alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Jimdo.com Phishing PDF via HTTP"; flow:established,from_server; file_data; content:"/Subtype/Link/Rect"; content:"/BS<</W 0>>/F 4/A<</Type/Action/S/URI/URI (http|3a|//"; distance:0; content:".jimdo.com/)>"; distance:0; fast_pattern; content:"www.Neevia.com"; distance:0; content:"Neevia Document Converter"; distance:0; reference:md5,70eaba2ab6410e3541a2e24a482ddddd; classtype:social-engineering; sid:2022029; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_11_04, deployment Perimeter, confidence Medium, signature_severity Major, tag Phishing, updated_at 2019_07_26;)