diff --git a/src/Signatures.php b/src/Signatures.php
index 98ffaf9..0598b33 100644
--- a/src/Signatures.php
+++ b/src/Signatures.php
@@ -3511,6 +3511,7 @@ class Signatures
         'preg_match\\("/\\$spider/"\\s*,\\s*\\$uagent',
         'echo\\s*eval\\s*/\\*\\*/\\s*\\(\'\\?>\'\\s*\\.\\s*join\\(""\\s*,\\s*file',
         'move_uploaded_file.*\\$_FILES\\["filename"\\]\\["tmp_name"\\].*\\$_FILES\\["filename"\\]\\["name"\\]',
+        'eval\\("\\?\\>"\\.gzinflate\\(base64_decode\\(\\$x\\)\\)\\);',
     ];
 
     /**
diff --git a/tests/Fixtures/malware/create_function_eval.php b/tests/Fixtures/malware/create_function_eval.php
new file mode 100644
index 0000000..4b9e1f3
--- /dev/null
+++ b/tests/Fixtures/malware/create_function_eval.php
@@ -0,0 +1,5 @@
+<?php
+
+$func = 'create_function';
+$b374k = $func('$x', 'eval("?>".gzinflate(base64_decode($x)));');
+$b374k('...base64 payload...');