ET CURRENT_EVENTS JJEncode Encoded Script Inside of PDF Likely Evil

7.0.35.0SID: 2017789Rev: 5Disabled1 views
Sourceet/open
Fileemerging-current_events.rules
CreatedNovember 30, 2013
UpdatedMarch 13, 2024
Classificationtrojan-activity
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS JJEncode Encoded Script Inside of PDF Likely Evil"; flow:established,to_client; flowbits:isset,ET.pdf.in.http; file.data; content:"|2c 24 24 24 24 3a 28 21 5b 5d 2b 22 22 29 5b|"; reference:md5,6776bda19a3a8ed4c2870c34279dbaa9; classtype:trojan-activity; sid:2017789; rev:5; metadata:created_at 2013_11_30, confidence Medium, signature_severity Minor, updated_at 2024_03_13;)

References

md5
6776bda19a3a8ed4c2870c34279dbaa9
Google SearchBrave Search

Metadata

created at2013_11_30
confidenceMedium
signature severityMinor
updated at2024_03_13

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!