""ET TROJAN APT_NGO_wuaclt PDF file""

SID: 2016579

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2013_03_15, updated_at 2013_03_15

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: from_server,established

Contents:

  • Value: "%PDF-"

  • Value: "|3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A|"

Within: 200

PCRE:

Special Options:

  • file_data

source