_20161122_013cd5a532dd4fc9bec0e645802b5d43_20161122_04f058c681bf_179

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20161122_013cd5a532dd4fc9bec0e645802b5d43.js, 20161122_04f058c681bf25ff13bf06a2183899f0.js, 20161122_0a7eae3614305d9bcd9fd114d6eac51f.js, 20161122_0b683833a0483ac094d513e17597fdc8.js, 20161122_0c7b0b2726e8981016c4cf40b28be6f4.js, 20161122_1447dfe52c6c180bfeb4adbe0ff4dffe.js, 20161122_159ed78a7637248e59926af246673c2d.js, 20161122_18193825f753a4ee609af94c679980f0.js, 20161122_1a2375c1b114b061d3b72632e03c9582.js, 20161122_1a50a207b1acf2b04d9b691da1fb8c19.js, 20161122_1b3d212f518bc177b78ba9fbcff0cf1f.js, 20161122_1bae332b7ec9c73321f19d06894233c6.js, 20161122_1d4f02cebee78d4b5e609b49ea0e9d26.js, 20161122_1e86b77bb4986d47e8d42628f1af1a93.js, 20161122_1ffdda1a0c8febd5ab5cf721795f8b2f.js, 20161122_205cc79dc59d076932afafe9534fecd0.js, 20161122_20e6eb82bbdba32e49edbf03a141e803.js, 20161122_211b0f295359dcebe056d2ae3f6c78fc.js, 20161122_21812fbc985a34ce4fc3db1a56d36161.js, 20161122_2425d4d39398bb65f9cbc7cd75f595a6.js, 20161122_26b60c8b465916f4d28ab242d1dd7240.js, 20161122_2729c1e57caf036dc9fab7daa7b511f5.js, 20161122_286bf3dd914e5d66dedfebe9a28763e7.js, 20161122_2a87de95dea5eda3944e049a426f0ff5.js, 20161122_2ce1a6f4789ab4e0e1268aa247ebe3fd.js, 20161122_2ceb2240f308d4d308f3da77f6bad82a.js, 20161122_2d036432fbdf3feeb9dc2fadc416a1be.js, 20161122_2d689a16d8cb2ba379c2d5d10f4b72e8.js, 20161122_2dad5b6ea6c0f1c5dc18df56c423daad.js, 20161122_2df7ecee40943971c84d81bd5091f662.js, 20161122_2e28a35d5ba03f8b0b7b8ecff627bc53.js, 20161122_2e5f43d9ea62c88442826c8daa3c970e.js, 20161122_2e8d7da0f58fa0537db4b6dfa614fd54.js, 20161122_3083afe5026f77e664e57bfdf64fab36.js, 20161122_3470d54f256b275f8fedae2a6b961be0.js, 20161122_360134a600600ed6b78003dd2839d2ae.js, 20161122_388c6f9d42d3191443357a75c26d01a5.js, 20161122_3913741953936e2ae59ed059b7f4fa0e.js, 20161122_3976956c3b834359ea9d803f97387b13.js, 20161122_3c6458f6beea2975b399ed0e287996ce.js, 20161122_3ebfce78c80cf391d4960186069663b5.js, 20161122_3edc7ab86ec32f54cba3d7bebe5d225d.js, 20161122_40edef5ab8ae67800d2679e2af53f83f.js, 20161122_4172d4685bc449e8ece3e5e5ce3c68d9.js, 20161122_42ee8030294ab087cf161298df9b1e85.js, 20161122_431228766166c28d1eba1180c0e59fb3.js, 20161122_437752eeee3603ea0f3a65f312188a93.js, 20161122_44f68579b4e4271f3cf26c86cb3f3428.js, 20161122_4865d938d54090fc4692663e02465907.js, 20161122_48ce4b8992b063a246447b7a210ad852.js, 20161122_4d8e31a23c82c947140dc0834e6d8446.js, 20161122_4fcf129f796c07cd057e7889c7074d56.js, 20161122_506dd030ffb94d2637b97bf89735d3b6.js, 20161122_5080e7d9ed53752b8484fb5da9918127.js, 20161122_50a3ba45afac7b36aabd6cd19cd1a2b7.js, 20161122_51c0c5d116fa427410cda151b9b6b6e6.js, 20161122_53b4b92f7837acf5bffabf3454de8d99.js, 20161122_555b6876ba9445a5806c47760a9efa71.js, 20161122_5561bc3fbf9e13c0203732cba8c1da06.js, 20161122_5bca0efa44be21aa82dc75652540f4d3.js, 20161122_5e9de4b3c200bdb0100a3ba437b956cb.js, 20161122_6056e20b774be7b67e714507107dac41.js, 20161122_618d94b50e7ce7efbe16770b4d883373.js, 20161122_622a64333ee00288c9ab127b72e00dc6.js, 20161122_629c1c18c3e23816db82fa70c37ea7c6.js, 20161122_62a5c7905484cd78271bc10157542bf5.js, 20161122_64b09fd324ea52882ac8436d30a92367.js, 20161122_68a048e5cf5c0c45773052a9c842c19c.js, 20161122_6aa16e0af6163f88802e186312d99625.js, 20161122_6c69dc9a7f121b4a5111222bfad93e99.js, 20161122_6e10affe01329cbd191f76808e7dd502.js, 20161122_6f76b83149ee352fe1b6bdaf3df81c26.js, 20161122_707408aadcb9f33a2fb90e22a8636fb9.js, 20161122_72efb39f42038c163a8ee584b475f2d9.js, 20161122_761bb337b5cdbd55f45a599556f60af9.js, 20161122_7837bd656aee23259ba9f69b8d81a4c8.js, 20161122_788d9fa1d140a605c27d7a08270670e3.js, 20161122_7b83b1b9b97628c2b4b2f5ee6de8045f.js, 20161122_7be0f5d2d9880f79d729a07d40c799ae.js, 20161122_7d21ecd7284b25862e8cb8a5d8da65ed.js, 20161122_7d75fdf83808975158df341a2969378e.js, 20161122_7e76e15e4aeda2eef27628e82584d690.js, 20161122_7eecfc6bc7671a67f4bab5f4eea40be2.js, 20161122_8098617b2b994022f32699a8f358150a.js, 20161122_80990ad910f4f962fd4eebbb27383736.js, 20161122_811c8d9c16b232fae1ca8cb8e540c0de.js, 20161122_85b4abbd97f2f06963e18f3468d2b175.js, 20161122_862a77b29fe16519dec64bc0f22b12be.js, 20161122_86330785c8aa85251fda37895e3d5b9a.js, 20161122_86e288f96ab860317382a3b23a40c068.js, 20161122_8b25b0a1b5648c719764140f2315d12a.js, 20161122_8c71be72769c6ccf74254719349bf12b.js, 20161122_8fbf2d733c89e1e2879d9b825e6ecd80.js, 20161122_91ad4a4c16ab0f31a274d61a514ea7ad.js, 20161122_91dbc3092fb58f786082fd3e547252a3.js, 20161122_923f1c4fb7321de7358d19a194d361a6.js, 20161122_93a2e62d6d26c44878cfb94c753531ba.js, 20161122_93b5b038ad1fc56432ff40ec179e2022.js, 20161122_940d8c4db56f78a3959750d6340dfbbb.js, 20161122_95b7a0ffc9d67e10f6cefea361c38abf.js, 20161122_95ebfa7aa586e9380e809d83cf7851be.js, 20161122_96f70b51286e4fe0eff22ba023f6df28.js, 20161122_97a27a9cfe8d2b33ccc8eff0869d2d28.js, 20161122_99770f49fe5ec0ef8f9cf82ebe00fef7.js, 20161122_9a8fdae695eae4edc7b3beba9c1e44c8.js, 20161122_9c9f0d1c0b479595e9e22c3d4bea0083.js, 20161122_9d41379278221d4ec5313c63facaf7fa.js, 20161122_a1ec7832111a09707c6f4e5cbe94e0b3.js, 20161122_a487bd6b8cbd6b01094654b2fa324751.js, 20161122_a58a7ca5a81e1b48aed6b13bfdd36c27.js, 20161122_a8480278399e9fed81a888f30a78d438.js, 20161122_a867b188b76e819c718e6e878633cc53.js, 20161122_a8a2f8ae70c48d3025708a8b47104423.js, 20161122_a8ea67b998c571bdb7afb975135a14c8.js, 20161122_a8ede4f1448bfe5c94655becb542237a.js, 20161122_acaaab9b87822512bf9bd27533e70068.js, 20161122_aced3325c89ddf1f1095fa21b3dcafba.js, 20161122_ae1eedda8d96fe6e12f8f5c4730e4f84.js, 20161122_af2c6f98d33e1540db79ebdd95fe1ea1.js, 20161122_b03dfa6ac66cd0aa270223f0f083b6d1.js, 20161122_b0d43384e41acd078d8824c85a6d1212.js, 20161122_b0f1a1c32493a3672b524ba8230cd09c.js, 20161122_b11f6fa9875014d6174d43a5bec2bbad.js, 20161122_b2db22a8241c0380731ea9960bcefe1b.js, 20161122_b370425a6a80da10a032477d166549bb.js, 20161122_b53e95dc186aec1bb3a108694cabe1e4.js, 20161122_b742616e539303805f6b10fdb912bd46.js, 20161122_b979c0c6602386e15f0c55714f03afe8.js, 20161122_b9d183cf31b34f471612d69bb337961f.js, 20161122_ba5d7e95087d278e88cbe351d4f412d7.js, 20161122_bacbe8ce9d100a4e3681c6a95799107e.js, 20161122_bcdebf4d64b15d7a8866a3c7160c6322.js, 20161122_be47cd241b6e2c6620fe2a19ed0f5985.js, 20161122_bf53ba041c2fcb1e80a87d7f76c4a1be.js, 20161122_c06fc0bb0aebabd4bd2de38fa1315fa6.js, 20161122_c076144a456c67e7c133ce775ddd96ba.js, 20161122_c4d852d7080b6151581a85aa55601486.js, 20161122_c55d110cb14b4d1ece965bba453ff7fa.js, 20161122_c573d5e6a564d81439c1697f85afe911.js, 20161122_c6b880cfbffb04930812761373201d96.js, 20161122_c83cf3add666e8326483aba2cfc7b305.js, 20161122_c84fba9d78e1caa465502960fd89cfd2.js, 20161122_cbc1404e2e85716ceea0a3775bcff9ca.js, 20161122_cc0f9ccbc000e751ce1b6d811ee67f27.js, 20161122_cf3b1d87adf052d21d20a1615af7e322.js, 20161122_d244d44fe0e140c285771d11544c2bda.js, 20161122_d54d07e8df7b195f8d0887759aeecf96.js, 20161122_d58fa92b630626210bfe420a6e1cfa2b.js, 20161122_d6c5ef5481a128719f1c840a9f572a8e.js, 20161122_d7676de3fb431f56890081bfab689df6.js, 20161122_d7e39bc767c7018e19933a3f1480310c.js, 20161122_d9b06fa1e375cc324dc99a08204a4f3e.js, 20161122_db14b4d12a070d4fbee35082d85ec425.js, 20161122_dea6118525821cfd2b14dd9633f926f7.js, 20161122_ded510d3641c96d3ef73a4110e115ff3.js,...

rule _20161122_013cd5a532dd4fc9bec0e645802b5d43_20161122_04f058c681bf_179 {
  meta:
    description = "datamaliciousorder - from files 20161122_013cd5a532dd4fc9bec0e645802b5d43.js, 20161122_04f058c681bf25ff13bf06a2183899f0.js, 20161122_0a7eae3614305d9bcd9fd114d6eac51f.js, 20161122_0b683833a0483ac094d513e17597fdc8.js, 20161122_0c7b0b2726e8981016c4cf40b28be6f4.js, 20161122_1447dfe52c6c180bfeb4adbe0ff4dffe.js, 20161122_159ed78a7637248e59926af246673c2d.js, 20161122_18193825f753a4ee609af94c679980f0.js, 20161122_1a2375c1b114b061d3b72632e03c9582.js, 20161122_1a50a207b1acf2b04d9b691da1fb8c19.js, 20161122_1b3d212f518bc177b78ba9fbcff0cf1f.js, 20161122_1bae332b7ec9c73321f19d06894233c6.js, 20161122_1d4f02cebee78d4b5e609b49ea0e9d26.js, 20161122_1e86b77bb4986d47e8d42628f1af1a93.js, 20161122_1ffdda1a0c8febd5ab5cf721795f8b2f.js, 20161122_205cc79dc59d076932afafe9534fecd0.js, 20161122_20e6eb82bbdba32e49edbf03a141e803.js, 20161122_211b0f295359dcebe056d2ae3f6c78fc.js, 20161122_21812fbc985a34ce4fc3db1a56d36161.js, 20161122_2425d4d39398bb65f9cbc7cd75f595a6.js, 20161122_26b60c8b465916f4d28ab242d1dd7240.js, 20161122_2729c1e57caf036dc9fab7daa7b511f5.js, 20161122_286bf3dd914e5d66dedfebe9a28763e7.js, 20161122_2a87de95dea5eda3944e049a426f0ff5.js, 20161122_2ce1a6f4789ab4e0e1268aa247ebe3fd.js, 20161122_2ceb2240f308d4d308f3da77f6bad82a.js, 20161122_2d036432fbdf3feeb9dc2fadc416a1be.js, 20161122_2d689a16d8cb2ba379c2d5d10f4b72e8.js, 20161122_2dad5b6ea6c0f1c5dc18df56c423daad.js, 20161122_2df7ecee40943971c84d81bd5091f662.js, 20161122_2e28a35d5ba03f8b0b7b8ecff627bc53.js, 20161122_2e5f43d9ea62c88442826c8daa3c970e.js, 20161122_2e8d7da0f58fa0537db4b6dfa614fd54.js, 20161122_3083afe5026f77e664e57bfdf64fab36.js, 20161122_3470d54f256b275f8fedae2a6b961be0.js, 20161122_360134a600600ed6b78003dd2839d2ae.js, 20161122_388c6f9d42d3191443357a75c26d01a5.js, 20161122_3913741953936e2ae59ed059b7f4fa0e.js, 20161122_3976956c3b834359ea9d803f97387b13.js, 20161122_3c6458f6beea2975b399ed0e287996ce.js, 20161122_3ebfce78c80cf391d4960186069663b5.js, 20161122_3edc7ab86ec32f54cba3d7bebe5d225d.js, 20161122_40edef5ab8ae67800d2679e2af53f83f.js, 20161122_4172d4685bc449e8ece3e5e5ce3c68d9.js, 20161122_42ee8030294ab087cf161298df9b1e85.js, 20161122_431228766166c28d1eba1180c0e59fb3.js, 20161122_437752eeee3603ea0f3a65f312188a93.js, 20161122_44f68579b4e4271f3cf26c86cb3f3428.js, 20161122_4865d938d54090fc4692663e02465907.js, 20161122_48ce4b8992b063a246447b7a210ad852.js, 20161122_4d8e31a23c82c947140dc0834e6d8446.js, 20161122_4fcf129f796c07cd057e7889c7074d56.js, 20161122_506dd030ffb94d2637b97bf89735d3b6.js, 20161122_5080e7d9ed53752b8484fb5da9918127.js, 20161122_50a3ba45afac7b36aabd6cd19cd1a2b7.js, 20161122_51c0c5d116fa427410cda151b9b6b6e6.js, 20161122_53b4b92f7837acf5bffabf3454de8d99.js, 20161122_555b6876ba9445a5806c47760a9efa71.js, 20161122_5561bc3fbf9e13c0203732cba8c1da06.js, 20161122_5bca0efa44be21aa82dc75652540f4d3.js, 20161122_5e9de4b3c200bdb0100a3ba437b956cb.js, 20161122_6056e20b774be7b67e714507107dac41.js, 20161122_618d94b50e7ce7efbe16770b4d883373.js, 20161122_622a64333ee00288c9ab127b72e00dc6.js, 20161122_629c1c18c3e23816db82fa70c37ea7c6.js, 20161122_62a5c7905484cd78271bc10157542bf5.js, 20161122_64b09fd324ea52882ac8436d30a92367.js, 20161122_68a048e5cf5c0c45773052a9c842c19c.js, 20161122_6aa16e0af6163f88802e186312d99625.js, 20161122_6c69dc9a7f121b4a5111222bfad93e99.js, 20161122_6e10affe01329cbd191f76808e7dd502.js, 20161122_6f76b83149ee352fe1b6bdaf3df81c26.js, 20161122_707408aadcb9f33a2fb90e22a8636fb9.js, 20161122_72efb39f42038c163a8ee584b475f2d9.js, 20161122_761bb337b5cdbd55f45a599556f60af9.js, 20161122_7837bd656aee23259ba9f69b8d81a4c8.js, 20161122_788d9fa1d140a605c27d7a08270670e3.js, 20161122_7b83b1b9b97628c2b4b2f5ee6de8045f.js, 20161122_7be0f5d2d9880f79d729a07d40c799ae.js, 20161122_7d21ecd7284b25862e8cb8a5d8da65ed.js, 20161122_7d75fdf83808975158df341a2969378e.js, 20161122_7e76e15e4aeda2eef27628e82584d690.js, 20161122_7eecfc6bc7671a67f4bab5f4eea40be2.js, 20161122_8098617b2b994022f32699a8f358150a.js, 20161122_80990ad910f4f962fd4eebbb27383736.js, 20161122_811c8d9c16b232fae1ca8cb8e540c0de.js, 20161122_85b4abbd97f2f06963e18f3468d2b175.js, 20161122_862a77b29fe16519dec64bc0f22b12be.js, 20161122_86330785c8aa85251fda37895e3d5b9a.js, 20161122_86e288f96ab860317382a3b23a40c068.js, 20161122_8b25b0a1b5648c719764140f2315d12a.js, 20161122_8c71be72769c6ccf74254719349bf12b.js, 20161122_8fbf2d733c89e1e2879d9b825e6ecd80.js, 20161122_91ad4a4c16ab0f31a274d61a514ea7ad.js, 20161122_91dbc3092fb58f786082fd3e547252a3.js, 20161122_923f1c4fb7321de7358d19a194d361a6.js, 20161122_93a2e62d6d26c44878cfb94c753531ba.js, 20161122_93b5b038ad1fc56432ff40ec179e2022.js, 20161122_940d8c4db56f78a3959750d6340dfbbb.js, 20161122_95b7a0ffc9d67e10f6cefea361c38abf.js, 20161122_95ebfa7aa586e9380e809d83cf7851be.js, 20161122_96f70b51286e4fe0eff22ba023f6df28.js, 20161122_97a27a9cfe8d2b33ccc8eff0869d2d28.js, 20161122_99770f49fe5ec0ef8f9cf82ebe00fef7.js, 20161122_9a8fdae695eae4edc7b3beba9c1e44c8.js, 20161122_9c9f0d1c0b479595e9e22c3d4bea0083.js, 20161122_9d41379278221d4ec5313c63facaf7fa.js, 20161122_a1ec7832111a09707c6f4e5cbe94e0b3.js, 20161122_a487bd6b8cbd6b01094654b2fa324751.js, 20161122_a58a7ca5a81e1b48aed6b13bfdd36c27.js, 20161122_a8480278399e9fed81a888f30a78d438.js, 20161122_a867b188b76e819c718e6e878633cc53.js, 20161122_a8a2f8ae70c48d3025708a8b47104423.js, 20161122_a8ea67b998c571bdb7afb975135a14c8.js, 20161122_a8ede4f1448bfe5c94655becb542237a.js, 20161122_acaaab9b87822512bf9bd27533e70068.js, 20161122_aced3325c89ddf1f1095fa21b3dcafba.js, 20161122_ae1eedda8d96fe6e12f8f5c4730e4f84.js, 20161122_af2c6f98d33e1540db79ebdd95fe1ea1.js, 20161122_b03dfa6ac66cd0aa270223f0f083b6d1.js, 20161122_b0d43384e41acd078d8824c85a6d1212.js, 20161122_b0f1a1c32493a3672b524ba8230cd09c.js, 20161122_b11f6fa9875014d6174d43a5bec2bbad.js, 20161122_b2db22a8241c0380731ea9960bcefe1b.js, 20161122_b370425a6a80da10a032477d166549bb.js, 20161122_b53e95dc186aec1bb3a108694cabe1e4.js, 20161122_b742616e539303805f6b10fdb912bd46.js, 20161122_b979c0c6602386e15f0c55714f03afe8.js, 20161122_b9d183cf31b34f471612d69bb337961f.js, 20161122_ba5d7e95087d278e88cbe351d4f412d7.js, 20161122_bacbe8ce9d100a4e3681c6a95799107e.js, 20161122_bcdebf4d64b15d7a8866a3c7160c6322.js, 20161122_be47cd241b6e2c6620fe2a19ed0f5985.js, 20161122_bf53ba041c2fcb1e80a87d7f76c4a1be.js, 20161122_c06fc0bb0aebabd4bd2de38fa1315fa6.js, 20161122_c076144a456c67e7c133ce775ddd96ba.js, 20161122_c4d852d7080b6151581a85aa55601486.js, 20161122_c55d110cb14b4d1ece965bba453ff7fa.js, 20161122_c573d5e6a564d81439c1697f85afe911.js, 20161122_c6b880cfbffb04930812761373201d96.js, 20161122_c83cf3add666e8326483aba2cfc7b305.js, 20161122_c84fba9d78e1caa465502960fd89cfd2.js, 20161122_cbc1404e2e85716ceea0a3775bcff9ca.js, 20161122_cc0f9ccbc000e751ce1b6d811ee67f27.js, 20161122_cf3b1d87adf052d21d20a1615af7e322.js, 20161122_d244d44fe0e140c285771d11544c2bda.js, 20161122_d54d07e8df7b195f8d0887759aeecf96.js, 20161122_d58fa92b630626210bfe420a6e1cfa2b.js, 20161122_d6c5ef5481a128719f1c840a9f572a8e.js, 20161122_d7676de3fb431f56890081bfab689df6.js, 20161122_d7e39bc767c7018e19933a3f1480310c.js, 20161122_d9b06fa1e375cc324dc99a08204a4f3e.js, 20161122_db14b4d12a070d4fbee35082d85ec425.js, 20161122_dea6118525821cfd2b14dd9633f926f7.js, 20161122_ded510d3641c96d3ef73a4110e115ff3.js,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a5a43e70d35848de62f06228b9ecd0504c6a5fcf750f0e85de2c4215c046c828"
    hash2       = "bc580e1a1dc66c46da148a6623b35fea6a8f29f11c9133063e5cdf3fcb24cc54"
    hash3       = "4cb667312ee4f9bd85f30b513b0091a87a143c6ffb2411060c259012c227a2af"
    hash4       = "bc1fd0622acb3f57121b974df24dc49bb3a93f0a955e303cf4cf0edc97d07d57"
    hash5       = "e680822da8be44d75e19ff21747a0c49008b934b6b3e3bc979deed9c94fac7ce"
    hash6       = "ccfe42d6c6662aaf3a3cc171327bb5f5797709c85f698ee1443da35d93424868"
    hash7       = "5c578e67645afb92e49662a486ba2da23b594d60673288dbd3bcccad1e54bcf7"
    hash8       = "44772a732c4cfc9ecc8f745d5046cead6b8f71239daf02402edbcfbb1c6e0919"
    hash9       = "65f1eb8ce79555f1e32874b05562bbec4074ec554b5131f06ec4aa6aae2dfcd3"
    hash10      = "7acea409c329bd62946a27253aca123905b5fc2f7c23e1df40047563cb638620"
    hash11      = "d3d789ceb6ae8323ebdbd872f8c6c0534acadcef8f8bb1feae9453e1e292b3ee"
    hash12      = "e40dbeea236e2ebf66bc3c53e6f7ac6a59716b6733e468d7018609f521ec40e9"
    hash13      = "01757db1e4c9c5b4c63fdaa4433d50071e14a239cccccaed7e6e57b4de935db3"
    hash14      = "e23b2d37b08da2711240fd399e29cf422c0440b404afbaff2b8552185b52b5ad"
    hash15      = "97123105d662f736de2db7a63b08f5ce7b1741db2d2ea09ba85d2bd3d8a6eaff"
    hash16      = "2f886c726877a5731e9fa003ed38a862ed9a2fd2facd97e50ae99ffee71b64ba"
    hash17      = "2fd39407cade03f451f8322f03dc1680e46c37508be51c0051b108dbf0a9ccbc"
    hash18      = "b6fc8b5a7bfb39a2796687cf3ff5e7c871145ce18aad776e52125682d20ea203"
    hash19      = "0ff43e89ff81d07624de8f68570a8fb679b4bb27752f0f212337266faa502fa9"
    hash20      = "92c6a99303a84154cfb828fa7629bec1dbaef7d68fdba70cffcadb606b2afb0d"
    hash21      = "557dbfab4a5ad13cd7e464eeb003e39f63cd28cacf0dc62640e340911c00de33"
    hash22      = "0c93875c0e27efd53c6cc3736d2a9927a4a2aba8e9da5f75857a0b0fc231febd"
    hash23      = "9718b720a7074d30179a7586b6c258c0b17866fb7e03341bc0f674671b2ef6ce"
    hash24      = "21c2f9e10e8be572e59b9bb33d2f0f06f3873ec57b9f3481233f9dd3e5e1809a"
    hash25      = "0d1fff96ae0798e347d7f97e43520bf983b454c52ed624f94d55fb070361f388"
    hash26      = "0f46bf729ac5f6c33b6396495a289711234f7c97d1572f60d588dfbe73cbb158"
    hash27      = "9c2214cea64701508dbb18a3a26e0ee28c9a4cd5f287709ab41bdca6097978b4"
    hash28      = "80437615f4421905ef11b3e0f23fb3ad431a298b383c1379eb0332f5b4893e0e"
    hash29      = "c8febe44caf4444d1c51175a4e6f3f6fbd694096484855a7dc623d33c11dbf8f"
    hash30      = "7e926674cbbc8736a9939d45d1750b311d3065c79aef05896e12b5e3be97f951"
    hash31      = "bf720b795b16cda64e47030844a8f44eb6ed90faa2e470832866fcf358438a17"
    hash32      = "f60064cc1d48d823ac0c061d8955de236e8957a284314c929a6a362dfe722e82"
    hash33      = "08ca5b5ebe284c08627d6d6a111dbac9e8696a36c95311be440d1b71b74a30be"
    hash34      = "48b1d70ded7c8ae2b97dd3151f7340542919d8af940d9d3084fc0426f750de33"
    hash35      = "d89a17ccb4098f9887f80eb828ed178ebaabb3a4acb3c2f8d17b4d6274ab8a67"
    hash36      = "730ecb90010d30dc1151ea17fe0699263c96b3d47332032af7367902f8200a78"
    hash37      = "84249158d4fc1ee2ac7e6d7f8fa833b65143081adfeb5b1bc286b5b1ee77990b"
    hash38      = "8452e835a686dab963269d6f394cc3a0dd456ec681052adeea62a13ad17d89f9"
    hash39      = "8b3ff7a4b76c8ecb9a3be8331865d0dd44151b346a17e45ec116903a5c30f3d1"
    hash40      = "5e32203869607c79ab17a2ae81f6e3976d3afb994728fffd9c16d53c36ba64e6"
    hash41      = "fcd7fd6b85d90566a16f48520c49a5f26f112de23ea79dec7e2789c717ffd2c6"
    hash42      = "b2664f7f6bf182223337bb79f51bc4b996234a61d42cfdcd4eb4ba2f38c6cb3c"
    hash43      = "b6d4dcd8fdaf3be714325b5e13cfc2336cf90f2c26d44ceecc4c431111d2facc"
    hash44      = "80c343a17fe35d199f552e98a7afafcb918b7af49db8b505f346fdba67cd4123"
    hash45      = "601a38b511f82c288a58cc2e0acf119f5d796e929323e9c4100a4c6ed4fde9d3"
    hash46      = "c975f1e5e4557cdb79d5cf761eedda7fcfd1ecc9568856fa39b2a886632bd194"
    hash47      = "78d845bbd5b0a91023e133f38a07b5c0c61149559c807d6d80cc4297c5a257d9"
    hash48      = "88f29ed7577dcfde778dd3e3dedd1727b07ad07442cec05cca0dd7a4067b1283"
    hash49      = "8ea712dfef2c6cf4a712b1b1134a2a62d94ad3345ea9e0f8be52485976325506"
    hash50      = "590f50a16f0cb3e79fb57612bcd38cf28e9beaee57c50ce9c30611fc658c9347"
    hash51      = "5f7c60b382ca8e5fd19ddf25e0d9ffbf8219fca206eb9ddc98f9c2d3c664f8ec"
    hash52      = "fc27aa809a9f54fbe2a755a89268c212b777835b2e636166b112e0e08e444369"
    hash53      = "c93776b6a6009b7d2ca1e2ce4d5a7ad195d3034aaba4157d1ca36fa678645655"
    hash54      = "729b4ced5cc58ab3e7551c6f86d7c2fb9bc0386d7d2335d96d4dfb1da579925e"
    hash55      = "eabc275011e14db86441efe39bc802f318843f5ab47190f57ea0a383453241f7"
    hash56      = "8f2784d3b8f434f2ce8435a4d2bf37bbfbfbe699c5bb91762310651400c85fed"
    hash57      = "a16463dded449f35e098f6d423465074a9850347dd0b9ac24d230ac47adc7a0e"
    hash58      = "286cab99abbd7fbf349b9abc690df4d3b06d63984f65cc5e36013e909f0fe138"
    hash59      = "b9c4943694797b9515ceda96ee4301e5e3ca9fa60fd86409e95a447a4eab1e83"
    hash60      = "900f87eddd42ee75c4030097e6bb8b2e2324549503f2cbf6e18b6b976c9a2b88"
    hash61      = "f8dc54f178262390e9cc85b26f1d8c995b3750974cec8c4552358541fd4163f4"
    hash62      = "b75cef83f9cb2f73a879b7b6cedd00435b5a619fe07fc0c1b81b619fe52daf7f"
    hash63      = "90537b35103e1efdb05132e0713b6681255200abc170239b3303b2401544a021"
    hash64      = "017a67e68ed7bac0eefb28880422ce725dfb5aa42f829bcc8106dc8735123fbe"
    hash65      = "beafd0b37b4ca34d73551ca1e0fba4a4d5c5db1d952bb9b18832645f104111cb"
    hash66      = "ccd3016f81c0cf685839d3f1d7b9135e04bc7fef02939ace1ee191c9d15f9eb8"
    hash67      = "a1699195213533007318e37f83196a2c60ea0a331050ce9efa970895b5cfc3d1"
    hash68      = "661f0dea5f662a7816dcf1363a5264651ef82e8b638f9c8470a2af7b148c269b"
    hash69      = "80ef7e9b651ba69509b6ad10ec069396c9163d8b07ff363a2da50e8e83975167"
    hash70      = "6816d6273744050d9cffd7f7fc77ad52b53b5600102454526c656e55e3dcf474"
    hash71      = "25bd89500e02545263dda572e3726b803ca0b18c194cf413fbf408627715afe3"
    hash72      = "c36b4f70a057a8ad2053ba44d2ee2563fa13ec3097543e2c0f69882dd35fb388"
    hash73      = "78af0374ff3eedabfe0b669a3ecebc1884e0b05dbbcdde2e130ad1ee08f1aae0"
    hash74      = "e4c5120bb328782c8dfe9772c4d60086c3935b81f35d2051e9540638380ff65c"
    hash75      = "dbb44b27b6c01d948d37143e2fda05022e8a5a0e75ba645e2b5a87bf6405cf9d"
    hash76      = "7adfb511c7897eb6258d316def61ca03a027aeae6a9cae58764966d6b19431f6"
    hash77      = "b1c4e516b90143e6bc98a724ea682c1dac80953b2386aebbc643d3bd868227d8"
    hash78      = "584cf33b5884efa5a73df359fd7b89242fc5cc544f5df7138d7012bf07d60699"
    hash79      = "39097c6c858b67290aa72c021c8035c12019bb5bd1de068a60a44c9a8cf10620"
    hash80      = "c0351cbb57fbe2736f8a1b7c38e42d2a05324ba480f1c4f20edd37678de3ce2e"
    hash81      = "0a3f4bdbfef7bb29a17cd999fe9d38be2246b23802ab206ec947315d7abdc2d1"
    hash82      = "16177018880217f8fc1a518215184117cd3bee59ae245488a6d898e19bd401da"
    hash83      = "222f221c2261e28e07fc7bc561f24814acb173ebb0a0495012eabe17016e0e8b"
    hash84      = "d25380e7d64da245b4b128e5b4daf48f890a7c8aa648545286ab9c3e9087fbd3"
    hash85      = "ca735f5e4fd7f628430b7a555cec15532e2e0fdcf330bfb3296c3032aaf56113"
    hash86      = "676263899a7bd70f00266e2a8a2b94a6b9ac80ce8ab45d719ad11a1a8735201f"
    hash87      = "457b98aefdcbb90ca5d9978115f7faa07236d4c46f78007a287e555fb1995fa5"
    hash88      = "5c31da952f4342d10557bae9b57a2cbe92dd1c53e2bf8d453264105a51511a87"
    hash89      = "3739736f99982e065d65a5f26427bd206047afba037537d0ae56bafbbcfd30a1"
    hash90      = "31024fa9da8cda5467c36eae3673010651ab168c6dbe3d26596dc27239695bc6"
    hash91      = "432fe1a3234e4ab06055f02208c608d5b78a195bead9ede1bd7c2434a1189e11"
    hash92      = "e469755a70f22143d7eabcdf355f72576ff370fe066eca8696a8bae567d3979e"
    hash93      = "e3478a30096909844384e43e8aaf6ac353b2ec7fc8a1e622a72fea6ca1181cdc"
    hash94      = "661f27b3b5ddf28ee6d0034978a30c9e86551ade86ac407ddda40cf1b4859cad"
    hash95      = "e45cb9bcd28652efc9198825e6ea44ae17e3a59e8196495e1e4d197fb5f4f6e5"
    hash96      = "47e2ce974fc5ffc2665df592e5ca1726fb307c313e7eb4fb5b94a207118884ee"
    hash97      = "f6fbed660168cb8ab0cd57c0cceca9b489411b8df1e7d7b154385032ef07f75c"
    hash98      = "a2209a180a44df5f7c719ec850ae1e072217aa6aa3b9049b4e3efc2e01b85f89"
    hash99      = "5af2eebac6868c1d7b244d290c21d376a9dd93f58f277c9368948c529041913f"
    hash100     = "ef33bea9f28dbdc025dd5552d50b0c3edb1eac0037a9828ea0cb4de6da8604a7"
    hash101     = "4437b5a6a35c54b30e9364d460ea4d1ab99a105b27cf3f7b36ecf45fbc6cb194"
    hash102     = "3087489498c7f142a82ceeffed2340f3f514901a8a202a4e0aaf9d404c5cf2c3"
    hash103     = "98c6b68933951af6559e714cb5ed8f8cbe5974a3ae24188eb745a20f40415556"
    hash104     = "e5dc1d4a1e8e19862aa08180ef67caa5410eaf49990e9bd5ee7caa647475a43b"
    hash105     = "3cc79a9d3dcfefc762be8be90b76f11309455e0d0d1429fbd25a4ccd3ff2eb31"
    hash106     = "0d40b880b80972ddca4a65924967fb52de96502e20f85be595e14112afd4a2e3"
    hash107     = "ba54309ac881b863b8f3e9033431278d8b5fbcf6f96250193f44917fc2345ea7"
    hash108     = "ed709c70643fb06bc15413db9bb9f7f5952fa5880a0f85ebf165a27d3f6e0d1a"
    hash109     = "ce94d93e986986279e716637d59c9cd800b3ebad8380caed42f9c2e9ed0bb42d"
    hash110     = "33be13ef3b71bac578daf05d25cf8b0dbf90a7d00fdf93986be2a06c9a6ae927"
    hash111     = "c10104fa4aff28b196e844378424d99392f35e4727aaea19cd27ecb5bf99f135"
    hash112     = "0cdf8448965b36908449307d8acf2cac32cd984ffbebd3bbf6ae3f2cba6a022c"
    hash113     = "ccbb383a1b5e5d907d0bf158f1b825ad7be05823090ec01440e3dec53dca56c6"
    hash114     = "572864ce15e48bbe0708ba9bd81869c94b660d6bc22613eb3d826002e1cd8785"
    hash115     = "fa20e1d48700d300bcd2570e4261dfe86a47e1c2c51e18b753de449e565f5589"
    hash116     = "15c9e077efce54187859581cb2bc9b2f0d55581535c5049d49fd0a7ed5edcc69"
    hash117     = "9d95633d48b47d4c88d024775cf9e1fd2e8fbc20e8e0be2f9d185d9bc86bfcf6"
    hash118     = "485d0cf141e027621d1cf100b9620d7f3f19d5bd0949e89dee940e88ae98c6d3"
    hash119     = "9090cc299b42abe900ab8148490ab06db51ba3a36ef3d5fa9083b2fff0e0e8c7"
    hash120     = "275dd48850948a6d7e4e8a0d84f45150605b741efb663873ec0de61cc7d60f9b"
    hash121     = "724075a17c72470a81ed964286db411f0386127291a004e40c70a162a2b663d4"
    hash122     = "6c25bd0ef2e369b01ad5763488f923d62c31cdc57e458d141893bde626fb3c71"
    hash123     = "39a17e844ae346f307c1db3f0f7e32cb8a88d8014cedab38a46d520c420f313b"
    hash124     = "3a26efbe2707a4c05d2cdb739a34d5a31b0199c1e316d7f6bfe5a3769572cef1"
    hash125     = "1d5ce42dec3c141160141aa8c835d112da5c34fe794c3d279ea83f55ccf85c22"
    hash126     = "5dccfb416aae4430844acd80d202eb10dd7562e7f5aa39acfa01a7f77049fc4e"
    hash127     = "70b18815518fe134d637eae3ab7b73546b0ae0d579fadfcb5fa395835cc5a80d"
    hash128     = "c05d5a97537bca7b2520a7c6f2c353e729a369b39ce63f2dfd6a02cb7638000e"
    hash129     = "c7ddd46e17df4216676146831ba66a7941711cedd620fac1b9cd49fb6178ce7f"
    hash130     = "474336d7a96f82ff580e910fabc140c477e228b70b8e39b027e22ecdefc7addf"
    hash131     = "cb91980b280724405955fed621abeede42d413b5da2b1e3bdeb6adc57cc48389"
    hash132     = "24ea8be212d6fd57179e9a0f68091c0fea3e5a377e8a79b0fe5e1ba995cee75a"
    hash133     = "a043d6ae14537fb37f296d5a2f54079baca547c7a14934f36096b50a47901640"
    hash134     = "f74521e77e44cd2fb36015f56f57104787eea3deef6fb0720b00f053874b5573"
    hash135     = "956dcf8cb231d11b904148662bdbcc90ad9a26d0b6745e953aa88435479a1f6c"
    hash136     = "9514082838ff298d4a12cfe337934c032066600b92097c051cf7f49c7a1ef401"
    hash137     = "3d38b839a554cc0950de64bb3009dec9f8b6716afc972c45ef71eb0f1acf294a"
    hash138     = "63b10e735fdbb41587aa957b13bf2d3e39f887b89405debb2c940d97ffe284c2"
    hash139     = "6262437eb8c5652e6802813d6ee293c1291cf77c529175a1c68dfce0a9ad0470"
    hash140     = "cda8c0ac04fea06b21c993fe51619bbee9ed17a3783fd544e1dfbac9fadc64c9"
    hash141     = "87a97be753874da9ed9af3101a3e8401fb7a3533f1d954c10d6fadf276033057"
    hash142     = "d8cb3bdc2703be4f4704d5304683b97814ae48c9deef9eec9095e315082942ee"
    hash143     = "ba19593359188ca8ed5287077fe1499d5211ccc956c25b022291ea38d1efb28a"
    hash144     = "65a7b7a917cb591071f99100e21ccc5520d2b0bae9bbc18b83e101509670e871"
    hash145     = "08b5e9efb4bc3d9e0ff8515d59b1fb2777a976812f8fa39974632ae77f973ef0"
    hash146     = "fb1392266f48c6f71959cbdc4599b4c429804b8dfcf16053742bad46c24686a7"
    hash147     = "09fda6e2492e4beffc34ff241aa087d1011d7c3300cf3a3bab441106faaceccb"
    hash148     = "452eff97677142f1c3c0dbec1400b70ba15aef38bfc462249aa19d99018f83bb"
    hash149     = "ad66d90ff5a9514574086ab81dd55d501af9410bc601ee10be1ec7ab6163b932"
    hash150     = "3830df75b02c8f76402f113cb69e71d0a1ff5b205a5f980ecd9ceb8db4504593"
    hash151     = "e61d13a4b7b68e202e9c7455da9c381d8f882a5754c452f3e1efebc33dff86a1"
    hash152     = "5c34b8e8815e07a839f02e9a62cae7986de0bd5269ba1b0aed9e9e00ff22213b"
    hash153     = "67f448938f5d2d0588826b41682eb7e03ac574a90a54b99e18658a08b7cf2cd1"
    hash154     = "1978a8c09309cb876ac32c6ecb0c49ccb537da32f1be4c733b3702142692fc12"
    hash155     = "27463efc1a80cad939a5322c3b444291ea39e701883873937f254806463a10cf"
    hash156     = "4920eb7e99b9e3f266bef456d2d9b45e3642aae9263e817599ca39aeed815a7e"
    hash157     = "37ad973696943874a7f8af2a87afbe6da50abc9339184b3f08cd633c75a3fa4d"
    hash158     = "c631958a05101a99b306f5bb153de5c4a5dd50f7dc3c55be417c4420e9244965"
    hash159     = "cf5befc7e930ac38a59aebdd345ea84e933c345823c65dad8804e3424c364661"
    hash160     = "6d56621f451e6b3622c1641adead1f55d73ab7c09ddb2f2af7d20e855b14e233"
    hash161     = "858457217b23c37c43c5e86554d5e4e08449ab5826ecd657cad077cf69dd446a"
    hash162     = "c402dccb91c225f8b1a527c7c8fc75f0e2589424d2557af8a690ff443c524871"
    hash163     = "f632357bed3962a29a1d5ca191dc98329eb92ef2f97efa9d9e99fda674aab4f7"
    hash164     = "b3c1b35bf99b64d9254c647c95ebf2b275980f28cf8ea907622a409d764b7618"
    hash165     = "8ba57d949d752322caf7970077e13293f0de8c0483a9dda1248171547263d108"
    hash166     = "ee57aa9c4a52803b9c5fa038e7e95f3b4fb7d9661389ce0d0d00fae2d015c339"
    hash167     = "ee9a1820d82e20ad331c6f512ee1f5294a7899586880328f89f0b2caa6e34439"
    hash168     = "e819b6b1b215fd68375ed13b95a54f4058cbb8f407d27c105c8c79e5ab941383"
    hash169     = "a06908dc23d37efbaaab3eba8c8756cb693579684dc7dde88828b74739b60411"
    hash170     = "61ee0b11047677f97bc8080de3b0fff16ae4c1a2aff31256b5207b694bde48bc"
    hash171     = "47f8e62a52cbf2c605042404176d837eef8b5df66aa3e2454ff03fef68661eb6"
    hash172     = "2426fbfd66b756e7aa2d96bb7338b1ea4260f55996f6cfce1a5f208b212c149d"
    hash173     = "7f6cbfa0d5247fc2cf2cd2ec49785fd8eee4422ce5ab4b958f2290f750160081"
    hash174     = "668f671402f973f980507da51a8b239f49db596bf1d67b8b44f7abc3575319fc"
    hash175     = "21268edd9b1f2bc748348ca671b60a83565fd6d5783e7243f9dc7cf424e2fefa"
    hash176     = "5e999d6e46343a01449b1a957ffa226f89ef9c37519ae5d2a8cdc551fcefc2d1"
    hash177     = "e4a593b7808c74a051d39496044bcb0139667d234f0de3f46311ca94133d538d"
    hash178     = "5c41c81d60dc020201e386b22d6ce035cc94c8510fbcc9611ccb829e749e2135"
    hash179     = "decd65fadd568e02cc1150e6c7b2382fcb205979aa00c78f42dbe78faff9bd01"
    hash180     = "172f193e0d5afffeb102e298f3ce4be4697cefece5c38b2fe2023d36b3faeb36"

  strings:
    $s1  = "ThatWorldIsKillingMeAj9.setRequestHeader(\"User-Agent\",\"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\");" fullword ascii
    $s2  = "while (ThatWorldIsKillingMeAj9.readystate < 4) WScript[\"Sleep\"](100);" fullword ascii
    $s3  = "ThatWorldIsKillingMeAt8.push(String[\"fromCharCode\"](ThatWorldIsKillingMeICy4));}" fullword ascii
    $s4  = "String.prototype.ThatWorldIsKillingMeHf1 = function () {return this.split(\",\").join(\"\");};" fullword ascii
    $s5  = "if (ThatWorldIsKillingMeSm1[0] != 77 || ThatWorldIsKillingMeSm1[1] != 90) continue;" fullword ascii
    $s6  = "function ThatWorldIsKillingMePOf5(ThatWorldIsKillingMeKXu6)" fullword ascii
    $s7  = "{var ThatWorldIsKillingMeJPg4=new Array();" fullword ascii
    $s8  = "ThatWorldIsKillingMeAj9[\"open\"](\"G,E,T\".ThatWorldIsKillingMeHf1(), ThatWorldIsKillingMeUPm8[ThatWorldIsKillingMeOAz0], false" ascii
    $s9  = "var ThatWorldIsKillingMeAt8=new Array();var ThatWorldIsKillingMeDXg0=\"\";var ThatWorldIsKillingMeRv6; var ThatWorldIsKillingMeI" ascii
    $s10 = "function ThatWorldIsKillingMeCw3(ThatWorldIsKillingMeHOq0)" fullword ascii
    $s11 = "{var ThatWorldIsKillingMeXv9=new Array();" fullword ascii
    $s12 = "var ThatWorldIsKillingMeSm1=new Array();" fullword ascii
    $s13 = "else {var ThatWorldIsKillingMeRv6=ThatWorldIsKillingMeXv9[ThatWorldIsKillingMeICy4];}" fullword ascii
    $s14 = "function ThatWorldIsKillingMeSGl8(ThatWorldIsKillingMeHOq0, ThatWorldIsKillingMeKXu6)" fullword ascii
    $s15 = "else {ThatWorldIsKillingMeICy4=ThatWorldIsKillingMeJPg4[ThatWorldIsKillingMeRv6];}" fullword ascii
    $s16 = "function ThatWorldIsKillingMeHn6(ThatWorldIsKillingMeAq2)" fullword ascii
    $s17 = "return ThatWorldIsKillingMeSm1;}" fullword ascii
    $s18 = "return ThatWorldIsKillingMeLn1[\"ShortPath\"];" fullword ascii
    $s19 = "function ThatWorldIsKillingMeSg1()" fullword ascii
    $s20 = "return ThatWorldIsKillingMeKXu6;}" fullword ascii

  condition:
    (uint16(0) == 0x7453 and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

88cda819-c727-47c1-b005-5b002ac02dd9

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion