ET CURRENT_EVENTS JJEncode Encoded Script Inside of PDF Likely Evil
Sourceet/open
CreatedNovember 30, 2013
UpdatedJuly 26, 2019
Classificationtrojan-activity
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS JJEncode Encoded Script Inside of PDF Likely Evil"; flow:established,from_server; flowbits:isset,ET.pdf.in.http; file_data; content:"|2c 24 24 24 24 3a 28 21 5b 5d 2b 22 22 29 5b|"; reference:md5,6776bda19a3a8ed4c2870c34279dbaa9; classtype:trojan-activity; sid:2017789; rev:4; metadata:created_at 2013_11_30, confidence Medium, signature_severity Minor, updated_at 2019_07_26;)
References
| md5 | 6776bda19a3a8ed4c2870c34279dbaa9 |
Metadata
created at2013_11_30
confidenceMedium
signature severityMinor
updated at2019_07_26
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!