roadwy-DefenderYara/Exploit/WinNT/SuspJavaExploit/Exploit_WinNT_SuspJavaExploit_D.yar

rule Exploit_WinNT_SuspJavaExploit_D{
	meta:
		description = "Exploit:WinNT/SuspJavaExploit.D,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 03 00 00 01 00 "
		
	strings :
		$a_00_0 = {77 67 65 74 20 68 74 74 70 3a 2f 2f 31 35 32 2e 36 37 2e 36 33 2e 31 35 30 2f 70 79 } //01 00 
		$a_00_1 = {63 68 6d 6f 64 20 37 37 37 20 70 79 } //01 00 
		$a_00_2 = {2e 2f 70 79 20 72 63 65 2e 78 38 36 } //00 00 
	condition:
		any of ($a_*)
 
}