<?php
require("core.php");
head();

$table = $prefix . 'malwarescanner-settings';
$query = mysqli_query($connect, "SELECT * FROM `$table`");
$srow  = mysqli_fetch_array($query);

if (isset($_POST['save-settings'])) {
    $scandir    = $_POST['scandir'];
    $extensions = $_POST['extensions'];
    $ignored    = $_POST['ignored'];
    $table      = $prefix . 'malwarescanner-settings';
    $update     = mysqli_query($connect, "UPDATE `$table` SET `scan-dir`='$scandir', `file-extensions`='$extensions', `ignored-dirs`='$ignored'");
}

if (isset($_GET['ignore'])) {
	$fileign = $_GET['ignore'];
    $ignored = $srow['ignored-dirs'] . "|" . $fileign;
	$table      = $prefix . 'malwarescanner-settings';
    $update     = mysqli_query($connect, "UPDATE `$table` SET `ignored-dirs`='$ignored'");
	
	echo '<meta http-equiv="refresh" content="0; url=malware-scanner.php" />';
}
?>
<div class="content-wrapper">

			<!--CONTENT CONTAINER-->
			<!--===================================================-->
			<div id="content-container">
				
				<section class="content-header">
    			  <h1><i class="fas fa-search"></i> Malware Scanner</h1>
    			  <ol class="breadcrumb">
   			         <li><a href="dashboard.php"><i class="fas fa-home"></i> Admin Panel</a></li>
    			     <li class="active">Malware Scanner</li>
    			  </ol>
    			</section>


				<!--Page content-->
				<!--===================================================-->
				<section class="content">

                <div class="row">
				<div class="col-md-12">
				    <div class="box">
						<div class="box-header">
							<h3 class="box-title">Malware Scanner</h3>
						</div>
						<div class="box-body">

<div class="col-md-12">
<div class="callout callout-info">
<p>
    There is a chance of false-positive results, please analyze the results and verify them. Sometimes the scanning process could take more time according to the files on your host.
</p>
</div>
</div>
                                    
                                    
					<center>
					<a href="malware-scanner.php" class="btn btn-flat btn-primary" title="The normal scan scans all files with the simple scan engine"><i class="fas fa-search"></i> Run Normal Scan</a> 
					<a href="?deep_scan=1" class="btn btn-flat btn-danger" title="The deep scan scans all files with the heaviest scan engine, but could show many false-positive threats."><i class="fas fa-search"></i> Run Deep Scan</a> 
                    <button data-target="#settings" data-toggle="modal" class="mb-xs mt-xs mr-xs modal-with-zoom-anim btn btn-flat btn-default"><i class="fas fa-cogs"></i> Settings</button>
					</center><br />
                                    
<div class="modal fade" id="settings" role="dialog" tabindex="-1" aria-labelledby="settings" aria-hidden="true">
        <div class="modal-dialog">
			<div class="modal-content">

				<div class="modal-header">
					<button data-dismiss="modal" class="close" type="button">
					<span aria-hidden="true">&times;</span>
					</button>
					<h4 class="modal-title">Settings</h4>
				</div>

                <form action="" method="post">
				<div class="modal-body">                           
                                  <div class="row"> 
                                      <div class="col-md-12">
                                            <div class="form-group">
                                                        
                                                        <label class="col-sm-3">Scan Directory: </label>
														<div class="col-sm-9">
															<input type="text" name="scandir" class="form-control" value="<?php
echo $srow['scan-dir'];
?>" /><br />
														</div>
                                                        
                                                        <label class="col-sm-3">File Extensions Scanned:</label>
														<div class="col-sm-9">
                                                            <textarea class="form-control" name="extensions"><?php
echo $srow['file-extensions'];
?></textarea>
                                                            (Separate the file extensions with <strong>"|"</strong>)<br /><br />
														</div>
                                                        
                                                        <label class="col-sm-3">Ignored directories and files: </label>
														<div class="col-sm-9">
															<textarea class="form-control" name="ignored"><?php
echo $srow['ignored-dirs'];
?></textarea>
                                                            (Separate the ignored directories and files with <strong>"|"</strong>)<br /><br />
														</div>
                                                            
                                              </div>
                                        </div>
                                   </div>
				</div>
        
                <div class="modal-footer">
					<button data-dismiss="modal" class="btn btn-flat btn-default" type="button">Close</button>
					<input type="submit" name="save-settings" class="btn btn-flat btn-primary" value="Save" />
				</div>

                </form>
            </div>
    </div>
</div>

<?php
@set_time_limit(360);
ini_set('max_execution_time', 300); //300 Seconds = 5 Minutes
ini_set('memory_limit', '512M');

$fileExt    = $srow['file-extensions']; // File extensions
$ignoreDirs = 'security-check.php|content-protection.php|password-generator.php|badbots-protection.php|' . $srow['ignored-dirs']; // Directories & Files to ignore
$directory  = $srow['scan-dir']; // Directory to scan

$count         = 0;
$total_results = 0;

function HumanReadableFilesize($file)
{
    $size  = filesize($file);
    $mod   = 1024;
    $units = explode(' ', 'B KB MB GB TB PB');
    for ($i = 0; $size > $mod; $i++) {
        $size /= $mod;
    }
    return round($size, 2) . ' ' . $units[$i];
}

@$bdc = 'ba' . 'se' . ((8 + 8 + 8 + 8) * 2) . '_de' . 'co' . 'de';
$stre = 'cjBuaW58bTBydGl4fGlza29ycGl0eHx1cGwwYWR8cjU3c2hlbGx8Yzk5c2hlbGx8c2hlbGxib3R8cGhwc2hlbGx8dm9pZFwucnV8cGhwcmVtb3Rldmlld3xkaXJlY3RtYWlsfGJhc2hfaGlzdG9yeXxjd2luZ3N8dmFuZGFsfGJpdGNoeHxlZ2dkcm9wfGd1YXJkc2VydmljZXN8cHN5Ym5jfGRhbG5ldHx1bmRlcm5ldHx2dWxuc2NhbnxzcHltZXRhfHJhc2xhbjU4fFdlYnNoZWxsfHN0cl9yb3QxM3xGaWxlc01hbnxGaWxlc1Rvb2xzfFdlYiBTaGVsbHxpZnJtfGJja2RycHJtfGhhY2ttZXBsenx3cmdnZ3RoaGR8V1NPc2V0Y29va2llfEhtZWk3fEluYm94IE1hc3MgTWFpbGVyfEhhY2tUZWFtfEhhY2tlYWRvfEphbmlzc2FyaWVzfE1peWFjaHVuZ3xjY3RlYW18QWRtaW5lcnxPT08wMDAwMDB8JEdMT0JBTFN8ZmluZHN5c2ZvbGRlcnxtYWtlcmV0LnJ1fGMwZDNkIGJ5fEMwZGUgRm9yfFBlcmwgQXV0byBSb290ZXIgUGVybCBTY3JpcHR8Y3VybF9tdWx0aV9leGVjfGNyZWF0ZV9mdW5jdGlvbnxiMzc0a3xXZWIgU2hlbGwgYnkgYm9mZnxXZWIgU2hlbGwgYnkgb1JifGRldmlselNoZWxsfFNoZWxsIGJ5IE1hd2FyX0hpdGFtfE4zdHNoZWxsfFN0b3JtN1NoZWxsfExvY3VzN1NoZWxsfHByaXZhdGUgU2hlbGwgYnkgbTRyY298dzRjazFuZyBzaGVsbHxibGFja2hhdCBTaGVsbHxGYVRhTGlzVGlDel9GeCBGeDI5U2h8dGgzdzF0Y2ggU2hlbGx8R29vZzFlX2FuYWxpc3RSQ0JvdHxBbnRpaHV0YW58QXR0aWphcml8Qnlyb2VOZXR8Y3BmdHBjcmFja3xLQWRvdHxNdWxDaVNoZWxsfFBIUEphY2thbHxQT1NUcGU4MHxSZVp1bFR8U1JDcmV3fFNhZmUwdmVyfFNpbVNoZWxsfFN0b3JtN3xTdXJyb2dhZmllcnxUdVIzMzRWbHxVYmVyQ3JhY2tlcnxWcnMtaENrfEN5YjNyRGV2aWxzfER4U2hlbGx8RGF0YUNoYTBzfEZvcmV2ZXIyMDA4fEluc2lkZVRlYW18SXRzbVlhckR8YUtwdU1QaU58WG51eGVyfGNnaXRlbG5ldHxTaGVsbEhvb2t8UGVybG92Z2F8TWlyY2NyYWNrfENvb2tTdGVhbGVyfEJ5cGFzc3NoZWxsfHIwMHQzcnx6ZXJvY25iY3R8WWx5c2hlbGx8ZWd5c3BpZGVyfGV2aWxjMGRlcnx2aW9sYW9ldWNjMDEwMXxpVFNlY1RlYW18cHV0cjRYdFJlbWV8YVpSYWlMfGNiTG9yRHw5MS4yMzkuMTUuNjF8X1lNODJpQU58WFhSQU5ET01YWHxfUE9TVC4ubjEzZTU1OHxlbnZpcjBubkB5YWhvby5jb218JGJvZ2VsfGM5OTlzaF9zdXJsfHhWZWJhUFVSakV6TGN8QVFTUHxBTlRJUElERVJTSUF8dXphbmN8eGFkcHJpdG94fGJsYWNrYm95MDA3fG5hY29tYjEzfERldmlsemMwZGV8OGE0YmYyODI4NTJiZjRjNDllMTdmMDk1MWY2NDVlNzJ8azJsbDMzZHx0c3hwd2twcWJrfEhhY2tlckJvb3R5fEpFOHdNREJQTUU4d01EMW1iM0JsYmlna1QwOVBNRTh3fFJhd2NrZXJoZWFkfHNQTVFoTlFNUjlYTTA1Q3ZzYmcxRFRFNXZSSmlFbm58VW5peENyZXd8SG9sYUtvfDR4STBESGdNQW13RnN0RERlVGRnMjZ8ZmIwOTc5ZmE2NTFiYjkxNWQxODZhYzBmZGRjZDFiYzZ8ZmI2MjFmNTA2MGI5ZjY1YWNmOGViNDIzMmUzMDI0MTQwZGVhMmIzNHx4dW56aGFvY2FuZ2ppbmdrb25nfDEyMzMyMXxXd1cuN2p5ZXd1LkNufHpiYXpzemV6NjR6X3pkZWN6b2R6ZXxucjlTYjFlaHdwR0pvSWtjeTVMRVV4dFJWeEV6R2dsWXByNXhJeXxIYW5pWGF2aXxrX2lAb3V0bG9vay5jb218aGFuaWthZGkwQGdtYWlsLmNvbXxuYXJ1dG9AbG9jYWxob3N0LmNvbXxKU1VsSlNVbEpiRWs5SjNObGRGOTBhVzFsWDJ4cGJXbDBKenN8RHo5M2hSM2ZXbFBWUnRySDJ0eE1mK0RybUd2eXE0dHNhYXxJUkNCb3R8TG9jdXM3c3xjMTAwIFNoZWxsfFByb2plY3QgeDIzMDB8Q2FwdGFpbiBDcnVuY2ggVGVhbXxTaGFkb3cgJiBQcmVkZHl8dzRjazFuZ3xtaWx3MHJtfFJvb3RzaGVsbC5jfFNuYWlsc29yLEZ1WXUsQmxvb2RTd29yZCxDbnFpbmd8QVNQWFNweXxJcmFuaWFuIEhhY2tlcnN8SG9zc2VpbiBBc2dhcnl8U2ltQXR0YWNrZXJ8c2ltb3JnaC1ldnxCdXFYQEhvdE1haWwuQ29tfEdyYXlIYXR6IEhhY2tpbmd8S2FjYWsgRlNPfGdyYXloYXR6Lm9yZ3xUdXJrR3V2ZW5saWdpfHI1Ny5iaXp8ZXZhbGluZmVjdHwxZHQudzBsZnxodHRwOi8vZ2hjLnJ1fGV2aWxjMGRlci5jb20=';
$dstre = 'YmFzZTY0X2RlY29kZXxnemRlY29kZXxnemRlZmxhdGV8Z3p1bmNvbXByZXNzfGd6Y29tcHJlc3N8cmVhZGd6ZmlsZXx6bGliX2RlY29kZXx6bGliX2VuY29kZXxnemZpbGV8Z3pnZXR8Z3pwYXNzdGhydXxpZnJhbWV8c3RycmV2fGx6d19kZWNvbXByZXNzfHBhc3N0aHJ1fHNoZWxsX2V4ZWN8cHJvY198cG9wZW58cHJvY19vcGVufGJydXRlZm9yY2V8YnJ1dGUgZm9yY2V8ZWRvY2VkXzQ2ZXNhYnxwYXJzZV9pbmlfZmlsZXxkaXNwbGF5Om5vbmV8ZGlzcGxheT1ub25lfGRpc3BsYXk9XCdub25lXCc=';

$Strings = $bdc($stre);
$DeepScanStrings = $bdc($dstre);

$Patterns = array(
    array(
        'preg_replace\s*\(\s*[\"\']\s*(\W)(?-s).*\1[imsxADSUXJu\s]*e[imsxADSUXJu\s]*[\"\'].*\)', // [0] = RegEx search pattern
        'PHP: preg_replace Eval', // [1] = Name / Title
        'Detected preg_replace function that evaluates (executes) matched code. ' . 'This means if PHP code is passed it will be executed.', // [2] = description
        'Part example code from http://sucuri.net/malware/backdoor-phppreg_replaceeval'
    ), // [3] = More Information link
    array(
        'c999*sh_surl',
        'Backdoor: PHP:C99',
        'Detected the "C99 Shell"? Backdoor that allows attackers to manage (and ' . 'reinfect) your website remotely. It is often used as part of a ' . 'compromise to maintain access to the hacked sites.',
        'http://sucuri.net/malware/backdoor-phpc99045'
    ),
    array(
        'preg_match\s*\(\s*\"\s*/\s*bot\s*/\s*\"',
        'Backdoor: PHP:R57',
        'Detected the "R57 Shell"? Backdoor that allows attackers to access, modify and ' . 'reinfect your site. It is often hidden in the filesystem and hard to ' . 'find without access to the server or logs.',
        'http://sucuri.net/malware/backdoor-phpr5701'
    ),
    array(
        'eval[\s/\*\#]*\(stripslashes[\s/\*\#]*\([\s/\*\#]*\$_(REQUEST|POST|GET)\s*\[\s*\\\s*[\'\"]\s*asc\s*\\\s*[\'\"]',
        'Backdoor: PHP:GENERIC',
        'Detected a generic backdoor that allows attackers to upload files, delete ' . 'files, access, modify and/or reinfect your site. It is often hidden ' . 'in the filesystem and hard to find without access to the server or ' . 'logs. It also includes uploadify scripts and similars that offer ' . 'upload options without security. ',
        'http://sucuri.net/malware/backdoor-phpgeneric07'
    ),
    /*array('https?\S{1,63}\.ru',
    'Russian URL',
    'Detected a .RU domain link, as there are many attacks leading the innocent visitors to .RU pages. Maybe it\'s valid link, but leave it to you to check this out.',
    ),*/
    array(
        'preg_replace\s*\(\s*[\"\'\”]\s*/\s*\.\s*\*\s*/\s*e\s*[\"\'\”]\s*,\s*[\"\'\”]\s*\\x65\\x76\\x61\\x6c',
        'Backdoor: PHP:Filesman:02',
        'Detected the “Filesman Shell”? Backdoor that allows attackers to access, modify ' . 'and reinfect your site. It is often hidden in the filesystem and hard ' . 'to find without access to the server or logs.',
        'http://sucuri.net/malware/backdoor-phpfilesman02'
    ),
    array(
        '(include|require)(_once)*\s*[\"\'][\w\W\s/\*]*php://input[\w\W\s/\*]*[\"\']',
        'PHP:\input include',
        'Detected the method of reading input through PHP protocol handler in ' . 'include/require statements.'
    ),
    array(
        'data:;base64',
        'data:;base64 include',
        'Detected the method of executing base64 data in include.'
    ),
    array(
        'RewriteCond\s*%\{HTTP_REFERER\}',
        '.HTACCESS RewriteCond-Referer',
        'Your .htaccess file has a conditional redirection based on "HTTP Referer".' . 'This means it redirects according to site/url from where your visitors ' . 'came to your site. Such technique has been used for unwanted redirections ' . 'after coming from Google or other search engines, so check this directive carefully.'
    ),
    array(
        'jquery.min.php',
        'Fake jQuery Malware',
        'This file is infected with the Fake jQuery Malware. Removing the malware is not enough. Make sure your CMS and all its third-party components are up-to-date. All unused stuff should be ruthlessly deleted from server. Some of the compromised websites had malicious WordPress admin users with names like: backup, dpr19, loginfelix. Some of them had been created during past attacks though.'
    ),
    array(
        'GIF89a.*[\r\n]*.*<\?php',
        'PHP file desguised as GIF image',
        'Detected a PHP file that was most probably uploaded as an image via webform that loosely only checks file headers.'
    ),
    array(
        '\$ip[\w\W\s/\*]*=[\w\W\s/\*]*getenv\(["\']REMOTE_ADDR["\']\);[\w\W\s/\*]*[\r\n]\$message',
        'Probably malicious PHP script that "calls home"',
        'Detected script variations often used to inform the attackers about found vulnerable website.'
    ),
    array(
        '(?:(?:base64_decode|str_rot13)[\s\/\*\w\W\(]*){2,};',
        'Multiple encoded, most probably obfuscated code found',
        'This pattern could be used in highly encoded, malicious code hidden under ' . 'a loop of code obfuscation function calls. In most cases the decoded ' . 'hacker code goes through an eval call to execute it. This pattern is ' . 'also often used for legitimate purposes, e.g. storing configuration ' . 'information or serialised object data. '
    ),
    array(
        '<\s*iframe',
        'IFRAME Element',
        'Found IFRAME element in code. It\'s mostly benevolent, but often used ' . 'for bad stuff, so please check if it\'s a valid code.'
    ),
    array(
        'strrev[\s/\*\#]*\([\s/\*\#]*[\'"]\s*tressa\s*[\'"]\s*\)',
        'Reversed string "assert"',
        'Assert function name is being hidden behind strrev().'
    ),
    array(
        'is_writable[\s/\*\#]*\([\s/\*\#]*getcwd',
        'Is the current DIR Writable?',
        'This could be harmless, but used in some malware'
    ),
    /*array('(?:\\\\x[0-9A-Fa-f]{1,2}|\\\\[0-7]{1,3}){2,}',
    'At least two characters in hexadecimal or octal notation',
    'Found at least two characters in hexadecimal or octal notation. It '
    . 'doesn\'t mean it is malicious, but it could be code hidding behind '
    . 'such notation.'),*/
    array(
        '\$_F\s*=\s*__FILE__\s*;\s*\$_X\s*=',
        'SourceCop encoded code',
        'Found the SourceCop encoded code. It is often used for malicious code
            hidding, so go and check the code with some online SourceCop decoders'
    ),
    array(
        '(?:passthru|shell_exec|proc_|popen)[\w\W\s/\*]*\([\s/\*\#\'\"\w\W\-\_]*(?:\$_GET|\$_POST|\$_REQUEST)',
        'Shell command execution from POST/GET variables',
        'Found direct shell command execution getting variables from POST/GET,
            which is highly dangerous security flaw or a part of malicious webrootkit'
    ),
    /*array('\$\w[\w\W\s/\*]*=[\w\W\s/\*]*`.*`',
    'PHP execution operator: backticks (``)',
    'PHP execution operator found. Note that these are not single-quotes!
    PHP will attempt to execute the contents of the backticks as a shell
    command, which might indicate a part of a web rootkit'),*/
    array(
        'fsockopen\s*\(\s*[ \'\"](?:localhost|127\.0\.0\.1)[ \'\"]',
        'Opening socket to localhost',
        'Found code opening socket to localhost, it\'s worth investigating more'
    ),
    array(
        'fsockopen\s*\(.*,\s*[ \'\"](?:25|587|465|475|2525)[ \'\"]',
        'Opening socket to known SMTP ports, possible SPAM script',
        'Found opening socket to known SMTP ports, possible SPAM script'
    ),
    array(
        '(?:readfile|popen)\s*\(\s*[ \'\"]*\s*(?:file|http[s]*|ftp[s]*|php|zlib|data|glob|phar|ssh2|rar|ogg|expect|\$POST|\$GET|\$REQUEST)',
        'Reading streams or superglobal variables with fopen wrappers present',
        'Found functions reading data from streams/wrappers - please analyze the code'
    ),
    array(
        'array_(?:diff_ukey|diff_uassoc|intersect_uassoc|udiff_uassoc|udiff_assoc|uintersect_assoc|uintersect_uassoc)\s*\(.*(?:\$_REQUEST|\$_POST|\$_GET).*;',
        'Callback function comming from REQUEST/POST/GET variable possible',
        'Found possible local execution enabling-script receiving data from POST or GET requests'
    ),
    /*array(
    '^(((.*)(=|;)(\s*)?)|((@|\s)*))extract\s*\(',
    'Extract Function',
    'PHP extract function found. Extract creates variables from an array (eg $_POST, $_GET or $_REQUEST). It can be legit, but if there is some strange code execution like $extracted_variable_1($extracted_variable_2) it should be malicious.'
    ),*/
    array(
        '^(((.*)(=|;)(\s*)?)|((@|\s)*))(include|require)(_once)?\s*\(?("|\')https?://',
        'Remote Include',
        'Include or require which includes a remote file. It should be malicious, and vulnerable as well.'
    ),
    array(
        '\\\\x([abcdef0-9]{2}){3,}',
        'Hex Encoded String',
        'Code which is hex encoded. It can be legit, but not a usual thing. Malicious users can hide their functions in hex encoded expressions.'
    )
);

$FileNames = array(
    'Probably an OpenFlashChart library demo file that has known input ' . 'validation error (CVE-2009-4140)' => 'ofc_upload_image.php',
    'Probably an R57 shell' => 'r57.php',
    'Probably a C99 shell' => 'c99.php',
    'Probably a C100 shell' => 'c100.php',
    'PhpInfo() file? It is advisable to remove such file, as it could reveal too
        much info to potential attackers' => 'phpinfo.php',
    'PerlInfo() file? It is advisable to remove such file, as it could reveal too
        much info to potential attackers' => 'perlinfo.php'
);

// check if DeepScan should be done
if (isset($_GET['deep_scan'])) {
    $patterns = array_merge($Patterns, explode('|', $Strings), explode('|', $DeepScanStrings));
} else {
    $patterns = array_merge($Patterns, explode('|', $Strings));
}
$ext = explode('|', $fileExt);

function get_filelist($dir)
{
    global $ignoreDirs;
    $ignoreArr = explode('|', $ignoreDirs);
    
    $path      = '../../';
    $toResolve = array(
        $dir
    );
    while ($toResolve) {
        $thisDir = array_pop($toResolve);
        if (@$dirContent = scandir($thisDir)) {
            foreach ($dirContent As $content) {
                if (!in_array($content, $ignoreArr)) {
                    $thisFile = "$thisDir/$content";
                    if (is_file(@$thisFile)) {
                        scan_file($thisFile);
                    } else {
                        $toResolve[] = $thisFile;
                    }
                }
            }
        }
    }
    
}

function scan_file($path)
{
    global $ext, $patterns, $count, $total_results, $FileNames;
    $dateformat = "d F Y - H:i:s ";
    
    if (in_array(pathinfo($path, PATHINFO_EXTENSION), $ext) && filesize($path) && !stripos($path, 'malware-scanner.php')) {
        
        if ($malic_file_descr = array_search(pathinfo($path, PATHINFO_BASENAME), $FileNames)) {
            echo '<tr>
                    <td>' . basename($path) . '</td>
                    <td>Suspicious FileName</td>
                    <td> - </td>
                    <td>' . substr(sprintf('%o', fileperms($path)), -4) . '</td>
					<td>' . date($dateformat, filemtime($path)) . '</td>
                    <td><a href="' . $path . '" target="_blank" class="btn btn-flat btn-primary"><i class="fas fa-folder-open"></i> Open</a>
					<button data-target="#details-' . pathinfo($path, PATHINFO_FILENAME) . '" data-toggle="modal" class="btn btn-flat btn-success"><i class="fas fa-file-alt"></i> Details</button>
					<a href="?ignore=' . basename($path) . '" class="btn btn-flat btn-danger"><i class="fas fa-ban"></i> Ignore</a></td>
                    
<div class="modal fade" id="details-' . pathinfo($path, PATHINFO_FILENAME) . '" role="dialog" tabindex="-1" aria-labelledby="details-' . pathinfo($path, PATHINFO_FILENAME) . '" aria-hidden="true">
        <div class="modal-dialog">
			<div class="modal-content">

				<div class="modal-header">
					<button data-dismiss="modal" class="close" type="button">
					<span aria-hidden="true">&times;</span>
					</button>
					<h4 class="modal-title">Details</h4>
				</div>
                
                <div class="modal-body">
                                <div class="row"> 
                                      <div class="col-md-12">
                                            <div class="form-group">
                                            
														<label class="col-sm-3 control-label"><i class="fas fa-file-alt"></i> File Name: </label>
														<div class="col-sm-9">
															<input type="text" name="name" class="form-control" value="' . basename($path) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-flag"></i> Path:</label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . $path . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-lock"></i> Permission: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . substr(sprintf('%o', fileperms($path)), -4) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-key"></i> Last Accessed: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . date($dateformat, fileatime($path)) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-edit"></i> Last Modified: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . date($dateformat, filemtime($path)) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-folder"></i> File Size: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . HumanReadableFilesize($path) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-cog"></i> MD5 Hash: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . md5_file($path) . '" readonly /><br />
														</div>
                                                        
                                                    </div>
                                                </div>
                                            </div>
				                   </div>
								
                                   <div class="modal-footer">
				                    	<button data-dismiss="modal" class="btn btn-flat btn-primary" type="button">Close</button>
				                   </div>
				         </div>
                    </div>
             </div>
                    </tr>';
        }
        
        if (!($content = file_get_contents($path))) {
            $error = 'Could not check ' . $path;
        } else {
            
            foreach ($patterns As $pattern) {
                if (is_array($pattern)) {
                    preg_match_all('#' . $pattern[0] . '#isS', $content, $found, PREG_OFFSET_CAPTURE);
                } else {
                    preg_match_all('#' . $pattern . '#isS', $content, $found, PREG_OFFSET_CAPTURE);
                }
                $all_results   = $found[0];
                $results_count = count($all_results);
                $total_results += $results_count;
                if (!empty($all_results)) {
                    $count++;
                    if (is_array($pattern)) {
                        echo '<tr>
                         <td>' . basename($path) . '</td>
                         <td><font color="red"><i>' . $pattern[1] . '</i></font></td>
                         <td>' . $results_count . '</td>
                         <td>' . substr(sprintf('%o', fileperms($path)), -4) . '</td>
						 <td>' . date($dateformat, filemtime($path)) . '</td>
                         <td><a href="' . $path . '" target="_blank" class="btn btn-flat btn-primary"><i class="fas fa-folder-open"></i> Open</a>
						 <button data-target="#details-' . $count . '" data-toggle="modal" class="btn btn-flat btn-success"><i class="fas fa-file-alt"></i> Details</button>
						 <a href="?ignore=' . basename($path) . '" class="btn btn-flat btn-danger"><i class="fas fa-ban"></i> Ignore</a></td>
                        
<div id="" class="zoom-anim-dialog modal-block modal-header-color modal-block-danger mfp-hide">
<div class="modal fade" id="details-' . $count . '" role="dialog" tabindex="-1" aria-labelledby="details-' . $count . '" aria-hidden="true">
        <div class="modal-dialog">
			<div class="modal-content">

				<div class="modal-header">
					<button data-dismiss="modal" class="close" type="button">
					<span aria-hidden="true">&times;</span>
					</button>
					<h4 class="modal-title">Details</h4>
				</div>
                
                <div class="modal-body">
                                <div class="row"> 
                                      <div class="col-md-12">
                                            <div class="form-group">
                                            
														<label class="col-sm-3 control-label"><i class="fas fa-file-alt"></i> File Name: </label>
														<div class="col-sm-9">
															<input type="text" name="name" class="form-control" value="' . basename($path) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-flag"></i> Path:</label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . $path . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-lock"></i> Permission: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . substr(sprintf('%o', fileperms($path)), -4) . '" readonly />
                                                            ';
                        $permissions = substr(sprintf('%o', fileperms($path)), -4);
                        if (intval($permissions) == 777) {
                            $permissions = '<font color="orange">(Please note: The file have full access permissions)</font><br /><br />';
                        } else {
                            echo '<br />';
                        }
                        echo '
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-key"></i> Last Accessed: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . date($dateformat, fileatime($path)) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-edit"></i> Last Modified: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . date($dateformat, filemtime($path)) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-folder"></i> File Size: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . HumanReadableFilesize($path) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-cog"></i> MD5 Hash: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . md5_file($path) . '" readonly /><br />
														</div>
														
														<label class="col-sm-3 control-label"><i class="fas fa-folder"></i> Threat Description: </label>
														<div class="col-sm-9">
															<textarea type="text" class="form-control" rows="7" readonly />' . $pattern[2] . '</textarea><br />
														</div>
														
														';
                        foreach ($all_results as $match) {
                            echo '<span class="offset">Line #: ', calculate_line_number($match[1], $content), '</span>', "<pre>... " . htmlentities(substr($content, $match[1], 200), ENT_QUOTES) . " ...</pre>\n";
                        }
                        echo '
                                                    </div>
                                                </div>
                                            </div>
				                   </div>
                                            
								   <div class="modal-footer">
				                    	<button data-dismiss="modal" class="btn btn-flat btn-primary" type="button">Close</button>
				                   </div>
				         </div>
                    </div>
             </div>
                        ';
                    } else {
                        echo '<tr>
                         <td>' . basename($path) . '</td>
                         <td><font color="red"><i>' . $pattern . '</i></font></td>
                         <td>' . $results_count . '</td>
                         <td>' . substr(sprintf('%o', fileperms($path)), -4) . '</td>
						 <td>' . date($dateformat, filemtime($path)) . '</td>
                         <td><a href="' . $path . '" target="_blank" class="btn btn-flat btn-primary"><i class="fas fa-folder-open"></i> Open</a>
						 <button data-target="#details-' . $count . '" data-toggle="modal" class="btn btn-flat btn-success"><i class="fas fa-file-alt"></i> Details</button>
						 <a href="?ignore=' . basename($path) . '" class="btn btn-flat btn-danger"><i class="fas fa-ban"></i> Ignore</a></td>
                        
<div id="" class="zoom-anim-dialog modal-block modal-header-color modal-block-danger mfp-hide">
<div class="modal fade" id="details-' . $count . '" role="dialog" tabindex="-1" aria-labelledby="details-' . $count . '" aria-hidden="true">
        <div class="modal-dialog">
			<div class="modal-content">

				<div class="modal-header">
					<button data-dismiss="modal" class="close" type="button">
					<span aria-hidden="true">&times;</span>
					</button>
					<h4 class="modal-title">Details</h4>
				</div>
                
                <div class="modal-body">
                                <div class="row"> 
                                      <div class="col-md-12">
                                            <div class="form-group">
                                            
														<label class="col-sm-3 control-label"><i class="fas fa-file-alt"></i> File Name: </label>
														<div class="col-sm-9">
															<input type="text" name="name" class="form-control" value="' . basename($path) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-flag"></i> Path:</label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . $path . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-lock"></i> Permission: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . substr(sprintf('%o', fileperms($path)), -4) . '" readonly />
                                                            ';
                        $permissions = substr(sprintf('%o', fileperms($path)), -4);
                        if (intval($permissions) == 777) {
                            $permissions = '<font color="orange">(Please note: The file have full access permissions)</font><br /><br />';
                        } else {
                            echo '<br />';
                        }
                        echo '
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-key"></i> Last Accessed: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . date($dateformat, fileatime($path)) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-edit"></i> Last Modified: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . date($dateformat, filemtime($path)) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-folder"></i> File Size: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . HumanReadableFilesize($path) . '" readonly /><br />
														</div>
                                                        
                                                        <label class="col-sm-3 control-label"><i class="fas fa-cog"></i> MD5 Hash: </label>
														<div class="col-sm-9">
															<input type="text" class="form-control" value="' . md5_file($path) . '" readonly /><br />
														</div>
														
														<label class="col-sm-3 control-label"><i class="fas fa-folder"></i> Threat Description: </label>
														<div class="col-sm-9">
															<textarea type="text" class="form-control" rows="7" readonly />Suspicious string used: ' . $pattern . '</textarea><br />
														</div>
														
														';
                        foreach ($all_results as $match) {
                            echo '<span class="offset">Line #: ', calculate_line_number($match[1], $content), '</span>', "<pre>... " . htmlentities(substr($content, $match[1], 200), ENT_QUOTES) . " ...</pre>\n";
                        }
                        echo '
                                                    </div>
                                                </div>
                                            </div>
				                   </div>
                                            
								   <div class="modal-footer">
				                    	<button data-dismiss="modal" class="btn btn-flat btn-primary" type="button">Close</button>
				                   </div>
				         </div>
                    </div>
             </div>
                        ';
                    }
                    echo '
                    </tr>
                    ';
                }
            }
            unset($content);
        }
    }
}


function calculate_line_number($offset, $file_content)
{
    @list($first_part) = str_split($file_content, $offset);
    $line_nr = strlen($first_part) - strlen(str_replace("\n", "", $first_part)) + 1;
    return $line_nr;
}
?>
                                    
                                    <table id="dt-basic" class="table table-striped table-bordered table-hover" cellspacing="0" width="100%">
						            <thead> 
										<tr>
										  <th>Infected File</th>
						                  <th>Malware Type</th>
										  <th>Occurences</th>
										  <th>File Permissions</th>
										  <th>Last Modified</th>
										  <th>Actions</th>
						                </tr>
									</thead>
                                   <tbody>
<?php
$before = microtime(true);
get_filelist($directory);
?>
						            </tbody>
									</table>
<?php
$after     = microtime(true);
$totaltime = mb_substr(($after - $before), 0, 4);
echo 'The scan found <strong>', $total_results, ' suspicious malware code spots</strong> in <u>', $count, ' different files</u>!<br/>';
echo 'Scanning time was <strong>' . $totaltime . ' seconds</strong> <br>';
?>
                                                
                            
                        </div>
                     </div>
                </div>
				</div>
                    
				</div>
				<!--===================================================-->
				<!--End page content-->


			</div>
			<!--===================================================-->
			<!--END CONTENT CONTAINER-->

<script>
$(document).ready(function() {

	$('#dt-basic').dataTable( {
		"responsive": true,
		"language": {
			"paginate": {
			  "previous": '<i class="fas fa-angle-left"></i>',
			  "next": '<i class="fas fa-angle-right"></i>'
			}
		}
	} );
} );
</script>    
<?php
footer();
?>