alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Generic - 8Char.JAR Naming Algorithm"; flow:established,to_client; http.header; content:"-Disposition|3a 20|inline"; nocase; content:".jar"; fast_pattern; pcre:"/[=\"]\w{8}\.jar/i"; file.data; content:"PK"; depth:2; classtype:trojan-activity; sid:2015050; rev:6; metadata:created_at 2012_07_12, confidence Medium, signature_severity Major, updated_at 2020_11_05;)