ET MALWARE Possible Malicious Macro DL EXE Feb 2016

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Possible Malicious Macro DL EXE Feb 2016";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:".exe"; nocase; endswith; fast_pattern;
    pcre:"/(?:\/(?:(?:p(?:lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(?:nel\/includes\/[^\x2f]+|tric)|o(?:sts?\/[a-z0-9]+|ny[a-z]*)|rogcicicic|m\d{1,2})|s(?:ystem\/(?:logs|engine)\/[^\x2f]+?|e(?:rv(?:au|er)|ct)|vchost[^\x2f]*|gau\/.*?|alam|ucks|can|ke)|(?=[a-z]*[0-9])(?=[0-9]*[a-z])(?!setup\d+\.exe$)[a-z0-9]{5,10}|in(?:voice(?:\/[^\x2f]+|[^\x2f]*)|st\d+|fos?)|a(?:d(?:min\/images\/\w+|obe)|salam|live|us)|m(?:edia\/files\/\w+|a(?:cros?|rch)|soffice)|d(?:o(?:c(?:\/[a-z0-9]+)?|ne)|bust)|(?:~.+?\/\.[^\x2f]+|\.css)\/.+?|c(?:onfig|hris|alc)|u(?:swinz\w+|pdate)|xml\/load\/[^\x2f]+|(?:[Dd]ocumen|ve)t|Ozonecrytedserver|w(?:or[dk]|insys)|t(?:mp\/.+?|est)|fa(?:cture|soo)|n(?:otepad|ach)|k(?:be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe$|(?:(?=[a-z0-9]*?[3456789][a-z0-9]*?[3456789])(?=[a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(?:^\/(?:image\/.+?\/[^\x2f]+|x\/setup)|[\x2f\s]order|keem)\.exe$)/i";
    http.user_agent;
    content:"Mozilla/4.0 (compatible|3b 20|MSIE 7.0|3b 20|Windows NT";
    http.host;
    content:!"7zip.org";
    content:!".bloomberg.com";
    content:!".bitdefender.com";
    content:!".microsoft.com"; endswith;
    http.accept;
    content:"*/*"; depth:3; endswith;
    http.accept_enc;
    content:"gzip, deflate"; depth:13; endswith;
    http.header_names;
    content:"|0d 0a|Accept|0d 0a|"; depth:10;
    content:!"Referer";
    content:!"Cookie";
    classtype:trojan-activity;
    sid:2022550; rev:21;
    metadata:affected_product MS_Office, attack_target Client_Endpoint, created_at 2016_02_19, deployment Perimeter, malware_family MalDocGeneric, performance_impact Moderate, confidence Medium, signature_severity Major, tag MalDoc, updated_at 2024_05_01;
)