False positive {HEX}php.cmdshell.gifheader.400

[vladki77]

Hello, thanks for the fix of #493, but for me the files that were previously detected as php.polyshell.jfif.phpcomment.704 are now detected as php.cmdshell.gifheader.400 (and 399 and 397). They are web archives, and wordpress, joomla and yii install packages

{HEX}php.cmdshell.gifheader.396:0::474946383961013b3c3f706870
{HEX}php.cmdshell.gifheader.397:0::474946383961013b??3c3f706870
{HEX}php.cmdshell.gifheader.398:0::474946383961013b????3c3f706870
{HEX}php.cmdshell.gifheader.399:0::474946383961013b??????3c3f706870
{HEX}php.cmdshell.gifheader.400:0::474946383961013b????????3c3f706870