File:Yara Signature of PAS TOOL PHP WEB KIT.png

From A Closer Look On Syria
Jump to navigation Jump to search

Yara_Signature_of_PAS_TOOL_PHP_WEB_KIT.png(499 × 499 pixels, file size: 48 KB, MIME type: image/png)

Yara Signature of PAS_TOOL_PHP_WEB_KIT also known as Grizzly Steppe according to U.S. Department of Homeland Security

Yara Signature
rule PAS_TOOL_PHP_WEB_KIT
{
meta:
description = "PAS TOOL PHP WEB KIT FOUND"
strings:
$php = "<?php"
$base64decode = /\='base'\.\(\d+\*\d+\)\.'_de'\.'code'/
$strreplace = "(str_replace("
$md5 = ".substr(md5(strrev("
$gzinflate = "gzinflate"
$cookie = "_COOKIE"
$isset = "isset"
condition:
(filesize > 20KB and filesize < 22KB) and
#cookie == 2 and
#isset == 3 and
all of them
}
Source

File history

Click on a date/time to view the file as it appeared at that time.

Date/TimeThumbnailDimensionsUserComment
current09:53, 3 January 2017Thumbnail for version as of 09:53, 3 January 2017499 × 499 (48 KB)Petri Krohn (talk | contribs)Yara Signature of PAS_TOOL_PHP_WEB_KIT also known as ''Grizzly Steppe'' according to U.S. Department of Homeland Security :'''''Yara Signature :rule PAS_TOOL_PHP_WEB_KIT :{ :meta: :description = "PAS TOOL PHP WEB KIT FOUND" :strings: :$php = "<?php" :...

The following page uses this file:

Metadata