_20161121_05b7de1e4f6e7e9bd7b3b82e32fa0467_20161121_082f085bf21e_189

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20161121_05b7de1e4f6e7e9bd7b3b82e32fa0467.js, 20161121_082f085bf21ede780f6b740059a83a1d.js, 20161121_0a7961e3b1d6adcd87aba39bfbe9163e.js, 20161121_0fc725d7ce0a3279a135c5755fa0e742.js, 20161121_144dfdf043668b82fb525e1e61e8dda1.js, 20161121_2f2ac1c328f3cdf2aa43fdff2497a6a1.js, 20161121_3480d204e350a091b2c6b74e25919918.js, 20161121_3536c33f60120388be988a90cf52305d.js, 20161121_388896bef6e2715866a6b656cb507844.js, 20161121_3c3c4dcb184efb3a936889bdf4b2bc09.js, 20161121_3cfd41dfd6e4aad3da02783a26e6c33a.js, 20161121_4158cbbe80e539b3514f6e62855bc17c.js, 20161121_442b8145a9e04dcb7226330e8b9a0270.js, 20161121_48eebbf0cdd089aa2fa9e1a8b0b2da99.js, 20161121_4c33e6d91198326c79a0c6eb9c0de67a.js, 20161121_4d2a3ab5a3bf9aaf6aff509838f0d3d4.js, 20161121_53cebae3bb89540fe02ff02cfff33d45.js, 20161121_58f30edcceb63bc2e96cb83ad12abf94.js, 20161121_639d3bd97b174229721a90183ebd1717.js, 20161121_63ad31799136b7b6e8498717e41c48ec.js, 20161121_66fd33d101ca5c25816415839fbf6e57.js, 20161121_698cce1624967765b833ef16da0cb4bf.js, 20161121_7c32e18d4801646697c783330603adb8.js, 20161121_7eec9006b687ea88330423ca5ea0df56.js, 20161121_8b0996bb4d034bc6a5237f8b0fab512b.js, 20161121_8d2d7a7befe10fd5479af4da14012a48.js, 20161121_8e82a0b082b9256519ef4e8523f9eb31.js, 20161121_9033a59b25b978d7a34b8cd1f3810f81.js, 20161121_96156379343fcdeaa0e692f35abb38d7.js, 20161121_9c5b370ab29c2fcdabf5d97eb7fa9524.js, 20161121_9db9494ee069ac7a8d3ae215ecc08404.js, 20161121_a37f5ac20df3ca2b4a20c0f2f6963cdc.js, 20161121_aae1238db410b5941967a8af6ec719ee.js, 20161121_b0f427a6ee1d47976be9d32af7fdf13c.js, 20161121_b6426fd068917be3098fd65132dba978.js, 20161121_b822ed9d4f9411cc33691282df63f118.js, 20161121_b8c49388500eb5c593aa0a5cca676e40.js, 20161121_b8fae0a3b45456b5bfc18c37d0e1cc27.js, 20161121_c0de61bf2601a12445881c277ec1c278.js, 20161121_c22510aace6d526f673f5ee24b8170a8.js, 20161121_c3ad08425c8adc64972c7bc7e9bf3ed1.js, 20161121_c5b0b0c41256fe018416c0d8b5d524c9.js, 20161121_c70d984d4eb9c68c9b065b84de778376.js, 20161121_d7d80418f6db70cb59108a6823d72896.js, 20161121_d9efbee041d47489c6729889b37500b2.js, 20161121_db5384292de9aabfac6b7fdd8eeefb5b.js, 20161121_dbd922941a340e038afe2e9002653d6f.js, 20161121_df752529f3841cf0a7c9a1aaead915a0.js, 20161121_e15fdf9684472f6e34cd16ca90f17562.js, 20161121_e596ffac5aa2845293dc1fbf3d9650fc.js, 20161121_e8b745c46a60151895181a7e5bf87f71.js, 20161121_ece1adf54ea00d6467d1b0b88d8fc578.js, 20161121_ed067ba324f15f7251719c853c1a6b5f.js, 20161121_ee90832510a7945e86da8cba2f9145d6.js, 20161121_f0442bfa324198f5a4b140b71340cd95.js, 20161121_f22d95297f5419a78a2f5000ddb1c0b1.js, 20161121_fed522d370712fb4030ce68e65a8944d.js, 20161121_ffe5df1839ce1247e335f851147e7ac1.js

rule _20161121_05b7de1e4f6e7e9bd7b3b82e32fa0467_20161121_082f085bf21e_189 {
  meta:
    description = "datamaliciousorder - from files 20161121_05b7de1e4f6e7e9bd7b3b82e32fa0467.js, 20161121_082f085bf21ede780f6b740059a83a1d.js, 20161121_0a7961e3b1d6adcd87aba39bfbe9163e.js, 20161121_0fc725d7ce0a3279a135c5755fa0e742.js, 20161121_144dfdf043668b82fb525e1e61e8dda1.js, 20161121_2f2ac1c328f3cdf2aa43fdff2497a6a1.js, 20161121_3480d204e350a091b2c6b74e25919918.js, 20161121_3536c33f60120388be988a90cf52305d.js, 20161121_388896bef6e2715866a6b656cb507844.js, 20161121_3c3c4dcb184efb3a936889bdf4b2bc09.js, 20161121_3cfd41dfd6e4aad3da02783a26e6c33a.js, 20161121_4158cbbe80e539b3514f6e62855bc17c.js, 20161121_442b8145a9e04dcb7226330e8b9a0270.js, 20161121_48eebbf0cdd089aa2fa9e1a8b0b2da99.js, 20161121_4c33e6d91198326c79a0c6eb9c0de67a.js, 20161121_4d2a3ab5a3bf9aaf6aff509838f0d3d4.js, 20161121_53cebae3bb89540fe02ff02cfff33d45.js, 20161121_58f30edcceb63bc2e96cb83ad12abf94.js, 20161121_639d3bd97b174229721a90183ebd1717.js, 20161121_63ad31799136b7b6e8498717e41c48ec.js, 20161121_66fd33d101ca5c25816415839fbf6e57.js, 20161121_698cce1624967765b833ef16da0cb4bf.js, 20161121_7c32e18d4801646697c783330603adb8.js, 20161121_7eec9006b687ea88330423ca5ea0df56.js, 20161121_8b0996bb4d034bc6a5237f8b0fab512b.js, 20161121_8d2d7a7befe10fd5479af4da14012a48.js, 20161121_8e82a0b082b9256519ef4e8523f9eb31.js, 20161121_9033a59b25b978d7a34b8cd1f3810f81.js, 20161121_96156379343fcdeaa0e692f35abb38d7.js, 20161121_9c5b370ab29c2fcdabf5d97eb7fa9524.js, 20161121_9db9494ee069ac7a8d3ae215ecc08404.js, 20161121_a37f5ac20df3ca2b4a20c0f2f6963cdc.js, 20161121_aae1238db410b5941967a8af6ec719ee.js, 20161121_b0f427a6ee1d47976be9d32af7fdf13c.js, 20161121_b6426fd068917be3098fd65132dba978.js, 20161121_b822ed9d4f9411cc33691282df63f118.js, 20161121_b8c49388500eb5c593aa0a5cca676e40.js, 20161121_b8fae0a3b45456b5bfc18c37d0e1cc27.js, 20161121_c0de61bf2601a12445881c277ec1c278.js, 20161121_c22510aace6d526f673f5ee24b8170a8.js, 20161121_c3ad08425c8adc64972c7bc7e9bf3ed1.js, 20161121_c5b0b0c41256fe018416c0d8b5d524c9.js, 20161121_c70d984d4eb9c68c9b065b84de778376.js, 20161121_d7d80418f6db70cb59108a6823d72896.js, 20161121_d9efbee041d47489c6729889b37500b2.js, 20161121_db5384292de9aabfac6b7fdd8eeefb5b.js, 20161121_dbd922941a340e038afe2e9002653d6f.js, 20161121_df752529f3841cf0a7c9a1aaead915a0.js, 20161121_e15fdf9684472f6e34cd16ca90f17562.js, 20161121_e596ffac5aa2845293dc1fbf3d9650fc.js, 20161121_e8b745c46a60151895181a7e5bf87f71.js, 20161121_ece1adf54ea00d6467d1b0b88d8fc578.js, 20161121_ed067ba324f15f7251719c853c1a6b5f.js, 20161121_ee90832510a7945e86da8cba2f9145d6.js, 20161121_f0442bfa324198f5a4b140b71340cd95.js, 20161121_f22d95297f5419a78a2f5000ddb1c0b1.js, 20161121_fed522d370712fb4030ce68e65a8944d.js, 20161121_ffe5df1839ce1247e335f851147e7ac1.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "b18c6fc017c5302194b89494de86be138361d9ccd18db157556afc8afc16f583"
    hash2       = "4b620c34b6ca2be6774bab1bae1e915e7711af555a15673561aa8d3c377aa790"
    hash3       = "fb5644ae8160666de6a21635987ce73c1198bdbd47e31bd9f0a313cd9312076f"
    hash4       = "d55a8c9a325c44720bbe3bd3d3efb1bddf02d3343aa38e788c37072e55f3f917"
    hash5       = "14962b46dbcd429cae501f8d15b2853c27e208058bebf9fbba9d0d35e7e8ac57"
    hash6       = "a7e72d9c78e021e2445abf71829a58b6772b60be5f73560a9329c6bfdbb0339f"
    hash7       = "3bd5928b403479a8feb87541e4b31ac0e845bf83039b0ee95fdcb498a077b61a"
    hash8       = "d28b35ebf603b3756386ef02d2e8d7656c938a13e84625f48a19de55ad9ad00a"
    hash9       = "fa7299acff3d0f81f63227196781a7e3ee42530ed13332d849f6a5af58d14d06"
    hash10      = "4a751d3db9ce026653adc6f63bf30f25d07737941c19f74a7fcdd01e5faba70e"
    hash11      = "49b574ec2c65fd8fe62f8be5511058d4b77448d274379982604ccc55a7870952"
    hash12      = "af7068668b777187786a6f2a834bf20b6b4010b22cf7d2ba4bd48f4fb164361f"
    hash13      = "1f2658f921a68c3c5b92fb94fee3131cd3c4e2555126a89a9005c4e0f777fbb3"
    hash14      = "e9b0cbcc2f101d1fa70517d3f74ecff20082ba77ce96e832d66fb306c52494b6"
    hash15      = "b9477276422d57065018712ba3076e83c7a3ba6872fec5d20f22c349b035b528"
    hash16      = "184ddd6b27e48a56ecc0816384e1e88ff926bef22977f901de2957e7bd3534e9"
    hash17      = "abb7ad528c9cc34017cfabf2ea3c416a0c88152fff5fadf6b004526251e0d7d1"
    hash18      = "9fd6317ffadd9705be0067b6065d3fc3a6fb60d55c32278c3b88b7c2edfa55bd"
    hash19      = "b536694c5a019979fceb3fdf1dec9ad71855f381da4aa62557b21054de1456be"
    hash20      = "81f7c844f1dd0c212e27d2729e86385dea78b10159286fb28cfd469b70189517"
    hash21      = "671df05b88c73f8fd52f79f180b3c8493ea46139af1952bf9216d7bc0910f876"
    hash22      = "40d584a43a2ca59a1401b7252120ce26a5138edccdc08fc287e8724c7b5ef18a"
    hash23      = "6110f7fb44f4e25743096d2bc4a640e1c2b15ebbe00ce9d48e5e55a0edeb1941"
    hash24      = "afb697d444767ec0b90e3ffa502144001ab570c0546afd07005f7c803e2fcbea"
    hash25      = "441624779546954afd48d105b832dd27949a45e73047b1831edfc6bbce9ca134"
    hash26      = "7876edfab8a84e32d5bc0aca96e673754751a7b6f287b848548a45bf4dcb1a30"
    hash27      = "fbaabdb1ab8e0155c9acb23ef0f2ae180ed93e20965c76c1195d61970751ee1b"
    hash28      = "47ae281ee695b1fed3434b4de74cbf20f0eb02b900700127a87005d76261c195"
    hash29      = "2626ca0258fafa807390fbba5b6024060559741aeb8f49cb73524f99e84cda8b"
    hash30      = "79a67dea59155ee732339806e7ce745db620d1436838a90e51f60b4c3c6f9763"
    hash31      = "0ce38ac5da572012aa306600a6e084e8f84afc2508b2e780ab9ca207daa974ce"
    hash32      = "0b9ad5808de8dc90aeac10a824f3ff3be52e6dc28ae11bd81a8e5abd62c0f3ed"
    hash33      = "1386da5d1fbb555cbfa0f54821d371a94fa81461f3d8b7a7580070c00f8b0f85"
    hash34      = "f9069073060898efc94cc9134137ee32310f004f9cc09989c6aec881e6c2b856"
    hash35      = "fed10f0fa76b402d29f441316178749fb3c2315efb0f02a2d549eaf2749215d2"
    hash36      = "bddc4d5b4af382949c60634ed3311f72409cd72fcd8b65a3ea4b0530e426d8c2"
    hash37      = "d5b572e3d4b77cf6aaa036ed9d92ad8a03328c1077800e77161eb01c0804a617"
    hash38      = "4382f9ccebdba1215f59907ba417936754c71ae5ebf93fab9651b2339d3ca1e1"
    hash39      = "295259441a951ffd7a29fd3966db99aae0de8ce734b74bd429ac2de5cde0f902"
    hash40      = "8eaf61f0ab97a42960ef50676959a15b9e00d4cf90e8b0392ffc319b0997d51e"
    hash41      = "416844c0baa84d1f117cbfe78daa806d7a1c286bb7091ba9d1e4c49e7e9a60fa"
    hash42      = "304b93b6ef233bc11245dae63e4d56b33624495536621691ca91a94c3d90a262"
    hash43      = "d9e9ca791fbaf8d92acbc21da534013a39d5b16eecbcad1b8269a096fa643cd8"
    hash44      = "a5ef1a2de93bb4bda333951f0ec77244c6dc9588fd5efe0369c581e055cb701e"
    hash45      = "3848e4291b0bc5e3065633a94198c49b022e75f3d2934722671ebec2e69ecd8f"
    hash46      = "f210db0461400f65260fef0f279fb3022eb1564c9594d295be871c0cde533748"
    hash47      = "fe1055ba2caabba9af0157ed29478d3a1f4de2275e6760e903dd79a3b5749b44"
    hash48      = "05a8aa01bb827f3a711f320ede14ed08ee2e8326e8d5047c1d6c80fa3241eef4"
    hash49      = "142e0763bd75fc1477a5ac4d877ab5d5a2ffc1042e29512c5617eec2ae5ea3b8"
    hash50      = "dc85e0ccbbba48faf7616930af7c7c8d60b8389dfe855c52f87a85eab78ef76c"
    hash51      = "63d4ca8e271ddd6eccff86fae3f08c7872e92dae1ef125c7da099e64f9764232"
    hash52      = "93db0ec4b3acac24ec47d4838e93f63dc3a1cf88be8fb45f20b7597903e5cf73"
    hash53      = "4ee18ca2c0e60632b79232268d04d4b4e900d6dd2e6cd5769dbade1bc05a2435"
    hash54      = "3cc7b2b53d819c07f647cc58e7f19d57806c5f54d602717bc064165949a0de72"
    hash55      = "2d3a782c88b184e4011c11653c1cc65336768a1a199c55a77515454794299e42"
    hash56      = "e7a42ccdc806ca00fb2da83a5f581db9225af1b62ec10c127634002c9df4b0f0"
    hash57      = "357f8ca8356f1715305d69683056fdd6de26f8ac6c9e8dfa45c7a90612e4f048"
    hash58      = "96d8ddf64b54375a2f5a8285c55d7ce7744d5238812b5b1e4732f43b882f76e4"

  strings:
    $s1  = "ArmaFuckingGeddonRu3.setRequestHeader(\"User-Agent\",\"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\");" fullword ascii
    $s2  = "while (ArmaFuckingGeddonRu3.readystate < 4) WScript[\"Sleep\"](100);" fullword ascii
    $s3  = "ArmaFuckingGeddonRm7.push(String[\"fromCharCode\"](ArmaFuckingGeddonUr6));}" fullword ascii
    $s4  = "String.prototype.ArmaFuckingGeddonOg5 = function () {return this.split(\",\").join(\"\");};" fullword ascii
    $s5  = "return ArmaFuckingGeddonBu8;}" fullword ascii
    $s6  = "var ArmaFuckingGeddonHu7=new Array();" fullword ascii
    $s7  = "return ArmaFuckingGeddonTy3(ArmaFuckingGeddonPm5);}" fullword ascii
    $s8  = "ArmaFuckingGeddonRu3[\"open\"](\"G,E,T\".ArmaFuckingGeddonOg5(), ArmaFuckingGeddonPZy2[ArmaFuckingGeddonYg6], false);" fullword ascii
    $s9  = "function ArmaFuckingGeddonOKp9(ArmaFuckingGeddonRSe8)" fullword ascii
    $s10 = "{var ArmaFuckingGeddonTi5=new Array();" fullword ascii
    $s11 = "return ArmaFuckingGeddonHu7;}" fullword ascii
    $s12 = "function ArmaFuckingGeddonNm9(ArmaFuckingGeddonRSe8, ArmaFuckingGeddonBu8)" fullword ascii
    $s13 = "else {var ArmaFuckingGeddonWMb8=ArmaFuckingGeddonTi5[ArmaFuckingGeddonUr6];}" fullword ascii
    $s14 = "else {ArmaFuckingGeddonUr6=ArmaFuckingGeddonZNt2[ArmaFuckingGeddonWMb8];}" fullword ascii
    $s15 = "var ArmaFuckingGeddonRm7=new Array();var ArmaFuckingGeddonRGc4=\"\";var ArmaFuckingGeddonWMb8; var ArmaFuckingGeddonUr6;" fullword ascii
    $s16 = "if (ArmaFuckingGeddonHu7[0] != 77 || ArmaFuckingGeddonHu7[1] != 90) continue;" fullword ascii
    $s17 = "return ArmaFuckingGeddonRGc4;}" fullword ascii
    $s18 = "return ArmaFuckingGeddonSs8[\"ShortPath\"];" fullword ascii
    $s19 = "function ArmaFuckingGeddonCCs7()" fullword ascii
    $s20 = "function ArmaFuckingGeddonYXq5(ArmaFuckingGeddonBu8, ArmaFuckingGeddonEIi0)" fullword ascii

  condition:
    (uint16(0) == 0x7453 and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

cc87a595-cf8d-4898-8153-6a7ca5394ef5

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion