private rule is_php {
    strings:
        $str = "<?"

    condition:
        $str
}

rule Malware_Expert_General_Uploader : Malware_Expert {
    meta:
		description = "Malware.Expert - General Uploader"
                author = "Malware.Expert"
                reference = "https://malware.expert"
                date = "2018-11-15"

    strings:
        $str1 = "multipart/form-data"
        $str2 = "$_FILE["
        $str3 = "move_uploaded_file"
	$str4 = /\bcopy\s*\(/
    condition:
	is_php and (filesize < 1024) and $str1 and ($str2 or $str3 or $str4)
}

/*
rule Malware_Expert_General_Malware : Malware_Expert {
    meta:
		description = "Malware.Expert - General small malware"
                author = "Malware.Expert"
                reference = "https://malware.expert"
                date = "2018-11-15"

    strings:
        $str1 = /(\$_SERVER|\$_GET|\$_POST|\$_REQUEST|\$_COOKIE)/
        $str2 = /(eval|assert|\$.*\(\s*\)\s*;)/
        $str3 = "base64_decode"
    condition:
	is_php and (filesize < 250) and (2 of ($*))
}
*/