contents\\s*\\([\'"]{0,1}1\\.txt[\'"]{0,1}\\s*,\\s*print_r\\s*\\(\\s*\\$_POST\\s*,\\s*true',
        'fwrite\\s*\\(\\s*\\$flw\\s*,\\s*\\$fl\\s*\$',
        '\\$sys_params\\s*=\\s*@?file_get_contents',
        '\\$allemails\\s*=\\s*@split\$"\\\\n"\\s*,\\s*\\$emaillist\$',
        'file_put_contents\$SVC_SELF\\s*\\.\\s*[\'"]/\\.htaccess',
        'create_function\\([\'"][\'"],\\s*\\$opt\\[1\\]\\s*\\.\\s*\\$opt\\[4\\]',
        '<script\\s+type=[\'"]{0,1}text/javascript[\'"]{0,1}\\s+src=[\'"]{0,1}jquery-u\\.js[\'"]{0,1}></script>',
        'URL=<\\?echo\\s+\\$index;\\s+\\?>',
        '\\#\\s*securityspace\\.com',
        '\\#\\s*stealth\\s*bot',
        'Apple\\s+SpAm\\s+ReZulT',
        'is_writable\\(\\$dir\\.[\'"]wp-includes/version\\.php[\'"]',
        'if\\(empty\\(\\$_COOKIE\\[[\'"]x[\'"]\\]\$\\){echo',
        '\\)\\];}if\$isset\\(\\$_SERVER\\[_',
        'if\\(@\\$vars\\(get_magic_quotes_gpc\\(\$\\s*\\?\\s*stripslashes\$\\$uri\$',
        'base[\'"]{0,1}\\.\$\\d+\\s*\\*\\s*\\d+\$',
        '\\$param\\s*=\\s*\\$param\\s*x\\s*\\$n\\.substr\\s*\$\\$param\\s*,\\s*length\\(\\$param\$',
        'register_shutdown_function\$\\s*[\'"]{0,1}read_ans_code',
        'base64_decode\\(\\$_POST\\[[\'"]{0,1}_-',
        'if\\(isset\\(\\$_POST\\[[\'"]{0,1}msgsubject[\'"]{0,1}\\]\$\\)',
        'mail\$\\$arr\\[[\'"]{0,1}to[\'"]{0,1}\\],\\$arr\\[[\'"]{0,1}subj[\'"]{0,1}\\],\\$arr\\[[\'"]{0,1}msg[\'"]{0,1}\\],\\$arr\\[[\'"]{0,1}head[\'"]{0,1}\\]\$;',
        'file_get_contents\$trim\\(\\$f\\[\\$_GET\\[',
        'ini_get\\([\'"]{0,1}filter\\.default_flags[\'"]{0,1}\$\\){foreach',
        'chunk_split\$base64_encode\\(fread\\(\\${\\${[\'"]{0,1}',
        '\\$str=[\'"]{0,1}<h1>403\\s+Forbidden</h1><\\?php\\s*@ob_start\$\$;@ini_set',
        'if\$isset\\(\\$_GET\\[php\\]\$\\)\\s*{\\$function',
        '\\$s\$"~\\[discuz\\]~e",\\$_POST',
        'PlgSystemXcalendarHelper::getInstance\\(\$',
        'is_dir_empty\$\\$_POST\\[[\'"]directory[\'"]\\]\$\\)\\s*{\\s*echo\\s+1;',
        'if\$isset\\(\\$_POST\\[[\'"]__bscode',
        'base64_encode\\(clean_url\\(\\$_SERVER',
        '\\$_GET\\[[\'"]mod[\'"]\\]==[\'"]0XX',
        '\\$folder\\.[\'"]/please_rename_UNZIPFIRST\\.zip',
        '@\\$strings\\(str_rot13\\(\'riny\\(onfr64_qrpbqr',
        '\\$pager\\s*=\\s*new\\s*ADODB_Pager\\(\$',
        '\\$this->server\\s*=\\s*[\'"]http://[\'"]\\.\\$this->server\\.[\'"]/img/\\?q=',
        'echo\\s*"<center><b>Done\\s*==>\\s*\\$userfile_name',
        'file_get_contents\$\\$[a-zA-Z0-9_]+\$;\\s*[a-zA-Z0-9_]+\$[\'"]https://dl\\.dropboxusercontent\\.com',
        'if\\(file_exists\\(\\$newPath\$\\)\\s*{\\s*echo\\s*"publish success',
        'function\\s+KillMe\$\$\\s*{\\s*unlink\$\\s*MyFileName\\(\$',
        '<\\?php\\s*error_reporting\$E_ERROR\$;\\s*\\$remote_path="http://',
        'echo\\s+php_uname\$\$;\\s*@unlink\$__FILE__\$;',
        '<title><\\?php\\s+echo\\s+\\$shell_title;\\s+\\?></title>',
        'chr\$ord\\(\\$str\\[\\$i\\]\$\\s*\\^\\s*\\$key\\);\\s*eval\$\\$ev\$;',
        '\\$wp__wp=\\$wp__wp\$str_replace',
        '<\\?php\\s*\\$wp__wp=',
        '<\\?php\\s*eval\\([\'"]\\\\x65',
        '@preg_replace\\([\'"]/\\(\\.\\*\$/e[\'"]\\s*,\\s*@\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        '<title>W3Lcome</title>',
        'if\$stristr\\(\\$files\\[\\$i\\],\\s*[\'"]php[\'"]\$\\)\\s*{\\s*\\$time\\s*=\\s*filemtime',
        '\\)\\){\\s*include\$getcwd\\(\$\\.[\'"]/[a-zA-Z0-9_]+\\.php[\'"]\\);\\s*exit;}\\s*\\?>',
        '<title>[\'"]\\.ucfirst\$\\$key\$',
        '<\\?php\\s*/\\*\\s*WSO',
        'function_exists\$"c99_sess_put',
        '3xp1r3\\s*Cyber\\s*Army',
        'file_get_contents\\(~\\s*base64_decode\\(',
        'hexdec\\(substr\\(md5\\(\\$_SERVER\\[[\'"]REQUEST_URI',
        'root_path=substr\\(\\$absolutepath,0,strpos\\(\\$absolutepath,\\$localpath\$\\);include_once',
        '\\$_SERVER\\["REMOTE_ADDR"\\];if\$\\(preg_match\\("/69\\.42\\.',
        '<\\?php\\s*if\\(isset\\(\\$_GET\\[php\\]\$\\)\\s*{',
        '\\)\\){if\$isset\\(\\$_FILES\\[[\'"]im[\'"]\\]\$\\){\\$dim=getcwd\$\$',
        'class\\s+JSYSOPERATION_SetPassword',
        '\\);array_filter\$\\$mcdata\\s*,\\s*base64_decode\\(',
        '<\\?php if\\(\\$message\$ echo "<p>\\$message</p>"; \\?>\\s*<form',
        'touch\$dirname\\(__FILE__\$,\\s*\\$time\\);touch\$\\$_SERVER\\[[\'"]SCRIPT_FILENAME[\'"]\\],',
        '<title>FakeSender',
        '\\$Conf\\s*=\\s*@?file_get_contents\\(\\$pg\\.[\'"]/\\?d=[\'"]\\s*\\.\\s*\\$_SERVER\\[[\'"]HTTP_HOST[\'"]\\]\$;',
        '<\\?\\s*include\$[\'"][\'"]\\.\\$droot\\.[\'"]/bitrix/images/iblock/',
        '\\$file\\[\\$key\\]\\s*=\\s*\\$ex\\[0\\]\\.\\$link\\.[\'"]</body>[\'"]\\.\\$ex\\[1\\];',
        '\\$\\w{1,45}\\[\\$\\w{1,45}\\]=chr\\(ord\\(\\$\\w{1,45}\\[\\$\\w{1,45}\\]\$\\^ord\$\\$\\w{1,45}\\[\\$\\w{1,45}%\\$\\w{1,45}\\]\$\\);return\\s*\\$\\w{1,45};}private static function',
        'if\\s*\$\\s*move_uploaded_file\\(\\s*\\$nazwa_plik\\s*,\\s*\\$uploadfile\$',
        'if\$strstr\\(\\$tempStr,[\'"]//file end',
        'trim\\(\\s*removeBOM\\(\\s*_file_get_contents\\(\\s*API_URL\\s*\$\\s*\\)\\s*\\)',
        '\\$\\w{1,45}\\s*=\\s*str_replace\$\\s*[\'"]\\[t1\\][\'"]\\s*,\\s*[\'"]<.php[\'"]\\s*,\\s*\\$',
        '\\*/\\$\\w{1,45}\\s*=\\s*@\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[\\s*\\w{1,45}\\s*\\];',
        'foreach\\(\\s*\\$RandomNum\\s*as\\s*\\$key\$\\s*{\\s*\\$Keys\\s*\\.=\\s*chr',
        'touch\$\\$extract_path\\s*\\.\\s*\\$stat\\[[\'"]name[\'"]\\]\\s*,\\s*filemtime\\(\\s*\\$archive_path',
        '\\$Conf\\s*=\\s*@file_get_contents\\(\\s*[\'"]http://',
        '\\$zip_status\\s*=\\s*\\$zip->open\\(\\s*[\'"][a-zA-Z0-9_]+\\.zip[\'"]\\s*\$;\\s*if\\s*\$\\s*\\$zip_status\\s*===\\s*true\\s*\$\\s*{\\s*if\\s*\$\\s*\\$zip->setPassword',
        '>config\\s*root\\s*man<',
        '=\\s*create_function\\([\'"][\'"]\\s*,\\s*\\$JSubMenu\\s*\$',
        '\\$arrayRows\\[count\$\\$arrayRows\$\\]\\s*=\\s*\\$email\\.[\'"]::1[\'"];',
        'Post\\.new\$URI\\.encode\\("/\\?q=user/password&name\\[\\#post_render',
        'unserialize\\(\\s*\\$this->getImageDecodedText\\(\\s*file_get_contents',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\\s*\\(?\\s*@?\\$_POST\\s*\\[\\s*[\'"].+?[\'"]\\s*\\]\\s*\\.\\s*"\\s*2\\s*>\\s*&1\\s*[\'"]',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\\s*\\(?\\s*[\'"]uname\\s+-a[\'"]\\s*\$?',
        '@?assert\\s*\$?\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\s*\\[\\s*[\'"]{0,1}.+?[\'"]{0,1}\\s*\\]\\s*',
        'php\\s+[\'"]\\s*\\.\\s*\\$wso_path',
        'find\\s+/\\s+-name\\s+\\.ssh\\s+>\\s+\\$dir/sshkeys/sshkeys',
        'system\\s*\\(?\\s*[\'"]{0,1}whoami[\'"]{0,1}\\s*\$?',
        'curl_setopt\\s*\$\\s*\\$ch\\s*,\\s*CURLOPT_URL\\s*,\\s*[\'"]{0,1}http://\\$host:\\d+[\'"]{0,1}\\s*\$',
        '\\beval\$\\s*\\$\\s*{\\s*\\$[a-zA-Z0-9_]+',
        'if\\(\\s*in_array\\(\\s*\\$_SERVER\\[[\'"]REMOTE_ADDR[\'"]\\]\\s*,\\s*\\$[a-zA-Z0-9_]+\$\\)\\s*\\$[a-zA-Z0-9_]+=\\$[a-zA-Z0-9_]+\\[rand\$0,count\\(\\$[a-zA-Z0-9_]+\$-1\\)\\];',
        'arr2html\$\\$_REQUEST',
        '\\$mdetails\\s*\\.=\\s*[\'"]<!--Deregister\\(\$\\s*Default\\s*Widgets:',
        'wp_remote_retrieve_body\$\\s*wp_remote_get\\(\\s*\\$jquery',
        '@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\\s*\$\\s*\\);\\s*[\'"]\\s*\\);\\s*\\$\\w{1,45}\$\\s*\$',
        'js_infection\\s*=\\s*array_reverse\$\\s*str_split',
        '\\$host\\.[\'"]ui[\'"]\\.[\'"]jquery\\.org/jquery',
        'handle_bot_cmd_shell',
        '{echo\\s*[\'"]200[\'"]\\s*;\\s*exit\\s*;\\s*}',
        'eval\\(\\s*KeyRegistration\\(\\s*KeyGeneration',
        '\\$to\\s*=\\s*base64_decode\\(\\$par\\[1\\]\$;\\s*redirect\$\\$to\$;',
        '\\$pager\\s*=\\s*new\\s*ADODB_Pager\$\$;\\s*\\$pager->render_pagelinks\$\$;',
        'eval\$\\${\\$',
        'password\\s*=\\s*str_replace\\([\'"]%%DOMAIN%%[\'"]\\s*,\\s*\\$first_lvl_domain',
        '\\$_POST\\[gogogo\\]',
        'if\\(file_exists\\(\\$redate_file\$\\){',
        '\\$this->quit\$file_put_contents',
        '\\$data\\s*=\\s*\\$db->{\\s*\\$cmd\\[[\'"]m[\'"]\\]\\s*}\\s*\\(\\s*\$;',
        '\\$ncontent=gethttpcnt\$',
        '\\$testcloack\\s*=\\s*cloack\\(\\$ip\$;',
        '\\$2\\.php\\?rewrite_params=\\$1&page_url=',
        '\\$\\w{1,45}\\s*=\\s*\$\\s*-\\s*\\(\\s*-\\d+\$\\s*\\+\\s*\\d+',
        'return\\s*\\$\\w{1,45}\\s*\\^\\s*str_repeat\\s*\$\\s*\\$\\w{1,45}\\s*,\\s*ceil\\s*\\(\\s*strlen',
        '=[\'"]base64_decode[\'"]\\s*;\\s*return\\s*\\$\\w{1,45}\\s*\\(\\s*\\$\\w{1,45}\\s*\$',
        'class\\s*WapClick',
        '\\b(include|include_once|require|require_once)\\s*[\'"]{0,1}zip:',
        '\\b(include|include_once|require|require_once)\\s*\$\\s*[\'"]{0,1}zip:',
        'file_get_contents\\(SRV_NAME\\s*\\.\\s*[\'"]\\?action=get_sites&noda_name=',
        'Location:\\s*[a-zA-Z0-9_]+\\.document\\.exe',
        'if\\(!preg_match\\([\'"]/Hacked by/i[\'"],\\$',
        'By\\s+Am!r',
        'Content-Type:\\s*\\$_',
        'eval\\s*\\(?\\s*gzinflate\\s*\\(?\\s*str_rot13',
        'if\\s*\\(\\s*is_callable\\s*\\(?\\s*[\'"]{0,1}\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)[\'"]{0,1}\\s*\$?',
        'eval\\s*\$?\\s*get_option\\s*\\(?',
        'add_filter\\s*\\(?\\s*[\'"]{0,1}the_content[\'"]{0,1}\\s*,\\s*[\'"]{0,1}_bloginfo[\'"]{0,1}\\s*,\\s*.+?\$?',
        'is_writable\\s*\$?\\s*[\'"]/var/tmp',
        'symlink\\s*\\(?\\s*[\'"]/home/',
        'isset\\(\\s*@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\$\\s*or\\s*die\$?.+?\$?',
        'gzuncompress\\s*\$?\\s*substr\\s*\\(?\\s*base64_decode',
        '\\$___\\s*=',
        'if\\s*\\(\\s*preg_match\\s*\\(\\s*[\'"]\\#yandex',
        '@setcookie\\([\'"]m[\'"],\\s*[\'"][a-zA-Z0-9_]+[\'"],\\s*time\\(\$\\s*\\+\\s*86400',
        'echo\\s+[\'"]o\\.k\\.[\'"];\\s*\\?>',
        'symbian\\|midp\\|wap\\|phone\\|pocket',
        'function\\s*chmod_R\\s*\$\\s*\\$path\\s*,\\s*\\$perm\\s*',
        'eval\\s*\\(\\s*gzinflate\\s*\\(\\s*str_rot13',
        'eval\\s*\\(\\s*str_rot13',
        'preg_replace\\s*\\(\\s*[\'"]/\\.\\*/',
        '\\$mailer\\s*=\\s*\\$_POST\\[\\s*[\'"]{0,1}x_mailer[\'"]{0,1}\\s*\\]',
        'preg_replace\\s*\\(\\s*@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        'echo\\s+[\'"]{0,1}install_ok[\'"]{0,1}',
        'Spam\\s+completed',
        'array\\(\\s*[\'"]Google[\'"]\\s*,\\s*[\'"]Slurp[\'"]',
        '<h1>403 Forbidden</h1><!-- token',
        '/e[\'"]\\s*,\\s*[\'"]\\\\x',
        'php_[\'"]\\.\\$ext\\.[\'"]\\.dll[\'"]{0,1}',
        'mx2\\.hotmail\\.com',
        'preg_replace\\(\\s*[\'"]e[\'"],[\'"]{0,1}',
        'fopen\\([\'"]{0,1}\\.\\./\\.\\./\\.\\./[\'"]{0,1}\\.\\$filepaths',
        '\\$data\\s*=\\s*array\\([\'"]{0,1}terminal[\'"]{0,1}\\s*=>',
        '\\$b\\s*=\\s*md5_file\\(\\$fileb\$',
        'portlets/framework/security/login',
        '\\$fileb\\s*=\\s*file_get_contents',
        'site_from=[\'"]{0,1}\\.\\$_SERVER\\[[\'"]{0,1}HTTP_HOST[\'"]{0,1}\\]\\.[\'"]{0,1}&site_folder=[\'"]{0,1}\\.\\$f\\[1\\]',
        'while\$count\\(\\$lines\$>\\$col_zap\\) array_pop\$\\$lines\$',
        '\\$string\\s*=\\s*\\$_SESSION\\[[\'"]{0,1}data_a[\'"]{0,1}\\]\\[[\'"]{0,1}nutzername[\'"]{0,1}\\]',
        'if \$!strpos\\(\\$strs\\[0\\],[\'"]{0,1}<\\?php',
        '\\$isevalfunctionavailable',
        'David\\s+Blaine',
        'if \\(date\\([\'"]{0,1}j[\'"]{0,1}\$\\s*-\\s*\\$newsid',
        '<!--\\s+js-tools',
        'if\$@preg_match\\(strtr\\([\'"]{0,1}/',
        '_[\'"]{0,1}\\]\\[2\\]\\([\'"]{0,1}Location:',
        '\\$_POST\\[[\'"]{0,1}smtp_login',
        'if\\s*\\(@is_writable\\(\\$index',
        '@ini_set\\s*\\([\'"]{0,1}include_path[\'"]{0,1},[\'"]{0,1}ini_get\\s*\\([\'"]{0,1}include_path',
        'Zend\\s+Optimization\\s+ver\\s+1\\.0\\.0\\.1',
        '\\$_SESSION\\[[\'"]{0,1}data_a[\'"]{0,1}\\]\\[\\$name\\]\\s*=\\s*\\$value',
        'if\\s*\\(function_exists\\([\'"]scan_directory',
        'array\\(\\s*[\'"]h[\'"]\\s*,\\s*[\'"]t[\'"]\\s*,\\s*[\'"]t[\'"]\\s*,\\s*[\'"]p[\'"]',
        '\\$counterUrl\\s*=\\s*[\'"]{0,1}http://',
        'for\\(\\$[a-zA-Z0-9_]+=\\d+;\\$[a-zA-Z0-9_]+<\\d+;\\$[a-zA-Z0-9_]+-=\\d+\${if\$\\$[a-zA-Z0-9_]+!=\\d+\$\\s*break;}',
        'if\$@function_exists\\([\'"]{0,1}fread',
        '\\$opt\\s*=\\s*\\$file\\(@?\\$_COOKIE\\[',
        'preg_replace\\(\${return\\s+__FUNCTION__',
        'if\\s*\$check_acc\\(\\$login,\\$pass,\\$serv',
        'print\\s+[\'"]{0,1}dle_nulled[\'"]{0,1}',
        'if\\(mail\\(\\$email\\[\\$i\\],\\s*\\$subject,\\s*\\$message,\\s*\\$headers',
        'TeaM\\s+MosTa',
        '[\'"]{0,1}DZe1r',
        'pack\\s+"SnA4x8"',
        '\\$_Post\\[[\'"]{0,1}SSN[\'"]{0,1}\\]',
        'Ethnic\\s+Albanian\\s+Hackers',
        'By\\s+DZ27',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\\([\'"]{0,1}cmd\\.exe',
        'Auto\\s*Xploiter',
        'by\\s+g00n',
        'if\\(\\$o<16\${\\$h\\[\\$e\\[\\$o\\]',
        'if\$is_dir\\(\\$path\\.[\'"]{0,1}/wp-content[\'"]{0,1}\$\\s+AND\\s+is_dir\$\\$path\\.[\'"]{0,1}/wp-admin',
        'if\\s*\\(\\s*file_put_contents\\s*\\(\\s*\\$index_path\\s*,\\s*\\$code',
        '@array\\(\\s*\\(string\$\\s*stripslashes\$\\s*\\$_REQUEST',
        'str_replace\\s*\\(\\s*[\'"]{0,1}/public_html',
        'if\\(\\s*isset\\(\\s*\\$_REQUEST\\[[\'"]{0,1}cid',
        'catatan\\s+situs',
        '/index\\.php\\?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=\\d+',
        'setcookie\\(\\s*\\$z\\[0\\]\\s*,\\s*\\$z\\[1\\]',
        '\\$S\\[\\$i\\+\\+\\]\\(\\$S\\[\\$i\\+\\+\\]\\(',
        '\\[\\$o\\]\$;\\$o\\+\\+\\){if\$\\$o<16\$',
        'typeof\\s*\$dle_admin\$\\s*==\\s*[\'"]{0,1}undefined[\'"]{0,1}\\s*\\|\\|\\s*dle_admin\\s*==',
        'create_function\$substr\\(2,1\$,\\$s\\)',
        'plugins/search/query\\.php\\?____pgfa=http%3A%2F%2Fwww\\.google',
        'return\\s+base64_decode\$\\$a\\[\\$i\\]\$',
        '\\$file\$@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        'curl_init\\(\\s*base64_decode',
        'eval\\([\'"]\\?>[\'"]\\.base64_decode',
        '[\'"][\'"]\\s*\\.\\s*BAse64_deCoDe',
        '[\'"][\'"]\\s*\\.\\s*gzUncoMpreSs',
        'grep\\s+-v\\s+crontab',
        'crc32\\(\\s*\\$_POST\\[\\s*[\'"]{0,1}cmd',
        '\\$bkeyword_bez=[\'"]',
        'file_get_contents\\(basename\\(\\$_SERVER\\[[\'"]{0,1}SCRIPT_NAME',
        '\\s*[\'"]{0,1}rookee[\'"]{0,1}\\s*,\\s*[\'"]{0,1}webeffector',
        '\\s*[\'"]{0,1}slurp[\'"]{0,1}\\s*,\\s*[\'"]{0,1}msnbot',
        'eval\\s*\\(\\s*TPL_FILE',
        '@?array_diff_ukey\\(\\s*@?array\\(\\s*\\(string\$\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        '\\$path\\s*=\\s*\\$_SERVER\\[\\s*[\'"]{0,1}DOCUMENT_ROOT[\'"]{0,1}\\s*\\]\\s*\\.\\s*[\'"]{0,1}/images/stories/[\'"]{0,1}',
        '\\$sape_option\\[\\s*[\'"]{0,1}fetch_remote_type[\'"]{0,1}\\s*\\]\\s*=\\s*[\'"]{0,1}socket[\'"]{0,1}',
        'file_put_contents\$\\s*\\$name\\s*,\\s*base64_decode\\(\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        'ereg_replace\\([\'"]{0,1}%5C%22[\'"]{0,1}\\s*,\\s*[\'"]{0,1}%22[\'"]{0,1}\\s*,\\s*\\$message',
        '\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]{0,1}ur[\'"]{0,1}\\]\$\\)\\s*\\$mode\\s*\\|=\\s*0400',
        '/plugins/search/query\\.php\\?____pgfa=http',
        '@?file_put_contents\$\\s*\\$this->file\\s*,\\s*strrev',
        'preg_match_all\\(\\s*[\'"]\\|\\(\\.\\*\$<\\\\!-- js-tools',
        'header\$[\'"]{0,1}r:\\s*no\\s+com',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\\([\'"]ls\\s+/var/mail',
        '\\$dor_content=preg_replace',
        '__url_get_contents\\(\\$l',
        '\\$GLOBALS\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\\(\\s*NULL',
        'uname\\][\'"]{0,1}\\s*\\.\\s*php_uname\\(\$\\s*\\.\\s*[\'"]{0,1}\\[/uname',
        '@\\$func\\(\\$cfile, \\$cdir\\.\\$cname',
        '\\beval\\(\\s*\\$[a-zA-Z0-9_]+\\(\\s*\\$<amc',
        '\\$_\\[\\s*\\d+\\s*\\]\\(\\s*\\$_\\[\\s*\\d+\\s*\\]\\(\\$_\\[\\s*\\d+\\s*\\]\\(\\s*\\$_\\[\\s*\\d+',
        'eregi\\(\\s*sql_regcase\\(\\s*\\$_',
        '\\#Use[\'"]{0,1}\\s*,\\s*file_get_contents\\(',
        'mkdir\\(\\s*[\'"]/home/',
        'fopen\\(\\s*[\'"]/home/',
        '\\$user_agent_to_filter\\s*=\\s*array\\(',
        'file_put_contents\\([\'"]{0,1}\\./libworker\\.so',
        '\\#!/bin/shncd\\s+[\'"]{0,1}[\'"]{0,1}\\.\\$SCP\\.[\'"]{0,1}[\'"]{0,1}nif',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\\(\\s*[\'"]{0,1}at\\s+now\\s+-f',
        'crontab\\s+-l\\|grep\\s+-v\\s+crontab',
        'David\\s*Blaine',
        'exploit-db\\.com/search/',
        'file_put_contents\$\\s*[\'"]{0,1}/home',
        'mail\\(\\s*\\$MailTo\\s*,\\s*\\$MessageSubject\\s*,\\s*\\$MessageBody',
        '\\$content\\s*=\\s*http_request\\([\'"]{0,1}http://[\'"]{0,1}\\s*\\.\\s*\\$_SERVER\\[[\'"]{0,1}SERVER_NAME[\'"]{0,1}\\]\\.[\'"]{0,1}/',
        '!file_put_contents\\(\\s*\\$dbname\\s*,\\s*\\$this->getImageEncodedText\\(\\s*\\$dbname',
        'scripts\\[\\s*gzuncompress\\(\\s*base64_decode\\(',
        'send_smtp\\(\\s*\\$email\\[[\'"]{0,1}adr[\'"]{0,1}\\]\\s*,\\s*\\$subj\\s*,\\s*\\$text',
        '=\\$file\\(@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        'touch\\(\\s*[\'"]{0,1}\\$basepath/components/com_content',
        '\\([\'"]\\$tmpdir/sess_fc\\.log',
        'file_exists\\(\\s*[\'"]/tmp/tmp-server',
        'mail\\(\\s*\\$retorno\\s*,\\s*\\$asunto\\s*,\\s*\\$mensaje',
        '\\$URL\\s*=\\s*\\$urls\\[\\s*rand\\(\\s*0\\s*,\\s*count\\(\\s*\\$urls\\s*\$\\s*-\\s*1\\)\\s*\\]\\.rand',
        '__file_get_url_contents\$\\s*\\$remote_url',
        '=by\\s+DRAGON=',
        'substr\\(\\s*\\$string2\\s*,\\s*strlen\\(\\s*\\$string2\\s*\$\\s*-\\s*9\\s*,\\s*9\\)\\s*==\\s*[\'"]{0,1}\\[l,r=302\\]',
        '\\[\\]\\s*=\\s*[\'"]RewriteEngine\\s+on',
        'fwrite\$\\s*\\$f\\s*,\\s*get_download\\(\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[',
        'tar\\s+-czf\\s+"\\s*\\.\\s*\\$FORM{tar}\\s*\\.\\s*"\\.tar',
        'scopbin[\'"]',
        '<div\\s+id=[\'"]link1[\'"]><button onclick=[\'"]processTimer\\(\$;[\'"]>',
        '<guid><\\?php\\s+echo\\s+\\$current_url',
        'int32\$\\(\\(\\$z\\s*>>\\s*5\\s*&\\s*0x07ffffff\$\\s*\\^\\s*\\$y\\s*<<\\s*2',
        'fopen\$\\s*\\$root_dir\\s*\\.\\s*[\'"]/\\.htaccess',
        '\\$in_Perms\\s+&\\s+0x4000',
        'file_get_contents\\(\\s*[\'"]/var/tmp',
        '/pmt/rav/',
        'fwrite\\(\\$fp\\s*,\\s*strrev\\(\\s*\\$context\\s*\$\\s*\\)',
        'Masri\\s+Cyber\\s+Team',
        'Us3\\s+Y0ur\\s+br41n',
        'Masr1\\s+Cyb3r\\s+Te4m',
        'tHANKs\\s+tO\\s+Snoppy',
        ',\\s*[\'"]/index\\\\\\.\$php\\|html\$/i[\'"]\\s*,\\s*RecursiveRegexIterator',
        'file_put_contents\$\\s*\\$index_path\\s*,\\s*\\$code',
        'getprotobyname\\(\\s*[\'"]tcp[\'"]\\s*\$\\s+\\|\\|\\s+die\\s+shit',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\$\\s*[\'"]cd\\s+/tmp;wget',
        '<a\\s+href=[\'"]oshibka-',
        'if\\(\\s*\\$_GET\\[\\s*[\'"]id[\'"]\\s*\\]!=\\s*[\'"][\'"]\\s*\$\\s*\\$id=\\$_GET\\[\\s*[\'"]id[\'"]\\s*\\]',
        'if\$[\'"]substr_count\\([\'"]\\$_SERVER\\[[\'"]REQUEST_URI[\'"]\\]\\s*,\\s*[\'"]query\\.php[\'"]',
        '\\$fill = \\$_COOKIE\\[\\\\[\'"]fill\\\\[\'"]\\]',
        '\\$result=smartCopy\\(\\s*\\$source\\s*\\.\\s*[\'"]/[\'"]\\s*\\.\\s*\\$file',
        '\\$bannedIP\\s*=\\s*array\\(\\s*[\'"]\\^66\\.102',
        '<loc><\\?php\\s+echo\\s+\\$current_url;',
        '\\$setcook\$;setcookie\$\\$set',
        '\$;function\\s+string_cpt\\(\\$',
        '[\'"]\\.[\'"][\'"]\\.[\'"][\'"]\\.[\'"][\'"]\\.[\'"][\'"]\\.[\'"]',
        'if\\(preg_match\\([\'"]\\#wordpress_logged_in\\|admin\\|pwd',
        'g_delete_on_exit\\s*=\\s*new\\s+DeleteOnExit',
        'SELECT\\s+\\*\\s+FROM\\s+dor_pages',
        'Academico\\s+Result',
        'value=[\'"]<\\?\\s+\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\$[\'"]',
        '\\d+&@preg_match\\(\\s*strtr\\(',
        'chr\\(\\s*hexdec\\(\\s*substr\\(\\s*\\$makeup',
        'read_file_new_2\\(\\$result_path',
        '\\$index_path\\s*,\\s*0404',
        '\\$file_for_touch\\s*=\\s*\\$_SERVER\\[[\'"]{0,1}DOCUMENT_ROOT[\'"]{0,1}\\]',
        '\\$_SERVER\\[[\'"]{0,1}REMOTE_ADDR[\'"]{0,1}\\];if\\(\\(preg_match\\(',
        '==\\s*[\'"]cshell[\'"]',
        'file_exists\\(\\s*\\$FileBazaTXT',
        'resultsign_warning',
        'function\\s+getfirstshtag',
        'file_get_contents\\(ROOT_DIR\\.[\'"]/templates/[\'"]\\.\\$config\\[[\'"]skin[\'"]\\]\\.[\'"]/main\\.tpl',
        'new\\s+conectBase\\([\'"]aHR',
        '\\$id\\s*\\.\\s*[\'"]\\?d=[\'"]\\s*\\.\\s*base64_encode\\(\\s*\\$_SERVER\\[\\s*[\'"]HTTP_USER_AGENT',
        'do_work\\(\\s*\\$index_file\\s*\$',
        'header\\s*\$\\s*_\\d+\\(',
        'By\\s+WebRooT',
        'Coded\\s+by\\s+EXE',
        'trim\\(\\s*\\$headers\\s*\$\\s*\\)\\s*as\\s*\\$header\\s*\\)\\s*header\$\\s*\\$header',
        '@\\$_SERVER\\[\\s*HTTP_HOST\\s*\\]>[\'"]\\s*\\.\\s*[\'"]\\\\r\\\\n[\'"]',
        'file_get_contents\\(\\s*\\$_SERVER\\[\\s*[\'"]DOCUMENT_ROOT[\'"]\\s*\\]\\s*\\.\\s*[\'"]/engine',
        'touch\\(\\s*\\$_SERVER\\[\\s*[\'"]DOCUMENT_ROOT[\'"]\\s*\\]\\s*\\.\\s*[\'"]/engine',
        'PHPSHELL_VERSION',
        '<\\?\\s*=@`\\$[a-zA-Z0-9_]+`',
        '&_SESSION\\[payload\\]=',
        'gzuncompress\\(\\s*file_get_contents\\(\\s*[\'"]http',
        'if\\(\\s*!empty\\(\\s*\\$_POST\\[\\s*[\'"]{0,1}tp2[\'"]{0,1}\\s*\\]\$\\s*and\\s*isset\$\\s*\\$_POST',
        'if\\(\\s*true\\s*&\\s*@preg_match\\(\\s*strtr\\(\\s*[\'"]/',
        '==\\s*0\$\\s*{\\s*echo\\s*PHP_OS\\s*\\.\\s*\\$',
        'isset\$\\s*\\$_SERVER\\[\\s*_\\d+\\(\\s*\\d+\\s*\$\\s*\\]\\s*\\)\\s*\\?\\s*\\$_SERVER\\[\\s*_\\d+\$\\d+\$\\s*\\]\\s*:\\s*_\\d+\$\\d+\$',
        '\\$index\\s*=\\s*str_replace\$\\s*[\'"]<\\?php\\s*ob_end_flush\\(\$;\\s*\\?>[\'"]\\s*,\\s*[\'"][\'"]\\s*,\\s*\\$index',
        '\\$status_loc_sh\\s*=\\s*file_exists',
        '\\$POST_STR\\s*=\\s*file_get_contents\$"php://input',
        'ge\\s*=\\s*stripslashes\\s*\\(\\s*\\$_POST\\s*\\[[\'"]mes',
        '\\$table\\[\\$string\\[\\$i\\]\\]\\s*\\*\\s*pow\\(64\\s*,\\s*2\$\\s*\\+\\s*\\$table',
        'if\$\\s*stripos\\(\\s*[\'"]\\*\\*\\*\\$ua',
        'flush_end_file\\(\\s*\\$filename\\s*,\\s*\\$filecontent',
        'preg_match\\(\\s*[\'"]{0,1}~Location:\\(\\.\\*\\?\$\$\\?:\\\\n\\|\\$',
        'touch\\(\\s*\\$this->conf->root',
        '\\beval\\(\\s*\\${\\s*\\$[a-zA-Z0-9_]+\\s*}\\[',
        'if\\s*\\(\\s*@filetype\\(\\$leadon\\s*\\.\\s*\\$file',
        'file_put_contents\\(\\s*\\$dir\\s*\\.\\s*\\$file\\s*\\.\\s*[\'"]/index',
        'filesize\\(\\s*\\$put_k_failu',
        'age\\s*=\\s*stripslashes\\s*\\(\\s*\\$_POST\\s*\\[[\'"]{0,1}mes[\'"]\\]',
        'function\\s+findHeaderLine\\s*\\(\\s*\\$template',
        '\\$status_create_glob_file\\s*=\\s*create_file',
        'echo\\s+show_query_form\\(\\s*\\$sqlstring',
        '==\\s*FALSE\\s*\\?\\s*\\d+\\s*:\\s*ip2long',
        'function\\s+mailer_spam',
        'EditHtaccess\\(\\s*[\'"]RewriteEngine',
        '\\$pathToDor',
        '\\$cur_cat_id\\s*=\\s*\\(\\s*isset\\(\\s*\\$_GET',
        '@\\$_COOKIE\\[\\s*[\'"][a-zA-Z0-9_]+[\'"]\\s*\\]\\(\\s*@\\$_COOKIE\\[\\s*[\'"][a-zA-Z0-9_]+[\'"]\\s*\\]\\s*\$\\s*\\)',
        'header\$[\'"]Location:\\s*http://\\$pp\\.org',
        'return\\s+[\'"]/home/[a-zA-Z0-9_]+/[a-zA-Z0-9_]+/',
        '[\'"]wp-[\'"]\\s*\\.\\s*generateRandomString',
        '\\$[a-zA-Z0-9_]+==[\'"]featured[\'"]\\s*\$\\s*\\){\\s*echo\\s+base64_decode',
        '\\$[a-zA-Z0-9_]+\\s*=\\s*\\$jq\\s*\$\\s*@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]',
        'exploit\\s*::\\.</title>',
        '\\$[a-zA-Z0-9_]+=str_replace\\([\'"]\\*a\\$\\*',
        'chr\\(\\s*\\$[a-zA-Z0-9_]+\\s*\$;\\s*}\\s*eval\$\\s*\\$[a-zA-Z0-9_]+',
        'if\\(\\s*isInString1?\\(\\$[a-zA-Z0-9_]+,[\'"]google',
        '\\$pp\\s*=\\s*\\$p\\[\\d+\\]\\s*\\.\\s*\\$p\\[\\d+\\]\\s*\\.\\s*\\$p\\[\\d+\\]\\s*\\.\\s*\\$p\\[\\d+\\]\\s*\\.\\s*\\$p\\[\\d+\\]',
        'file_put_contents\\(DIR\\.[\'"]/[\'"]\\.[\'"]index\\.php',
        '@get_headers\\(\\s*\\$fullpath\$',
        '@\\$_GET\\[[\'"]pw[\'"]\\]',
        'json_encode\$alexusMailer',
        '=[\'"]\$\\);[\'"]\\)\\);',
        '=\\s*\\$[a-zA-Z0-9_]+\$\\b(eval|base64_decode|strrev|preg_replace|preg_replace_callback|urldecode|strstr|gzinflate|sprintf|gzuncompress|assert|str_rot13|md5|array_walk|array_filter)\\(',
        '\\]\\s*}\\s*\\(\\s*{\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[',
        'request\\.servervariables\\(\\s*[\'"]HTTP_USER_AGENT[\'"]\\s*\$\\s*,\\s*[\'"]Googlebot',
        'eval\$[\'"]\\?>[\'"]\\s*\\.\\s*join\\([\'"][\'"],file\\(\\$',
        'setopt\\(\\$ch\\s*,\\s*CURLOPT_POSTFIELDS\\s*,\\s*http_build_query\\(\\$data',
        'mysql_connect\\(\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\\s*,\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        'request\\.servervariables\\([\'"]HTTP_USER_AGENT[\'"]\$,[\'"]aidu[\'"]',
        '\\]\\s*\\)\\s*\\)\\s*{\\s*eval\\s*\$\\s*\\${\\$',
        'by\\s+Error\\s+7rB',
        '@ircservers\\[rand\\s+@ircservers\\]',
        'set_time_limit\\(intval\\(\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        'nick\\s+[\'"]chanserv[\'"];',
        'Magic\\s+Include\\s+Shell',
        '\\$[a-zA-Z0-9_]+\$;\\$[a-zA-Z0-9_]+=create_function\$[\'"][\'"],\\$[a-zA-Z0-9_]+\$;\\$[a-zA-Z0-9_]+\$\$',
        'curlOpen\$\\$remote_path\\.\\$param_value',
        'fwrite\\(\\$fp,[\'"]\\\\xEF\\\\xBB\\\\xBF[\'"]\\.\\$body\$;',
        '\\$[a-zA-Z0-9_]+\\+\\+\\)\\s*{\\s*\\$[a-zA-Z0-9_]+\\s*=\\s*array_unique\$array_merge\\(\\$[a-zA-Z0-9_]+\\s*,\\s*[a-zA-Z0-9_]+\\([\'"]\\$[a-zA-Z0-9_]+',
        'and\\s*\\(!\\s*strstr\\(\\$ua,[\'"]rv:11[\'"]\$\\)',
        'echo\\s+\\$ok\\s+\\?\\s+[\'"]SHELL_OK[\'"]',
        ';eval\$\\$todocontent\\[0\\]\$',
        'or\\s+strtolower\$@ini_get\\([\'"]safe_mode',
        'if\\(!isset\\(\\$_REQUEST\\[chr\\(',
        '\\$processo\\s*=\\s*\\$ps\\[rand\\s+scalar\\s+@ps\\]',
        'echo\\s+[\'"]uname\\s+-a;\\s*\\$uname',
        '\\.tcpflood\\s+<target>',
        '\\$bot\\[[\'"]server[\'"]\\]=\\$servban\\[rand\\(0,count\\(',
        '\\.:\\s+w33d\\s+:\\.',
        'BLACKUNIX\\s+CREW',
        ';\\$[a-zA-Z0-9_]+\\[\\$[a-zA-Z0-9_]+\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\\[\\d+\\]\\.\\$[a-zA-Z0-9_]+\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\\[\\d+\\]\\.\\$',
        'case\\s*[\'"]create_symlink[\'"]:',
        'socket_connect\\(\\$[a-zA-Z0-9_]+,\\s*[\'"]gmail-smtp-in\\.l\\.google\\.com[\'"]\\s*,\\s*25\$\\s*==\\s*FALSE',
        'call_user_func\$@unhex\\(0x[a-zA-Z0-9_]+\$\$\\$_',
        '\\$_=@\\$_REQUEST\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\$\\.@\\$_\$\\$_REQUEST\\[',
        '\\$GLOBALS\\[\\$GLOBALS\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\\[\\d+\\]\\.\\$GLOBALS\\[',
        '\\.\\$[a-zA-Z0-9_]+\\[\\$[a-zA-Z0-9_]+\\]\\.[\'"]{[\'"]\$\\);};unset\$\\$',
        'http_build_query\\(\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\$\\.[\'"]&ip=[\'"]\\s*\\.\\s*\\$_SERVER',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\$\\s*[\'"]/sbin/ifconfig[\'"]',
        '<\\?php\\s+if\\s*\\(isset\\s*\\(\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]images[\'"]\\]\$\\)\\s*{\\$',
        '<title>GORDO\\s+20',
        'copy\$\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\\s*,\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\$',
        'sprintf\$[a-zA-Z0-9_]+\\(\\$[a-zA-Z0-9_]+\\s*,\\s*\\$[a-zA-Z0-9_]+\$\\s*\\)',
        '=\\s*str_replace\$\\s*[\'"]\\|\\|\\|[a-zA-Z0-9_]+\\|\\|\\|[\'"]\\s*,\\s*[\'"][\'"]',
        '\\$[a-zA-Z0-9_]+\\[0\\]=pack\\([\'"]H\\*[\'"],[\'"][a-zA-Z0-9_]+[\'"]\$;array_filter\$\\$[a-zA-Z0-9_]+,pack\\([\'"]H\\*[\'"],[\'"][a-zA-Z0-9_]+[\'"]',
        'eval\\(\\${\\${"',
        '--visitorTracker--',
        '<%--SuExp--%>',
        'str_rot13\\(\\s*[\'"]riny',
        '\\$__a\\s*=\\s*str_replace\\(".",\\s*".",\\s*\\$__.\$;\\s*\\$__.\\s*=\\s*str_replace',
        'echo\\s*exec\$[\'"]whoami[\'"]\$;',
        'file_put_contents\$[\'"][a-zA-Z0-9_]+\\.php[\'"],\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"][a-zA-Z0-9_]+[\'"]\\],FILE_APPEND\$;',
        '\\$dirpath\\.[\'"]/[\'"]\\.\\$value\\.[\'"]/wp-config\\.php[\'"]\\)\\.',
        'array_diff_ukey\$\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[',
        '\\$[a-zA-Z0-9_]+=file_get_contents\\([\'"]http://www\\.ask\\.com/web\\?q=',
        'if\\(!empty\\(\\s*\\$_FILES\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\$\\){copy\$\\$_FILES\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\],\\$_FILES\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\$;}',
        'register_shutdown_function\\s*\$\\s*create_function\\(\\s*@?\\${\\s*[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\s*}\\s*,\\s*@?\\${\\s*[\'"]_(GET|POST|SERVER|COOKIE|REQUEST|FILES)[\'"]\\s*}{\\s*[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\s*}\\s*\$\\s*\\);',
        '@?filter_var\\s*\$@?\\s*\\${[\'"]_(GET|POST|SERVER|COOKIE|REQUEST|FILES)[\'"]}{[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}}\\s*,\\s*FILTER_CALLBACK\\s*,\\s*array\\s*\\(\\s*[\'"][a-zA-Z0-9_]+[\'"]\\s*=>\\s*\\${\\s*[\'"]_(GET|POST|SERVER|COOKIE|REQUEST|FILES)[\'"]\\s*}{\\s*[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\s*}\\s*\$\\s*\\)\\s*;',
        'if\$\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]!=\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\${extract\$\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\$;\\s*usort\$\\$[a-zA-Z0-9_]+,\\$[a-zA-Z0-9_]+\$;}',
        'declare\$\\s*ticks=\\d+\\s*\$\\s*;@?register_tick_function\$\\s*\\${[\'"]_(GET|POST|SERVER|COOKIE|REQUEST|FILES)[\'"]}\\s*{[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}}\\s*,\\${[\'"]{0,1}_(GET|POST|SERVER|COOKIE|REQUEST|FILES)[\'"]{0,1}}\\s*{[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}}\$;',
        'define\$[a-zA-Z0-9_]+\\s*,\\s*\\$_SERVER\\[[a-zA-Z0-9_]+\\]\$;\\s*@?register_shutdown_function\$\\s*create_function\\(\\$[a-zA-Z0-9_]+,[a-zA-Z0-9_]+\$\\s*\\);',
        '\\${[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}}=@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES);@?!\$@?\\${[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}}\\[\\d+\\]&&@?\\${@?[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}}\\[\\d+\\]\$\\?\\${@?[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}}:@?@?\\${[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}}\\[\\d+\\]\$@?\\${[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}}\\[\\d+\\]\$;',
        'setcookie\$[\'"][a-zA-Z0-9_]+[\'"]\\s*,\\s*serialize\\(@?\\$_<GPC>\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\$',
        '</div>\\s*<%--PortScan--%>',
        'GIF89...<\\?php',
        '\\$[a-zA-Z0-9_]+\\s*=\\s*fopen\$[\'"][a-zA-Z0-9_]+\\.php[\'"]\\s*,\\s*[\'"]w\\+?[\'"]\$;\\s*fputs\$\\$[a-zA-Z0-9_]+\\s*,\\s*\\$[a-zA-Z0-9_]+\$;\\s*fclose\$\\$[a-zA-Z0-9_]+\$;\\s*unlink\$__FILE__\$;',
        'CreateJoomCode\$\\$[a-zA-Z0-9_]+\$;',
        'function\\s+CreateWpCode',
        '<br>[\'"]\\.php_uname\$\$\\.[\'"]<br></b>',
        'if\$\\$[a-zA-Z0-9_]+\\s*=\\s*@?strpos\\(\\$[a-zA-Z0-9_]+,"check_meta\\(\$;"\\)\\)',
        'if\$isset\\(\\$_GET\\[[\'"]install[\'"]\\]\$\\){\\s*\\$db->exec\$[\'"]CREATE TABLE IF NOT EXISTS article',
        'arr2html\\(\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]\\w{1,45}[\'"]\\]\$;',
        'function\\s+get_text_fr_serv\$\\s*\\$url_s',
        'function\\s+curl_get_from_webpage_one_time\\(\\s*\\$url',
        '\\$article\\d+\\s*=\\s*explode\\("\\#\\#\\#",\\$str\\d+\$',
        'echo\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]\\w{1,45}[\'"]\\]\\s*.\\s*\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"]\\w{1,45}[\'"]\\]',
        'file_get_contents\$[\'"]http://\\d+\\.\\d+\\.\\d+\\.\\d+/\\w{1,45}\\.php\\?h=',
        'class\\s*LLM_base',
        'fn_dolly_get_filename_from_headers',
        '\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\\s*,\\s*\$\\s*;\\s*array_filter\$\\$\\w{1,45}\\s*,\\s*\\$\\w{1,45}',
        '\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\[[\'"][a-zA-Z0-9_]+[\'"]\\]\\s*\$\\s*;\\s*array_filter\$\\$\\w{1,45}\\s*,\\s*\\$\\w{1,45}',
        'eval\\s*\\([\'"]\\?>[\'"]\\s*\\.\\s*\\$\\w{1,45}\$\\s*;',
        'if\\s*\$!\\s*\\$_POST\\s*\\[[\'"]to[\'"]\\]\\s*&&\\s*!\\s*\\$_GET\\s*\\[[\'"]ch[\'"]\\]\\s*&&\\s*count',
        'google\'\$\\s*!==\\s*false\\s*\\)\\s*\\\\{\\s*header\$\'HTTP/1\\.0\\s*404',
        'call_user_func\\(\\$\\w{1,45},\'\\$code=function',
        'eval\\s*\\(?\\s*@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        'assert\\s*\\(?\\s*@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\\s*\\(?\\s*@?\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\s*\\[',
        '<b>eval\\s*\\(\\s*\\b(eval|base64_decode|strrev|preg_replace|preg_replace_callback|urldecode|strstr|gzinflate|sprintf|gzuncompress|assert|str_rot13|md5|array_walk|array_filter)\\s*\\(',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\\s*\\(?\\s*[\'"]wget',
        '==[\'"]\$\\);return;\\?>',
        'uggc://',
        '\\$[a-zA-Z0-9_]+\\[\\$[a-zA-Z0-9_]+\\]=chr\$\\$[a-zA-Z0-9_]+\\[ord\\(\\$[a-zA-Z0-9_]+\\[\\$[a-zA-Z0-9_]+\\]\$\\]\\);',
        '\\$[a-zA-Z0-9_]+\\[chr\$\\d+\$\\]\$[a-zA-Z0-9_]+\\(',
        '\\$[a-zA-Z0-9_]+\\s*\\(\\s*\\d+\\s*\\^\\s*\\d+\\s*\$\\s*\\.\\s*\\$[a-zA-Z0-9_]+\\s*\$\\s*\\d+\\s*\\^\\s*\\d+\\s*\$\\s*\\.\\s*\\$[a-zA-Z0-9_]+\\s*\$\\s*\\d+\\s*\\^\\s*\\d+\\s*\$',
        '\\b(ftp_exec|system|shell_exec|passthru|popen|proc_open)\$[\'"]{0,1}\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\["',
        '\\$[a-zA-Z0-9_]+=array\\([\'"]\\$[a-zA-Z0-9_]+\\[\\s*\\]=array_pop\\(\\$[a-zA-Z0-9_]+\$;\\$[a-zA-Z0-9_]+',
        '\\$[a-zA-Z0-9_]+=pack\$[\'"]H\\*[\'"],substr\\(\\$[a-zA-Z0-9_]+,\\s*-\\d+\$\\);\\s*return\\s+\\$[a-zA-Z0-9_]+\$substr\\(',
        '\\$[a-zA-Z0-9_]+\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\\[[\'"]{0,1}[a-zA-Z0-9_]+[\'"]{0,1}\\]\\(\\$[a-zA-Z0-9_]+,\\$[a-zA-Z0-9_]+,\\$[a-zA-Z0-9_]+\\[',
        '</form>[\'"];if\\(isset\\(\\$_POST\\[[\'"]\\w{1,45}[\'"]\\]\$\\){if\$is_uploaded_file\\(\\$_FILES\\[[\'"]\\w{1,45}[\'"]\\]\\[[\'"]\\w{1,45}[\'"]\\]\$\\){@copy\$\\$_FILES',
        '\\./host\\s+encrypt\\s+publickey\\.pub\\s+[\'"]/home',
        '\\$res_el\\[[\'"]link[\'"]\\]\\.[\'"]-\\|\\|-good[\'"]',
        '=\\s*explode\\([\'"]_\\|\\|_[\'"],\\$_POST',
        '\\$current\\s*=\\s*file_get_contents\\([\'"]http://.{0,500}?\\$id[\'"]\$;\\s*file_put_contents\$\\$id,\\s*\\$current\$;',
        '\\$domain\\s*=\\s*\\$domains\\[array_rand\$\\$domains,\\s*1\$\\];\\s*\\$url',
        '\\$\\w{1,45}\\s*=\\s*\\$\\w{1,45}\\.[\'"]/api\\.php\\?action=fulltxt&config=[\'"]\\.\\$\\w{1,45}\\.[\'"]&\\w{1,45}=[\'"]\\.\\$\\w{1,45};',
        '\\$_POST\\[[\'"]\\w{1,45}[\'"]\\]\\);@eval',
        'function\\s*rs2html\$&\\$rs,\\$ztabhtml=false,\\$zheaderarray=false',
        'if\\(isset\\(\\$_GET\\[[\'"]p[\'"]\\]\$\\)\\s*{\\s*header\$[\'"]Content-Type:\\s*text/html;charset=windows-1251[\'"]\$;\\s*\\$path=\\$_SERVER\\[[\'"]DOCUMENT_ROOT[\'"]\\]',
        'session_write_close\$\$;\\s*LocalRedirect\$\\$download_dir',
        'GetThisIp\\(\$;\\s*if\$\\$action\\s*==\\s*"fileinfo',
        'if\\s*\\(\\s*s\\.indexOf\\([\'"]google[\'"]\$\\s*>\\s*0\\s*\\|\\|\\s*s\\.indexOf\$[\'"]bing[\'"]\$\\s*>\\s*0\\s*\\|\\|\\s*s\\.indexOf\$[\'"]yahoo[\'"]\$',
        '@chmod\$[\'"]\\.htaccess[\'"],\\d+\$;\\s*@chmod\$[\'"]index\\.php[\'"],\\d+\$;',
        'ping\\s+-c\\s+[\'"]\\s*\\.\\s*\\$ping_count',
        'Antichat\\s+Socks5',
        'function\\s+BridgeEstablish2',
        'function\\s*__obfuscate_redirect',
        '\\$_POST\\[\\s*[\'"]pwd[\'"]\\]=[\'"]Weak\\s+Liver',
        '\\[BITRIX\\]\\s*\\[WordPress\\]\\s*\\[osCommerce\\]\\s*\\[Joomla\\]</h3>',
        '<title>\\s*Kazuya404',
        'if \$@\\$array\\[\\d+\\] == \\d+\$\\s*{\\s*header\\s*\$\\s*[\'"]Location:\\s*\\$url',
        'if\\s*\\(\\s*isset\\(\\s*\\$_POST\\[[\'"]proxy[\'"]\\]\\s*\$\\s*\\)\\s*{\\s*curl_setopt',
        '\\b(include|include_once|require|require_once)\\s*\$\\s*\\$path\\s*\\.\\s*\\$_',
        'die\\(substr\\(md5\\(microtime\\(\$\\)\\s*,',
        'function mkdirr\$\\$pn,\\$mode=null',
        '\\]}\${return self::MOBILE_GRADE_A;}',
        'if\\s*\$\\$_(GET|POST|SERVER|COOKIE|REQUEST|FILES)\\s*\\[\'\\w{1,45}\'\\]\\s*\$\\s*{\\s*echo\\s*"OK";\\s*exit\\s*\$\\s*\$;\\s*}',
        '\\b(eval|base64_decode|strrev|preg_replace|preg_replace_callback|urldecode|strstr|gzinflate|sprintf|gzuncompress|assert|str_rot13|md5|array_walk|array_filter)\$file_get_contents\\([\'"]http://',
        '}\\s*=\\s*file_get_contents\\([\'"]http://',
        'if\\s*\\(\\s*is_mobile\\(\\s*\$\\s*\\)\\s*exit\$[\'"]<script',
        '\\$\\w{1,45}\\s*,\\s*"\\.php\\.suspected"',
        '\\$\\w{1,45}\\s*=\\s*\\$_GET\\["link"\\];\\s*switch\\s*\\(\\$\\w{1,45}\$\\s*{\\s*case\\s*"[a-zA-Z0-9_]+"\\s*:\\s*\\$\\w{1,45}="http',
        'include_once\$urldecode\\(',
        'gethttpcnt\\(\\$url\\s*,\\s*\\$timeout',
        ';eval\\(""\$;if',
        '\\.php";@file_put_contents\$\\$\\w{1,45}\\s*,\\s*\\$\\w{1,45}\$;echo\\s*"http',
        '@preg_replace\$\\$exif\\[[\'"]{0,1}ImageDescription',
        '\\$testcloack\\s*=\\s*cloack\\(\\s*\\$ip\\s*\$',
        'function\\s*get_exec_local',
        'preg_match\\("/\\$engines/"\\s*,\\s*\\$_SERVER',
        'preg_match\\("/\\$spider/"\\s*,\\s*\\$uagent',
        'echo\\s*eval\\s*/\\*\\*/\\s*\\(\'\\?>\'\\s*\\.\\s*join\\(""\\s*,\\s*file',
    ];

/**
     * Get all signatures optimized.
     */
    public static function getAll()
    {
        static $optimized;

if (empty($optimized)) {
            $optimized = self::$regex;
            $raw = self::$raw;
            foreach ($raw as &$pattern) {
                $pattern = preg_quote($pattern, '#');
                $pattern = str_replace([' ', "'", '"'], ['[\s]*', '[\'"]', '[\'"]'], $pattern);
            }
            $optimized = array_merge($optimized, $raw);
            self::optimizeSignatures($optimized);
        }

return $optimized;
    }

/**
     * Optimize signatures.
     *
     * @param $sigs
     */
    public static function optimizeSignatures(&$sigs)
    {
        $sigs = array_unique($sigs);

// Add SigId
        foreach ($sigs as &$s) {
            $s .= '(?<X' . hash('crc32b', $s) . '>)';
        }
        unset($s);

$fix = [
            '([^\?\s])${0,1}\.[\+\*]${0,1}\2[a-z]*e' => '(?J)\.[+*](?<=(?<d>[^\?\s])$..|(?<d>[^\?\s])..)$?\g{d}[a-z]*e',
            'http://.+?/.+?\.php\?a' => 'http://[^?\s]++(?<=\.php)\?a',
            '\s*[\'"]{0,1}.+?[\'"]{0,1}\s*' => '.+?',
            '[\'"]{0,1}.+?[\'"]{0,1}' => '.+?',
        ];

$sigs = str_replace(array_keys($fix), array_values($fix), $sigs);

$fix = [
            '~^\\\\[d]\+&@~' => '&@(?<=\d..)',
            '~^((\[\'"\]|\\\\s|@)(\{0,1\}\.?|[?*]))+~' => '',
        ];

$sigs = preg_replace(array_keys($fix), array_values($fix), $sigs);

self::optimizeSignaturesCheck($sigs);

$tmp = [];
        foreach ($sigs as $i => $s) {
            if (!preg_match('#^(?>(?!\.[*+]|\\\\\d)(?:\\\\.|\[.+?\]|.))+$#', $s)) {
                unset($sigs[$i]);
                $tmp[] = $s;
            }
        }

usort($sigs, 'strcasecmp');
        $txt = implode("\n", $sigs);

for ($i = 24; $i >= 1; ($i > 4) ? $i -= 4 : --$i) {
            $txt = preg_replace_callback('#^((?>(?:\\\\.|\\[.+?\\]|[^(\n]|$(?:\\\\.|[^)(\n])++$)(?:[*?+]\+?|\{\d+(?:,\d*)?\}[+?]?|)){' . $i . ',})[^\n]*+(?:\\n\\1(?![{?*+]).+)+#im', [self::class, 'optimizeSignatureMergePrefixes'], $txt);
        }

$sigs = array_merge(explode("\n", $txt), $tmp);

self::optimizeSignaturesCheck($sigs);
    }

/**
     * Merge signatures prefixes.
     *
     * @param $m
     *
     * @return string
     */
    protected static function optimizeSignatureMergePrefixes($m)
    {
        $limit = 8000;

$prefix = $m[1];
        $prefixLen = strlen($prefix);

$len = $prefixLen;
        $r = [];

$suffixes = [];
        foreach (explode("\n", $m[0]) as $line) {
            if (strlen($line) > $limit) {
                $r[] = $line;
                continue;
            }

$s = substr($line, $prefixLen);
            $len += strlen($s);
            if ($len > $limit) {
                $r[] = count($suffixes) === 1 ? $prefix . $suffixes[0] : $prefix . '(?:' . implode('|', $suffixes) . ')';
                $suffixes = [];
                $len = $prefixLen + strlen($s);
            }
            $suffixes[] = $s;
        }

if (!empty($suffixes)) {
            $r[] = count($suffixes) === 1 ? $prefix . $suffixes[0] : $prefix . '(?:' . implode('|', $suffixes) . ')';
        }

return implode("\n", $r);
    }

/**
     * Checking errors in pattern.
     *
     * @param $signs
     *
     * @return bool
     */
    protected static function optimizeSignaturesCheck(&$signs)
    {
        $result = true;
        foreach ($signs as $k => $sign) {
            if (trim($sign) === '') {
                unset($signs[$k]);
                $result = false;
            }

if (@preg_match('#' . $sign . '#smiS', '') === false) {
                unset($signs[$k]);
                $result = false;
            }
        }

return $result;
    }
}
<?php

namespace AMWScan\Interfaces;

interface VerifierInterface
{
    /**
     * Initialize path.
     *
     * @param $path
     *
     * @return mixed
     */
    public static function init($path);

/**
     * Is verified file.
     *
     * @param $path
     *
     * @return mixed
     */
    public static function isVerified($path);
}
<?php

/**
 * PHP Antimalware Scanner.
 *
 * @author Marco Cesarato <cesarato.developer@gmail.com> * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License
 *
 * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner
 */

namespace AMWScan\Abstracts;

abstract class SingletonAbstract
{
    protected static $instance;

/**
     * Returns the *Singleton* instance of this class.
     *
     * @return self
     */
    public static function getInstance()
    {
        if (static::$instance === null) {
            $static = new static();
        }

return $static;
    }

/**
     * Protected constructor to prevent creating a new instance of the
     * *Singleton* via the `new` operator from outside of this class.
     */
    protected function __construct()
    {
    }

/**
     * Private clone method to prevent cloning of the instance of the
     * *Singleton* instance.
     *
     * @return void
     */
    private function __clone()
    {
    }

/**
     * Private unserialize method to prevent unserializing of the *Singleton*
     * instance.
     *
     * @return void
     */
    public function __wakeup()
    {
    }
}
<?php

namespace AMWScan;

use Phar;

class Path
{
    /**
     * Clean path.
     *
     * @param $path
     *
     * @return string
     */
    public static function get($path)
    {
        $path = trim($path);
        $path = str_replace(['/', '\\'], DIRECTORY_SEPARATOR, $path);

return preg_replace('/' . preg_quote(DIRECTORY_SEPARATOR, '/') . '+/', DIRECTORY_SEPARATOR, $path);
    }

/**
     * Return real current filename.
     *
     * @return string|string[]|null
     */
    public static function getCurrent()
    {
        if (strlen(Phar::running()) > 0) {
            return Phar::running(false);
        }
        $string = pathinfo('index.php');
        $dir = parse_url($string['dirname'] . '/' . $string['basename']);

return realpath($dir['path']);
    }

/**
     * Return real current path.
     *
     * @return string|string[]|null
     */
    public static function getCurrentDir()
    {
        return dirname(self::getCurrent());
    }

/**
     * Get filesize.
     *
     * @param $filePath
     * @param int $dec
     *
     * @return string
     */
    public static function getFilesize($filePath, $dec = 2)
    {
        $bytes = filesize($filePath);
        $size = ['B', 'kB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB'];
        $factor = floor((strlen($bytes) - 1) / 3);

return sprintf("%.{$dec}f", $bytes / pow(1024, $factor)) . ' ' . @$size[$factor];
    }

/**
     * Convert to Bytes.
     *
     * @param string $from
     *
     * @return int|null
     */
    public static function sizeToBytes($from)
    {
        $units = ['B', 'KB', 'MB', 'GB', 'TB', 'PB'];
        $number = substr($from, 0, -2);
        $suffix = strtoupper(substr($from, -2));

if (is_numeric($suffix[0])) {
            return preg_replace('/\D/', '', $from);
        }
        $pow = array_flip($units)[$suffix] ?: null;
        if ($pow === null) {
            return null;
        }

return $number * pow(1024, $pow);
    }
}
<?php

namespace AMWScan;

// Autoload
spl_autoload_register(function ($name) {
    $namespace = __NAMESPACE__ . '\\';
    $classname = trim($name, '\\');
    if (strpos($classname, $namespace) === 0) {
        $file = str_replace(__NAMESPACE__ . '\\', '', $name) . '.php';
        $file = str_replace(['\\', '/'], DIRECTORY_SEPARATOR, $file);
        if (\Phar::running() === '') {
            $file = __DIR__ . '/' . $file;
        }
        require_once $file;
    }
});

// Settings
ini_set('memory_limit', '1G');
ini_set('xdebug.max_nesting_level', 500);
ob_implicit_flush(false);
set_time_limit(-1);

// Errors
error_reporting(0);
ini_set('display_errors', 0);
ini_set('display_startup_errors', 0);

if (Scanner::isCli()) {
    $app = new Scanner();
    $report = $app->run();

// Exit with appropriate code for CI/CD systems
    if (is_object($report) && isset($report->detected) && $report->detected > 0) {
        exit(1); // Malware detected
    }

exit(0); // No issues or scan completed successfully
}
<?php

namespace AMWScan;

/**
 * Class Deobfuscator.
 */
class Deobfuscator
{
    /**
     * Full code.
     *
     * @var string
     */
    private $fullCode = '';

/**
     * Deobfuscate code.
     *
     * @param $str
     *
     * @return bool|mixed|string|string[]|null
     */
    public function deobfuscate($str)
    {
        $str = str_replace([".''", "''.", '.""', '"".'], '', $str);

$this->fullCode = $str;

$type = $this->getObfuscateType($str);
        if (empty($type)) {
            $strDecoded = $this->decode($str);
            $type = $this->getObfuscateType($strDecoded);
            if (!empty($type)) {
                $str = $strDecoded;
            }
        }

if (in_array('globals', $type, true)) {
            $str = $this->deobfuscateBitrix($str);
        }

if (in_array('eval', $type, true)) {
            $str = $this->deobfuscateEval($str);
        }

if (in_array('als', $type, true)) {
            $str = $this->deobfuscateAls($str);
        }

if (in_array('lockit', $type, true)) {
            $str = $this->deobfuscateLockit($str);
        }

if (in_array('fopo', $type, true)) {
            $str = $this->deobfuscateFopo($str);
        }

if (in_array('byterun', $type, true)) {
            $str = $this->deobfuscateByterun($str);
        }

if (in_array('urldecode_globals', $type, true)) {
            $str = $this->deobfuscateUrldecode($str);
        }

return $str;
    }

/**
     * Decode.
     *
     * @param $code
     *
     * @return mixed
     */
    public function decode($code)
    {
        $matchesPhp = CodeMatch::getCode($code);
        foreach ($matchesPhp as $matchPhp) {
            $str = preg_replace("/(<\?(php)?)(.*?)(?!\B\"[^\"]*)(\?>|$)(?![^\"]*\"\B)/si", '$1$3$4', @$matchPhp[0]);

// Convert dec
            $str = preg_replace_callback('/\\\\(0\d{2})/', function ($match) {
                return chr(hexdec($match[1]));
            }, $str);

// Convert oct
            $str = preg_replace_callback('/\\\\(1\d{2})/', function ($match) {
                return chr(octdec($match[1]));
            }, $str);

// Convert hex
            $str = preg_replace_callback('/\\\\x[A-Fa-f0-9]{2}/', function ($match) {
                return @hex2bin(str_replace('\\x', '', $match[0]));
            }, $str);

// Convert chr
            $str = preg_replace_callback('/(chr|mb_chr)[\s]*$(([\s\($]*[\d\.]+[\s]*[\*\/\-\+]?[\s]*)+)\)/', function ($match) {
                $calc = (int)$this->calc(trim($match[2]));
                $result = $match[1]($calc);

return "'" . $result . "'";
            }, $str);

// Remove point between two strings ex. "ev"."al" to "eval"
            $str = preg_replace("/(\\'|\\\")[\s\r\n]*\.[\s\r\n]*('|\")/", '', $str);
            // Remove multiple spaces
            $str = preg_replace("/([\s]+)/", ' ', $str);

// Decode strings
            $decoders = [
                'str_rot13',
                'gzinflate',
                'base64_decode',
                'rawurldecode',
                'gzuncompress',
                'strrev',
                'convert_uudecode',
                'urldecode',
            ];
            $patternDecoder = [];
            foreach ($decoders as $decoder) {
                $patternDecoder[] = preg_quote($decoder, '/');
            }
            $lastMatch = null;
            $recursiveLoop = true;
            do {
                // Check decode functions
                $regexPattern = '/((' . implode('|', $patternDecoder) . ')[\s\r\n]*$(([^()]|(?R))*)?$)/';
                preg_match($regexPattern, $str, $match);

// Get value inside function
                if ($recursiveLoop && isset($match[0]) && preg_match('/($(?:\"|\\\')(([^\\\'\"]|(?R))*?)(?:\"|\\\')$)/', $match[0], $encodedMatch)) {
                    $value = $encodedMatch[2];
                    $decodersFound = array_reverse(explode('(', $match[0]));
                    foreach ($decodersFound as $decoder) {
                        if (in_array($decoder, $decoders, true) && (is_string($value) && !empty($value))) {
                            $value = @$decoder($value); // Decode
                        }
                    }
                    if (is_string($value) && !empty($value)) {
                        $value = str_replace('"', "'", $value);
                        $value = '"' . $value . '"';
                        $str = str_replace($match[0], $value, $str);
                    } else {
                        $recursiveLoop = false;
                    }
                } else {
                    $recursiveLoop = false;
                }
            } while (!empty($match[0]) && $recursiveLoop);

$code = str_replace($matchPhp, $str, $code);
        }

return $code;
    }

/**
     * Deobfuscate bitrix.
     *
     * @param $str
     *
     * @return string|string[]|null
     */
    private function deobfuscateBitrix($str)
    {
        $res = $str;
        $funclist = [];
        $res = preg_replace("|[\"']\s*\.\s*['\"]|mi", '', $res);
        $res = preg_replace_callback('~(?:min|max)$\s*\d+[\,\|\s\|+\|\-\|\*\|\/][\d\s\.\,\+\-\*\/]+$~m', function ($expr) {
            return $this->calc($expr);
        }, $res);
        $res = preg_replace_callback('|(round$(.+?)$)|smi', function ($matches) {
            $value = $matches[2];
            if (is_numeric($value)) {
                return round($value);
            }
            return $matches[0];
        }, $res);
        $res = preg_replace_callback('|base64_decode$["\'](.*?)["\']$|smi', function ($matches) {
            return "'" . base64_decode($matches[1]) . "'";
        }, $res);

$res = preg_replace_callback('|["\'](.*?)["\']|sm', function ($matches) {
            $temp = base64_decode($matches[1]);
            if (base64_encode($temp) === $matches[1] && preg_match('#^[ -~]*$#', $temp)) {
                return "'" . $temp . "'";
            }

return "'" . $matches[1] . "'";
        }, $res);

if (preg_match_all('|\$(?:\{(?:"|\'))?GLOBALS(?:(?:"|\')\})?\[(?:"|\')(.+?)(?:"|\')\]\s*=\s*Array$(.+?)$;|smi', $res, $founds, PREG_SET_ORDER)) {
            foreach ($founds as $found) {
                $varname = $found[1];
                $funclist[$varname] = explode(',', $found[2]);
                $funclist[$varname] = array_map(function ($value) {
                    return trim($value, "'");
                }, $funclist[$varname]);

$res = preg_replace_callback('|\$(?:\{(?:"|\'))?GLOBALS(?:(?:"|\')\})?\[\'' . preg_quote($varname, '|') . '\'\]\[(\d+)\]|smi', function ($matches) use ($varname, $funclist) {
                    return $funclist[$varname][$matches[1]];
                }, $res);
            }
        }

if (preg_match_all('|function\s*(\w{1,60})$\$\w+${\$\w{1,60}\s*=\s*Array$(.{1,30000}?)$;[^}]+}|smi', $res, $founds, PREG_SET_ORDER)) {
            foreach ($founds as $found) {
                $strlist = explode(',', $found[2]);
                $res = preg_replace_callback('|' . $found[1] . '$(\d+)$|smi', function ($matches) use ($strlist) {
                    return $strlist[$matches[1]];
                }, $res);
            }
        }

$res = preg_replace('~<\?(php)?\s*\?>~mi', '', $res);
        if (preg_match_all('~<\?\s*function\s*(_+(.{1,60}?))$\$[_0-9]+$\{\s*static\s*\$([_0-9]+)\s*=\s*(true|false);.{1,30000}?\$\3=array$(.*?)$;\s*return\s*base64_decode$\$\3~smi', $res, $founds, PREG_SET_ORDER)) {
            foreach ($founds as $found) {
                $strlist = explode("',", $found[5]);
                $res = preg_replace_callback('|' . $found[1] . '\((\d+)$|sm', function ($matches) use ($strlist) {
                    return $strlist[$matches[1]] . "'";
                }, $res);
            }
        }

return $res;
    }

/**
     * Calc.
     *
     * @param $expr
     *
     * @return mixed
     */
    private function calc($expr, $level = 0)
    {
        if($level>100) return $expr;
        if (is_array($expr)) {
            $expr = $expr[0];
        }
        preg_match('~(min|max)?$([^$]+)\)~mi', $expr, $exprArr);
        if (!empty($exprArr[1]) && ($exprArr[1] === 'min' || $exprArr[1] === 'max')) {
            return $exprArr[1](explode(',', $exprArr[2]));
        }

// Use a more flexible regex that handles spaces around operators
        preg_match_all('~([\d\.]+)\s*([\*\/\-\+])?\s*~', $expr, $exprArr);
        if (!empty($exprArr[1]) && !empty($exprArr[2])) {
            // Filter out empty operators
            $operators = array_filter($exprArr[2], function($op) { return $op !== ''; });
            
            if (in_array('*', $operators, true)) {
                $pos = array_search('*', $exprArr[2], true);
                $res = @$exprArr[1][$pos] * @$exprArr[1][$pos + 1];
                // Use regex replacement to handle spaces properly
                $pattern = '~' . preg_quote($exprArr[1][$pos], '~') . '\s*\*\s*' . preg_quote($exprArr[1][$pos + 1], '~') . '~';
                $newExpr = preg_replace($pattern, $res, $expr, 1);
                if ($newExpr === $expr) {
                    return $expr; // No change made, stop recursion
                }
                $expr = $this->calc($newExpr, $level+1);
            } elseif (in_array('/', $operators, true)) {
                $pos = array_search('/', $exprArr[2], true);
                $res = $exprArr[1][$pos] / $exprArr[1][$pos + 1];
                $pattern = '~' . preg_quote($exprArr[1][$pos], '~') . '\s*/\s*' . preg_quote($exprArr[1][$pos + 1], '~') . '~';
                $newExpr = preg_replace($pattern, $res, $expr, 1);
                if ($newExpr === $expr) {
                    return $expr;
                }
                $expr = $this->calc($newExpr, $level+1);
            } elseif (in_array('-', $operators, true)) {
                $pos = array_search('-', $exprArr[2], true);
                $res = $exprArr[1][$pos] - $exprArr[1][$pos + 1];
                $pattern = '~' . preg_quote($exprArr[1][$pos], '~') . '\s*-\s*' . preg_quote($exprArr[1][$pos + 1], '~') . '~';
                $newExpr = preg_replace($pattern, $res, $expr, 1);
                if ($newExpr === $expr) {
                    return $expr;
                }
                $expr = $this->calc($newExpr, $level+1);
            } elseif (in_array('+', $operators, true)) {
                $pos = array_search('+', $exprArr[2], true);
                $res = $exprArr[1][$pos] + $exprArr[1][$pos + 1];
                $pattern = '~' . preg_quote($exprArr[1][$pos], '~') . '\s*\+\s*' . preg_quote($exprArr[1][$pos + 1], '~') . '~';
                $newExpr = preg_replace($pattern, $res, $expr, 1);
                if ($newExpr === $expr) {
                    return $expr;
                }
                $expr = $this->calc($newExpr, $level+1);
            } else {
                return $expr;
            }
        }

return $expr;
    }

/**
     * Eval.
     *
     * @param $matches
     *
     * @return bool|string
     */
    private function decodeEval($matches)
    {
        $string = $matches[0];
        $string = substr($string, 5, -2);

return $this->decodeString($string);
    }

/**
     * Decode string.
     *
     * @param $string
     * @param int $level
     *
     * @return bool|string
     */
    private function decodeString($string, $level = 0)
    {
        if (trim($string) === '') {
            return '';
        }
        if ($level > 100) {
            return '';
        }

if (($string[0] === '\'') || ($string[0] === '"')) {
            return substr($string, 1, -1);
        }

if ($string[0] === '$') {
            $string = str_replace(')', '', $string);
            preg_match_all('~\\' . preg_quote($string, '~') . '\s*=\s*(\'|")([^"\']+)(\'|")~msix', $this->fullCode, $matches);

return @$matches[2][0];
        }

$pos = strpos($string, '(');
        $function = substr($string, 0, $pos);

$arg = $this->decodeString(substr($string, $pos + 1), $level + 1);
        if (strtolower($function) === 'base64_decode') {
            return @base64_decode($arg);
        }

if (strtolower($function) === 'gzinflate') {
            return @gzinflate($arg);
        }

if (strtolower($function) === 'gzuncompress') {
            return @gzuncompress($arg);
        }

if (strtolower($function) === 'strrev') {
            return @strrev($arg);
        }

if (strtolower($function) === 'str_rot13') {
            return @str_rot13($arg);
        }

return $arg;
    }

/**
     * Deobfuscate eval.
     *
     * @param $str
     *
     * @return mixed
     */
    private function deobfuscateEval($str)
    {
        $res = preg_replace_callback('~eval$(base64_decode|gzinflate|strrev|str_rot13|gzuncompress).*?$;~msix', function ($matches) {
            return $this->decodeEval($matches);
        }, $str);

return str_replace($str, $res, $this->fullCode);
    }

/**
     * Get eval code.
     *
     * @param $string
     *
     * @return mixed|string
     */
    private function getEvalCode($string)
    {
        preg_match("/eval$(.*?)$;/", $string, $matches);

return (empty($matches)) ? '' : end($matches);
    }

/**
     * Get text inside quotes.
     *
     * @param $string
     *
     * @return mixed|string
     */
    private function getTextInsideQuotes($string)
    {
        if (preg_match_all('/("(.*?)")/', $string, $matches)) {
            $array = end($matches);

return @end($array);
        }

if (preg_match_all('/(\'(.*?)\')/', $string, $matches)) {
            $array = end($matches);

return @end($array);
        }

return '';
    }

/**
     * Deobfuscate lockit.
     *
     * @param $str
     *
     * @return string
     */
    private function deobfuscateLockit($str)
    {
        $obfPHP = $str;
        $phpcode = base64_decode($this->getTextInsideQuotes($this->getEvalCode($obfPHP)));
        $hexvalues = $this->getHexValues($phpcode);
        $tmpPoint = $this->getHexValues($obfPHP);
        $pointer1 = hexdec($tmpPoint[0]);
        $pointer2 = hexdec($hexvalues[0]);
        $pointer3 = hexdec($hexvalues[1]);
        $needles = $this->getNeedles($phpcode);
        $needle = $needles[count($needles) - 2];
        $beforeNeedle = end($needles);

$phpcode = base64_decode(strtr(substr($obfPHP, $pointer2 + $pointer3, $pointer1), $needle, $beforeNeedle));

return "<?php {$phpcode} ?>";
    }

/**
     * Get needles.
     *
     * @param $string
     *
     * @return array
     */
    private function getNeedles($string)
    {
        preg_match_all("/'(.*?)'/", $string, $matches);

return (empty($matches)) ? [] : $matches[1];
    }

/**
     * Get hex values.
     *
     * @param $string
     *
     * @return array
     */
    private function getHexValues($string)
    {
        preg_match_all('/0x[a-fA-F0-9]{1,8}/', $string, $matches);

return (empty($matches)) ? [] : $matches[0];
    }

/**
     * Deobfuscate als.
     *
     * @param $str
     *
     * @return string
     */
    private function deobfuscateAls($str)
    {
        preg_match('~__FILE__;\$[O0]+=[0-9a-fx]+;eval$\$[O0]+\(\'([^\']+)\'$\);return;~mix', $str, $layer1);
        preg_match('~\$[O0]+=(\$[O0]+$)+\$[O0]+,[0-9a-fx]+$,\'([^\']+)\',\'([^\']+)\'\)\);eval\(~mix', base64_decode($layer1[1]), $layer2);
        $res = explode('?>', $str);
        if (end($res) !== '') {
            $res = substr(end($res), 380);
            $res = base64_decode(strtr($res, $layer2[2], $layer2[3]));
        }

return "<?php {$res} ?>";
    }

/**
     * Deobfuscate byterun.
     *
     * @param $str
     *
     * @return string
     */
    private function deobfuscateByterun($str)
    {
        $fullCode = $this->fullCode;
        preg_match('~\$_F=__FILE__;\$_X=\'([^\']+)\';\s*eval\s*$\s*\$?\w{1,60}\s*\(\s*[\'"][^\'"]+[\'"]\s*$\s*\)\s*;~mix', $str, $matches);
        if (!empty($matches)) {
            $res = base64_decode($matches[1]);
            $res = strtr($res, '123456aouie', 'aouie123456');
            $fullCode = str_replace($matches[0], $res, $this->fullCode);
        }

return '<?php ' . $fullCode . ' ?>';
    }

/**
     * Deobfuscate urldecode.
     *
     * @param $str
     *
     * @return mixed
     */
    private function deobfuscateUrldecode($str)
    {
        preg_match('~(\$[O0_]+)=urldecode$"([%0-9a-f]+)"$;((\$[O0_]+=(\1\{\d+\}\.?)+;)+)~mix', $str, $matches);
        $alph = urldecode($matches[2]);
        $funcs = $matches[3];
        for ($i = 0, $iMax = strlen($alph); $i < $iMax; $i++) {
            $funcs = str_replace([$matches[1] . '{' . $i . '}.', $matches[1] . '{' . $i . '}'], [$alph[$i], $alph[$i]], $funcs);
        }

$str = str_replace($matches[3], $funcs, $str);
        $funcs = explode(';', $funcs);
        foreach ($funcs as $func) {
            $funcArr = explode('=', $func);
            if (count($funcArr) === 2) {
                $funcArr[0] = str_replace('$', '', $funcArr[0]);
                $str = str_replace('${"GLOBALS"}["' . $funcArr[0] . '"]', $funcArr[1], $str);
            }
        }

return $str;
    }

/**
     * Format PHP.
     *
     * @param $string
     *
     * @return mixed
     */
    private function formatPHP($string)
    {
        return str_replace(['<?php', '?>', PHP_EOL, ';'], ['', '', '', ";\n"], $string);
    }

/**
     * Deobfuscate fopo.
     *
     * @param $str
     *
     * @return bool|string
     */
    private function deobfuscateFopo($str)
    {
        $phpcode = $this->formatPHP($str);
        $phpcode = base64_decode($this->getTextInsideQuotes($this->getEvalCode($phpcode)));
        $array = explode(':', $phpcode);
        @$phpcode = gzinflate(base64_decode(str_rot13($this->getTextInsideQuotes(end($array)))));
        $old = '';
        while (($old !== $phpcode) && (strlen(strstr($phpcode, '@eval($')) > 0)) {
            $old = $phpcode;
            $funcs = explode(';', $phpcode);
            if (count($funcs) === 5) {
                $phpcode = gzinflate(base64_decode(str_rot13($this->getTextInsideQuotes($this->getEvalCode($phpcode)))));
            } elseif (count($funcs) === 4) {
                $phpcode = gzinflate(base64_decode($this->getTextInsideQuotes($this->getEvalCode($phpcode))));
            }
        }

return substr($phpcode, 2);
    }

/**
     * Get obfuscation type.
     *
     * @param $str
     *
     * @return array
     */
    private function getObfuscateType($str)
    {
        $str = str_replace([".''", "''.", '.""', '"".'], '', $str);

$types = [];

if (preg_match('~\$(?:\{(?:"|\'))?GLOBALS(?:(?:"|\')\})?\[\s*[\'"]_+\w{1,60}[\'"]\s*\]\s*=\s*\s*(?:array\s*$|\[)\s*base64_decode\s*\(~mix', $str)) {
            $types[] = 'globals';
        }
        if (preg_match('~function\s*_+\d+\s*\(\s*\$i\s*$\s*{\s*\$a\s*=\s*(?:Array|\[)~mix', $str)) {
            $types[] = 'globals';
        }
        if (preg_match('~__FILE__;\$[O0]+=[0-9a-fx]+;eval$\$[O0]+\(\'([^\']+)\'$\);return;~mix', $str)) {
            $types[] = 'als';
        }
        if (preg_match('~\$[O0]*=urldecode$\'%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64\'$;\s*\$(?:(?:"|\')\})?GLOBALS(?:(?:"|\')\})?\[\'[O0]*\'\]=\$[O0]*~mix', $str)) {
            $types[] = 'lockit';
        }
        if (preg_match('~\$\w+="(\\\x?[0-9a-f]+){13}";@eval$\$\w+\(~mix', $str)) {
            $types[] = 'fopo';
        }
        if (preg_match('~\$_F=__FILE__;\$_X=\'([^\']+\');eval\(~mx', $str)) {
            $types[] = 'byterun';
        }
        if (preg_match('~(\$[O0_]+)=urldecode\("([%0-9a-f]+)"$;((\$[O0_]+=(\1\{\d+\}\.?)+;)+)~mix', $str)) {
            $types[] = 'urldecode_globals';
        }
        if (preg_match('~eval\((base64_decode|gzinflate|strrev|str_rot13|gzuncompress)~mix', $str)) {
            $types[] = 'eval';
        }

return $types;
    }
}
<?php
/**
 * PHP Antimalware Scanner.
 *
 * @author Marco Cesarato <cesarato.developer@gmail.com>
 * @license http://opensource.org/licenses/gpl-3.0.html GNU Public License
 *
 * @see https://github.com/marcocesarato/PHP-Antimalware-Scanner
 */

namespace AMWScan;

class Exploits
{
    /**
     * Default exploits definitions.
     *
     * @var array
     */
    protected static $default = [
        'eval_chr' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/eval[\s]*$[\s]*chr[\s]*\(.*?[\s]*$/i',
        ],
        'eval_chr_obf' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/chr[\s]*$[\s]*101[\s]*$[\s]*\.[\s]*chr[\s]*$[\s]*118[\s]*$[\s]*\.[\s]*chr[\s]*$[\s]*97[\s]*$[\s]*\.[\s]*chr[\s]*$[\s]*108[\s]*$/i',
        ],
        'eval_preg' => [
            'description' => 'RCE (Remote Code Execution), through PCRE (Perl compatible Regular Expression), allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(preg_replace(_callback)?|mb_ereg_replace|preg_filter)[\s]*$[^)]*(\/|\\\\x2f)(e|\\\\x65)[\\\'\"].*?(?=$)\)/i',
        ],
        'eval_base64' => [
            'description' => 'RCE (Remote Code Execution), through Base64 text, allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/eval[\s]*$[\s]*base64_decode[\s]*\((?<=\().*?(?=$)\)/i',
        ],
        'eval_comment' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(eval|preg_replace|system|assert|passthru|(pcntl_)?exec|shell_exec|call_user_func(_array)?)\/\*[^\*]*\*\/$(?<=\().*?(?=$)\)/',
        ],
        'eval_execution' => [
            'description' => 'RCE (Remote Code Execution) and Code Injection allow remote attackers to execute arbitrary commands or code on the target machine via HTTP request',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(eval[\s]*$[\s]*\$[a-z0-9_]+[\s]*\([\s]*(?<=\()@?\$_(GET|POST|SERVER|COOKIE|REQUEST).*?(?=$)\)/si',
        ],
        'align' => [
            'description' => 'Code alignment technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::WARNING,
            'pattern' => '/(\$\w+=[^;]*)*;\$\w+=@?\$\w+$(?<=\().*?(?=$)\)/si',
        ],
        // b374k shell
        'b374k' => [
            'description' => 'Web shell (b374k) for the remote management',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/[\'"]ev[\'"]\.[\'"]al[\'"]\.[\'"][\s]*$[\s]*("|\\\')[\s]*\?>/i',
            'link' => 'https://github.com/b374k/b374k',
        ],
        // weevely3 launcher
        'weevely3' => [
            'description' => 'Web shell (Weevely) for post-exploitation purposes that can be extended over the network at runtime',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\$\w=\$[a-zA-Z]\(\'\',\$\w$;\$\w;/i',
            'link' => 'https://github.com/epinna/weevely3',
        ],
        'c99_launcher' => [
            'description' => 'Web Shell (C99) designed for post-exploitation purposes that can be extended over the network at runtime',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/;\$\w+$\$\w+(,\s?\$\w+)+$;/i',
            'link' => 'https://github.com/4Hackerz/C99-Shell',
        ],
        // concatenation of more than eight `chr()`
        'too_many_chr' => [
            'description' => 'Concatenation of `chr` technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::WARNING,
            'pattern' => '/(chr$[\d]+$\.){8}/i',
        ],
        // concatenation of vars array
        'concat' => [
            'description' => 'Concatenation of arrays technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::WARNING,
            'pattern' => '/(\$[\w\[\]\\\'\"]+\\.[\n\r]*){10}/i',
        ],
        // concatenation of more than 6 words, with spaces
        'concat_vars_with_spaces' => [
            'description' => 'Concatenation of vars technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::WARNING,
            'pattern' => '/(\$([a-zA-Z0-9]+)[\s]*\.[\s]*){6}/',
        ],
        // concatenation of more than 6 words, with spaces
        'concat_vars_array' => [
            'description' => 'Concatenation of arrays technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::WARNING,
            'pattern' => '/(\$([a-zA-Z0-9]+)(\{|\[)([0-9]+)(\}|\])[\s]*\.[\s]*){6}.*?(?=\})\}/i',
        ],
        'var_as_func' => [
            'description' => 'RCE (Remote Code Execution) and Code Injection, through global vars used as PHP function, allow remote attackers to execute PHP code on the target machine via HTTP request',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\$_(GET|POST|COOKIE|REQUEST|SERVER)[\s]*\[[^\]]+\][\s]*$(?<=\().*?(?=$)\)/i',
        ],
        'global_var_string' => [
            'description' => 'Code Injection, through escaped global vars, allow inject attackers to execute PHP code on the target machine via HTTP request',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\$\{[\s]*[\'"]_(GET|POST|COOKIE|REQUEST|SERVER)[\'"][\s]*\}/i',
        ],
        'extract_global' => [
            'description' => 'Code Injection, extracting global var arrays, allow remote attackers to inject PHP code on the target machine via HTTP request',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/extract$[\s]*\$_(GET|POST|COOKIE|REQUEST|SERVER).*?(?=$)\)/i',
        ],
        'escaped_path' => [
            'description' => 'Escaped path technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(\\\\x[0-9abcdef]{2}[a-z0-9.-\/]{1,4}){4,}/i',
        ],
        'include_icon' => [
            'description' => 'LFI (Local File Inclusion), including `.ico` file, allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/@?include[\s]*($[\s]*)?("|\\\')([^"\\\']*)(\.|\\\\056\\\\046\\\\2E)(\i|\\\\151|\\\\x69|\\\\105)(c|\\\\143\\\\099\\\\x63)(o|\\\\157\\\\111|\\\\x6f)(\"|\\\')((?=$)\))?/mi',
        ],
        'backdoor_code' => [
            'description' => 'Backdoor that checks to see if the user is a web spider and if not, retrieves data from another webserver and displays it to the visitor',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/eva1fYlbakBcVSir/i',
        ],
        'infected_comment' => [
            'description' => 'Comments composed by 5 random chars usually used to detect if a file is infected yet',
            'level' => CodeMatch::WARNING,
            'pattern' => '/\/\*[a-z0-9]{5}\*\//i',
        ],
        'hex_char' => [
            'description' => 'Hex char is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\\\\[Xx](5[Ff])/i',
        ],
        'hacked_by' => [
            'description' => 'Hacker credits',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/hacked[\s]*by/i',
        ],
        'killall' => [
            'description' => 'RCE (Remote Code Execution) that allow remote attackers to kill processes on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/killall[\s]*\-9/i',
        ],
        'globals_concat' => [
            'description' => 'Concatenation of globals vars technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\$GLOBALS\[[\s]*\$GLOBALS[\\\'[a-z0-9]{4,}\\\'\]/i',
        ],
        'globals_assign' => [
            'description' => 'Global vars assignment is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\$GLOBALS\[\\\'[a-z0-9]{5,}\\\'\][\s]*=[\s]*\$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\.\$[a-z]+\d+\[\d+\]\./i',
        ],
        'base64_long' => [
            'description' => 'Long Base64 encoded text is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::WARNING,
            'pattern' => '/[\\\'\"][A-Za-z0-9+\/]{260,}={0,3}[\\\'\"]/',
        ],
        'base64_inclusion' => [
            'description' => 'LFI (Local File Inclusion), through a Base64 inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/@?include[\s]*($[\s]*)?("|\\\')data\:text/plain;base64[\s]*\,[\s]*\$_GET\[[^\]]+\](\\\'|")[\s]*((?=$)\))?/si',
        ],
        'clever_include' => [
            'description' => 'LFI (Local File Inclusion), through a image inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/@?include[\s]*($[\s]*)?("|\\\')[\s]*[^\.]+\.(png|jpe?g|gif|bmp|ico).*?("|\\\')[\s]*((?=$)\))?/i',
        ],
        'basedir_bypass' => [
            'description' => 'Basedir bypass used for manipulate files or execute code outside the base directory set on the server configuration',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/curl_init[\s]*$[\s]*[\"\\\']file:\/\/.*?(?=$)\)/i',
        ],
        'basedir_bypass2' => [
            'description' => 'Basedir bypass used for manipulate files or execute code outside the base directory set on the server configuration',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/file\:file\:\/\//i',
        ],
        'non_printable' => [
            'description' => 'Non printable technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(function|return|base64_decode).{,256}[\\x00-\\x1F\\x7F-\\xFF]{3}/ui',
        ],
        'double_var' => [
            'description' => 'Double var technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::WARNING,
            'pattern' => '/\${[\s]*\${.*?}(.*)?}/i',
        ],
        'double_var2' => [
            'description' => 'Double var technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::WARNING,
            'pattern' => '/\${\$[0-9a-zA-z]+}/i',
        ],
        'global_save' => [
            'description' => 'Globals assignment technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\[\s]*=[\s]*\$GLOBALS[\s]*\;[\s]*\$[\s]*\{/i',
        ],
        // Check for ${"\xFF"}, IonCube use this method ${"\x
        'hex_var' => [
            'description' => 'Hex var technique is usually used for the obfuscation of malicious code, it is also used by IonCube',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\$\{[\s]*[\'"]\\\\x.*?(?=\})\}/i',
        ],
        'register_function' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/register_[a-z]+_function[\s]*$[\s]*[\\\'\"][\s]*(eval|assert|passthru|exec|include|system|shell_exec|`).*?(?=$)\)/i',
        ],
        'safemode_bypass' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\x00\/\.\.\/|LD_PRELOAD/i',
        ],
        'ioncube_loader' => [
            'description' => 'IonCube is a PHP encoder and hence a module/library for protected functions and often used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/IonCube\_loader/i',
            'link' => 'https://www.ioncube.com',
        ],
        'nano' => [
            'description' => 'Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\$[a-z0-9-_]+\[[^]]+\]$(?<=\().*?(?=$)\)/',
            'link' => 'https://github.com/s0md3v/nano',
        ],
        'nano2' => [
            'description' => 'Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/base64_decode[^;]+getallheaders/',
            'link' => 'https://github.com/s0md3v/nano',
        ],
        // function that takes a callback as 1st parameter
        'execution' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\b(eval|assert|passthru|exec|include|system|pcntl_exec|shell_exec|base64_decode|`|array_map|ob_start|call_user_func(_array)?)[\s]*$[\s]*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\\\?@?\$_(GET|REQUEST|POST|COOKIE|SERVER)).*?(?=$)\)/',
            'link' => 'https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html',
        ],
        // functions that takes a callback as 2nd parameter
        'execution2' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\b(array_filter|array_reduce|array_walk(_recursive)?|array_walk|assert_options|uasort|uksort|usort|preg_replace_callback|iterator_apply)[\s]*$[\s]*[^,]+,[\s]*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\\\?@?\$_(GET|REQUEST|POST|COOKIE|SERVER)).*?(?=$)\)/',
            'link' => 'https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html',
        ],
        // functions that takes a callback as 2nd parameter
        'execution3' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine via HTTP',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\b(array_(diff|intersect)_u(key|assoc)|array_udiff)[\s]*$[\s]*([^,]+[\s]*,?)+[\s]*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\\\?@?\$_(GET|REQUEST|POST|COOKIE|SERVER))[\s]*\[[^]]+\][\s]*$+[\s]*;/',
            'link' => 'https://cwe.mitre.org/data/definitions/77.html, https://cwe.mitre.org/data/definitions/78.html',
        ],
        'shellshock' => [
            'description' => 'Shell shock technique is usually used for the obfuscation of malicious code using PHP functions',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/[\s]*{[\s]*[a-z:][\s]*;[\s]*}[\s]*;/',
        ],
        'silenced_eval' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute PHP code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/@eval[\s]*$(?<=\().*?(?=$)\)/',
        ],
        'silence_inclusion' => [
            'description' => 'LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/@(include|include_once|require|require_once)[\s\r\n]+([\s]*$)?("|\\\')([^"\\\']*)(\\\\x[0-9a-f]{2,}.*?){2,}([^"\\\']*)("|\\\')[\s]*((?=$)\))?/si',
        ],
        'silence_inclusion2' => [
            'description' => 'LFI (Local File Inclusion), through a silent inclusion, allow remote attackers to inject and execut arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/@(include|include_once|require|require_once)[\s\r\n]+([\s]*$)?("|\\\')([^"\\\']*)(\\[0-9]{3,}.*?){2,}([^"\\\']*)("|\\\')[\s]*((?=$)\))?/si',
        ],
        'ssi_exec' => [
            'description' => 'SSI (Server-Side Includes) injection allows the exploitation of a web application by injecting malicious code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\<\!\-\-\#exec[\s]*cmd\=/i',
            'link' => 'https://owasp.org/www-community/attacks/Server-Side_Includes_(SSI)_Injection, http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec',
        ],
        'htaccess_handler' => [
            'description' => 'RCE (Remote Code Execution), through Htaccess handler x-httpd-php/cgi, interpreting PHP code, allow remote attackers to execute PHP code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/SetHandler[\s]*application\/x\-httpd\-(php|cgi)/i',
        ],
        'htaccess_type' => [
            'description' => 'RCE (Remote Code Execution), through Htaccess add type x-httpd-php/cgi, interpreting PHP code, allow remote attackers to execute PHP code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/AddType\s+application\/x-httpd-(php|cgi)/i',
        ],
        'file_prepend' => [
            'description' => 'LFI (Local File Inclusion), prepending a file at the bottom of every others PHP files, allow remote attackers to inject and execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/php_value[\s]*auto_prepend_file/i',
        ],
        'iis_com' => [
            'description' => 'RCE (Remote Code Execution), through ISS Server, allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::WARNING,
            'pattern' => '/IIS\:\/\/localhost\/w3svc/i',
        ],
        'reversed' => [
            'description' => 'Reverse function technique is used for the obfuscation of dangerous PHP functions',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(noitcnuf\_etaerc|metsys|urhtssap|edulcni|etucexe\_llehs|ecalper\_rts|ecalper_rts)/i',
        ],
        'rawurlendcode_rot13' => [
            'description' => 'Raw url decode and rot13 string together technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/rawurldecode[\s]*$str_rot13[\s]*\((?<=\().*?(?=$)\)/i',
        ],
        'serialize_phpversion' => [
            'description' => 'RCE (Remote Code Execution), unserializing php version, allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\@serialize[\s]*$[\s]*(Array\(|\[)[\'"]php[\'"][\s]*\=\>[\s]*\@phpversion[\s]*\((?<=\().*?(?=$)\)/si',
        ],
        'md5_create_function' => [
            'description' => 'The `create_function` technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\$md5[\s]*=[\s]*.*create_function[\s]*$.*?$;[\s]*\$.*?\)[\s]*;/si',
        ],
        'god_mode' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\/\*god_mode_on\*\/eval$base64_decode\([\"\\\'][^\"\\\']{255,}[\"\\\']$\);[\s]*\/\*god_mode_off\*\//si',
        ],
        'wordpress_filter' => [
            'description' => 'Wordpress Filter RCE (Remote Code Execution) allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/\$md5[\s]*=[\s]*[\"|\\\']\w+[\"|\\\'];[\s]*\$wp_salt[\s]*=[\s]*[\w,\"\\\'\;$]+[\s]*\$wp_add_filter[\s]*=[\s]*create_function$.*?$;[\s]*\$wp_add_filter$.*?$;/si',
        ],
        'password_protection_md5' => [
            'description' => 'MD5 Password protection file, typically used on web shells',
            'level' => CodeMatch::WARNING,
            'pattern' => '/md5[\s]*$[\s]*@?\$_(GET|REQUEST|POST|COOKIE|SERVER)[^)]+$[\s]*===?[\s]*[\\\'\"][0-9a-f]{32}[\\\'\"]/si',
        ],
        'password_protection_sha' => [
            'description' => 'SHA Password protection file, typically used on web shells',
            'level' => CodeMatch::WARNING,
            'pattern' => '/sha[\d]+[\s]*$[\s]*@?\$_(GET|REQUEST|POST|COOKIE|SERVER)[^)]+$[\s]*===?[\s]*[\\\'\"][0-9a-f]{40}[\\\'\"]/si',
        ],
        'custom_math' => [
            'description' => 'Custom math technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/%$\d+[\s]*\-[\s]*\d+[\s]*\+[\s]*\d+$[\s]*==[\s]*$[\s]*\-[\s]*\d+[\s]*\+[\s]*\d+[\s]*\+[\s]*\d+[\s]*$/si',
        ],
        'custom_math2' => [
            'description' => 'Custom math technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/$[\s]*\$[a-zA-Z0-9]+%\d[\s]*==[\s]*\([\s]*\d+[\s]*\-[\s]*\d+[\s]*\+[\s]*\d+[\s]*$/si',
        ],
        'uncommon_function' => [
            'description' => 'Function name technique usually used for the obfuscation of malicious code',
            'level' => CodeMatch::WARNING,
            'pattern' => 'function\s+_[0-9]{8,}[\s]*$[\s]*(?<=\().*?(?=$)\)',
        ],
        'download_remote_code' => [
            'description' => 'RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/file_get_contents[\s]*$[\s]*base64_url_decode[\s]*\([\s]*@*\$_(GET|POST|SERVER|COOKIE|REQUEST).*?(?=$)\)/i',
        ],
        'download_remote_code2' => [
            'description' => 'RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/fwrite[\s]*($\w+\((?<=\().*?(?=$)\))?[^\)]*\$_(GET|POST|SERVER|COOKIE|REQUEST).*?(?=\))\)/si',
        ],
        'download_remote_code3' => [
            'description' => 'RFU (Remote File Upload), via HTTP, allow to write malicious code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(file_get_contents|fwrite)[\s]*$[\s]*@?*\$_(GET|POST|SERVER|COOKIE|REQUEST).*?(?=$)\)/si',
            'link' => 'https://www.acunetix.com/blog/articles/local-file-inclusion-lfi',
        ],
        'download_remote_code_web' => [
            'description' => 'RFU (Remote File Upload), from external website, allow to write malicious code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(file_get_contents|file_put_contents)[\s]*$[\s]*[\'"]https?:\/\/([\w.-]+\.)?(codepad|pastebin|controlc|hastebin|justpaste|privatebin|cryptbin|zerobin|paste2|slexy|myconan)\.(org|com|net|in|me).*?(?=$)\)/i',
        ],
        'php_uname' => [
            'description' => 'RCE (Remote Code Execution) allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/php_uname[\s]*$[\s]*["\'asrvm]+[\s]*$/si',
        ],
        'etc_passwd' => [
            'description' => 'The `/etc/passwd` file on Unix systems contains password information, an attacker who has accessed the `etc/passwd` file may attempt a brute force attack of all passwords on the system',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(\/)*etc\/+passwd\/*/si',
        ],
        'etc_shadow' => [
            'description' => 'The `/etc/shadow` file on Unix systems contains password information, an attacker who has accessed the `etc/shadow` file may attempt a brute force attack of all passwords on the system',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(\/)*etc\/+shadow\/*/si',
        ],
        'explode_chr' => [
            'description' => 'RCE (Remote Code Execution), exploding chars, allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/explode[\s]*$chr[\s]*\([\s]*\(?\d{3}([\s]*-[\s]*\d{3})?[\s]*$.*?(?=\))\)/i',
        ],
        'imap_open' => [
            'description' => 'RCE (Remote Code Execution), through imap_open, allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/imap_open$[\'"]{[\'"][\s]*\.[\s]*\$_(GET|POST|SERVER|COOKIE|REQUEST).*?(?=$)\)/i',
            'link' => 'https://bugs.php.net/bug.php?id=76428',
        ],
        'imap_open_proxy' => [
            'description' => 'RCE (Remote Code Execution), through imap, allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/x[\s]*\-oProxyCommand[\s]*\=(.*?\|base64(\\\\t\-d)?(\|sh)?)?/i',
        ],
        'exec_escaped' => [
            'description' => 'RCE (Remote Code Execution), through exec escaped chars, allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/exec[\s]*[\s]*$[\s]*[\'"][\s]*([\s]*\\[0-9a-fx]{2,3}[\s]*){3,}/i',
        ],
        'urldecode_concat' => [
            'description' => 'RCE (Remote Code Execution), through concatenated text encoded with urldecode or rawurldecode, allow remote attackers to execute arbitrary commands or code on the target machine',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/(\$[a-z]{2,}[\s]*=[\s]*(urldecode|rawurldecode)[\s]*\([\s]*\$_(GET|REQUEST|POST|COOKIE|SERVER)[\s]*\[[\s]*\'[\s]*[a-z]{2,}[\s]*\'[\s]*\][\s]*$[\s]*;[\s]*){3,}/i',
        ],
        'xor_post_payload' => [
            'description' => 'XOR post technique is usually used for the obfuscation of malicious code',
            'level' => CodeMatch::WARNING,
            'pattern' => '/([\s]*\$\w+[\s]*\[[\s]*\$\w+[\s]*%[\s]*strlen[\s]*$[\s]*\$\w+$[\s]*\][\s]*\;?[\s]*){2,}/i',
        ],
        'source_guardian' => [
            'description' => 'SourceGuardian is a PHP encoder often used for the obfuscation of malicious code',
            'level' => CodeMatch::DANGEROUS,
            'pattern' => '/[;\s]*sg\_load[\s]*$[\s]*[\\\'\"][A-Za-z0-9+\/]{150,}={0,3}[\\\'\"][\s]*$/i',
            'link' => 'https://www.sourceguardian.com',
        ],
    ];

/**
     * Get all exploits.
     *
     * @return array[]
     */
    public static function getAll()
    {
        return self::$default;
    }

/**
     * Get lite exploits.
     *
     * @return array[]
     */
    public static function getLite()
    {
        $exploits = self::$default;

// Function that takes a callback as 1st parameter
        $exploits['execution']['pattern'] = '/\b(eval|assert|passthru|exec|include|system|pcntl_exec|shell_exec|`|array_map|ob_start|call_user_func(_array)?)\s*$\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST|COOKIE|SERVER)).*?(?=$)\)/';
        // Concatenation of more than 8 words, with spaces
        $exploits['concat_vars_with_spaces']['pattern'] = '/(\$([a-zA-Z0-9]+)[\s\r\n]*\.[\s\r\n]*){8}/';
        // Concatenation of more than 8 words, with spaces
        $exploits['concat_vars_array']['pattern'] = '/(\$([a-zA-Z0-9]+)(\{|\[)([0-9]+)(\}|\])[\s\r\n]*\.[\s\r\n]*){8}.*?(?=\})\}/i';

unset(
            $exploits['nano'],
            $exploits['double_var2'],
            $exploits['base64_long']
        );

return $exploits;
    }
}
�S������8�H�Nx��8�� ���7-P���GBMB