Creating Yara Rules about malstrom

[burdenless]

@adimenia I need to open up the restrictions on the syntax check, but if you format your rules similar to the way I have below, it should work. Assuming you don't have any comments preceding the rule keyword.

rule php_in_image {
    strings:
        $gif = /^GIF8[79]a/
        $jfif = { ff d8 ff e? 00 10 4a 46 49 46 }
        $png = { 89 50 4e 47 0d 0a 1a 0a }

        $php_tag = "<?php"
    condition:
        (($gif at 0) or
        ($jfif at 0) or
        ($png at 0)) and

        $php_tag
}