""ET CURRENT_EVENTS Nuclear EK PDF URI Struct""

SID: 2017636

Revision: 12

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_10_28, deployment Perimeter, malware_family Nuclear, signature_severity Critical, tag Exploit_Kit, tag Nuclear, updated_at 2022_05_03

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: ".pdf"

• Value: "/1"

Within:

PCRE: "/^Referer\x3a[^\r\n]+?\/[a-z0-9A-Z_-]{26,}.html(?:\x3a\d{1,5})?\r$/Hm"

Special Options:

• http_uri

• http_uri

source