alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP AdWare.Win32.Yotoon.hs Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/product-am.php?id="; fast_pattern; content:"&v="; content:"&offer["; distance:0; http.user_agent; content:"NSISDL/1.2 (Mozilla)"; depth:20; http.header_names; content:!"Referer|0d 0a|"; reference:md5,20c7226185ed7999e330a46d3501dccb; classtype:pup-activity; sid:2018307; rev:7; metadata:created_at 2014_03_19, signature_severity Minor, updated_at 2020_10_12;)