alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE USPS Spam/Trojan Executable Download"; flow:established,to_client; http.header; content:"filename=USPS_Invoice"; fast_pattern; content:".exe"; within:32; reference:url,www.virustotal.com/file-scan/report.html?id=41866ac1950b620bd13fb3d6063e3781eaa3bbccb3089b13073abe752d0a6ffa-1318350235; classtype:trojan-activity; sid:2013770; rev:8; metadata:created_at 2011_10_12, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_08;)