Versions (5)
Version DetailsCurrent
Rev: 3 • May 16, 2013, 12:00 PMET MALWARE Embedded ZIP/APK File With Fake Windows Executable Header - Possible AV Bypass Attempt
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Embedded ZIP/APK File With Fake Windows Executable Header - Possible AV Bypass Attempt"; flow:established,to_client; file_data; content:"MZ"; within:2; content:"This program"; distance:0; content:"PK|03|"; distance:0; content:"classes."; distance:0; reference:url,research.zscaler.com/2013/03/guess-who-am-i-pe-or-apk.html; classtype:trojan-activity; sid:2016855; rev:3; metadata:created_at 2013_05_16, deprecation_reason False_Positive, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_13;)
May 16, 2013, 12:00 PM
Feb 13, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
Dec 15, 2025, 10:34 PM
rules/emerging-malware.rules