Fix #265 Included filesize condition in all rules

malware/MALW_Magento_suspicious.yar

@@ -7,18 +7,12 @@ ref : https://github.com/gwillem/magento-malware-scanner/
 author : https://github.com/gwillem
 
 */
-global private rule malware_size {
-    meta:
-        description = "Limit on file size"
-    condition:
-        /* uint16(0) == 0x4B50 and filesize < 3MB */
-        filesize < 500KB
-}
-
 
 rule fromCharCode_in_unicode {
-    strings: $ = "\\u0066\\u0072\\u006f\\u006d\\u0043\\u0068\\u0061\\u0072\\u0043\\u006f\\u0064\\u0065"
-    condition: any of them
+    strings: 
+        $ = "\\u0066\\u0072\\u006f\\u006d\\u0043\\u0068\\u0061\\u0072\\u0043\\u006f\\u0064\\u0065"
+    condition: 
+        any of them and filesize < 500KB
 }
 rule function_through_object {
     strings: 
@@ -26,12 +20,14 @@ rule function_through_object {
         $ = "['unescape']"
         $ = "['charCodeAt']"
         $ = "['fromCharCode']"
-    condition: any of them
+    condition: 
+        any of them and filesize < 500KB
 }
 rule hex_script {
     strings:
         $ = "\\x73\\x63\\x72\\x69\\x70\\x74\\x22"
-    condition: any of them
+    condition: 
+        any of them and filesize < 500KB
 }
 
 rule php_malfunctions {
@@ -40,7 +36,8 @@ rule php_malfunctions {
         $ = "gzinflate("
         $ = "str_rot13("
         $ = "base64_decode("
-    condition: 3 of them
+    condition: 
+        3 of them and filesize < 500KB
 }
 
 rule php_obf_malfunctions {
@@ -48,29 +45,39 @@ rule php_obf_malfunctions {
         $ = "eval(base64_decode"
         $ = "eval(gzinflate"
         $ = "str_rot13(base64_decode"
-    condition: any of them
+    condition: 
+        any of them and filesize < 500KB
 }
         
 rule fopo_obfuscator {
     strings:
         $ = "www.fopo.com.ar"
-    condition: any of them
+    condition: 
+        any of them and filesize < 500KB
 }
 
 rule obf_base64_decode {
-    strings: $ = "\\x62\\x61\\x73\\145\\x36\\x34\\x5f\\x64\\x65\\143\\x6f\\144\\145"
-    condition: any of them
+    strings: 
+        $ = "\\x62\\x61\\x73\\145\\x36\\x34\\x5f\\x64\\x65\\143\\x6f\\144\\145"
+    condition: 
+        any of them and filesize < 500KB
 }
+
 rule html_upload {
     strings: 
         $ = "<input type='submit' name='upload' value='upload'>"
         $ = "if($_POST['upload'])"
-    condition: any of them
+    condition: 
+        any of them and filesize < 500KB
 }
+
 rule php_uname {
-    strings: $ = "php_uname()"
-    condition: any of them
+    strings: 
+        $ = "php_uname()"
+    condition: 
+        any of them and filesize < 500KB
 }
+
 rule scriptkiddies {
     strings:
         $ = "lastc0de@Outlook.com" nocase
@@ -78,10 +85,13 @@ rule scriptkiddies {
         $ = "AgencyCaFc" nocase
         $ = "IndoXploit" nocase
         $ = "Kapaljetz666" nocase
-    condition: any of them
+    condition: 
+        any of them and filesize < 500KB
 }
+
 rule eval_with_comments {
 	strings:
 		$ = /(^|\s)eval\s*\/\*.{,128}\*\/\s*\(/
-	condition: any of them
+	condition: 
+        any of them and filesize < 500KB
 }