alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE JS/Nemucod.M.gen downloading PDF payload"; flow:from_server,established; flowbits:isset,ET.nemucod.pdfrequest; file_data; content:"%PDF-"; within:5; fast_pattern; reference:url,www.certego.net/en/news/italian-spam-campaigns-using-js-nemucod-downloader/; reference:md5,0bc86ab7ead67e264531ccb16c3c529a; classtype:trojan-activity; sid:2021955; rev:2; metadata:created_at 2015_10_15, malware_family JS_Nemucod_M_gen, signature_severity Major, updated_at 2019_07_26;)