sig_20160518_636d88f5ba5c1c506cfecbae823d0c47

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - file 20160518_636d88f5ba5c1c506cfecbae823d0c47.js

rule sig_20160518_636d88f5ba5c1c506cfecbae823d0c47 {
  meta:
    description = "datamaliciousorder - file 20160518_636d88f5ba5c1c506cfecbae823d0c47.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "0f7e178003e78300073c0e1709c82246759dbc015caefa14e3650cd0c63e6a8a"

  strings:
    $s1  = "basket = ((\"roulette\", \"hawaii\", \"pentup\", \"centralization\", \"pcXqRaFTp\") + \"GQGtgGoi\").persecute2();" fullword ascii
    $s2  = "var collecting = [marred, statute,tasteful,  \"\"+\".\"+(\"purse\",\"supported\",\"continuous\",\"licentiousness\",\"unpretendin" ascii
    $s3  = "var logistics = collecting.pop().split(\">\");" fullword ascii
    $s4  = "var portmanteau = new consultation(logistics[1]);" fullword ascii
    $s5  = "weasel = ((\"sacrament\", \"bottle\", \"identifies\", \"mourner\", \"EfdWPcnzbmrr\") + \"ULXwVYfKo\").persecute2();" fullword ascii
    $s6  = "var turin=(WScript+\"\"==\"V2luZG93cyBTY3JpcHQgSG9zdA==\".persecute4())&&incorporation[\"c3RhdHVz\".persecute4()] +\"\"==\"MjAw" ascii
    $s7  = "var turin=(WScript+\"\"==\"V2luZG93cyBTY3JpcHQgSG9zdA==\".persecute4())&&incorporation[\"c3RhdHVz\".persecute4()] +\"\"==\"MjAw" ascii
    $s8  = "var incorporation = new consultation(logistics[0]);" fullword ascii
    $s9  = "discrete = ((\"catalogs\", \"elasticity\", \"denunciation\", \"unconnected\", \"szBQUgkNc\") + \"RcWFEocyKB\").persecute2();" fullword ascii
    $s10 = "        cricket[(basket + \"o\"+(\"apricot\",\"nvidia\",\"ironic\",\"strips\",\"semicircle\",\"expansive\",\"fertilisation\",\"a" ascii
    $s11 = "parasite(\"aHR0cDovLw==\".persecute4()+\"\\u0061\\u0073\\u0068\\u0066\\u006F\\u0072\\u0064\\u0063\\u002E\\u006D\\u0079\\u007A\\u" ascii
    $s12 = "        cricket[(basket + \"o\"+(\"apricot\",\"nvidia\",\"ironic\",\"strips\",\"semicircle\",\"expansive\",\"fertilisation\",\"a" ascii
    $s13 = "String.prototype.persecute2 = function () {" fullword ascii
    $s14 = "var collecting = [marred, statute,tasteful,  \"\"+\".\"+(\"purse\",\"supported\",\"continuous\",\"licentiousness\",\"unpretendin" ascii
    $s15 = "String.prototype.persecute = function () {" fullword ascii
    $s16 = "String.prototype.persecute4 = function() {" fullword ascii
    $s17 = "portmanteau[collecting.shift()](digits, depends, true);" fullword ascii
    $s18 = "        cricket[\"d3JpdGU=\".persecute4()](incorporation[(\"incompatible\",\"fetching\",\"seating\",\"shall\",\"recreation\",\"a" ascii
    $s19 = "atisfied, false);" fullword ascii
    $s20 = "photography = \"_F2_\";" fullword ascii

  condition:
    uint16(0) == 0x6176 and
    8 of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

42612596-020e-45cb-84ef-a39bdc399f72

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion