On Wed, October 19, 2016 3:12 pm, Joel Esler (jesler) wrote: > Heino, > > > Can you clarify which sig caught it? > > > Doc.Dropper.Agent-177659 is not an actual sig number. Damn cut and paste... it's: Doc.Dropper.Agent-1776597 (a hash) -- Cheers, Steve Twitter: @sanesecurity