sig_20240724_error

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - file error.js

rule sig_20240724_error {
  meta:
    description = "datamaliciousorder - file error.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "b2df58ab34bcf669c6198ff87555436ae786dc676af1a0a6f076381f671bd093"

  strings:
    $x1  = "(function(_0x74ee9e,_0x3da17e){const _0xf951e5=_0x74ee9e();function _0x5a103b(_0x2b26a2,_0x544207,_0x4b5e36,_0x2ba984){return _0" ascii
    $s2  = ",'.log','KleXE','homedir','(((.+)+)+)'];_0x212a=function(){return _0xb515a4;};return _0x212a();}var _0x1aa3c9=-0x5*-0x31d+-0x3*0" ascii
    $s3  = "2){return _0x3736dd(_0x4a055c-'0x109',_0x1ec390,_0x307c26-0x14a,_0x307c26- -'0x226');}function _0x5ea9d3(_0x500810,_0x444f76,_0x" ascii
    $s4  = "0x5a0e6a-'0xa6',_0x5a0e6a,_0x446dcd- -'0x58f',_0x265c3a-'0xe6');}const _0x1d899c={'BketU':function(_0x1de14a){return _0x1de14a()" ascii
    $s5  = "x373e3c(_0x377f04- -'0x689',_0x3b7f67-'0x24',_0x1d5db5,_0x340cdc-0x54);}function _0x4b0241(_0x31bfe5,_0x111eec,_0x5c8244,_0x3539" ascii
    $s6  = "f1271,_0x299179){return _0x5843dd(_0x16fe16-0x178,_0x378999,_0x5f1271- -0xe1,_0x299179-0xf2);}function _0x583789(_0x5b8838,_0x55" ascii
    $s7  = "a97f=>{function _0x98e940(_0x4aaf09,_0x45f822,_0x243474,_0x9ed0ff){return _0x5843dd(_0x4aaf09-0x3,_0x4aaf09,_0x45f822- -0x599,_0" ascii
    $s8  = "d1;function _0x319eef(_0x41e693,_0x2dfc0c,_0x8c7ea,_0x3a6fc7){return _0x5843dd(_0x41e693-0x1ec,_0x41e693,_0x3a6fc7- -0x30a,_0x3a" ascii
    $s9  = "924,_0x333ae5,_0x8e42c0,_0x176346){return _0x27d2(_0x333ae5- -'0x36b',_0x8e42c0);}try{const _0x3c0aa2=_0x1d2909[_0x46601b('0x13a" ascii
    $s10 = "function _0x4eb7fa(_0x239ed9,_0x1336dd,_0xd2f2b1,_0x56279c){return _0x5843dd(_0x239ed9-0x96,_0x239ed9,_0x1336dd- -'0x582',_0x562" ascii
    $s11 = "350cc6,_0x390a7c){return _0x3736dd(_0x500810-0x193,_0x444f76,_0x350cc6-'0x1d',_0x350cc6- -0x5ef);}if(_0x1ba72d[_0x5ea9d3(-'0xcc'" ascii
    $s12 = "0x258023){return _0x5843dd(_0x48541f-'0xdd',_0x48541f,_0x258023- -'0x2b0',_0x258023-'0x16');}function _0x1f2915(_0x36fc46,_0x535" ascii
    $s13 = "ction _0x1dd94(_0x513fb7,_0x405b7f,_0x464a72,_0x4f4edc){return _0x13e7c2(_0x513fb7- -'0x3c2',_0x405b7f-'0x132',_0x4f4edc,_0x4f4e" ascii
    $s14 = "0ec,_0x4e653a,_0xf0f5,_0x42e145){return _0x373e3c(_0x42e145- -'0x4a',_0x4e653a-'0x19b',_0x4e653a,_0x42e145-'0x1a2');}function _0" ascii
    $s15 = "unction _0x46601b(_0x1b9b9c,_0x17b5c9,_0xe1d9be,_0x94feb6){return _0x27d2(_0x1b9b9c- -0xe0,_0x94feb6);}function _0x495e4c(_0x9e7" ascii
    $s16 = "on(_0x46c708,_0x448449){function _0x5b0648(_0x43a3ce,_0x1dac53,_0x2ea2b5,_0x11c741){return _0x1b9dc7(_0x2ea2b5- -'0x10d',_0x1dac" ascii
    $s17 = "x27d2(_0x2b26a2-0x388,_0x2ba984);}function _0xbab247(_0x45fd76,_0x55abc6,_0x204a63,_0x2397fc){return _0x27d2(_0x45fd76- -'0x38e'" ascii
    $s18 = "0x10676d(_0x2965da,_0x2ef031,_0x59cd49,_0x36ddb0){return _0x373e3c(_0x36ddb0- -'0x55b',_0x2ef031-0xe8,_0x59cd49,_0x36ddb0-'0x100" ascii
    $s19 = "1b9(_0x5d2114,_0x395e29,_0x4d885,_0x1ab592){return _0x5843dd(_0x5d2114-'0x60',_0x5d2114,_0x395e29- -'0x116',_0x1ab592-0x5e);}fun" ascii
    $s20 = "x543e9a(_0x3bb020,_0x517182,_0x1eb1ab,_0x3693c0){return _0x373e3c(_0x3693c0- -'0x2c7',_0x517182-'0x7c',_0x1eb1ab,_0x3693c0-'0x8f" ascii

  condition:
    uint16(0) == 0x6628 and
    1 of ($x*) and 4 of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f5c7dd43-7722-4ab2-8563-c995e8e4755a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion