ET MALWARE Inbound JasperLoader Using Array Push Obfuscation

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET MALWARE Inbound JasperLoader Using Array Push Obfuscation";
    flow:established,from_server;
    http.stat_code;
    content:"200";
    file.data;
    content:"|20|=|20|new|20|Array|28 29 3b|"; depth:50;
    content:".push|28 22|"; distance:0;
    pcre:"/^(?:\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?<pushvar>\.push\x28\x22)(?:\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?P=pushvar)(?:[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?P=pushvar)(?:[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?P=pushvar)/Ri";
    content:".push|28 22 22 29 0d 0a|"; fast_pattern;
    content:"eval|28|"; distance:0;
    classtype:trojan-activity;
    sid:2027102; rev:5;
    metadata:attack_target Client_Endpoint, created_at 2019_03_19, deployment Perimeter, malware_family JasperLoader, performance_impact Low, confidence Medium, signature_severity Major, tag Downloader, tag JavaScript, updated_at 2020_08_28;
)