sig_20151006_71007e5a891fbc3f1f25a3a715305565

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - file 20151006_71007e5a891fbc3f1f25a3a715305565.js

rule sig_20151006_71007e5a891fbc3f1f25a3a715305565 {
  meta:
    description = "datamaliciousorder - file 20151006_71007e5a891fbc3f1f25a3a715305565.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "0259356c2eff905810e3bfd5fa105beeb42a33460991e13d28b3ba2bf9d2d6e3"

  strings:
    $s1  = "function spqf() { esmw += 'me'; }; function urgr() { esmw += 'k.com'; }; function guxj() { esmw += 'on'; }; function cfvi() { es" ascii
    $s2  = "function spqf() { esmw += 'me'; }; function urgr() { esmw += 'k.com'; }; function guxj() { esmw += 'on'; }; function cfvi() { es" ascii
    $s3  = "function qnbd() { esmw += '\"GET'; }; function qwaw() { esmw += 'ullNa'; }; function jlap() { esmw += ' b'; }; function cczk() {" ascii
    $s4  = "function mirg() { esmw += '.Cr'; }; function cga() { esmw += ' xa'; }; function ckqr() { esmw += '.exe\"'; }; function wid() { e" ascii
    $s5  = "function jcqz() { esmw += 'var d'; }; function xew() { esmw += 'com w'; }; function bkgj() { esmw += '.Str'; }; function iebw() " ascii
    $s6  = "function jcqz() { esmw += 'var d'; }; function xew() { esmw += 'com w'; }; function bkgj() { esmw += '.Str'; }; function iebw() " ascii
    $s7  = "function qnbd() { esmw += '\"GET'; }; function qwaw() { esmw += 'ullNa'; }; function jlap() { esmw += ' b'; }; function cczk() {" ascii
    $s8  = "function wvq() { esmw += '\"+b[i'; }; function xdkz() { esmw += '.ope'; }; function rvb() { esmw += '\"); '; }; function bflm() " ascii
    $s9  = "function vfg() { esmw += 'Resp'; }; function vgsb() { esmw += 'dn ='; }; function oozu() { esmw += '.XML'; }; function xpkm() { " ascii
    $s10 = "function mirg() { esmw += '.Cr'; }; function cga() { esmw += ' xa'; }; function ckqr() { esmw += '.exe\"'; }; function wid() { e" ascii
    $s11 = "function pyh() { esmw += 'pt.Sh'; }; function bwd() { esmw += '=\"+f'; }; function oww() { esmw += 'http:'; }; function zqt() { " ascii
    $s12 = "function pyh() { esmw += 'pt.Sh'; }; function bwd() { esmw += '=\"+f'; }; function oww() { esmw += 'http:'; }; function zqt() { " ascii
    $s13 = "function vfg() { esmw += 'Resp'; }; function vgsb() { esmw += 'dn ='; }; function oozu() { esmw += '.XML'; }; function xpkm() { " ascii
    $s14 = "function wvq() { esmw += '\"+b[i'; }; function xdkz() { esmw += '.ope'; }; function rvb() { esmw += '\"); '; }; function bflm() " ascii
    $s15 = "function lud() { esmw += 'Sc'; }; function ktv() { esmw += ' xo'; }; function xtfi() { esmw += '; }'; }; function ypk() { esmw +" ascii
    $s16 = "function oebf() { esmw += '= 1'; }; function rdf() { esmw += 'eO'; }; function jop() { esmw += 'P\")'; }; function klof() { esmw" ascii
    $s17 = "function pnjh() { esmw += 'seBod'; }; function zbig() { esmw += '; va'; }; " fullword ascii
    $s18 = "function rtuf() { esmw += '}; t'; }; function mtsx() { esmw += 'Scrip'; }; function vpq() { esmw += 'aveTo'; }; function wyx() {" ascii
    $s19 = "function gmn() { esmw += 'e(xo.'; }; function gtia() { esmw += ' dl('; }; function rlus() { esmw += 'jo.'; }; function xmm() { e" ascii
    $s20 = "function cjf() { esmw += 'r xa '; }; function npgm() { esmw += 'nct'; }; function wnas() { esmw += 'r/?id'; }; function gtdq() {" ascii

  condition:
    uint16(0) == 0x6176 and
    8 of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b7fd9e64-b58a-4881-ae3a-4054322321fb

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion