Could be a whitespace character issue. Try to see if ClamAV normalizes
your php script:
clamscan --debug --leave-temps --tempdir=yourtempdir yourphpscript.php
Go to yourtempdir and see if there is a file(s) there. Look for any
differences between it and your original file. Base your signature on
I'm having some issues creating a hex signature to match some PHP code
I've run across. I've pulled the snippet of the PHP code that I want to
match on and created the signature using sigtool --hex-dump, but when I
try testing against it, there are no matches. However, if I convert the
entire PHP
