alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED pamdql Exploit Kit 09/25/12 Sending PDF"; flow:established,from_server; content:"application/pdf|0d 0a|"; fast_pattern:only; http_header; pcre:"/^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$/C"; file_data; content:"%PDF-"; within:5; classtype:exploit-kit; sid:2015725; rev:9; metadata:created_at 2012_09_21, signature_severity Unknown, updated_at 2021_06_23;)