_20160906_0292c9ba83bb305e4fb299d6342dd7f6_20160906_0866425bddf9_159

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160906_0292c9ba83bb305e4fb299d6342dd7f6.js, 20160906_0866425bddf985031af505ef49986b91.js, 20160906_0f01c9de8873a585badc7e05e0e3f142.js, 20160906_201e9711a02133a7f48d8c6f540a7c68.js, 20160906_2a8007752534e29a1955591816714f80.js, 20160906_2ffa9959f700777a2a401b6e3475e9eb.js, 20160906_390024fcef27f001a021f0d19d601b6d.js, 20160906_395690a0b0f536d5249b076cfaf347d3.js, 20160906_41ef03320f2f4c84f9f2be8674e892a0.js, 20160906_429018c07c42ad3d445c8d2c76ded96e.js, 20160906_42eaa10f53ac267cce156825f9676ac9.js, 20160906_43e411925b9fc49436f534fb4b8a9146.js, 20160906_442d8b74e5430f7e88ab4becc907c899.js, 20160906_49e3c875c900e945267515c6fb0516c4.js, 20160906_4ff6b2bccf1e42d9833466e05f6b0c2d.js, 20160906_5933e8c2417a6f23930d379be26db4d6.js, 20160906_5a19cb6fa4f29737e4fa6c55116a253c.js, 20160906_5e3fcd72a150eed3a491dd2661043695.js, 20160906_5ecb4343ce82cb279b6ff6372bb71073.js, 20160906_637be674457da45c4956173ec4fba906.js, 20160906_66f995b5ee6532a5e5e64af34b9fa5a2.js, 20160906_6dde8379338de93174d95745c4aa6f8f.js, 20160906_701cdd824f51288ca79ecb30f1e5d276.js, 20160906_7205e7ef13f6d06870c2589d0aca89ca.js, 20160906_724011054b0eaa1bb103889417fdd8cc.js, 20160906_737c311d02cf993e122869b4a3e651ae.js, 20160906_791da0a73edc907ffb98573089a971e9.js, 20160906_793959e572b1367810063f5f9690ffee.js, 20160906_79f4932e56af89b1509f1a09fb6b5dfd.js, 20160906_7a674cdd2092fd56d375fa7b049cf70c.js, 20160906_80f5ea2003be2156243445bce20e1be5.js, 20160906_870c828ba65323c22a3d0f63e2b0981e.js, 20160906_8bd481872bc68cb46b83fb4cf0927c31.js, 20160906_8d34a74d94336d09d1fcf2db8e699e6d.js, 20160906_9458f13568c0cae3310ef50811c693d9.js, 20160906_a366f95f1194eceb8a88874e9b83cccd.js, 20160906_a8a448c274752c790567a25764e28ec2.js, 20160906_aeb36114621823f39b9ef32086d29ff2.js, 20160906_b3ee4a951f626aa9e232dd89af46c726.js, 20160906_c2517217b4a4dafbff446ecf9d26117d.js, 20160906_d13486e5bf57eff6763122c9cc5c26a3.js, 20160906_d1434c644bf23f54766888c4edd0316c.js, 20160906_d37a40498b4c122fa891fd00e97a8aa9.js, 20160906_d3a5d8411b4a62acb8ef56383bdd0d31.js, 20160906_d43aed7ae290ed572cbca9002fb86675.js, 20160906_d65e6510bfc5894db6217b9d3b583752.js, 20160906_da51bb6609c8847e326df1239daf0fee.js, 20160906_e409e2b04b5f948991d9ebfe73faeb51.js, 20160906_e72b2b1ad7429fbd459ca612e89c5420.js, 20160906_e8f9dc0ef5bffb7035914e9c7dec7363.js, 20160906_ea5e223ccf8e5ed3849c3c4c7230e22c.js, 20160906_eb29a1dd0a0715b0c25ff32ecf87adec.js, 20160906_f3a27e89a6638bcbd7c3039bdf5ce0ed.js, 20160906_f66629da399af7273ea13bc3c1efbd6d.js, 20160906_f7c6806531b6607d1042b5f54fc6b1d5.js

rule _20160906_0292c9ba83bb305e4fb299d6342dd7f6_20160906_0866425bddf9_159 {
  meta:
    description = "datamaliciousorder - from files 20160906_0292c9ba83bb305e4fb299d6342dd7f6.js, 20160906_0866425bddf985031af505ef49986b91.js, 20160906_0f01c9de8873a585badc7e05e0e3f142.js, 20160906_201e9711a02133a7f48d8c6f540a7c68.js, 20160906_2a8007752534e29a1955591816714f80.js, 20160906_2ffa9959f700777a2a401b6e3475e9eb.js, 20160906_390024fcef27f001a021f0d19d601b6d.js, 20160906_395690a0b0f536d5249b076cfaf347d3.js, 20160906_41ef03320f2f4c84f9f2be8674e892a0.js, 20160906_429018c07c42ad3d445c8d2c76ded96e.js, 20160906_42eaa10f53ac267cce156825f9676ac9.js, 20160906_43e411925b9fc49436f534fb4b8a9146.js, 20160906_442d8b74e5430f7e88ab4becc907c899.js, 20160906_49e3c875c900e945267515c6fb0516c4.js, 20160906_4ff6b2bccf1e42d9833466e05f6b0c2d.js, 20160906_5933e8c2417a6f23930d379be26db4d6.js, 20160906_5a19cb6fa4f29737e4fa6c55116a253c.js, 20160906_5e3fcd72a150eed3a491dd2661043695.js, 20160906_5ecb4343ce82cb279b6ff6372bb71073.js, 20160906_637be674457da45c4956173ec4fba906.js, 20160906_66f995b5ee6532a5e5e64af34b9fa5a2.js, 20160906_6dde8379338de93174d95745c4aa6f8f.js, 20160906_701cdd824f51288ca79ecb30f1e5d276.js, 20160906_7205e7ef13f6d06870c2589d0aca89ca.js, 20160906_724011054b0eaa1bb103889417fdd8cc.js, 20160906_737c311d02cf993e122869b4a3e651ae.js, 20160906_791da0a73edc907ffb98573089a971e9.js, 20160906_793959e572b1367810063f5f9690ffee.js, 20160906_79f4932e56af89b1509f1a09fb6b5dfd.js, 20160906_7a674cdd2092fd56d375fa7b049cf70c.js, 20160906_80f5ea2003be2156243445bce20e1be5.js, 20160906_870c828ba65323c22a3d0f63e2b0981e.js, 20160906_8bd481872bc68cb46b83fb4cf0927c31.js, 20160906_8d34a74d94336d09d1fcf2db8e699e6d.js, 20160906_9458f13568c0cae3310ef50811c693d9.js, 20160906_a366f95f1194eceb8a88874e9b83cccd.js, 20160906_a8a448c274752c790567a25764e28ec2.js, 20160906_aeb36114621823f39b9ef32086d29ff2.js, 20160906_b3ee4a951f626aa9e232dd89af46c726.js, 20160906_c2517217b4a4dafbff446ecf9d26117d.js, 20160906_d13486e5bf57eff6763122c9cc5c26a3.js, 20160906_d1434c644bf23f54766888c4edd0316c.js, 20160906_d37a40498b4c122fa891fd00e97a8aa9.js, 20160906_d3a5d8411b4a62acb8ef56383bdd0d31.js, 20160906_d43aed7ae290ed572cbca9002fb86675.js, 20160906_d65e6510bfc5894db6217b9d3b583752.js, 20160906_da51bb6609c8847e326df1239daf0fee.js, 20160906_e409e2b04b5f948991d9ebfe73faeb51.js, 20160906_e72b2b1ad7429fbd459ca612e89c5420.js, 20160906_e8f9dc0ef5bffb7035914e9c7dec7363.js, 20160906_ea5e223ccf8e5ed3849c3c4c7230e22c.js, 20160906_eb29a1dd0a0715b0c25ff32ecf87adec.js, 20160906_f3a27e89a6638bcbd7c3039bdf5ce0ed.js, 20160906_f66629da399af7273ea13bc3c1efbd6d.js, 20160906_f7c6806531b6607d1042b5f54fc6b1d5.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a1c3c1769c78210ad59fe0fae0dd853725c64bc44adb02a980a65994f427f5b5"
    hash2       = "5e549425c6b30e0949cd56393a37a4abd3aa9dd83ebab7a1aebc847d7302aa64"
    hash3       = "524d131f6aa4b580b538c44d47d7b2923ab216706b06ac67acf8172515d289e4"
    hash4       = "d6fd830bd1bd43429cf06ff5a4d3bfc9c6be12fd842464593b2ece82e03e837e"
    hash5       = "75067603b7a42fdb3d93a3ebf274919ae088118ce0c815d7786854b6e229a84c"
    hash6       = "94b3d60850f7f97ef250712c60aa86544b931a24b55d93a1a5368def50c3183d"
    hash7       = "4fe83005d7ba9e2a2003e5fc4d1c3bab1b15827f486a1307f34b4ae6e42a1ece"
    hash8       = "d95bc7a8be93c6c77914ea9229d4725422565d44df60e7818bd91085ca37f07b"
    hash9       = "e4e2d991d9f9b4cb8e3dbcd0fe37cb06e9428fc6218ee91c822e3723d049aa19"
    hash10      = "25cd81815677ff70221850d9ae8e41fefc529aab7b12e1ddd7d27f983f2c1349"
    hash11      = "28484438db5fc23b523dc4eb705fb71f8d7a311082a9e85a1777f387f36068be"
    hash12      = "e491eec7336b11771c64e2f6b474140bd530d6261296a003202a175881d7df8e"
    hash13      = "d9162c631d9e8ad3acc1add658486bb7175864941f38fe458000272b251f06f7"
    hash14      = "fed71d09700d2956e56c191970a6199e951b90439b6e7b9f54fc392bb314acd0"
    hash15      = "227d167d87b1ea31f2473af5edf5cca8ee2ef941c993ac5c9e945bcf79c9792a"
    hash16      = "b074645a2955c6c0756e2f2abd99b8b2a818b0e74f77899a66c74e0869406b5b"
    hash17      = "85b2d4cfd4c19f018f00d5c563e3b6b3caa4bf2943494d15196811fa0942244c"
    hash18      = "cff4957daf908e0923636873c463ab3bcb0a2cbeed119dbb4be9f14c05751cd0"
    hash19      = "705499dfdb32423a0e6382969adb0dffea7a7d367d91696adae3d30c5ad080e9"
    hash20      = "f386932c2c79df8194b8d9f54a955fbff42982525c558ea1db840c0d30dc01fa"
    hash21      = "b0e5509f3c15ee598e8afcb448703f2b60a8f54dedfd5e678d93579c5023b104"
    hash22      = "45798bfeef5084ad09838f0eb091a8701353a2edc95c6f3242a42e0eb5a1da15"
    hash23      = "c96a8a16ea9560888c62415dbe2b82cf663d12a82648a788d4874846ac2457bb"
    hash24      = "457ab1bba0f1225747198184d4d125ad1a24709a284b6a03a4c2e6c10c70292a"
    hash25      = "00471ce42323e2bdf15ddb806192a24beef83dfb1a7fb377b8dd8df1c069aa80"
    hash26      = "220ecb0df634f731ca536c7efc7ab7a071da08ff3bbaf8151ae6645db21198d6"
    hash27      = "55f20e03a9f3f1f51acbfddcd85a87bb8595e056932509bfa5712b47dbe82704"
    hash28      = "7184c73de237361f6f24c9024bed9ad3c428ea4b6cb5927a3b5a097622dbf977"
    hash29      = "7208f4b207589eec978ff239f4911731fd910afca6de76c88b23f7ac4b7b3dfc"
    hash30      = "8cf5cca2095a1d675808a0c752bb2cfb20452e9ddb4250132614e7de76c14e57"
    hash31      = "db1c2aa418344db6f75b228d1674f629bb0243b41ad78d238f57a8561f94d34e"
    hash32      = "d8f575b62e614337812231b8beb63ba6dc8bf5ab3c5eda6a1f70971aa0d55fde"
    hash33      = "833228c79569b5ea9145f9dad9552d075fe53419db65df7800fd003142444003"
    hash34      = "65d99287d74e0ef397e6cdd6f881afb693312ea9d0b56f55c80925bd33520998"
    hash35      = "1ef12327e481ae99499836acd096f494c606370a18b555cb1a59c23e4b0667dc"
    hash36      = "6df886940c19f2210eee38276f570cf48a685203672aa59885c7299ab791bae9"
    hash37      = "2096502dd69b58f75a28b4a09d5e5c39e87154a60c15930f02a986a911ba85a4"
    hash38      = "a90e82832ea100a785fa7bacfce2384d4b1f5500ac39845bbaf671aeec0f27e1"
    hash39      = "8d9f4b6829aa7de83fc98b47f0afa94ad77f2bc688421d0f35dba0472aeb2cee"
    hash40      = "d42bb5d81e9cc8f96bb6586e19f60fe0d6709f2a555b09e360b58083a61f346f"
    hash41      = "c337635f06ed961bd8e88104b16da1e6740b8934df3e0653f3c694863f19a141"
    hash42      = "b73fc4cf4963c28d644ab7677a7a4755814abadee50c6cd9267970fe21a12750"
    hash43      = "b17e152982dddb146985fb5845f18fa2403b17b43b83435eb25f445c5eafc242"
    hash44      = "532e020add7db06282c48748002cb4a6328fc8fb61266b8926abb856e05112e1"
    hash45      = "c3c753fc2d53c140acf917d7df3c981d8faffba81e4f16ffa0068bc5eb9f934e"
    hash46      = "6dee45bd3884decf2e3214b8aba25db6011c6518af20ae507dcad96152f0c14e"
    hash47      = "3800fab98447fffae7a03da1523a555a64ff3cbcce4499ef9cf33d893d536175"
    hash48      = "816c3ff2eaa144d111a789d906b4ab9cd02b1c0dce2f8439c68ed6cd05debfad"
    hash49      = "5cb72c31bd90ae728d7a9e4cec94e6fdf7a403b59c4e2b6c813ad513524bbad8"
    hash50      = "35f9df2220b57fb0059cb6efe17c87a5f0758fa58588f704b0d5df29932a45b8"
    hash51      = "650a4aea1785949a0e27e05a6868b595e2a87917b6a220e4b3b2c080bfc56baa"
    hash52      = "ae3ed4667c4e3b40afc4d53984a1f2c2c8a95c16da63725700235756d7917def"
    hash53      = "5bf4c80f59cc5ce6b46b47f261b5866ccad8aee9e4ddc04caea4126ccb0fbc85"
    hash54      = "b9f15b930523ce2b6a61c51a764de2d2131d329034c63cfc79ba0eb377bf5de6"
    hash55      = "97548f2012d9e6057802504291220f5f94ce8f21a6ede86c1fd0048c7a6096c9"

  strings:
    $s1  = "<head><script language='JScript'>" fullword ascii
    $s2  = "String.prototype.doyouwillcrazylalalaSAMBADIGA = function() {" fullword ascii
    $s3  = "var subchickas = new Enumerator(fsoObj.GetFolder(chickaPath).SubFolders);" fullword ascii
    $s4  = "doyouwillcrazylalalaBIBRO2Native.doyouwillcrazylalalaBIBRO2typize = function(object, doyouwillcrazylalalaBIBRO2family){" fullword ascii
    $s5  = "if ((!doyouwillcrazylalalaBIBRO2check || !object[doyouwillcrazylalalaBIBRO2property]) && typeof object.prototype[doyouwillcrazyl" ascii
    $s6  = "doyouwillcrazylalalaBIBRO2undefilled.dEDWWEE = function(){" fullword ascii
    $s7  = "doyouwillcrazylalalaBIBRO2undefilled.angle = function(doyouwillcrazylalalaBIBRO2p) {" fullword ascii
    $s8  = "doyouwillcrazylalalaBIBRO2Native.doyouwillcrazylalalaBIBRO2genericize = function(object, doyouwillcrazylalalaBIBRO2property, doy" ascii
    $s9  = "doyouwillcrazylalalaBIBRO2Native.doyouwillcrazylalalaBIBRO2genericize = function(object, doyouwillcrazylalalaBIBRO2property, doy" ascii
    $s10 = "if ((!doyouwillcrazylalalaBIBRO2check || !object[doyouwillcrazylalalaBIBRO2property]) && typeof object.prototype[doyouwillcrazyl" ascii
    $s11 = "doyouwillcrazylalalaBIBRO2undefilled.doyouwillcrazylalalaBIBRO2sameOrN = function(doyouwillcrazylalalaBIBRO2param1, doyouwillcra" ascii
    $s12 = "String.prototype.doyouwillcrazylalalaBIBROvlompado = function() {" fullword ascii
    $s13 = "doyouwillcrazylalalaBIBRO2undefilled.doyouwillcrazylalalaBIBRO2sameOrN = function(doyouwillcrazylalalaBIBRO2param1, doyouwillcra" ascii
    $s14 = "        } while (doyouwillcrazylalalaBIBRO2XCOP < doyouwillcrazylalalaBIBRO2len && doyouwillcrazylalalaBIBRO2c3 == -1);" fullword ascii
    $s15 = "        } while (doyouwillcrazylalalaBIBRO2XCOP < doyouwillcrazylalalaBIBRO2len && doyouwillcrazylalalaBIBRO2c4 == -1);" fullword ascii
    $s16 = "        } while (doyouwillcrazylalalaBIBRO2XCOP < doyouwillcrazylalalaBIBRO2len && doyouwillcrazylalalaBIBRO2ddDccC1 == -1);" fullword ascii
    $s17 = " function doyouwillcrazylalalaBIBRO2center(doyouwillcrazylalalaBIBRO2rivulet) {" fullword ascii
    $s18 = "};String.prototype.doyouwillcrazylalalaBIBRO2center2 = function () {" fullword ascii
    $s19 = "var doyouwillcrazylalalaVITK_BOSKO_1S = new Array(-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-901,-90" ascii
    $s20 = "alalaBIBRO2property] == 'function') object[doyouwillcrazylalalaBIBRO2property] = function(){" fullword ascii

  condition:
    (uint16(0) == 0x683c and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2e241676-4de5-4f76-834e-adcf1d954f6c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion