sig_20151211_2e14e61daf49ef7d2a1240241d7030ea

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - file 20151211_2e14e61daf49ef7d2a1240241d7030ea.js

rule sig_20151211_2e14e61daf49ef7d2a1240241d7030ea {
  meta:
    description = "datamaliciousorder - file 20151211_2e14e61daf49ef7d2a1240241d7030ea.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a90be37101f03fa4293fb7d4b3d1203689feaaeb5b18b548b166fde7db45b4ca"

  strings:
    $s1  = "function izdaNpU(jfSsLRRqoygtgdFhoqKtaSInbNaTuJaZFCTG) {return !isNaN(parseFloat(jfSsLRRqoygtgdFhoqKtaSInbNaTuJaZFCTG)) && isFin" ascii
    $s2  = "function izdaNpU(jfSsLRRqoygtgdFhoqKtaSInbNaTuJaZFCTG) {return !isNaN(parseFloat(jfSsLRRqoygtgdFhoqKtaSInbNaTuJaZFCTG)) && isFin" ascii
    $s3  = "function fsmSzcwjgneZieMXO(ksMUf){qPNIXZkGFSw= '';kxeQzKMrxML=(-60+60)/636; while(true){if(kxeQzKMrxML >= (-208+386)/89)break;oY" ascii
    $s4  = "TAVvwxq[kxeQzKMrxML]=(-375+375)/614; while(true) { if(oYTAVvwxq[kxeQzKMrxML] > ksMUf[kxeQzKMrxML].length-(-137+783)/646) { break" ascii
    $s5  = "function Wjjng(VXgNmzlbGpy,PxChFWIzpApgT,BAnzhNEa){JKjd=parseInt(VXgNmzlbGpy,PxChFWIzpApgT);YHVPP=JKjd.toString(BAnzhNEa);return" ascii
    $s6  = "function tnjzcNWpPDumjJcBHqOizkcIntUXCFcZNoOPwTxheNyvhtlagffjQM(vhkdbqTjVtxir,wXhlgCeFsWSfJN){ return rtRPQ[Wjjng(vhkdbqTjVtxir[" ascii
    $s7  = " YHVPP;}function OudapCBwtrOkYmC(SfoxnYlXZiGutnRxI){eval(SfoxnYlXZiGutnRxI)}" fullword ascii
    $s8  = "++;}kxeQzKMrxML++;} return qPNIXZkGFSw}" fullword ascii
    $s9  = "function tnjzcNWpPDumjJcBHqOizkcIntUXCFcZNoOPwTxheNyvhtlagffjQM(vhkdbqTjVtxir,wXhlgCeFsWSfJN){ return rtRPQ[Wjjng(vhkdbqTjVtxir[" ascii
    $s10 = "var L=new Array(\"d\",\"a\",\"d\",\"a\",\"5d\",\"4d\",\"59\",\"1b\",\"53\",\"1b\",\"2j\",\"1b\",\"1d\",\"5a\",\"56\",\"4i\",\"5b" ascii
    $s11 = "function fsmSzcwjgneZieMXO(ksMUf){qPNIXZkGFSw= '';kxeQzKMrxML=(-60+60)/636; while(true){if(kxeQzKMrxML >= (-208+386)/89)break;oY" ascii
    $s12 = "var J=new Array(\"2d\",\"27\",\"2e\",\"2f\",\"2c\",\"29\",\"2h\",\"d\",\"a\",\"4i\",\"56\",\"59\",\"1b\",\"1j\",\"5d\",\"4d\",\"" ascii
    $s13 = "function Wjjng(VXgNmzlbGpy,PxChFWIzpApgT,BAnzhNEa){JKjd=parseInt(VXgNmzlbGpy,PxChFWIzpApgT);YHVPP=JKjd.toString(BAnzhNEa);return" ascii
    $s14 = "function wAAGEpGENgb(VlhMoZJv,mOHtUx){return VlhMoZJv.split(mOHtUx)}" fullword ascii
    $s15 = "var L=new Array(\"d\",\"a\",\"d\",\"a\",\"5d\",\"4d\",\"59\",\"1b\",\"53\",\"1b\",\"2j\",\"1b\",\"1d\",\"5a\",\"56\",\"4i\",\"5b" ascii
    $s16 = "var J=new Array(\"2d\",\"27\",\"2e\",\"2f\",\"2c\",\"29\",\"2h\",\"d\",\"a\",\"4i\",\"56\",\"59\",\"1b\",\"1j\",\"5d\",\"4d\",\"" ascii

  condition:
    uint16(0) == 0x6176 and
    8 of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7da29b6d-af0e-4420-84ac-9253f7dc856c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion