flow:established,from_server; file_data; content:"plugin_pdf_ie()"; classtype:trojanactivity; reference:url,pwc.blogs.com/cyber_security_updates/2014/10/scanboxframework-whos-affected-and-whos-using-it-1.html; metadata:tlp WHITE,author CDD;