_20161121_000447b1e6884d342c357631007281ea_20161121_080f241a0994_231

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20161121_000447b1e6884d342c357631007281ea.js, 20161121_080f241a099454e3e8fda20619f39ab2.js, 20161121_0cc9bb35b3ec8fe706746b955b5ade72.js, 20161121_1a4ebfb3236049da51d4858b923b946c.js, 20161121_2107dd360d3b1efc452b3394b060709a.js, 20161121_299b7f89a8c95050ecfbc7e0f99cc54a.js, 20161121_29e0e942d14d6cfa2bef0ee35b6f3984.js, 20161121_2c7513e081e6a7372f2c3f2958f0252c.js, 20161121_2d090e4110c29e212ece305079f442cf.js, 20161121_2f247c6a99899e5b0ad3bf099eead063.js, 20161121_40e3e95d971b7e5bdd655e71ea546a82.js, 20161121_4133ed610b3da788ebd7c9551eadd0c8.js, 20161121_43fac7b42886a4d2651c99e0f33eb616.js, 20161121_46b02704fa2d97d6e5392a22968ec23d.js, 20161121_46eb1e5220544430e0b544b7577dfc40.js, 20161121_48646490b8152171895ad51f90547d38.js, 20161121_4c5203f197966b72cb27b6944cc52000.js, 20161121_5144a3072a650758ede42436794ded5e.js, 20161121_541840f83b92193d097dfb026e5b4789.js, 20161121_54b8e1aed5ad5221ea24d9495100f7b5.js, 20161121_5cab65736f0bece4ba0c917f597f9464.js, 20161121_5cc4276aea35357ea53b0d74ea696c04.js, 20161121_64bc2302484167fb9b55e8b923d415e8.js, 20161121_64d8833690307e4efdaeacc9c069a194.js, 20161121_661e77f57b6057d3f02de9b014bc49ed.js, 20161121_6bd69baae6f15db35884bfb5ed86bdd1.js, 20161121_6fbd7e7e2baab28d9129893c38615f7e.js, 20161121_72ce096a1655420f3e1d163d6bccf7cc.js, 20161121_77331dee1dd98f2a0c88e4009763ec1b.js, 20161121_78537f6caaba02eb3ed52a6ac7f436dd.js, 20161121_7f8da8b16e50500ac3dcfe3cedf9949c.js, 20161121_82fb98e849d45073daced7f217b0b31f.js, 20161121_841d7e1b120962b1473441928aa9a123.js, 20161121_85e6e65dd0ba6bb320c32ff316593fae.js, 20161121_a0ec4a101df0f283061753352e3de381.js, 20161121_a70c1670e7d49a7015feda45b04bfa1c.js, 20161121_a7d86563b5ee8068d965b1577d569871.js, 20161121_b1766be1f479f6fc792bcacde167d61c.js, 20161121_b182d1ec7754ca4f39a5256fa31e4744.js, 20161121_b279dac369278757a640e737d6829938.js, 20161121_b6901ea40415bf7c4d9c452e0dd64d13.js, 20161121_b825cce426ed9d0850a03f8ec42cfd1e.js, 20161121_b94e1a0b3b7af1c3df1363357714b661.js, 20161121_b9808250810fba9ef3018974cd9e6eea.js, 20161121_bfe36d48f94cdcb35c6c40cf5d6d4f0c.js, 20161121_c074fe9203f5939e878cfc62f05ecc42.js, 20161121_cf252389cf1901d3b2c4fd6a4c4da265.js, 20161121_cf30e310f7eac6fc2547466f1470d6c8.js, 20161121_d396843dd4c32e85fd5e113e1e34d79c.js, 20161121_e851f9c35f7523946f3e5276b5ab330b.js, 20161121_e9057502b5b36d305c830f781d71b43a.js, 20161121_fc8a36edfcfdffa120b3c7241ad27455.js

rule _20161121_000447b1e6884d342c357631007281ea_20161121_080f241a0994_231 {
  meta:
    description = "datamaliciousorder - from files 20161121_000447b1e6884d342c357631007281ea.js, 20161121_080f241a099454e3e8fda20619f39ab2.js, 20161121_0cc9bb35b3ec8fe706746b955b5ade72.js, 20161121_1a4ebfb3236049da51d4858b923b946c.js, 20161121_2107dd360d3b1efc452b3394b060709a.js, 20161121_299b7f89a8c95050ecfbc7e0f99cc54a.js, 20161121_29e0e942d14d6cfa2bef0ee35b6f3984.js, 20161121_2c7513e081e6a7372f2c3f2958f0252c.js, 20161121_2d090e4110c29e212ece305079f442cf.js, 20161121_2f247c6a99899e5b0ad3bf099eead063.js, 20161121_40e3e95d971b7e5bdd655e71ea546a82.js, 20161121_4133ed610b3da788ebd7c9551eadd0c8.js, 20161121_43fac7b42886a4d2651c99e0f33eb616.js, 20161121_46b02704fa2d97d6e5392a22968ec23d.js, 20161121_46eb1e5220544430e0b544b7577dfc40.js, 20161121_48646490b8152171895ad51f90547d38.js, 20161121_4c5203f197966b72cb27b6944cc52000.js, 20161121_5144a3072a650758ede42436794ded5e.js, 20161121_541840f83b92193d097dfb026e5b4789.js, 20161121_54b8e1aed5ad5221ea24d9495100f7b5.js, 20161121_5cab65736f0bece4ba0c917f597f9464.js, 20161121_5cc4276aea35357ea53b0d74ea696c04.js, 20161121_64bc2302484167fb9b55e8b923d415e8.js, 20161121_64d8833690307e4efdaeacc9c069a194.js, 20161121_661e77f57b6057d3f02de9b014bc49ed.js, 20161121_6bd69baae6f15db35884bfb5ed86bdd1.js, 20161121_6fbd7e7e2baab28d9129893c38615f7e.js, 20161121_72ce096a1655420f3e1d163d6bccf7cc.js, 20161121_77331dee1dd98f2a0c88e4009763ec1b.js, 20161121_78537f6caaba02eb3ed52a6ac7f436dd.js, 20161121_7f8da8b16e50500ac3dcfe3cedf9949c.js, 20161121_82fb98e849d45073daced7f217b0b31f.js, 20161121_841d7e1b120962b1473441928aa9a123.js, 20161121_85e6e65dd0ba6bb320c32ff316593fae.js, 20161121_a0ec4a101df0f283061753352e3de381.js, 20161121_a70c1670e7d49a7015feda45b04bfa1c.js, 20161121_a7d86563b5ee8068d965b1577d569871.js, 20161121_b1766be1f479f6fc792bcacde167d61c.js, 20161121_b182d1ec7754ca4f39a5256fa31e4744.js, 20161121_b279dac369278757a640e737d6829938.js, 20161121_b6901ea40415bf7c4d9c452e0dd64d13.js, 20161121_b825cce426ed9d0850a03f8ec42cfd1e.js, 20161121_b94e1a0b3b7af1c3df1363357714b661.js, 20161121_b9808250810fba9ef3018974cd9e6eea.js, 20161121_bfe36d48f94cdcb35c6c40cf5d6d4f0c.js, 20161121_c074fe9203f5939e878cfc62f05ecc42.js, 20161121_cf252389cf1901d3b2c4fd6a4c4da265.js, 20161121_cf30e310f7eac6fc2547466f1470d6c8.js, 20161121_d396843dd4c32e85fd5e113e1e34d79c.js, 20161121_e851f9c35f7523946f3e5276b5ab330b.js, 20161121_e9057502b5b36d305c830f781d71b43a.js, 20161121_fc8a36edfcfdffa120b3c7241ad27455.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "4ef2e2cab99d40d87ef1afcf55cf2b44478e0639d86638399a9e55e22ec52d05"
    hash2       = "034fd6f7cc32d42122a4598e758b18d334edf44a38829fbc196d4cd0422c85e7"
    hash3       = "a3ed0e14beaf127e9d690b646b6fb1430fedae860a7308542119a2bcf63c3409"
    hash4       = "911277b885ad892c15c034b1c440179b84cdfc5e22ad01f99303f2511194e412"
    hash5       = "add870937d0e75570443bbc045b8a58e5c81e5a7f050e00d93c3b528771694aa"
    hash6       = "07091cc25b673f3a4aefc997ac50495eda5e46fe168d41fb529c14a07ae80668"
    hash7       = "e31b97d3090de174af735b7bf4bce1d6ffba0f35a78e88d1e536034bba461aa1"
    hash8       = "8dbad0c85a24d2b7da9e6c6a45311bc4123659c331d63958f44240c92fda0823"
    hash9       = "d18e05c5b7600a43ebd07b5bea4b0aa7d4adc0732334a18684dac08baf5e17ec"
    hash10      = "8d037304fc1633c841fbb7c31f81f4cc1fac8e918be815f6dca2be741f76c555"
    hash11      = "9cfa59397b26898bc1d516f9c6f3926f7b501f5bd28dc6aebadb082028d0be45"
    hash12      = "3ba6becf88588fa1fbc408915c89efb5b9dac4324c19c2055cc75e3dd1d4c4e0"
    hash13      = "256857a3cffe140dc7e38697724dfe873f68fc8f1633804ad6d92eef4a6e3748"
    hash14      = "f94e0bc78dd7bd5a459e0b22b2906d758d12b928bf8f18884bd10572a730e382"
    hash15      = "805553b75d04d02553dbf1a715d7d39ed9bf94f9f6a8ca1f26f46186d9c53235"
    hash16      = "cc85bb05cfb39351d83aa740d85fef1dab8b94f0e2112ade681279cafff1c25f"
    hash17      = "d6701791a9afc00c22881349c3cef3a54dbd425b0e93bb6be8ca2e2709f8d0f4"
    hash18      = "6fea502c0b701da9d72feebd710abcd8122c2374173e6e4ae8d65c6f92d25825"
    hash19      = "e5d32c81872aa989139bb5e6119ba07ad95ae19c9bd604a07fd9ec83e187ebb9"
    hash20      = "829d67f472609c46d4ab55fcfdbb2c53f42442b246145ed1a610c2dc3a208cc0"
    hash21      = "fa61ded9e54ce1c081c5b10e8f09edf5122507c07f93fa86e1f89ff68def6520"
    hash22      = "95d31afe99d96e7b8fb4b1363fe246998b34e4d5b60a8946e1c3867177f5da28"
    hash23      = "ff51fea35c35681d32fac595d402c3738e37f48c5c4571a61c7f1c1b005460d0"
    hash24      = "9d7842808e9d1762875083025c2ab8ed60b100c859b0f47a6d3291bacaa9cead"
    hash25      = "775cae1c764b7a461bd3dfdf182ae4c482e0fde8b77b2cb81e57cb65fbdcc920"
    hash26      = "daa94d63fb1477a1d8a39296b4e72ca5bc9fb97bdd62bc651c76a07c2bd8bafb"
    hash27      = "ae1ffef34f805a0aa0a6eaabb7c187923ab3c91caaa78b4dcc80ebae2e340e5a"
    hash28      = "293e7ce5c3625fb2febeb7c051851f738b58f582cec5ba3ced42a1271a2e48e1"
    hash29      = "476d188e8d830b85fa9aef0df8f61a3fcfb39d0523635b90f3dfd11f1c78fc48"
    hash30      = "89b696860aca5c00331c708ceb4a6700471180158f2fd71ccdf6f56971e96635"
    hash31      = "e8f0e6fd0aea26a75975790f121e3fd77bf4716a47e53c2b1429266bb4facb4d"
    hash32      = "c3dbee75bf384a13342f8cf8b90ab1c16e21b3cb3d040186dca3ff7523896a4c"
    hash33      = "054fb1e34e979050c6837f56c5cae59fc5e68aa804c8a015679848b2779d0a2b"
    hash34      = "5ec67f7b23ab78b617e821215970d50d25cde6f5f20740e7b969ceb76c397175"
    hash35      = "dca80db80619e778b4739a8d6ab04f5355ecbae0f859d0b546fe5aef93a97cf9"
    hash36      = "f579c3ee6804760460de4dede3860f6317f29a0ee9d3b70fb9d039c37c82e240"
    hash37      = "e3acd55bc216ebda314113caa3a9bf6816f8abd36c8dcbd962ac3e32c1411cfe"
    hash38      = "b22a28d6722481b2d1df93799156e2a3e2df19ca4695d4be403c1e3dda814164"
    hash39      = "916bb61602e535961043c25484ea8dda3cd871e6f4d2acb00679fc30f7928fed"
    hash40      = "5db4299b731f47bb35b1b7e83bf3555d64658eb8c718719abed74c30cab8d615"
    hash41      = "88b8ae171e8b40d52a85485f439534e9bceb4753fd42a082ad6591a0eeff9acf"
    hash42      = "8624da3dee00e663da9df5ad582741fda68f99b7cc9b60ec2f65de7a8668ed32"
    hash43      = "ea2ad6fb25a3b69441184a32a1a50b948857595b737e9923106bd9c765e2f7e2"
    hash44      = "f5100bd98d4d4ebfa5d1a2b1a9d7bce2b5406f90019a18e84c5aee8c6f8ddad5"
    hash45      = "4e4b79d2536778f5f63f570f0c0fa4d63b88b1922558515915f31ab04525b987"
    hash46      = "802f467989c9447dc969e0aaacfc8690b09621963688bee2fd009377a85ff42e"
    hash47      = "d0db8bc170421e7f61b039ca71000e44cac334e1f430f52f48aeddef1e004bc5"
    hash48      = "b87cffe0ca111243eedace710d7d4eeda6ff3a432b9dbe913dcdfc7022e31fe9"
    hash49      = "405e9a6ff04fb5ea1f8d8246b604e08120eaf79fb393d1f6a85a1f18e51aab63"
    hash50      = "8677299dfd26314cec3a2c43a1b8c71450d152bf2867e569d3c00a53a5227875"
    hash51      = "375476f6d685a94280426241d9c7bd8c919d6c17b213bd2a235de89d69c4c5dc"
    hash52      = "916246adc44d6bf0a7b2ba527f4214260c0e11ebee90cb168dc3da42be42254a"

  strings:
    $s1  = "WellSoRudeGGa5.setRequestHeader(\"User-Agent\",\"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\");" fullword ascii
    $s2  = "while (WellSoRudeGGa5.readystate < 4) WScript[\"Sleep\"](100);" fullword ascii
    $s3  = "WellSoRudeGGa5[\"open\"](\"GET\", WellSoRudeQOm2[WellSoRudeGNg7], false);" fullword ascii
    $s4  = "WellSoRudeMl0.push(String[\"fromCharCode\"](WellSoRudeQAj3));}" fullword ascii
    $s5  = "{var WellSoRudeNz5=new Array();" fullword ascii
    $s6  = "function WellSoRudeKMt2(WellSoRudeIr8)" fullword ascii
    $s7  = "var WellSoRudeMl0=new Array();var WellSoRudeHVh4=\"\";var WellSoRudeWq2; var WellSoRudeQAj3;" fullword ascii
    $s8  = "function WellSoRudeEd7()" fullword ascii
    $s9  = "return WellSoRudeHVh4;}" fullword ascii
    $s10 = "if (WellSoRudeJUb1[0] != 77 || WellSoRudeJUb1[1] != 90) continue;" fullword ascii
    $s11 = "function WellSoRudeCo3(WellSoRudeYBh8)" fullword ascii
    $s12 = "function WellSoRudeHWl5(WellSoRudeHFv0)" fullword ascii
    $s13 = "else {var WellSoRudeWq2=WellSoRudeNz5[WellSoRudeQAj3];}" fullword ascii
    $s14 = "function WellSoRudeHp3(WellSoRudeHFv0, WellSoRudeYBh8)" fullword ascii
    $s15 = "return WellSoRudeYBh8;}" fullword ascii
    $s16 = "return WellSoRudeVg5.ShortPath;" fullword ascii
    $s17 = "else {WellSoRudeQAj3=WellSoRudePHt1[WellSoRudeWq2];}" fullword ascii
    $s18 = "return WellSoRudeKMt2(WellSoRudeQy6);}" fullword ascii
    $s19 = "{var WellSoRudePHt1=new Array();" fullword ascii
    $s20 = "function WellSoRudePo4(WellSoRudeYBh8, WellSoRudeABn7)" fullword ascii

  condition:
    (uint16(0) == 0x2f2f and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

59407716-d411-4600-ae6f-6d26add41280

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion