_20160726_054a26a115a527bb999d904028587d96_20160726_0a4b1a76830f_227

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160726_054a26a115a527bb999d904028587d96.js, 20160726_0a4b1a76830fab55b4bc7cf680b6da3e.js, 20160726_0ba27d401ad72097924df487913cc3e6.js, 20160726_0caf14302aa2c34777bb84dc0af77cfe.js, 20160726_0d6af9f54b93af40d93d7bce5a0a9c1a.js, 20160726_176f401c529c58c661e0e7b5cb3c08ed.js, 20160726_20a65c5c8b154b32a7402e483c7e6222.js, 20160726_228fff5e5fbfb99d2925114ffb123e96.js, 20160726_28c0d5d078c96be98b1c38cfeb1f259a.js, 20160726_3e3becc86752b0298d8c0fd5ecaa7036.js, 20160726_4c8a524790c3a4618e74f32afc9db551.js, 20160726_4d04624692b9daf9daab8bd75b73164b.js, 20160726_51ec820c8b11a9670a8af823fab00dbf.js, 20160726_57d6220db269373f2d6a14e75338d844.js, 20160726_677f06553ed46dcb45dffb4c5420016a.js, 20160726_69681cc0bd140f173cd08aeff0d479bb.js, 20160726_6a876986d3caf4dcc810cbbee33edf57.js, 20160726_6ac3c9f07985c9f47de161a6f86c5126.js, 20160726_6c3f0c6613c043e312e9baf3c843e120.js, 20160726_78bc00c299d79f2891f423777e6dbcdf.js, 20160726_8e7f4b3b7fd0a19e93678ced730a7f6d.js, 20160726_8e9b4493d65989991cc683ad4f319942.js, 20160726_959e024bf713ebeb4fb13bd412a92ffd.js, 20160726_9a3ed581803b8f268f6cf29b3954548d.js, 20160726_9bac787a3ee1e59197f7ae043a49d2b6.js, 20160726_b654fbe3248310522508e6507700469e.js, 20160726_b9b061ec083a9b4690e2e5723da1f577.js, 20160726_e3bde5850cfd4a3cad588ad09c7b71ba.js, 20160726_eca60d0422284ef3fd48fd105deb0d8e.js, 20160726_f858529cb3d7bb9d5f531c77c3c11c2f.js

rule _20160726_054a26a115a527bb999d904028587d96_20160726_0a4b1a76830f_227 {
  meta:
    description = "datamaliciousorder - from files 20160726_054a26a115a527bb999d904028587d96.js, 20160726_0a4b1a76830fab55b4bc7cf680b6da3e.js, 20160726_0ba27d401ad72097924df487913cc3e6.js, 20160726_0caf14302aa2c34777bb84dc0af77cfe.js, 20160726_0d6af9f54b93af40d93d7bce5a0a9c1a.js, 20160726_176f401c529c58c661e0e7b5cb3c08ed.js, 20160726_20a65c5c8b154b32a7402e483c7e6222.js, 20160726_228fff5e5fbfb99d2925114ffb123e96.js, 20160726_28c0d5d078c96be98b1c38cfeb1f259a.js, 20160726_3e3becc86752b0298d8c0fd5ecaa7036.js, 20160726_4c8a524790c3a4618e74f32afc9db551.js, 20160726_4d04624692b9daf9daab8bd75b73164b.js, 20160726_51ec820c8b11a9670a8af823fab00dbf.js, 20160726_57d6220db269373f2d6a14e75338d844.js, 20160726_677f06553ed46dcb45dffb4c5420016a.js, 20160726_69681cc0bd140f173cd08aeff0d479bb.js, 20160726_6a876986d3caf4dcc810cbbee33edf57.js, 20160726_6ac3c9f07985c9f47de161a6f86c5126.js, 20160726_6c3f0c6613c043e312e9baf3c843e120.js, 20160726_78bc00c299d79f2891f423777e6dbcdf.js, 20160726_8e7f4b3b7fd0a19e93678ced730a7f6d.js, 20160726_8e9b4493d65989991cc683ad4f319942.js, 20160726_959e024bf713ebeb4fb13bd412a92ffd.js, 20160726_9a3ed581803b8f268f6cf29b3954548d.js, 20160726_9bac787a3ee1e59197f7ae043a49d2b6.js, 20160726_b654fbe3248310522508e6507700469e.js, 20160726_b9b061ec083a9b4690e2e5723da1f577.js, 20160726_e3bde5850cfd4a3cad588ad09c7b71ba.js, 20160726_eca60d0422284ef3fd48fd105deb0d8e.js, 20160726_f858529cb3d7bb9d5f531c77c3c11c2f.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a33140025126482d1c0d2af89ba9096064cf288fc9dd794a9248d871d5e5b3e6"
    hash2       = "b36fab312f98381b1648f811e2fa740fa359a54e73e0e9e69471c58c7c94083b"
    hash3       = "f0666c7cfed14afd0f918ebee0b2bb77fc87baf76478ebc45fb5d09b8cc118ad"
    hash4       = "80f92545ebc520ce98b242334ef5d9d5b1e2217f575bbbd5cbde513d80b005fb"
    hash5       = "2502c2a3dcef94d36265ad15740b12e8b84843e1f6a76481499bd5b23d4deb30"
    hash6       = "8203c0b178c1ac40820822f2fe026722677604282ce3777234e04b2df18342a0"
    hash7       = "325bc913f93b8b6e64d10e410553e129c0e4b159d71662634448eddee1cd5d1c"
    hash8       = "884d2771b9fcb60db42f884fa631dd04f280f08da1266a262cb419c8e4d28876"
    hash9       = "8c394900c85b7d17b9600b2c0446e082fc0df06afbc91798616f298efe9dc261"
    hash10      = "d5754eb0015eb041328c075b2269b57cac148ff8f4e39aa9f58232fada4588f5"
    hash11      = "dc92662faee479d876c0d47b892aa62e910188ba51b9180d36c4fe287836d9af"
    hash12      = "99426c983a1d99e3ffe062024836c158bda7516f691a2b9bbc9bc86859c58379"
    hash13      = "5db02b26ef33f829f1403e551aa64aca00f24fb503c831ef67951b827779b944"
    hash14      = "45ee6c6266a15ccb315245b98144d3f57bc5db548a1ef2381eb67c90bad5b9ee"
    hash15      = "2436c7e05a5a93b8fccb46372b58317ee279febee8260918c263a1b9c7820abb"
    hash16      = "3a20591d53b0c60f1ac841cdc46f433da675357947c033efb5c2f725a085ad50"
    hash17      = "466816b0089c88beb47c949fec535fd2210be7c2e7a326e99f9eab4d18481baf"
    hash18      = "eeb3ab29f0ea1153e6bb18d5ba0972789cf2aecde08e5f3fb6097f0aa28349e7"
    hash19      = "c2a368cae71c8a96eac03ff5a5faf4164d9feb362c1d713a0512e53aa4af3a5a"
    hash20      = "2ff5a461f9a3f7f844ac8f08bf36a9fda33d04fd804ce25e5d2bbda370416a76"
    hash21      = "c70edc48806ac7a6baa1d6665af75e6c954ab954c084b433b4abb3a2c2da86b0"
    hash22      = "884cd2bd5f241f360e01376a5216a28e7300f8dac02310c4c699f0a9d257909b"
    hash23      = "0a1bed284cafeab3a2ef39226d51f6738bfa35061031e1f697e9fc5baf836591"
    hash24      = "24fcb5c788b41d092bf7ae523bdbf86579d8e60fff566d2ae8ad9831ecbbf33f"
    hash25      = "f5e5c038676b256e16b7fea1297deb16c8363b1844a7c57404d81d5d21939491"
    hash26      = "5d660c2c8723e2d8df406ffb6873c0f48105a147d23e7fcb7489f14164cd2f55"
    hash27      = "6e2c0d249b5991718551b10ac9acc454b4609dc9f72021e90d48625ba747518b"
    hash28      = "7ec5d60f85b8f8fba7ea379ea2925ffb07e210431e759cb7871733159aafa9a5"
    hash29      = "efe421658d6612beab341459a03160ce14957cf277addd432829a1ee8081810a"
    hash30      = "658703cff965e32ac1f2c24880c3f6172c57aa53dcfa6683140d475c95a463dc"

  strings:
    $s1  = "String.prototype.datskyparkmisternlo_center2 = function () {" fullword ascii
    $s2  = "String.prototype.datskyparkmisternlo_peremenD = function() {" fullword ascii
    $s3  = "datskyparkmisternlo_Native.datskyparkmisternlo_genericize = function(object, datskyparkmisternlo_property, datskyparkmisternlo_c" ascii
    $s4  = "};datskyparkmisternlo_Native.datskyparkmisternlo_implement = function(datskyparkmisternlo_objects, datskyparkmisternlo_propertie" ascii
    $s5  = "datskyparkmisternlo_Native.datskyparkmisternlo_genericize = function(object, datskyparkmisternlo_property, datskyparkmisternlo_c" ascii
    $s6  = "};datskyparkmisternlo_Native.datskyparkmisternlo_implement = function(datskyparkmisternlo_objects, datskyparkmisternlo_propertie" ascii
    $s7  = "datskyparkmisternlo_Native.datskyparkmisternlo_typize = function(object, datskyparkmisternlo_family){" fullword ascii
    $s8  = "datskyparkmisternlo_rodmands.datskyparkmisternlo_sameOrN = function(datskyparkmisternlo_param1, datskyparkmisternlo_param2) {" fullword ascii
    $s9  = "datskyparkmisternlo_rodmands.datskyparkmisternlo_subtract = function(datskyparkmisternlo_param1, datskyparkmisternlo_param2) {" fullword ascii
    $s10 = "var datskyparkmisternlo_peremenA = new Array(-1, -1, -1, -1, -1, -1,-1,-1);" fullword ascii
    $s11 = "if ((!datskyparkmisternlo_check || !object[datskyparkmisternlo_property]) && typeof object.prototype[datskyparkmisternlo_propert" ascii
    $s12 = "    return new datskyparkmisternlo_rodmands(datskyparkmisternlo_param1.x - datskyparkmisternlo_param2.x, datskyparkmisternlo_par" ascii
    $s13 = "if ((!datskyparkmisternlo_check || !object[datskyparkmisternlo_property]) && typeof object.prototype[datskyparkmisternlo_propert" ascii
    $s14 = "    return new datskyparkmisternlo_rodmands(datskyparkmisternlo_param1.x - datskyparkmisternlo_param2.x, datskyparkmisternlo_par" ascii
    $s15 = "        } while (datskyparkmisternlo_i < datskyparkmisternlo_len && datskyparkmisternlo_c3 == -1);" fullword ascii
    $s16 = "        } while (datskyparkmisternlo_i < datskyparkmisternlo_len && datskyparkmisternlo_c1 == -1);" fullword ascii
    $s17 = "        } while (datskyparkmisternlo_i < datskyparkmisternlo_len && datskyparkmisternlo_c4 == -1);" fullword ascii
    $s18 = "} catch (datskyparkmisternlo_RFXuYwO) {WScript.echo(datskyparkmisternlo_RFXuYwO.message);" fullword ascii
    $s19 = "    datskyparkmisternlo_ok(datskyparkmisternlo_spyFunction1.datskyparkmisternlo_calledWith(), \"Function called without argument" ascii
    $s20 = "function datskyparkmisternlo_achievment(datskyparkmisternlo_bidttt){if(datskyparkmisternlo_bidttt==1){return 2;}else{return 17;}" ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

39fbbb0d-854d-423c-8fb0-e95f0fd270f2

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion