_20161129_00ab221e994396bb156722707b033ef6_20161129_00eb0c83a036_218

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20161129_00ab221e994396bb156722707b033ef6.js, 20161129_00eb0c83a036d45c2137c8ded2007504.js, 20161129_01d80f24e1186ca5338c562c78863cb2.js, 20161129_0237f6b729ec68c94a9d183baefd3bd1.js, 20161129_0246d6ef98fdda0063de5f203a257957.js, 20161129_067909d1f53daf3223d828edecedaddb.js, 20161129_092b8941fe3e630754f715d568db1789.js, 20161129_09cc7d6a0c0e356347c6400c0ad39da1.js, 20161129_0b042b47af92790120ecfc7e6f44fcab.js, 20161129_0da2fbbd589d4b2ce1502d2dd096a13d.js, 20161129_0e788ec34eed1e7dd8a06e2d72717be4.js, 20161129_0fd79839521255e785ccace37df4a2d7.js, 20161129_10bce1d64755f4b77462b22469db600b.js, 20161129_10d4d681e731bead761896c5d6af8bdf.js, 20161129_112b38fa78be2c37d43f906d829f9192.js, 20161129_1151a728cb374717ef3da6ace4abe762.js, 20161129_12e1082401c63af1a17a73c1264e8c4c.js, 20161129_151c24bce915345fa86a01c5a6f65361.js, 20161129_15870b1ed00a6e13f6fb9decad48c4d7.js, 20161129_159a84d8a89a79ec02272e47bd42a369.js, 20161129_18143a7a5e5203352ee564a75324ae76.js, 20161129_18564cf11779d07c716a585dfad77154.js, 20161129_1a741dbbe23d7b75d01b060af8f36528.js, 20161129_1a8e893ab8248bd89bd25eee96494b24.js, 20161129_1ad6e95f4d7e8fb1d50af092297ac700.js, 20161129_1af5452970093589a90a2e825ba9a3ef.js, 20161129_212758d0314bb22c108a3a39741f59bc.js, 20161129_21c481b139267688f1c091ec28d36965.js, 20161129_24374e0fb36814a5c540ec51452316d1.js, 20161129_253321aed2f4723ce9379314efbc1483.js, 20161129_25f321fbfa8bc66e38e933c3551991ba.js, 20161129_28b5a13ec90adfe33cf0c23d2f6655c9.js, 20161129_2a1012da8dbdedc9dd701a8c254fb598.js, 20161129_2c131b80915dea02c49b9e97fc5dc18a.js, 20161129_2d8d06e76d5bd802f4d5069c5ddac34b.js, 20161129_2df63a8a2d4dbe1095e470c18c740123.js, 20161129_2e45730865e6ee7a9433b4b9975e24b3.js, 20161129_2e6a11d8c9584f99ccc60c9f822a197e.js, 20161129_2f9efdd818d842b04e2284d155ec60a1.js, 20161129_314b1defa70c428a81cf45cdd5af5a2e.js, 20161129_347ed5662d50f8cbaf5a593770c7a34c.js, 20161129_3571ae954bc9462b5e1aeb3d7a6b4a3c.js, 20161129_38ec7a5b644f3fd71deaeaad78b35caf.js, 20161129_3a8b4d4501f82ceaa4791b4263f01311.js, 20161129_3c9e8d649b7c37a263d32a5d5c17b691.js, 20161129_3e55f07e0e9e1386ec072930aa1afcad.js, 20161129_3f5005731119468a271be03bb67d33fd.js, 20161129_400eec5af64ed7fbc450d9515822f1a6.js, 20161129_416683b403d799a91eb112130b4449dc.js, 20161129_43215f97b8c66d63660c8719e37002a9.js, 20161129_451b5c724458ac22f1d1f4c1f2bdf91a.js, 20161129_463cb0d2fb90483bd8e595038ec1f9ad.js, 20161129_469bff33ef89e65bfbe0ee1d0c81264e.js, 20161129_46dde81a40aad4452e52b5d8a7f6d38c.js, 20161129_47c45701ca6a879e05dacb34f84b3a29.js, 20161129_47ce7ff28ffe895c5432a9fb6f5ca659.js, 20161129_482370bce4bb1d8e7e1762f7da771f3a.js, 20161129_49a1322c5b7184835479bab5566d4faa.js, 20161129_4cb468ae40501847a865c952ab7abe6e.js, 20161129_4ed7843a28bf97109f1c54d4c859a19c.js, 20161129_50b6b4273f82433143e7b76aa75fdcc4.js, 20161129_525dcbedfa4f77c510da8e7c205fe6c8.js, 20161129_539b4b7504933e1c16da611358655309.js, 20161129_53baa4b06632342045cc61f765657f72.js, 20161129_551e3bebd466a39990d09a4337c63c3a.js, 20161129_56653f0187fa9b1c0ab6d09d4bd94643.js, 20161129_5a30b49ecd1e4c461d6c8f62801f2cdd.js, 20161129_5af1245f3299026b6ba0bb8f740a2279.js, 20161129_5b6487520c931e171fd967669fc85a8a.js, 20161129_5e2b6c2a545010308103227349d0d422.js, 20161129_5ec7553b7f1b354d0d1d66836947ce88.js, 20161129_6015dc310870cc8b986dfd627749bf8a.js, 20161129_605f5d1dfe0da2343f0f3a166735dad9.js, 20161129_63014f4e9d33c950e4df3c4888071964.js, 20161129_669bc07040b2e9c18e8dcd49f91baaa9.js, 20161129_690b308f00e765610c9d3da92fbca4bb.js, 20161129_6a089fe29a6b723e7bd36b9b09f115d0.js, 20161129_6c830bf0ea42ec9a1799640a95696908.js, 20161129_6cb8ae1a1161a599facbf0198946b28e.js, 20161129_6ede23fc49a4a0131776367cf366e3e1.js, 20161129_6f64c50f2bb69f731d9820a34fc79075.js, 20161129_70c6fb1a66b437705b7767f6033cac87.js, 20161129_717ea949344158da4ccf1f34e534985e.js, 20161129_71f287654190d1d17499fa72a7836db9.js, 20161129_720c6355fcf182b7fe715b998ee1d502.js, 20161129_743cff343760f2b0a017b94d3c580f48.js, 20161129_75ef2d7520c00f6ab09a7ef0e969695c.js, 20161129_776728880688439e3d8adee6cadff458.js, 20161129_7a60a309514c18715a0469652af273b0.js, 20161129_7aed3a2fb646d451593affbc5c27ea46.js, 20161129_7c0edf3377115a0bbd427027a0b784cb.js, 20161129_7c999026aa0b58058254e747839d1eda.js, 20161129_7f7187b35f4e3680ecd958bcef3fb704.js, 20161129_8064441933cefeb930ebe0b61745d3cc.js, 20161129_80c7dea82e4884b82b12f61834fcd65f.js, 20161129_824311874b65f38c65a71d676132d811.js, 20161129_84f7193a2e5633f71b55c9526cb21f87.js, 20161129_8511449da2e5664a1babff262bad61b2.js, 20161129_859120d8241013a89a562f27eb28526c.js, 20161129_85a31291a0be39e9bb16eb739bb377dc.js, 20161129_87ef4727877b5480f5e5c229d1fbe280.js, 20161129_880bae0eb7bcdf03b8deef4845ed930a.js, 20161129_8b6cda75e9c2e986d4855675c8805817.js, 20161129_8ba930186d03292ac6d4dd4cdb0be73d.js, 20161129_8bc8d4a0e2b5a6d77ae6d2a9c00fd56e.js, 20161129_8c1a477de4c486c8db09f43f7170a4bb.js, 20161129_8ca842da3053e12508a762b14729ead5.js, 20161129_8db1ac5274a03dd055a64283b5b731f8.js, 20161129_8f2e8a536bcd4e6ed4d7d16b3db0c848.js, 20161129_91e340159fb2175d432c1086af9ed53a.js, 20161129_93518b237bd13a6eb8e81b9efd18ee28.js, 20161129_93830725453db1138e52d2dd9a75ad5f.js, 20161129_94640b00e115ede50f4c7441a207892c.js, 20161129_957842dd366f045f34684d080ac83e12.js, 20161129_95d5a535679e7f0851625e019e5f236c.js, 20161129_992f8dfdde9e342363d662d45268dc34.js, 20161129_9a2f276929ea28af5b9a2025eb5181d3.js, 20161129_9ae680c0b67537969d7892190d465247.js, 20161129_9b8f66221a9f76a1f4f6ee663e9c2c11.js, 20161129_9c657d805e1aa622ee9a92fc81af9e0c.js, 20161129_9e9245fce79611b25c79be1346cb4cf6.js, 20161129_9f80f491f8170137aab62f2905cff1b2.js, 20161129_a11fd4e1c9b93147f92890614ca3fcb2.js, 20161129_a247841cc255457c695e1042f4ca4d81.js, 20161129_a48dfdc0a8bd534cf23cd41e02089e03.js, 20161129_a632b38a3be5699228f19ba583da67c9.js, 20161129_a6b62d954c615c45a61b22befd70a160.js, 20161129_a8bf12413df8d01a84f6ceecb1e590d5.js, 20161129_aa658a03e569b243582ec7b2e8660ee3.js, 20161129_ac6dc38c1849d95c58dbf4c1bdd3dcc2.js, 20161129_ac7919ce584f20d34d58cb22481608b5.js, 20161129_ad07717f461de17848daf2aaca24d0ee.js, 20161129_aeef47b77d4133ece326c32ba471a5f0.js, 20161129_afb2592f0da6ff697efea00de323cc1a.js, 20161129_b0781da1464f026c85f6f60073dd044d.js, 20161129_b19fce48cc8173a18b898dbc8c6ed188.js, 20161129_b2a33dea9bf1341303f6ad42dce404f4.js, 20161129_b2fc740d731c441b51e13fc7b437c225.js, 20161129_b4d93a19a51f0cf88fc5c89c8f3695f6.js, 20161129_b50ab0fe1a83a4238dec5f15bf6cb0bd.js, 20161129_b6918ab717eb15a74cce9c04cd0577e5.js, 20161129_b6f94394f934d05992bbeedf16d48005.js, 20161129_b85cf1a4598281340139329adba3b930.js, 20161129_b87a3be69eb3c5b6600179ab8b6c3507.js, 20161129_b913e62cd58133b08099a338d50955e0.js, 20161129_bcf9b06f8aba4f98234bed6d1dd3c442.js, 20161129_c01a821779605c0e1f869adf3266c55a.js, 20161129_c07cd6ced67ae4d38b3052346b075edc.js, 20161129_c2769171d450f665b290f30166ececb7.js, 20161129_c3804e3049c673172625e839e9bad776.js, 20161129_c3831dd36b5759a6ad64ffa8a475c9b9.js, 20161129_c69fc0213877cc39cfcdebfaaed9a74d.js, 20161129_c816ab2c0f1d40dc1fce7a0bf2ce0564.js, 20161129_c94ab76623fcb043565824996844f776.js, 20161129_ca1fe1ddcb4f73752f57edc0147efc0e.js,...

rule _20161129_00ab221e994396bb156722707b033ef6_20161129_00eb0c83a036_218 {
  meta:
    description = "datamaliciousorder - from files 20161129_00ab221e994396bb156722707b033ef6.js, 20161129_00eb0c83a036d45c2137c8ded2007504.js, 20161129_01d80f24e1186ca5338c562c78863cb2.js, 20161129_0237f6b729ec68c94a9d183baefd3bd1.js, 20161129_0246d6ef98fdda0063de5f203a257957.js, 20161129_067909d1f53daf3223d828edecedaddb.js, 20161129_092b8941fe3e630754f715d568db1789.js, 20161129_09cc7d6a0c0e356347c6400c0ad39da1.js, 20161129_0b042b47af92790120ecfc7e6f44fcab.js, 20161129_0da2fbbd589d4b2ce1502d2dd096a13d.js, 20161129_0e788ec34eed1e7dd8a06e2d72717be4.js, 20161129_0fd79839521255e785ccace37df4a2d7.js, 20161129_10bce1d64755f4b77462b22469db600b.js, 20161129_10d4d681e731bead761896c5d6af8bdf.js, 20161129_112b38fa78be2c37d43f906d829f9192.js, 20161129_1151a728cb374717ef3da6ace4abe762.js, 20161129_12e1082401c63af1a17a73c1264e8c4c.js, 20161129_151c24bce915345fa86a01c5a6f65361.js, 20161129_15870b1ed00a6e13f6fb9decad48c4d7.js, 20161129_159a84d8a89a79ec02272e47bd42a369.js, 20161129_18143a7a5e5203352ee564a75324ae76.js, 20161129_18564cf11779d07c716a585dfad77154.js, 20161129_1a741dbbe23d7b75d01b060af8f36528.js, 20161129_1a8e893ab8248bd89bd25eee96494b24.js, 20161129_1ad6e95f4d7e8fb1d50af092297ac700.js, 20161129_1af5452970093589a90a2e825ba9a3ef.js, 20161129_212758d0314bb22c108a3a39741f59bc.js, 20161129_21c481b139267688f1c091ec28d36965.js, 20161129_24374e0fb36814a5c540ec51452316d1.js, 20161129_253321aed2f4723ce9379314efbc1483.js, 20161129_25f321fbfa8bc66e38e933c3551991ba.js, 20161129_28b5a13ec90adfe33cf0c23d2f6655c9.js, 20161129_2a1012da8dbdedc9dd701a8c254fb598.js, 20161129_2c131b80915dea02c49b9e97fc5dc18a.js, 20161129_2d8d06e76d5bd802f4d5069c5ddac34b.js, 20161129_2df63a8a2d4dbe1095e470c18c740123.js, 20161129_2e45730865e6ee7a9433b4b9975e24b3.js, 20161129_2e6a11d8c9584f99ccc60c9f822a197e.js, 20161129_2f9efdd818d842b04e2284d155ec60a1.js, 20161129_314b1defa70c428a81cf45cdd5af5a2e.js, 20161129_347ed5662d50f8cbaf5a593770c7a34c.js, 20161129_3571ae954bc9462b5e1aeb3d7a6b4a3c.js, 20161129_38ec7a5b644f3fd71deaeaad78b35caf.js, 20161129_3a8b4d4501f82ceaa4791b4263f01311.js, 20161129_3c9e8d649b7c37a263d32a5d5c17b691.js, 20161129_3e55f07e0e9e1386ec072930aa1afcad.js, 20161129_3f5005731119468a271be03bb67d33fd.js, 20161129_400eec5af64ed7fbc450d9515822f1a6.js, 20161129_416683b403d799a91eb112130b4449dc.js, 20161129_43215f97b8c66d63660c8719e37002a9.js, 20161129_451b5c724458ac22f1d1f4c1f2bdf91a.js, 20161129_463cb0d2fb90483bd8e595038ec1f9ad.js, 20161129_469bff33ef89e65bfbe0ee1d0c81264e.js, 20161129_46dde81a40aad4452e52b5d8a7f6d38c.js, 20161129_47c45701ca6a879e05dacb34f84b3a29.js, 20161129_47ce7ff28ffe895c5432a9fb6f5ca659.js, 20161129_482370bce4bb1d8e7e1762f7da771f3a.js, 20161129_49a1322c5b7184835479bab5566d4faa.js, 20161129_4cb468ae40501847a865c952ab7abe6e.js, 20161129_4ed7843a28bf97109f1c54d4c859a19c.js, 20161129_50b6b4273f82433143e7b76aa75fdcc4.js, 20161129_525dcbedfa4f77c510da8e7c205fe6c8.js, 20161129_539b4b7504933e1c16da611358655309.js, 20161129_53baa4b06632342045cc61f765657f72.js, 20161129_551e3bebd466a39990d09a4337c63c3a.js, 20161129_56653f0187fa9b1c0ab6d09d4bd94643.js, 20161129_5a30b49ecd1e4c461d6c8f62801f2cdd.js, 20161129_5af1245f3299026b6ba0bb8f740a2279.js, 20161129_5b6487520c931e171fd967669fc85a8a.js, 20161129_5e2b6c2a545010308103227349d0d422.js, 20161129_5ec7553b7f1b354d0d1d66836947ce88.js, 20161129_6015dc310870cc8b986dfd627749bf8a.js, 20161129_605f5d1dfe0da2343f0f3a166735dad9.js, 20161129_63014f4e9d33c950e4df3c4888071964.js, 20161129_669bc07040b2e9c18e8dcd49f91baaa9.js, 20161129_690b308f00e765610c9d3da92fbca4bb.js, 20161129_6a089fe29a6b723e7bd36b9b09f115d0.js, 20161129_6c830bf0ea42ec9a1799640a95696908.js, 20161129_6cb8ae1a1161a599facbf0198946b28e.js, 20161129_6ede23fc49a4a0131776367cf366e3e1.js, 20161129_6f64c50f2bb69f731d9820a34fc79075.js, 20161129_70c6fb1a66b437705b7767f6033cac87.js, 20161129_717ea949344158da4ccf1f34e534985e.js, 20161129_71f287654190d1d17499fa72a7836db9.js, 20161129_720c6355fcf182b7fe715b998ee1d502.js, 20161129_743cff343760f2b0a017b94d3c580f48.js, 20161129_75ef2d7520c00f6ab09a7ef0e969695c.js, 20161129_776728880688439e3d8adee6cadff458.js, 20161129_7a60a309514c18715a0469652af273b0.js, 20161129_7aed3a2fb646d451593affbc5c27ea46.js, 20161129_7c0edf3377115a0bbd427027a0b784cb.js, 20161129_7c999026aa0b58058254e747839d1eda.js, 20161129_7f7187b35f4e3680ecd958bcef3fb704.js, 20161129_8064441933cefeb930ebe0b61745d3cc.js, 20161129_80c7dea82e4884b82b12f61834fcd65f.js, 20161129_824311874b65f38c65a71d676132d811.js, 20161129_84f7193a2e5633f71b55c9526cb21f87.js, 20161129_8511449da2e5664a1babff262bad61b2.js, 20161129_859120d8241013a89a562f27eb28526c.js, 20161129_85a31291a0be39e9bb16eb739bb377dc.js, 20161129_87ef4727877b5480f5e5c229d1fbe280.js, 20161129_880bae0eb7bcdf03b8deef4845ed930a.js, 20161129_8b6cda75e9c2e986d4855675c8805817.js, 20161129_8ba930186d03292ac6d4dd4cdb0be73d.js, 20161129_8bc8d4a0e2b5a6d77ae6d2a9c00fd56e.js, 20161129_8c1a477de4c486c8db09f43f7170a4bb.js, 20161129_8ca842da3053e12508a762b14729ead5.js, 20161129_8db1ac5274a03dd055a64283b5b731f8.js, 20161129_8f2e8a536bcd4e6ed4d7d16b3db0c848.js, 20161129_91e340159fb2175d432c1086af9ed53a.js, 20161129_93518b237bd13a6eb8e81b9efd18ee28.js, 20161129_93830725453db1138e52d2dd9a75ad5f.js, 20161129_94640b00e115ede50f4c7441a207892c.js, 20161129_957842dd366f045f34684d080ac83e12.js, 20161129_95d5a535679e7f0851625e019e5f236c.js, 20161129_992f8dfdde9e342363d662d45268dc34.js, 20161129_9a2f276929ea28af5b9a2025eb5181d3.js, 20161129_9ae680c0b67537969d7892190d465247.js, 20161129_9b8f66221a9f76a1f4f6ee663e9c2c11.js, 20161129_9c657d805e1aa622ee9a92fc81af9e0c.js, 20161129_9e9245fce79611b25c79be1346cb4cf6.js, 20161129_9f80f491f8170137aab62f2905cff1b2.js, 20161129_a11fd4e1c9b93147f92890614ca3fcb2.js, 20161129_a247841cc255457c695e1042f4ca4d81.js, 20161129_a48dfdc0a8bd534cf23cd41e02089e03.js, 20161129_a632b38a3be5699228f19ba583da67c9.js, 20161129_a6b62d954c615c45a61b22befd70a160.js, 20161129_a8bf12413df8d01a84f6ceecb1e590d5.js, 20161129_aa658a03e569b243582ec7b2e8660ee3.js, 20161129_ac6dc38c1849d95c58dbf4c1bdd3dcc2.js, 20161129_ac7919ce584f20d34d58cb22481608b5.js, 20161129_ad07717f461de17848daf2aaca24d0ee.js, 20161129_aeef47b77d4133ece326c32ba471a5f0.js, 20161129_afb2592f0da6ff697efea00de323cc1a.js, 20161129_b0781da1464f026c85f6f60073dd044d.js, 20161129_b19fce48cc8173a18b898dbc8c6ed188.js, 20161129_b2a33dea9bf1341303f6ad42dce404f4.js, 20161129_b2fc740d731c441b51e13fc7b437c225.js, 20161129_b4d93a19a51f0cf88fc5c89c8f3695f6.js, 20161129_b50ab0fe1a83a4238dec5f15bf6cb0bd.js, 20161129_b6918ab717eb15a74cce9c04cd0577e5.js, 20161129_b6f94394f934d05992bbeedf16d48005.js, 20161129_b85cf1a4598281340139329adba3b930.js, 20161129_b87a3be69eb3c5b6600179ab8b6c3507.js, 20161129_b913e62cd58133b08099a338d50955e0.js, 20161129_bcf9b06f8aba4f98234bed6d1dd3c442.js, 20161129_c01a821779605c0e1f869adf3266c55a.js, 20161129_c07cd6ced67ae4d38b3052346b075edc.js, 20161129_c2769171d450f665b290f30166ececb7.js, 20161129_c3804e3049c673172625e839e9bad776.js, 20161129_c3831dd36b5759a6ad64ffa8a475c9b9.js, 20161129_c69fc0213877cc39cfcdebfaaed9a74d.js, 20161129_c816ab2c0f1d40dc1fce7a0bf2ce0564.js, 20161129_c94ab76623fcb043565824996844f776.js, 20161129_ca1fe1ddcb4f73752f57edc0147efc0e.js,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "01a816056dbda232f4fc2bd81db99cba0c6c508f0cc6a1eda6c6e802a63d1564"
    hash2       = "e10738dc8da4da452ae50fbc7ae79a0e1450076d7cfb3c66890f3a180335b520"
    hash3       = "0f4514d628fa5b036cc9ba491b7e4b25bb4e1895cebcd4ddd350834a2f3a4f51"
    hash4       = "a6954974b173fb97a0ac87c9b76dd771a0fb17bf41685b2fb644bccdcfd599ea"
    hash5       = "78631c63c9ee44021994126447a42690a5fcdc5946c500037d9627006118b7be"
    hash6       = "fe001a45a8dfdb3d820d740a8b6ae33a4ab8d99f8a096132771ebd4f6c7d5be6"
    hash7       = "b4360f7685ce192f5915a41ed36bdf4f8263bdedb90479fa39067de35d33b638"
    hash8       = "d4dd700bffa0a5200fb374c96314125579e28ecc00099413fb53b5ef5af2aef1"
    hash9       = "a118d181153b1c798ebb8d3a39e4dbcce042484bcf79bfd5fb47417c3be4a7e4"
    hash10      = "5ec8dd9a46d5acf42248a203f777c1c8d25636b9927aa9d691e6260db0cfac71"
    hash11      = "0402128b4f8cd28f1492ef490a5a33047df8b9e607e4245510f6d702ac40c991"
    hash12      = "69feff11dddb859237acb9b8c47aaa2ab9af4482f402746065b6c41fa55e5c44"
    hash13      = "011155dd2c57ba8dc1a12d2ea7ae9d2e1ec7a84bfde34bf1ccf51e8ffcc956e3"
    hash14      = "04bc72fea656dca952adfe8e255ff1ecaf86ff198bbf0b8ffd5a9df83331aa8e"
    hash15      = "432e8ead21878de80efedf9bd1e34eb64df40a21397161e7ed4a3c522750cc7c"
    hash16      = "b0a7959f6eb31678ede3fe856e4cd23b3592e1cc901b800f625a8284b1363957"
    hash17      = "c33f4708292bb89850d01b56ea1b20621062106aaaabf1c265e9c04b44c89643"
    hash18      = "61249e31cfe5ed3c53a89a7b546af2d04c56a8e73f3a1affd28e81a771faa39b"
    hash19      = "69004caa3754532ade51d557c3b9058ae3cb16ec35acd8288061b9b8b7a47b63"
    hash20      = "00475de5afc887e1078d046e83fd6c71da2dff17364dd9110d36387d9ef9fe75"
    hash21      = "92818718c72df732116ceaddf66526d4e30424deff016b73da3742e32382d188"
    hash22      = "f82bc7de04e4a014c7b624e824571d69c409afaf8acbe28da98bea92607f74e0"
    hash23      = "87d9c1e1faeedc6bb835b4bd7d0c4cfcff7af42db4d5503fc283562310cc533d"
    hash24      = "ffda16923fc41927872548f0b435a5835a37e97477bbae073e06f7d25ee6c00c"
    hash25      = "4c7b2b768cb6d53717de277d7b055fb569c1c2ffc12909e44fb923310a75e019"
    hash26      = "127614701da0c6f85ca8fbe461b69040e5c78802ee75468269b6e7fc7db73da7"
    hash27      = "b68801b5d1962254d0a8851d85d5bebde2f880d9d408bc2096299cb1d193b8e9"
    hash28      = "4dce956542178c80eaf8c6c4224b2905e818e54862f49e9ca2ad04a7b036e654"
    hash29      = "0575e3f47b617934b877927fcff243eaaf4052fddf0d6dfcdd9fe5642871fdab"
    hash30      = "73753febe12c6f477dc2481f38f46d657450099d4ab867db9e182b489c5eabd4"
    hash31      = "610aa114379cf1dfb5330b27094ba1fdf323f38bad2f6db88b7195ae5ca6defc"
    hash32      = "44564ea3b4d17e117151948cb0844035b81ce13c85eae88ece9f3a76a40e1eee"
    hash33      = "cbb386028bc77b2fa831a06754b077cc7476930ba7a9e4261e34dfa91c00d02a"
    hash34      = "3814c6e8efcd4272076d6983217baab88cba0aec51739442aa7c21b642db8856"
    hash35      = "ba9c012b2dd6e603cec3b6757cdd4552132f5638ba2fdcd7bfe1ce9bf4229972"
    hash36      = "ebbde7a4877d41fd2798f117886f65c4398e84be28000afe464825fe3571d045"
    hash37      = "1fb2625fd73b0303fd1794ed0d500d09e880d11da9b1167802de555efc4b2858"
    hash38      = "5c75ce407b2f766ef864ab16ff4db73bbe35afe8147f218c8fd10bc3eafa529e"
    hash39      = "8b27ec339c131d3fb94ce8f5b7e381e83c44fb9120397ef2807a7b89bf70b12d"
    hash40      = "e41eee0530fb43a2f69daf88c1a4859d8a7533eab4fb72273b5b0ca6093e850a"
    hash41      = "49c699c39bb36e8af0d5d0c417876017ecaf26b9517c2e1e44cfb4766b7e41b8"
    hash42      = "9ce4339df0440b85e3da771bcce835520d17f7102ac4032b777e56d81a89262d"
    hash43      = "cc47475587e69ba7aa7e97f535b0087f9098085e869200637ea7c32e32eb49c8"
    hash44      = "e8b896dc51ff25ebfae43155b98afa1c14ad1262f43f104f1010e6b36fec1736"
    hash45      = "1d4e610f032b4526c33a1f746f3ab685f6e6ff57173aaef30304af956acbc008"
    hash46      = "e14126aa9d293d9f64db080bd2324ec75f9b406fa7bbbfc1fbf7df82834d5f77"
    hash47      = "6c6b45bab8bdd97719e7d66642dfbf2b5023ae653e463553b14480a2710e96be"
    hash48      = "647a3a7c275facc276cd44321dd8664d7d45f1150a7847a043b3c456020a8fa7"
    hash49      = "9c95330cb1792b6d915074151a747df5ec445939a8fe38b8f07c473d458c4978"
    hash50      = "c63301b2c4fd9c12a6448d8ed62b02233a82b955cf4a3a0f6cae8dc789510be5"
    hash51      = "60c1b4d7e4329a968201a4cca7e0eac8551541b4ba3f57f1afa996d49e96a6e6"
    hash52      = "f3e8732ee8a6b29a535eae52df72446981ab4c17a6c794e552cdb743d4595d31"
    hash53      = "188ba8d0f5ae9cb8b77287cabdab70db33032d2601551685fdae24868303dfab"
    hash54      = "73d561f0f7282e38e0e5aab078cac7326f05549e34424adb4f05d1c1645f7a3b"
    hash55      = "587da64f03b22b7abb7ae65888b49c3ecafc80145c03692323e01de4f446c580"
    hash56      = "5f03500854c88afc4ce8c2dcfe955963b4515e694581082d455a00a2df35b8eb"
    hash57      = "77381e52cb964cea93ef6a091a111eca706a036fcd4c93ec880ca617874f883d"
    hash58      = "c426bf56ff6f5c12d0edaccde0b2880f0ad96fe9ed2588b121cf78174faacfad"
    hash59      = "504e909a61a70c63d9aae687a2ef6e59d0df7b242453e681d943f4a2b28c3ab9"
    hash60      = "74872a7c11f0ff78df58e6223b4c8066b934bcebc2a9ceefb7a584f50459a11c"
    hash61      = "d49f7f6f632990b05004a33eb070d4c2465bb9f24ac41385e2311fbaad3f9f27"
    hash62      = "59beee34a848d8a912ecc04393eee194304726a93f8be2eedf71a7527e069e68"
    hash63      = "b59d0e65a231c9be3aeee254849574bf4af1650f9330b7b9b324634a47bed9ec"
    hash64      = "aa2fd64d4242caf12a4832f8a65bf888f7afb9ee1494585e53969f2914d966e5"
    hash65      = "34ab4aa9382c44f213e820f8f224ee1878dc84aa7f40b8c44f9c0440be19f60f"
    hash66      = "41aa1515925d56d606763682ad8b1095ea7b87db3582077e41a5fa3a3dad4ad0"
    hash67      = "e17aa8599d6a01af83a4b5c6d59d9a2835ab28e195c7f157a847e0b5ba97b69f"
    hash68      = "d6f8d8e1732a7f2465f89a612b551f28e003ad10f59e23aac48289c4aed26273"
    hash69      = "2964f1b57f95bd30deb92100e32913d94f5baca974394116613fd4a5b2fa6d7c"
    hash70      = "124f7c21d32536b0c317e07913e4a662a8a29893bdbcc837358b1a0acd6ed063"
    hash71      = "551a68b1b60126df9e2b412d92b4df1b9fc4a1c3cb58ce3d73910d32abdf475c"
    hash72      = "e59be4b1e2fd34fa65bdd3ecd3006e7d8908dcd3007182ff455de41dd0a01aef"
    hash73      = "4db402e768b528db07adbc8f32ae457873515901569a3c85471dd2e08950f6c4"
    hash74      = "2687a88cd90baf9b9a66d1fd63104ccbde8c110907a78a92091bb436fb6a0e3b"
    hash75      = "c213fd85be4fc431f0571d08cfc2667193fd5ec30be46f2a5767a8fe4652dabe"
    hash76      = "2c617388096be7ccbbb4c0d776d243e3d21f41b0bddbffe3219e5b6db0d5ef78"
    hash77      = "f940831d32d38152a35712aa0ee75224ef0b9b9e2fa511c85ed5c0dc16282a22"
    hash78      = "578d2c2dc0bae4d094f33c20cbd24277cbeee74b1be55b15ca9e6cd66617a106"
    hash79      = "81bd08737500670459cd84ba64d7fa1de6fb6e7ec9f2d75bfd46e1447f5836ff"
    hash80      = "4c882fef12f0b549926effebd80c8ebf36a21ef7b94d19ed1ccc3ae3e235c711"
    hash81      = "ce41baf2041b0d922aac6e2bce26fb39eb8a1468b7d9e7868816e59903e360e9"
    hash82      = "20800660b85fd1fcb1d0e5325b6f7434c3215872861a905df2184ef185a5878f"
    hash83      = "5d9452995a0c67f890b5bb0c99032727e8d8a87b85553b27cb8ce13839240799"
    hash84      = "beecc6a60ad6a507c438db4a6542b5ddcbc2d4e4ce828cc211a4a27983afb901"
    hash85      = "058aa4dfe08e724e85d8fc0e8650994390804958406593a671260d3119437675"
    hash86      = "6ea3c59b1a72d62656977017820196693fc0a9256ebd41e0e4e4ee251b5c7b0a"
    hash87      = "9f1d76983afaa76c8842d347713f983ef28c4891881b06ce5ed31fb88417e92e"
    hash88      = "1b852d1d2832c3756caf165bf13a4578e39bc1c08e883152e1c2b891f3c2064b"
    hash89      = "88616651c8256e8e31d6011e2d67f6399659c9deee541cb9f24e154ec8e063ef"
    hash90      = "40d272294c433d1bfaf1af74680edb0d8f8e2884bdbd3ca92546f32b6576dbef"
    hash91      = "40a04ef977c340465cfa7784c00099dec53026f50cd0443833258ad53070aa89"
    hash92      = "5a1df938ab501942c5ad812e7c5b2281f1adc84dececd31069813440ce822dbb"
    hash93      = "2ab787f3f0d2a32d060f409309101dac1c7f27ff57f8eebf532b28893b2ca691"
    hash94      = "b72272614d029ff532a97dd10f618dac56d59b464199cde76cefb13d7dd07eed"
    hash95      = "3444d62d4b3fcc9949703836323bc892f29739531814936c4c67029c3477e066"
    hash96      = "0eb037ac02371b5c347290f085cf4bae2c96ae85607f7f8e2402b61ecda7683a"
    hash97      = "525f9a9896278ddb0cb75faaadeea87e615a254749288b0ae999a2240ac2813b"
    hash98      = "12517cdad35537ddf3223155f8a2e9f1dcd40baf681799592d68fd37fdfb0dbb"
    hash99      = "ec2ef42b0daa77997d18e9edc935ebcfbee740a64e4a1f9e3958b1708ad8cd0f"
    hash100     = "5c253865d39c6bc40b1c8af5600c82d175e8e3b68f75ab492bcecb73983fd918"
    hash101     = "799527d8f085e12816458e2889c13e48595ff0775cb860edf9452e2d4d7a5ef8"
    hash102     = "66de3322ca11a7b327577969a62e1d98774a557d24e6892a70305a14a92b00f5"
    hash103     = "1d81fcee948ee7127568e8664d92173dc93ca030cd987e9c4dd0d6a695860575"
    hash104     = "0a2e41d4ad12dd37a16a26086d2e45a714fa3c0cdbf5ff25a90a19d4828be982"
    hash105     = "57edafa18c85e354e621fe72f100f58e2379568cddbc6cf062cc3f2d8e9da738"
    hash106     = "5e6603059a8482185a586ed98fa0dadaf6f81a80fa5f0459ce5344423d5fb023"
    hash107     = "8eda35ac67735144e266e70655f87cae0f4767ffec1d63f56c662c4e73b831e9"
    hash108     = "6015ba745231548a4d49887dc61c19d1b2e5a2b8c08a64550acf9ebff732e5df"
    hash109     = "20d8e6cf0d314bd8ac681b935ed5d1662160125c1df2f09cd4366b77f1887808"
    hash110     = "bf50c290eefe37ad6aa595efffedab2b4ffe543bc4756d1a5210f0d12b8675be"
    hash111     = "372afed2c5b6013189f1b30ed1b27e89ad3c7208390df142e14da536445994cf"
    hash112     = "460e331b546194c21372b50ad155f250ef19f518ddea5bf6a65878c62a4d52f9"
    hash113     = "a1218f302e221d23a625443b4397ac2d44e36b274e8a298349d143a8d6a752e2"
    hash114     = "8b0be9d19660b15f8fa8e3e73be97902f76047f804ec1703b91e6870d6f3da02"
    hash115     = "1f536ba628a6ddf2636e7e010b081c4c11fdebe54f1853e06988f5e3a43cc796"
    hash116     = "59a00c229c3ca8acc79e3da29856fe0f2bf2334b41273c11991a8d2567ee2ba6"
    hash117     = "1e58997ffca3852b97fbdc5d1b994da99af2b9aac0140aa7961da1a1edf966d5"
    hash118     = "2693416bb4b6048ee484ab18471264fa77fe685ea6d4e9becb9255dc08a5dd83"
    hash119     = "07cbed572170e927e4c4fd7ad8657a5b82c4fd95daab1d6c08d069117012a1f2"
    hash120     = "9f71816a1df71fc08c198d8a7bac7599fbe4955b5288aeef611eef49181f3174"
    hash121     = "06f16aae98823b496f93d5e4c6fb5b53df9427b7482cbb2c2761ccc0ff63fdd3"
    hash122     = "710bde53f13e90762c810afe4dcf7cb344e1c2298fc0f73a2940a60f60c42bdd"
    hash123     = "80098290bf54232c494a1fb4b71027c4286575b9e0a91ea55161f53922441b04"
    hash124     = "109065d2bc8e82d55052a694911924fd0cd9dc8342bd31cd1e73a1dd0ec646b0"
    hash125     = "4de5f5f6dc7e923eb3bfa31a8a56f188d95b9edf0134ead026ba8fcfa56b71c2"
    hash126     = "f06ef48b4b25bb53f87f51b3ba21fb8524b5a1d720bf97a551c148d5eabb8b55"
    hash127     = "c44bcc02babcacb3e089b35505137bcf07a6a651467e42790094285006fe4469"
    hash128     = "8758d0b0441cff539286eac1c57291901bee28c09bf1b74040ce973c85f14a85"
    hash129     = "42ac96a3d914acb3454b5b60874ad4c3441dbb853c09c467feb49b811b999abe"
    hash130     = "eef90a971442caf75ef49a592cd01343fadd1763eb2c548b6c7961a4a90a0715"
    hash131     = "5d39f3fd15b5cecf417fa9361c12d584294e8516f51531f6f4a9e0e915f24730"
    hash132     = "fad3f280c3696fb1dbc7c3290ec58d0fae6fbf3ad4951c337ba608945a5aca13"
    hash133     = "d61172b845645138b175ddf1c8a0663770e817d18e5e8094306a549c88e20060"
    hash134     = "a5d53228c74069729dbc66a53242da6553940113400596335a4576e35a19d35a"
    hash135     = "a4a3597ea4cea4c2234e4c3e709c0616a72633551f5552e0af7ee0273f7d062b"
    hash136     = "284a89db853066000ab391be6d90f82b2b57fde1c895cfea2221a0f1cb305b0f"
    hash137     = "103daaaa57cd792548716572bbab7b405e8674e51747a27240701284358e7ae3"
    hash138     = "6b4deb35b2c344bc5a5cf298282d20e3e2f0498b025f7963a6ef5772e3b7e69a"
    hash139     = "1e14b26de2c868870e80ff8a0d1f1ccc7758369d37a9fc979c80519b770d1361"
    hash140     = "e45b212755dfbb380a46ea33db03f70ae4512edac842d9be1443b41524f08473"
    hash141     = "7e065af3163056f80f9eb7f9960360826acdd36fc64c8113905c485d23ac490a"
    hash142     = "db5a9bdef005510d7160f4aab95cd6fd972d0cbabb50b31c21dee381946440bb"
    hash143     = "cded1c7cc251be57438019728358b990042d81409a20b456cdecb8ff02c18ebe"
    hash144     = "d84903c6c370c8a6ad14bd28522d1a41c960d1e25ab49020b42b624c4cd65467"
    hash145     = "db8d1bb86bcd0e0f51140c47fd7c72465d5ce0347a82ffb9b7a3667c9145c9de"
    hash146     = "52640a91787ead6411b2c1f6c382b2ae81a1d9f969688ca22644f0d9c93907ad"
    hash147     = "5e6a2f8caa373bcad2395e0aea280b1e9fbf86060dfe336b33b965bdfa647b21"
    hash148     = "5debdab0555e5bcec0d0a3ec693fa202432905ac959f72431b16495ab5e23df2"
    hash149     = "481cf361d6809e557e533973d958babdd38ada1aac1c467425e861dedb1a3d81"
    hash150     = "7d7830f34f37b4a18c7b4e650a570d8f2eccd7bb51896139fc36b9a8283a28a7"
    hash151     = "15d7867b56becfe2cb5f684897b3c936fa497466b17579371a6f109e41dcf5f6"
    hash152     = "ffface053bf9089f21268e9c58de52df78421e2db915104f6dcd488c9146db86"
    hash153     = "4f165ec6b3b06d517878d5c423c1531a9a2316da1665c29e232013f9f43bdafe"
    hash154     = "f408b9d96ce265c88379c6d0173b36f01199126c8e6e8110dcc6f71eaca8c16d"
    hash155     = "caa12bc1e8ba6aa0b0267ac23c65ad2c5fc01acf06e003cced4654e36379865c"
    hash156     = "85014998bf1b9591156c24d55680fb9cbf09b31d561afbd1a6c166847cc431f3"
    hash157     = "c45c3b6508122009266b770f053b6987af7cf4f27629fb487f1d38db488e22c2"
    hash158     = "644d02d0116c83d2880202edf6687977d2c6c0bf11fd0c6e6f8a3c59505c55be"
    hash159     = "22e6db19d8fd5fef5c76cb71bb452a63fb5b1a27471515813fbbac4cec36811b"
    hash160     = "97b0135e3af719255d44c3cec5a4b2dd7bb100a375ca8c6317d115ba20cebb03"
    hash161     = "098d52063debcf1b0d04cdc012b492556c45ba14328621582d30a97557b5ef29"
    hash162     = "2bff297f96149401f56140fe83359f320ff193e7c0e0a09bbeec24b210e7fca1"
    hash163     = "06dbc8485ebec73b072837cc24165f7780d1cf7878c462f02ffe233b56a91c5c"
    hash164     = "a977b42bca83193f8637cd278bab5a6e0ac53d1c2f2db9e803f15473a913bc0f"
    hash165     = "dbe554347ef494048046886c8affb28959b470af3591d11bf12266f1a96abec5"
    hash166     = "d86bb29e276fc340b594c21efb6264795584a5d94aa9887488cd218db9b9bb0d"
    hash167     = "716fb8e61ea3b0db9ce645a3edb82016e4b5b67fd7768e4bde8d5c3b78ead37f"
    hash168     = "c7cc679c313b6593dd297b78a0492aafd2fced2ce4338b054d8d75bd0448ea4e"
    hash169     = "4f9613249edf3097a6964e80745b33932b5bdd71d259b5b19af0d1250148ab98"
    hash170     = "98e784271d93938c778a22a6204beeafd5e3f774efec5a000670b3323bd6db2e"
    hash171     = "2e663bd45c0ce7944b82adb7b9b31e3017a1032faf2da4231a451693649aabf6"
    hash172     = "04c5762382dd315885dbe2bf1ac7d756d44e4a7374f03aaaa837436e29fe57b5"
    hash173     = "dcd5822e3b5566e2cfcbe3c2b764268afa9f8993a1cf6214e2d07df57c92fcd1"
    hash174     = "407ca84d3b6a3e97b87dcbf5a8e8397583d04d7137b8c886f4f3f4a399c6be80"
    hash175     = "ece0b7d5cd3828af4997d089e28a87641c22e61c4bb3219881e4e56f8cee45a3"
    hash176     = "9bc1cebc12949b451b665203c79b4747bb6eb737611514fda00ff111276714cf"
    hash177     = "5980e20194320c3357d42443031899a151ae1774f9ad210ba336bf48e726a694"
    hash178     = "9835342e7fffb5478b705bebdb937b96bb95e5942dabb7bf0a90ddc9dc003535"
    hash179     = "4aa012bd5c125d0d400ae568c37a65342e0b49b60f9b71a7a6a638234655e398"
    hash180     = "fe2bc8f85d1580a30bc57b2a51d2e14c4111ce4c1495fb9149263e6938109679"
    hash181     = "f0b97ef9299f3a2d364345fadc9f05b0169561cb38de95827da9fc1561556629"
    hash182     = "f6a9981a3b1470bcb6f16f34322ba8eb752b9b3de561418cb7c6ea552a78ae30"
    hash183     = "8dd807f98622345d728110a7aa115ec7613698e76e3505a365cc6e2fe82a4c61"
    hash184     = "e87e39b279fa128beb4b3bb33d01355210c0622e089b2b726bb3590a68f71cb2"
    hash185     = "8968792f6b2fab016ba33a1950e4fc48db66f1c3d58df2186849d25d9ac288db"
    hash186     = "4da797cffbbbee0f6b7f6a1434c61e2439e63cc76e0bbbb035f7554073fd8428"
    hash187     = "aebc5cc4e12fc8742082da50c7335256afdf58bf6f1e0882a6c3526b57382de6"
    hash188     = "8430f6009ca04f69a674d52fa2242d31ba49aa33ea75a77529f68b5ac5644db1"
    hash189     = "7f8c03466ae8811aa09dff1569bb9ef2fcb425c351e658571a4b8b439d1cbb94"
    hash190     = "c16d310bfaa5c387da8587449a9f215c3269348fe314b78e25103ad05d5714ec"
    hash191     = "5bca9010dba87d0b9a064278dea0e86fe988f5315963ebd77621657d33947e8b"
    hash192     = "fcf9131b8e73cf8ccdcf65d0d4929da3d8d08fa1f86298b03d1d734e94f542e3"
    hash193     = "912a42696cc7879a47d6b32dbbb70eed80b4c20f2e4681efb910d89da7c7b467"
    hash194     = "86bab3807714f75308fb73f0322f63b1c575c06455882fd86b85e0068c64407b"
    hash195     = "2d53787ff1097b47b5d1860ae592e9bb93064ac62fbf86e8aeae82f203236760"
    hash196     = "fcaf74149ff76e81a19b167dc3be45153454f54a0ba5b15eba71cd7636c47a90"

  strings:
    $s1  = "KavalaMi3.setRequestHeader(\"User-Agent\",\"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\");" fullword ascii
    $s2  = "// while (KavalaMi3.readystate < 4) WScript[\"Sleep\"](100);" fullword ascii
    $s3  = "KavalaMi3.open(\"\\x47\\x2c\\x45\\x2c\\x54\".KavalaENm4(), KavalaRv3[KavalaYw0], false);" fullword ascii
    $s4  = "String.prototype[\"KavalaENm4\"] = function () {return (\"asdf\", this.split(\",\").join(\"\"));};" fullword ascii
    $s5  = "KavalaFx5.push(String[\"fromCharCode\"](KavalaHWa3));}" fullword ascii
    $s6  = "function KavalaOSv7(KavalaHCf2, KavalaLSq4)" fullword ascii
    $s7  = "else {KavalaHWa3=KavalaSr6[KavalaYRs2];}" fullword ascii
    $s8  = "function KavalaAj4()" fullword ascii
    $s9  = "if (KavalaXBx9[0] != 77 || KavalaXBx9[1] != 90) continue;" fullword ascii
    $s10 = "KavalaNGy2[949]=238;KavalaNGy2[8745]=239;KavalaNGy2[8801]=240;KavalaNGy2[177]=241;KavalaNGy2[8805]=242;KavalaNGy2[8804]=243;Kava" ascii
    $s11 = "return KavalaXBx9;}" fullword ascii
    $s12 = "eval('var KavalaFx5=new Array();var KavalaGBr5=\"\";var KavalaYRs2; var KavalaHWa3;');" fullword ascii
    $s13 = "function KavalaZa6(KavalaLSq4, KavalaCe0)" fullword ascii
    $s14 = "return KavalaTVq5[\"ShortPath\"];" fullword ascii
    $s15 = "return KavalaLSq4;}" fullword ascii
    $s16 = "eval(\"KavalaSr6[238]=949;KavalaSr6[239]=8745;KavalaSr6[240]=8801;KavalaSr6[241]=177;KavalaSr6[242]=8805;KavalaSr6[243]=8804;Kav" ascii
    $s17 = "{var KavalaNGy2=new Array();" fullword ascii
    $s18 = "function KavalaFf8(KavalaOYj5)" fullword ascii
    $s19 = "function KavalaNn0(KavalaLSq4)" fullword ascii
    $s20 = "return KavalaGBr5;}" fullword ascii

  condition:
    (uint16(0) == 0x7453 and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b027b337-e2cb-4f8e-bfdb-27b4d9551e5f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion