_20160914_031aadbec3c615bbd716004e53da6729_20160914_0399742a3317_132

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160914_031aadbec3c615bbd716004e53da6729.js, 20160914_0399742a331716256c1996caffe5088b.js, 20160914_03f2f6cc0cd9b445708651148c57d8a3.js, 20160914_04946d748bd481474e216b9a233f2909.js, 20160914_067a45b9b9ac56f9aeb10ba8651400f3.js, 20160914_06bf9998e7a289b11eeb2935f1fa569c.js, 20160914_0ddb0727dedf9a56d640b9fce8a36379.js, 20160914_133c19ad9c8e7f488d1a3897b5a126cc.js, 20160914_1535054ea607358e4696bfddcc37f0ed.js, 20160914_171951f0f6ace0ad8827cc178e5ac887.js, 20160914_18e65633960e2af813695d02cdadc8b3.js, 20160914_1a325977e2e9c55c3f50f47961d35165.js, 20160914_1c455e5460d53d4a025f119b5d8dfe7e.js, 20160914_1d21abdd8898dd49bdfdfcc00cce34b8.js, 20160914_1f59fe75432975e748949ce0253a9700.js, 20160914_210cea2212d638efa1fd51125e5dd968.js, 20160914_219426db0402dd06a00419570d456701.js, 20160914_21f1462f214d67c2864c103e739ba6b0.js, 20160914_2628e79563d9edd2a40260b56331a8fb.js, 20160914_2aaff8f30ecfbf5b33b7e3b51afcbd60.js, 20160914_2ab54d108ae398d0647a2bd7851e4c25.js, 20160914_2bf1e08d4188abc4ca918195575cf835.js, 20160914_2df5a8d9ffeb03037b2ff78eb3895755.js, 20160914_31b482a15c94e323f61fe6e48ed53af9.js, 20160914_3306ded8c9623f873de4e66cba4c8f0f.js, 20160914_33919c7fadf66e99c410cb406fe1eb8c.js, 20160914_33d703918716c7e1664230bda52497d4.js, 20160914_34ccde637aa3d6c5b8e0b30bca63c18f.js, 20160914_372ff85a86b52ad45458f0ab207bca64.js, 20160914_39324e63fb4a017eb0e6e4b49fa5a21a.js, 20160914_39c6c8543bfa6ede911a5697dcd5cf59.js, 20160914_3a4528ebdbdfb4ce7cdc33c83d079920.js, 20160914_3b143ccd3dd5dd1465debbb879cf01c0.js, 20160914_3e75591924b004db3f3b4487e358ccb4.js, 20160914_3fe0f69e5c2d387f8f5a13a0ec6b8a10.js, 20160914_4817388b3f7f35afe76fe8a8c9e4710e.js, 20160914_4b7efb295bc85c0fe9f93f96861d6b5a.js, 20160914_4cc31ea65fc9f7f00154fe4b3c75ce55.js, 20160914_512a40229134abff8354cf5b6fbe0909.js, 20160914_5256910fe6933a4bb63b6beaebd6c67c.js, 20160914_53de68e320b6d6fab40264a20964ad06.js, 20160914_5480e01c72b642e89f593fa06210a4ea.js, 20160914_54ae2dc0d99615b672a7aa07728d0ea7.js, 20160914_55b25a51669913932377de9b0f473739.js, 20160914_59dd90bafe12e44dbf588a8582954f65.js, 20160914_5a765c986a8eabe85d56bc5470f1dffa.js, 20160914_5b6a0206fa47b9b25a2648792569a074.js, 20160914_5c44af1db9ae61b0b2b67a7eddce7de8.js, 20160914_5deb7a41ded5d4fd3f219c41948ae966.js, 20160914_5f6c8927c28d428165bf04496ba587c6.js, 20160914_60c409929016e46d229a48abe662c1e2.js, 20160914_664e5da91895638de3d1ca98d95f41ed.js, 20160914_67f4767e392cbddd80704ccda891b8ac.js, 20160914_68fc76be16778b378dc398ae06720e44.js, 20160914_69721d885320f45baa749bcc84a9ba4b.js, 20160914_6985f7007ff328615bf2c6b30b8f57eb.js, 20160914_699eb204851b6d73f792eaaad7b2c799.js, 20160914_69f533787f718699acd177e246a15c6e.js, 20160914_6d879208b300bdc5d9328dad8bbd3636.js, 20160914_6fcd18c69e40ecd2e4bb4ea1c2787ee4.js, 20160914_70aea6be88fe8b034f3247625d733774.js, 20160914_71bdffca9d683f85cea993991271f94e.js, 20160914_7201f40923abfd7165cbbdaba2ae3397.js, 20160914_7645352806e19e3b7a88ac1a4978d193.js, 20160914_7cae8d01a36dd6c6f05aa61d2ff5455c.js, 20160914_7fba08249cba92edb00fdb84b5b58ccf.js, 20160914_885a26864b158dd44c011d16c1298d9d.js, 20160914_8a37ad718808fe2265ef9c0ee72f6532.js, 20160914_8af40a67235d08b49d110e366cdcee9b.js, 20160914_8b5b3772bc293aadf880545c91f44928.js, 20160914_8e373522a5035dd0910de4ce8da9a7ba.js, 20160914_8eee4cfc8c73a0e5b91066042ee85e95.js, 20160914_8f894459f7e49b05b9015bb4532b8106.js, 20160914_961baf89f01cd307b72390c8e0597eed.js, 20160914_99f320f2203596adb91fec472dc64682.js, 20160914_9a96f5b24701efaf20485e9cbd7096db.js, 20160914_9db80c2824fee13e94e52f1f86d403ad.js, 20160914_9dd7a2145e86ada17e213b6aca4bebc3.js, 20160914_a12f45d44f3aeb956cddc715235ed69f.js, 20160914_a13ab0124226e8d57c843f306759f7cf.js, 20160914_a53d69c99c1a33d068476d1235c11cda.js, 20160914_a87403d0cb0797b41b1e2587b8e56829.js, 20160914_ac6936b6dcffcfd90672dc2cf10c3abc.js, 20160914_acdcf784e052f4f1e35d74e624ecd347.js, 20160914_ae6b8e37cb6748d4000bc4c571fac8c7.js, 20160914_b5f4fe376878e11d6cc31fb0b486a166.js, 20160914_b933b4876fdc0635192eba814f714e7e.js, 20160914_b9e025801e533d7fad5e21880d6b2554.js, 20160914_ba4edc46a297dc0fe50a20f9455c7e7a.js, 20160914_bb22dabbe56764fada92e964079bee95.js, 20160914_bc0aa7838487fa2a284d8fc078c6bc38.js, 20160914_bdbe9e72d01205d5bf3f6eafd3b48dc4.js, 20160914_bdd1b4eef4f60dfa64b3c06790a1916b.js, 20160914_beb009a86bb7e5611f88d143d300fba6.js, 20160914_c1f67d00bf9bb7fd36a3a8afb72ae177.js, 20160914_c2d78d91978bdf550e71014b2dc310c7.js, 20160914_c35c26b5549cae4542ee053813da978b.js, 20160914_c41f7290ead7e8832133c9783ed7254f.js, 20160914_c89479681552813f1b80069578edcfec.js, 20160914_cf4420448238c4dd53b439c590172448.js, 20160914_d1457d5883a5b7152d3d2372a0607444.js, 20160914_d3192fd955b8cc3ebebc2f0e1ca2d857.js, 20160914_d5ccbc1ad007620fb733a07ebc3a9861.js, 20160914_d6d08de9644ea603a78676c8e53aec8b.js, 20160914_dca1579ef6b4d6669280b3acfb8f8740.js, 20160914_e00863d329543c46343fe0d28380a0ae.js, 20160914_e68de9d06d7c692df882ea865379d112.js, 20160914_e8086980383517fb43fc64ddb0cc868f.js, 20160914_ed69d40fb22b34f58c2887b5acade1c8.js, 20160914_eee25e01b4a16ebe1164a73c70e55277.js, 20160914_ef25af12f9a0383d879e27a4e7150408.js, 20160914_f1b4cc0649be7a18446c22c4c6524fa5.js, 20160914_f2c6c62886414c393cd9f5d8eee45cab.js, 20160914_f3041ec89209b62c81d4c53104a51cad.js, 20160914_f52d5d8306f96a3943395e211cc9245d.js, 20160914_f5411c09dbe5c9f56f0c357d3e6bd34d.js, 20160914_f778d4ac4a745510a50884edae42f958.js, 20160914_f91b92e2483fb1521b73b5e155eb9a3b.js, 20160914_fa34789e73ab08d253ff82aadb2665e0.js, 20160914_fb044b5fd20d4fc95b060ea61b0c4b88.js, 20160914_fbf165d1b7a7208554e4d1eabd7f6816.js, 20160914_fc25137960f422192c095cf2835eeab0.js, 20160914_fe3fec19eb838efee6e09e52dc50894d.js, 20160914_fe573765dc98d834e30ad91850a194f9.js, 20160914_fe99e38b5780e7facc0d96aba4570d7b.js

rule _20160914_031aadbec3c615bbd716004e53da6729_20160914_0399742a3317_132 {
  meta:
    description = "datamaliciousorder - from files 20160914_031aadbec3c615bbd716004e53da6729.js, 20160914_0399742a331716256c1996caffe5088b.js, 20160914_03f2f6cc0cd9b445708651148c57d8a3.js, 20160914_04946d748bd481474e216b9a233f2909.js, 20160914_067a45b9b9ac56f9aeb10ba8651400f3.js, 20160914_06bf9998e7a289b11eeb2935f1fa569c.js, 20160914_0ddb0727dedf9a56d640b9fce8a36379.js, 20160914_133c19ad9c8e7f488d1a3897b5a126cc.js, 20160914_1535054ea607358e4696bfddcc37f0ed.js, 20160914_171951f0f6ace0ad8827cc178e5ac887.js, 20160914_18e65633960e2af813695d02cdadc8b3.js, 20160914_1a325977e2e9c55c3f50f47961d35165.js, 20160914_1c455e5460d53d4a025f119b5d8dfe7e.js, 20160914_1d21abdd8898dd49bdfdfcc00cce34b8.js, 20160914_1f59fe75432975e748949ce0253a9700.js, 20160914_210cea2212d638efa1fd51125e5dd968.js, 20160914_219426db0402dd06a00419570d456701.js, 20160914_21f1462f214d67c2864c103e739ba6b0.js, 20160914_2628e79563d9edd2a40260b56331a8fb.js, 20160914_2aaff8f30ecfbf5b33b7e3b51afcbd60.js, 20160914_2ab54d108ae398d0647a2bd7851e4c25.js, 20160914_2bf1e08d4188abc4ca918195575cf835.js, 20160914_2df5a8d9ffeb03037b2ff78eb3895755.js, 20160914_31b482a15c94e323f61fe6e48ed53af9.js, 20160914_3306ded8c9623f873de4e66cba4c8f0f.js, 20160914_33919c7fadf66e99c410cb406fe1eb8c.js, 20160914_33d703918716c7e1664230bda52497d4.js, 20160914_34ccde637aa3d6c5b8e0b30bca63c18f.js, 20160914_372ff85a86b52ad45458f0ab207bca64.js, 20160914_39324e63fb4a017eb0e6e4b49fa5a21a.js, 20160914_39c6c8543bfa6ede911a5697dcd5cf59.js, 20160914_3a4528ebdbdfb4ce7cdc33c83d079920.js, 20160914_3b143ccd3dd5dd1465debbb879cf01c0.js, 20160914_3e75591924b004db3f3b4487e358ccb4.js, 20160914_3fe0f69e5c2d387f8f5a13a0ec6b8a10.js, 20160914_4817388b3f7f35afe76fe8a8c9e4710e.js, 20160914_4b7efb295bc85c0fe9f93f96861d6b5a.js, 20160914_4cc31ea65fc9f7f00154fe4b3c75ce55.js, 20160914_512a40229134abff8354cf5b6fbe0909.js, 20160914_5256910fe6933a4bb63b6beaebd6c67c.js, 20160914_53de68e320b6d6fab40264a20964ad06.js, 20160914_5480e01c72b642e89f593fa06210a4ea.js, 20160914_54ae2dc0d99615b672a7aa07728d0ea7.js, 20160914_55b25a51669913932377de9b0f473739.js, 20160914_59dd90bafe12e44dbf588a8582954f65.js, 20160914_5a765c986a8eabe85d56bc5470f1dffa.js, 20160914_5b6a0206fa47b9b25a2648792569a074.js, 20160914_5c44af1db9ae61b0b2b67a7eddce7de8.js, 20160914_5deb7a41ded5d4fd3f219c41948ae966.js, 20160914_5f6c8927c28d428165bf04496ba587c6.js, 20160914_60c409929016e46d229a48abe662c1e2.js, 20160914_664e5da91895638de3d1ca98d95f41ed.js, 20160914_67f4767e392cbddd80704ccda891b8ac.js, 20160914_68fc76be16778b378dc398ae06720e44.js, 20160914_69721d885320f45baa749bcc84a9ba4b.js, 20160914_6985f7007ff328615bf2c6b30b8f57eb.js, 20160914_699eb204851b6d73f792eaaad7b2c799.js, 20160914_69f533787f718699acd177e246a15c6e.js, 20160914_6d879208b300bdc5d9328dad8bbd3636.js, 20160914_6fcd18c69e40ecd2e4bb4ea1c2787ee4.js, 20160914_70aea6be88fe8b034f3247625d733774.js, 20160914_71bdffca9d683f85cea993991271f94e.js, 20160914_7201f40923abfd7165cbbdaba2ae3397.js, 20160914_7645352806e19e3b7a88ac1a4978d193.js, 20160914_7cae8d01a36dd6c6f05aa61d2ff5455c.js, 20160914_7fba08249cba92edb00fdb84b5b58ccf.js, 20160914_885a26864b158dd44c011d16c1298d9d.js, 20160914_8a37ad718808fe2265ef9c0ee72f6532.js, 20160914_8af40a67235d08b49d110e366cdcee9b.js, 20160914_8b5b3772bc293aadf880545c91f44928.js, 20160914_8e373522a5035dd0910de4ce8da9a7ba.js, 20160914_8eee4cfc8c73a0e5b91066042ee85e95.js, 20160914_8f894459f7e49b05b9015bb4532b8106.js, 20160914_961baf89f01cd307b72390c8e0597eed.js, 20160914_99f320f2203596adb91fec472dc64682.js, 20160914_9a96f5b24701efaf20485e9cbd7096db.js, 20160914_9db80c2824fee13e94e52f1f86d403ad.js, 20160914_9dd7a2145e86ada17e213b6aca4bebc3.js, 20160914_a12f45d44f3aeb956cddc715235ed69f.js, 20160914_a13ab0124226e8d57c843f306759f7cf.js, 20160914_a53d69c99c1a33d068476d1235c11cda.js, 20160914_a87403d0cb0797b41b1e2587b8e56829.js, 20160914_ac6936b6dcffcfd90672dc2cf10c3abc.js, 20160914_acdcf784e052f4f1e35d74e624ecd347.js, 20160914_ae6b8e37cb6748d4000bc4c571fac8c7.js, 20160914_b5f4fe376878e11d6cc31fb0b486a166.js, 20160914_b933b4876fdc0635192eba814f714e7e.js, 20160914_b9e025801e533d7fad5e21880d6b2554.js, 20160914_ba4edc46a297dc0fe50a20f9455c7e7a.js, 20160914_bb22dabbe56764fada92e964079bee95.js, 20160914_bc0aa7838487fa2a284d8fc078c6bc38.js, 20160914_bdbe9e72d01205d5bf3f6eafd3b48dc4.js, 20160914_bdd1b4eef4f60dfa64b3c06790a1916b.js, 20160914_beb009a86bb7e5611f88d143d300fba6.js, 20160914_c1f67d00bf9bb7fd36a3a8afb72ae177.js, 20160914_c2d78d91978bdf550e71014b2dc310c7.js, 20160914_c35c26b5549cae4542ee053813da978b.js, 20160914_c41f7290ead7e8832133c9783ed7254f.js, 20160914_c89479681552813f1b80069578edcfec.js, 20160914_cf4420448238c4dd53b439c590172448.js, 20160914_d1457d5883a5b7152d3d2372a0607444.js, 20160914_d3192fd955b8cc3ebebc2f0e1ca2d857.js, 20160914_d5ccbc1ad007620fb733a07ebc3a9861.js, 20160914_d6d08de9644ea603a78676c8e53aec8b.js, 20160914_dca1579ef6b4d6669280b3acfb8f8740.js, 20160914_e00863d329543c46343fe0d28380a0ae.js, 20160914_e68de9d06d7c692df882ea865379d112.js, 20160914_e8086980383517fb43fc64ddb0cc868f.js, 20160914_ed69d40fb22b34f58c2887b5acade1c8.js, 20160914_eee25e01b4a16ebe1164a73c70e55277.js, 20160914_ef25af12f9a0383d879e27a4e7150408.js, 20160914_f1b4cc0649be7a18446c22c4c6524fa5.js, 20160914_f2c6c62886414c393cd9f5d8eee45cab.js, 20160914_f3041ec89209b62c81d4c53104a51cad.js, 20160914_f52d5d8306f96a3943395e211cc9245d.js, 20160914_f5411c09dbe5c9f56f0c357d3e6bd34d.js, 20160914_f778d4ac4a745510a50884edae42f958.js, 20160914_f91b92e2483fb1521b73b5e155eb9a3b.js, 20160914_fa34789e73ab08d253ff82aadb2665e0.js, 20160914_fb044b5fd20d4fc95b060ea61b0c4b88.js, 20160914_fbf165d1b7a7208554e4d1eabd7f6816.js, 20160914_fc25137960f422192c095cf2835eeab0.js, 20160914_fe3fec19eb838efee6e09e52dc50894d.js, 20160914_fe573765dc98d834e30ad91850a194f9.js, 20160914_fe99e38b5780e7facc0d96aba4570d7b.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "6e41167487b6b62197e9ae6c75ef6dcd7b6430d4aa51b6df3ce8796dbc8e1e28"
    hash2       = "a357a80024a3e9075e78af900ce6b3c8845ebf82d04425416d8ab7d225f8fd93"
    hash3       = "eb1c21cdf42207d4532682decaf1121b8c53683aaad9e09a7362c4e36407924e"
    hash4       = "7a0114312b8ddd4079cd2fcf5065d15b096c071450173dfbab8d9d814357f9a9"
    hash5       = "567cceca43b42910ef745f87f8184b06ea8f4ad03c2cfc678d1c443e55cc8916"
    hash6       = "e54166462327f3a860c017b86719acce1137eac9d00f57718e30c4682efff314"
    hash7       = "f7b5d305f004141340b9d6e5bca5587ff0e2cc24c9cfc7b56eef0d8ff6382568"
    hash8       = "eb0f44e4c4c62284db7baee7616b2609aac4d2a43e38d9e07981fe8358e4960b"
    hash9       = "aab8db084ef70367645d9e29a66531b28d1f990ddac4fc1cc5c323cceaf1227c"
    hash10      = "2314de771e95a3e448ef0a9419fa94ddedb7e12649f7f8ab1f0bf65e9658f288"
    hash11      = "3d137820dedf2dbf664074eb46f3bbd1336346e9391f2022bf9c68133fcdc1b8"
    hash12      = "5b86ac2256fe338e5e4a70e231920afe0becefc54c69e9cb72d9641ec4b5ff23"
    hash13      = "548b21cf7173e469da39e5d04d44f457888768805dce16756b835930951b013f"
    hash14      = "d5c86abfdb20ad8751092da28ee0da0027f4aac0ad119186f9cfa155a6031f57"
    hash15      = "9904236b73d147339d99e71aa7577f35fb0e6a8adad427c96025f4f0edff4f12"
    hash16      = "d3c1485514d8736c02ed75c2a664d9a4336d0482b48148ef9123f84af649143d"
    hash17      = "493159a60ed39b04cb826c5bf93fc15b0495db520729497e74656ecb8ead3928"
    hash18      = "075b7163cb09b7680256300389af46b10d1a4b1ffa01a160c1535a75c4997641"
    hash19      = "1a7a1f0139b4977553c5c6b2ed83c953e4acf56ef7e27afa5d446c8d99b8f8fb"
    hash20      = "0d54403d9dd494af28b39b24f65678da8068cc48f88e7200eb71c324e531b55f"
    hash21      = "c48eca7768d91c2eaf6851f25e38c39fab25a7ebd4e0387d7523df91a0cb43a5"
    hash22      = "414a93f61e458f945105344d19180c0ea6be0ceb9b1617f42a7c4866671a46ba"
    hash23      = "53a2cb9f8ca453f5d7e9287f9fba468c15eb729850b64c0ccf43775cd6e2366a"
    hash24      = "3771c3bd6131e3ec7462fd800dcebf8359c74b0aabb37ba84e31462e04d02fa5"
    hash25      = "775a5bfad6945453ed671a40976fb6cb1653d0fbc35b3865076e66ddaf1fa950"
    hash26      = "0478bb4264fc61fb7f34b21ef84d70d62b061aba0f69209962778d32748997ad"
    hash27      = "068084bbf5d2791706cfc10c9b17863e5876f315cd40889a672ba11f4741c1a7"
    hash28      = "2315f454a4abc8f16d4f35b48bfdf185e157e846b9dc7c8bb71f4c572ed4576e"
    hash29      = "3f21da4884dac67480a800b932eceb9c96a6815bb1034dd8e091c087875860c6"
    hash30      = "b6daec6976aa83e874cb4fe0ed45c664d05ff0778e81a46c3b2ab18cab4474c3"
    hash31      = "4590cdb3c3fa7c672cf08a0d86fdfa12a9df18dae906d28977937f92d5d1dbf1"
    hash32      = "4fd23a6dc7f3270445d05c7a3dcc5f61901b8dc7c8e920afd9980cdd7bc0e3a6"
    hash33      = "c33ed8ffa55bad4a5d0282d62b55fc6e7ced4ab232923e09a5f7f4c36b5b5ba6"
    hash34      = "29bf2d421bd89614f756d8f3829bd56cf943e4ecd6eb6382a05eaae46d5f6ad7"
    hash35      = "7d98b1f64f2e88c37f4b418c8cb8f126523dc94cf9044e3ab2fb1c450f8be2c4"
    hash36      = "9139cc2717989ff41392f140046902e5a8d08ceb0f2de1e5247530b8a45c5a83"
    hash37      = "ac5d658850d941ef82b979ad4ed6ab23adfbaeddf8980d98768dbda86543078f"
    hash38      = "0310c0beeebf060ea8484aec4fc081803dbcc84894383df425538f5444ae99c1"
    hash39      = "71ab1da62c239f1aee1736aa57e8ca106db693616d6559655c0398e018d63816"
    hash40      = "bdd54bf7f33e6a1fef8eadf9a28072ccb337fb1ec85d702c520d5e3c69b42ad6"
    hash41      = "5a21bd691ce72cb6000bd04f68b657160c2eaa2aee5ab354c4a086394d75ca43"
    hash42      = "6ad2e3c27995ee8cddc4ad146b15105ff53d5f8ab9ddebd389c7794e87a29d2e"
    hash43      = "f9d38a6a260633f56d9234719ade3bd0d9abbf482d5434d5dca822ee6a293117"
    hash44      = "1ed2222cc01915b82dce002476e5cea43c3745033c1a070443aa331f7d4c3d66"
    hash45      = "8e5f7801e4b265b4618e94e60dfa0c7a12b524d40e53bc24e1394727ea516e61"
    hash46      = "d316ac883daa76afe47f43aa83ce75f38d9b5ef8b1359ef3c74b525bde194320"
    hash47      = "b9ed10945aa475474b68390c9d720995d97a82c7433a8293f9d82ea03404d58c"
    hash48      = "734da1f8757eb670e145b3bbe48a3f0156f1d5da6dd915f8177f237699decf8e"
    hash49      = "a048f83fde271464a1e84347c01d01b71966f1a3c13b014e0df47d05c6660ea6"
    hash50      = "4f871173d3a78ae930de8e0d727f2be250ba3930af5094f1d83fab1ac637c155"
    hash51      = "a4e70d50bee11a6fabe05d7c90b2df9975c1608893bae3bb0040a58346ed679b"
    hash52      = "fc056ec7bfe24dfd928d1bb800c819486356c4fa5b633d1cba609fc2c3800b65"
    hash53      = "cd7464eebe6a82d98350226b8c10c7ccc2067ce4f55ed25a9c28d51d15684ae9"
    hash54      = "3cac57f6928d983e6b619737d77f9283a68fdd1c1433ab7a458143ce0ede465d"
    hash55      = "c41abd408acbf58d4b65284143efe90ea5ffe5c799cefb15afd0a49c96c3961b"
    hash56      = "0d6f348c77096c22c8c01f2143aec7f0afa0d4cb7f4d8896e5be78ce613b175a"
    hash57      = "9453521795f468c49bf3d3d65a95fec5024ffde9eff5e259c9d960e11ec1976a"
    hash58      = "3b5d66c326b03c04bc26b46ae639cfacc202635f7a5b8e20d5350659d3be4195"
    hash59      = "8140fe242b205dc4366f8362e3b4e12ff4cb20b1cff97011620bc8b229b7ba2c"
    hash60      = "0d32e14f5859e7ff38eda8779cc866b0e75bb9d1e265862e674629a244801375"
    hash61      = "8c175955cd667d7a1aaa02a1b46c0ec6f796586d28c6190ea3f9c98e5e09dc8d"
    hash62      = "db70b03e23896141d91407805205691141268cf000d5866a6d71746a5a4e3508"
    hash63      = "aeb251ecd6ddbec7e53c40ff8da48436f7326ca466e4cbba3a7a92d15b52d9d3"
    hash64      = "f6c1ce319953abf0c085b85f0cfa4c41c978368381e15de7079fc44714f3ac39"
    hash65      = "7bd0be13814cb49807b0fd72b659f020319c4a145db265cef22d081aaf546885"
    hash66      = "7f302852c49a5c054d4786119643bc51c86a7c7c37612ad9ef318ea53a70aa47"
    hash67      = "9b04f2c000f6a3a100cd6d1d07240315e9f8afc5f90dd0841d189e86de4a4b7a"
    hash68      = "7d9c242ba5664b83fdb723590e82533dd5739afa4fc7322b6bbc189be4692320"
    hash69      = "9112664451ec90dfca1b51e5e50dc93e32779a1ce8348462eee36e384bf9bf32"
    hash70      = "9d35d8667470081074a7bd3880fef732c40c058a4d51ab66e528176e45466c7b"
    hash71      = "7ee8bdf1a6458bb446956c7698a6a91cd78f0eefec0a74db9f85bbae1fb8b26f"
    hash72      = "c546ab2ca870828eeabb0f21479c3e9677e745c02e970ad93c9028165dd34cb5"
    hash73      = "e0cadc08700ea72890c2b0e9912c189f0e4d9da5ce8e83a4eef53a71c9d9b543"
    hash74      = "0e4265485d6f739a6ae137c32f933b80a85b3771073472daf622e07f8fe30421"
    hash75      = "d8b2d74c874c6805c6d99176b784918942ff6e40c0ead0177fe1222987da8695"
    hash76      = "c86ace0d93aecc22d0234297ae46635a010d676f4db9af6648a3ce7037e06bb3"
    hash77      = "05518e265e1d3ae8fc8202f1ee4d439ec45c06ca59d2c3a0f0f7506e45fbd952"
    hash78      = "da5482a261697ec028622c9747d5b746f06b7ab5c9315932d5043c5cdc1465bf"
    hash79      = "35f99d9abdd8738bc9c05262837c39f44a33c1911c1e3f76e4fe0788de9edd8d"
    hash80      = "29f6624d3041c3c350831c153e6b3e694b925069e843a947a4ecc5f942f777cd"
    hash81      = "d44e8298056275331132b9920b65520a84e633921dbb7ad0d1abd65812fc8331"
    hash82      = "330c2d4ecc225e2abfcd250084c7d09b1bd791835d73ab0b60415e6587b7b222"
    hash83      = "2afc2feac7e4b48dc1d426d8675ca9ea2ffdd599a81ac91cce21de8379edee24"
    hash84      = "b57d58645258e7850fda1449085c52d86eaf4c8795e771c9fb14e3668c2f2435"
    hash85      = "8012bbc9d53c9443c615b991f96c704be2210636b200bf3621937aada7f6719c"
    hash86      = "61114f6fbfafd1f3fe3b11fcdb3e3697046e7c9ad083ff06b71fd0f1e051b4c3"
    hash87      = "b0dbfd21076f8d2db209993796d2a41d36e979f25f2fe6dd934d6831e869329e"
    hash88      = "a878b3e651da9451f2e85737f600e685c0aee29d85f544128faf8a13b6210e23"
    hash89      = "fb6c186fdb807c6436e573fd916c01b85cf019b32d2c7e926155e027d359c194"
    hash90      = "ebb0c34a0882b29548d0f5aa656c6f941bdc7a9b5202ae7cbb6a4b919074dcc7"
    hash91      = "ee9152ba4230655e4b1c527ea07055bbff0e4ae5b296b2061eb5937be3e0ca17"
    hash92      = "e34e7ada7c314deeea1352cdbc4fe6ec2e7b7891a42ea8639d27d6e5c4ba046c"
    hash93      = "ddeaec5d0772b260d9e0525477ae326d7b61be63b3b929c5bd92fc856fcfbb20"
    hash94      = "f76c1c544405f57d10f43974afeaac6e503dec1e733ab20c3fa768ab3e65edd8"
    hash95      = "a476db62da8d52eff32c691a4ce7ad2f1da553f54bf3d1607669fe2c3d7455c1"
    hash96      = "4bbe889013b67b2ff32c55c1068e30ba22190bf6d19da107e21bde0a00d2ebb1"
    hash97      = "e50ed08e0b3b2fbeae09213595f568c9bb0a03ee9896878e981476bfafc39b04"
    hash98      = "c522f9ccfceae0121885747cd4d534f49b09a40cb04bf34c82bc18e9d4d15be7"
    hash99      = "703ffcabcd728780429b74c21386505761b840a8d22c40e2a2b937cb3d6b22f4"
    hash100     = "56fde4d575e70e40155a071d2e63707621227ac0771713f045b62bd45976a24b"
    hash101     = "0829e2df04f4280551ddb00c252e39952578b7a3585d9acc2f29fe48ed4c0f5d"
    hash102     = "35173606e408e9ad0eefd6f48e28b8a64cde0e488e38b9402e00af119b5c9865"
    hash103     = "273eda164117c58bb4d85a31c3d6735741b95734ead968cea9d0b641c3f42b67"
    hash104     = "c9785994101c7a031e08d3c1d45bdc7e69f18850304a2fedc97c8de4a25c14a1"
    hash105     = "97d4f50ffcb16cb5486a53af15474df90eaa1027e5b3c44383f60174e2c9dabf"
    hash106     = "fc61804b86bcb129eef386c69e45ae0269b67383b9f71653ef95f968778198a5"
    hash107     = "88dcc6028d6262ccb476e3f7f119354df56357ec572bdeeb518fb137186fd4a9"
    hash108     = "d0f7c57125a3b238ed091501bb64a225d25db68b3544322ec08223ffc5b3a315"
    hash109     = "2b46208fc96bc1a9b66a114f9660269d801b7894f95c918746a670844ed93552"
    hash110     = "0b6f2f698531da618aee5d6dc0d12634b6d29cbe8c43e232b1195915f24ce4ec"
    hash111     = "d9ff49362b39740c4ed51930fe66deda72eacb69b817e1c4c582c586981e454f"
    hash112     = "b9726a46a408e2c175d279139e506a3ad829dfa2fc5d4b61dd928917a843ca97"
    hash113     = "db421ffded43625d2b39f35ac85ab0103a90f35c372034f6a113ae1b45a1e2bb"
    hash114     = "a2e40436a87963fc654df432e36dad46b13dd44e1b6a1157ed8913e98369d024"
    hash115     = "61bc0e9aaf048606dce8d3996ccfbb9ee942de5001c0dfac9e2b4640f5557df0"
    hash116     = "dc8f0fdc08dc0efd0f64a979363fc467c8f4712cf94c5d52e7716ea6094bef96"
    hash117     = "cc54c8fe6ab1bb853d1d08c53997b261a54b9c83aa069b10c41d941b940d6287"
    hash118     = "5a9ed2ca51990c5e5872622b19bbd0137d4b7feb45b55ee706b459db396ee901"
    hash119     = "9117d9276bfd4ee70e65ea26f9a22e6e27e68ab85618796ace79dc8597e72ae9"
    hash120     = "db998f950341534a608fea021860ad059e8d1fdf09c92e208c8013be1146e917"
    hash121     = "ef69e4b0aa746a64937c3238ae3f43c8865a2fdb86c9448601a202a70342a0af"
    hash122     = "5b75a3d355934e3ad09c35a3177bc06b92279fac0eeddc1c02ebcf5e0ab7bcd2"
    hash123     = "7223aa55219f8cec665454595ea7c6944b67b0b7ae55d4ac7eec7c9e30f784a9"
    hash124     = "7348f7497e2c2a3945fd328627fc4a2a83058354e9d67b3123e36809fad605ce"
    hash125     = "47938acc386e01eb069439c2b74a40ed7f6d740abb3c82972ad38ccbf02eaaf6"

  strings:
    $s1  = "kupluyasiskiibudetpivoOKAYBOSS2Native.kupluyasiskiibudetpivoOKAYBOSS2genericize = function(object, kupluyasiskiibudetpivoOKAYBOS" ascii
    $s2  = "String.prototype.kupluyasiskiibudetpivoMRADXHO = function() {" fullword ascii
    $s3  = "String.prototype.kupluyasiskiibudetpivoOKAYBOSSzapadniy2 = function () {" fullword ascii
    $s4  = "kupluyasiskiibudetpivoOKAYBOSS2Native.kupluyasiskiibudetpivoOKAYBOSS2typize = function(object, kupluyasiskiibudetpivoOKAYBOSS2fa" ascii
    $s5  = "kupluyasiskiibudetpivoOKAYBOSS2Native.kupluyasiskiibudetpivoOKAYBOSS2typize = function(object, kupluyasiskiibudetpivoOKAYBOSS2fa" ascii
    $s6  = "kupluyasiskiibudetpivoOKAYBOSS2Native.kupluyasiskiibudetpivoOKAYBOSS2genericize = function(object, kupluyasiskiibudetpivoOKAYBOS" ascii
    $s7  = "if ((!kupluyasiskiibudetpivoOKAYBOSS2check || !object[kupluyasiskiibudetpivoOKAYBOSS2property]) && typeof object.prototype[kuplu" ascii
    $s8  = "if ((!kupluyasiskiibudetpivoOKAYBOSS2check || !object[kupluyasiskiibudetpivoOKAYBOSS2property]) && typeof object.prototype[kuplu" ascii
    $s9  = "        } while (kupluyasiskiibudetpivoOKAYBOSS2XCOP < kupluyasiskiibudetpivoOKAYBOSS2len && kupluyasiskiibudetpivoOKAYBOSS2c4 =" ascii
    $s10 = "        } while (kupluyasiskiibudetpivoOKAYBOSS2XCOP < kupluyasiskiibudetpivoOKAYBOSS2len && kupluyasiskiibudetpivoOKAYBOSS2c3 =" ascii
    $s11 = "        } while (kupluyasiskiibudetpivoOKAYBOSS2XCOP < kupluyasiskiibudetpivoOKAYBOSS2len && kupluyasiskiibudetpivoOKAYBOSS2ddDc" ascii
    $s12 = "var kupluyasiskiibudetpivoVITK_BOSKO_1S = new Array(-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-" ascii
    $s13 = "function kupluyasiskiibudetpivoOKAYBOSS2sud(vardos){" fullword ascii
    $s14 = "tt==1){return 2;}else{return 17;}" fullword ascii
    $s15 = "function kupluyasiskiibudetpivoOKAYBOSS2_bCho(T, D, C) {" fullword ascii
    $s16 = "yasiskiibudetpivoOKAYBOSS2property] == 'function') object[kupluyasiskiibudetpivoOKAYBOSS2property] = function(){" fullword ascii
    $s17 = "var kupluyasiskiibudetpivoOKAYBOSS2dodo = false;" fullword ascii
    $s18 = "kupluyasiskiibudetpivoOKAYBOSS2undefilled.kupluyasiskiibudetpivoOKAYBOSS2sameOrN = function(kupluyasiskiibudetpivoOKAYBOSS2param" ascii
    $s19 = "return object.prototype[kupluyasiskiibudetpivoOKAYBOSS2property].apply(kupluyasiskiibudetpivoOKAYBOSS2args.shift(), kupluyasiski" ascii
    $s20 = "var kupluyasiskiibudetpivoVITK_BOSKO_1S = new Array(-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-" ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1b9d5cca-8ef8-45b3-b9b5-c15048e9f648

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion