ET MALWARE Executable Download Purporting to be JavaScript likely 2nd stage Infection

7.0.35.0SID: 2013352Rev: 6Enabled2 views
Sourceet/open
Fileemerging-malware.rules
CreatedAugust 4, 2011
UpdatedMarch 6, 2024
Classificationtrojan-activity
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Executable Download Purporting to be JavaScript likely 2nd stage Infection"; flow:established,to_client; http.stat_code; content:"200"; http.content_type; content:"application/x-javascript"; nocase; startswith; file.data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; fast_pattern; classtype:trojan-activity; sid:2013352; rev:6; metadata:created_at 2011_08_04, signature_severity Major, updated_at 2024_03_06;)

Metadata

created at2011_08_04
signature severityMajor
updated at2024_03_06

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!