ET MALWARE Backdoor.Win32.PcClient.bal CnC (OUTBOUND) 2

alert tcp $HOME_NET any -> $EXTERNAL_NET !139 (
    msg:"ET MALWARE Backdoor.Win32.PcClient.bal CnC (OUTBOUND) 2";
    flow:to_server,established;
    content:"|12 12|"; offset:2; depth:2;
    content:!"|12 12|"; within:2;
    content:"|12 12|"; distance:2; within:2;
    content:!"|12 12|"; within:2;
    content:"|12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12|";
    pcre:"/[^\x12][^\x4e\x38\x39\x2f\x6e\x28\x29\x30\x2d\x2e\x2c\x3e\x31\x18][\x40-\x48\x4a-\x4d\x31-\x34\x3a-\x3c\x3f\x50-\x5f\x60-\x6c\x6f\x73-\x7f\x70\x71\x20-\x27\x2a\x2b]{1,14}\x12/R";
    reference:md5,00ccc1f7741bb31b6022c6f319c921ee;
    classtype:command-and-control;
    sid:2019202; rev:4;
    metadata:created_at 2014_09_22, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)