ET MALWARE Possible Malicious Macro EXE DL AlphaNumL

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Possible Malicious Macro EXE DL AlphaNumL";
    flow:established,to_server;
    urilen:10<>40;
    http.uri;
    content:".exe"; fast_pattern; offset:5;
    pcre:"/\/(?=[0-9]*?[a-z]*?[a-z0-9)(?=[a-z0-9]*[0-9][a-z]*[0-9][a-z0-9]*\.exe)(?!setup\d+\.exe)[a-z0-9]{5,15}\.exe/";
    http.header;
    content:"Accept|3a 20|*/*|0d 0a|"; depth:13;
    http.host;
    content:!".bloomberg.com";
    content:!"leg1.state.va.us";
    content:!"7-zip.org";
    content:!"virginia.gov";
    http.user_agent;
    content:"Mozilla/4.0 (compatible|3b 20|MSIE 7.0|3b 20|Windows NT"; depth:45;
    http.accept_enc;
    content:"gzip, deflate"; bsize:13;
    http.header_names;
    content:!"Referer|0d 0a|";
    classtype:trojan-activity;
    sid:2022566; rev:8;
    metadata:created_at 2016_02_26, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_08_20;
)