ET PHISHING Javascript XOR Encoding - Observed in Apple Phishing 2016-12-09

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET PHISHING Javascript XOR Encoding - Observed in Apple Phishing 2016-12-09";
    flow:from_server,established;
    http.stat_code;
    content:"200";
    http.content_type;
    content:"text/html"; startswith;
    file.data;
    content:"strHTML=|22 22 3b|"; nocase; within:100; fast_pattern;
    content:"strHTML+=|22|"; within:11;
    content:"function XOR"; nocase; distance:0;
    content:"strPass"; nocase; distance:0;
    content:"binl2b64"; nocase; distance:0;
    content:"core_hmac_md5"; nocase; distance:0;
    content:"hex_hmac_md5"; nocase; distance:0;
    classtype:social-engineering;
    sid:2032200; rev:3;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_12_09, deployment Perimeter, confidence Medium, signature_severity Major, tag Phishing, updated_at 2020_08_03;
)