alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Kelihos.F EXE Download Common Structure 2"; flow:established,to_server; http.uri; content:"od"; offset:2; depth:2; nocase; content:".exe"; nocase; endswith; fast_pattern; pcre:"/^\/[mp]od[12]\/[^\/]+?\.exe$/i"; http.header_names; content:"|0d 0a|Host|0d 0a|"; depth:8; content:!"User-Agent"; reference:md5,9db28205c8dd40efcf7f61e155a96de5; classtype:trojan-activity; sid:2018395; rev:8; metadata:created_at 2014_04_16, performance_impact Significant, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_08;)