_20160921_034dbd5881bc0324f5773d7774d981c4_20160921_05c83a67fb56_232
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_034dbd5881bc0324f5773d7774d981c4.js, 20160921_05c83a67fb56c3e2f515dcdc094f3438.js, 20160921_164a257da283d5c859dcaffb21bf752c.js, 20160921_17c44cf20b688f3f5be613056d39409e.js, 20160921_2c106cc001daa2dffdfde7e2aa5c908b.js, 20160921_3b7ec37cdbfac434e32c8743c60228af.js, 20160921_4f1da2d661fb97b4733f3fbf35efff6c.js, 20160921_56567a449e5ae44cd4a4e62bb55e63f3.js, 20160921_5a42d0e1880d178346694a30bc112076.js, 20160921_5e9244484429cd897ec88fe97140c29c.js, 20160921_64060d97e498db57bf68dbb08be86bba.js, 20160921_6c49e33f1abb3ca2b0ff12a4878e38c8.js, 20160921_8acd2bde0828f30802ece6249f9b9483.js, 20160921_8b9d3c425718975422f8fe0d71119686.js, 20160921_8dce9d2aa0d1e296bbcc31a437e35a45.js, 20160921_a0b892850e7511a70b7c95d4603de0d8.js, 20160921_a2f8f3f44ef6a3341feac8fb57e829ce.js, 20160921_b714100d69b955de920a302ff8bef7db.js, 20160921_bd40742bedf80aa0091b1fafd0a7ba4b.js, 20160921_bfdb187f27d136f64e05f0dcf2ee4914.js, 20160921_c4afaa1e41efa7633248f1941bda4010.js, 20160921_d0ae6acc5cc4f52f8d5df0b47ef8659a.js, 20160921_dc73cfa7a33eb762f38614c69a95919d.js, 20160921_e63dc8126cee826e8d941c1665ea92b4.js, 20160921_f2abfe62ed227fb547869419a6d3af3c.js, 20160921_fa89d54bd5a7a27defe09d5a56b5a881.js, 20160921_fb2ccc1a635114bc23ea8a0a8413b110.js, 20160921_fc08be0621d4ffbced0eaca2b2622b07.js
rule _20160921_034dbd5881bc0324f5773d7774d981c4_20160921_05c83a67fb56_232 {
meta:
description = "datamaliciousorder - from files 20160921_034dbd5881bc0324f5773d7774d981c4.js, 20160921_05c83a67fb56c3e2f515dcdc094f3438.js, 20160921_164a257da283d5c859dcaffb21bf752c.js, 20160921_17c44cf20b688f3f5be613056d39409e.js, 20160921_2c106cc001daa2dffdfde7e2aa5c908b.js, 20160921_3b7ec37cdbfac434e32c8743c60228af.js, 20160921_4f1da2d661fb97b4733f3fbf35efff6c.js, 20160921_56567a449e5ae44cd4a4e62bb55e63f3.js, 20160921_5a42d0e1880d178346694a30bc112076.js, 20160921_5e9244484429cd897ec88fe97140c29c.js, 20160921_64060d97e498db57bf68dbb08be86bba.js, 20160921_6c49e33f1abb3ca2b0ff12a4878e38c8.js, 20160921_8acd2bde0828f30802ece6249f9b9483.js, 20160921_8b9d3c425718975422f8fe0d71119686.js, 20160921_8dce9d2aa0d1e296bbcc31a437e35a45.js, 20160921_a0b892850e7511a70b7c95d4603de0d8.js, 20160921_a2f8f3f44ef6a3341feac8fb57e829ce.js, 20160921_b714100d69b955de920a302ff8bef7db.js, 20160921_bd40742bedf80aa0091b1fafd0a7ba4b.js, 20160921_bfdb187f27d136f64e05f0dcf2ee4914.js, 20160921_c4afaa1e41efa7633248f1941bda4010.js, 20160921_d0ae6acc5cc4f52f8d5df0b47ef8659a.js, 20160921_dc73cfa7a33eb762f38614c69a95919d.js, 20160921_e63dc8126cee826e8d941c1665ea92b4.js, 20160921_f2abfe62ed227fb547869419a6d3af3c.js, 20160921_fa89d54bd5a7a27defe09d5a56b5a881.js, 20160921_fb2ccc1a635114bc23ea8a0a8413b110.js, 20160921_fc08be0621d4ffbced0eaca2b2622b07.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "82795298a84df6fa0b0e45225727206f9a173f55589db6b76ab8df4198dc55c7"
hash2 = "0535a055f646391a67e495ab3466f375b47d00382cf1ac28c70355309533f19c"
hash3 = "36edb416a5f8703ead3fb8f8fbb7a0fb98ac21c559eb20558b33460ba9dfc9a0"
hash4 = "0a10c81cc5c3cc9eb38f73af3b77ed314fed047818a2410613c91431eee6bee1"
hash5 = "ca5356b92abf859d45d843749f45e5e06c7d045b4e7ea5d215ab87cdb8c8f66b"
hash6 = "86390741cf6e610c2e526db749631548b514c268decade5a5870edfebb141d4b"
hash7 = "57198460b755f2336c23ed27d26f09514db08ab180e216293a853489286f4ff2"
hash8 = "e0950a0ccf96b116ed17c3fbaa99325e34f0b717e3e354bd1f926eee8465c6a7"
hash9 = "ca8e81eec437e87b27dedb202751f13e736aa092e78fffde5fbf40616f2e3738"
hash10 = "002e6ee9d0d9e7f54ead7f8981f20be210819f7a75c52e3d1e91de2fd03ada17"
hash11 = "30a02b9f75ed0112affe2c698cfdbe2ec2a5bc4d8248ac34ebe13e072bd212f0"
hash12 = "b2c5f6e5a1ebce2cb0eb54f0d28ea21ab88b07dc646376bb3fc5ce29af1615aa"
hash13 = "9cf59fc7ffd1ec7428d01db709ab365cf4dfe41d386ebb308b8bad860ff941b1"
hash14 = "523032dc97c061d21e22a215d1568aa470cd8d5f46ddb3bae63dafcde8db3687"
hash15 = "26c784fc7a8e4ee1608e66a82f1ba134972418c5968433b39f54392e7f3de0f2"
hash16 = "0b5459eb728a278a131a764184d1d333fcd3fc212087b66d9cedce792b1a2d7a"
hash17 = "619e82812300e58dd7cd06b8fbcf2f7e3f6757812cc075603c82363ab6481758"
hash18 = "fc43d54db3c24d6f7ce2d47a45ffcd0768d5cfe90e405322e477be98fe4a8170"
hash19 = "85233a675e78f03dbcaaf2a32253b0d4a36e5c5e7008041477e560a514d38729"
hash20 = "cbf2173e7b067de6ce6bf189ba38c78f3f0d97a7e6685c0191e08885badfeb3e"
hash21 = "64cdab0c251929ea414823662957bad76268a8398b0c708715609f37e7070a69"
hash22 = "8cde265a6a44d9e9f86f351959c030a86800d101b5b5ca057ac1cdc5c5a1e38d"
hash23 = "50e80269adbbca38f500219eaf7cec16f396b3d8a7c56d342b2e4839819ea598"
hash24 = "b87ae77185b5925bd9480daa9d4b74b2291cc670108bf85e0379579434ebff34"
hash25 = "843cfa29e93bfa9adfe4410735aacbf939d01a404dc3c507c0562f478b65086f"
hash26 = "30f2a7c2562ef79254c8129be50246b9c41eb24f000c8cfbd0f4f8c28b49b00f"
hash27 = "c85e7d8e5c1682f21f2d8c9a0e1f6039d583d7eda8276ca9ed3ed381fbde9a7e"
hash28 = "1641412d2cba74b5cd1b4c4619c995601c42039d472339eb7cb10d97e1d47339"
strings:
$s1 = ";})(),(function fuck(){return \"Pc\";})(),(function fuck(){return \"Ug\";})(),(function fuck(){return \"Dc\";})(),(function fuck" ascii
$s2 = "ction fuck(){return \"Za\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"XFd\";})(),(function fuck(){retur" ascii
$s3 = "on fuck(){return \"Xw\";})(),(function fuck(){return \"Za\";})(),(function fuck(){return \"Dc\";})(),(function fuck(){return \"I" ascii
$s4 = "Pu\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"Pc\";})(),(function fuck(){return \"Oh\";})(),(function " ascii
$s5 = "})(),(function fuck(){return \"Ik\";})(),(function fuck(){return \"KVh\";})(),(function fuck(){return \"Xw\";})(),(function fuck" ascii
$s6 = "){return \"Wo\";})(),(function fuck(){return \"QTc\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MBg\";}" ascii
$s7 = "n \"IPu\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"Cd\";})(),(function fuck(){return \"Xw\";})(),(func" ascii
$s8 = "(function fuck(){return \"Jg\";})(),(function fuck(){return \"IOs\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){re" ascii
$s9 = "\";})(),(function fuck(){return \"Qh\";})(),(function fuck(){return \"XFd\";})(),(function fuck(){return \"Sx\";})(),(function f" ascii
$s10 = " fuck(){return \"Cd\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MB" ascii
$s11 = "ction fuck(){return \"Nm\";})(),(function fuck(){return \"DWe\";})(),(function fuck(){return \"Fv\";})(),(function fuck(){return" ascii
$s12 = "urn \"Za\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"We\";})(),(function fuck(){return \"Na\";})(),(fu" ascii
$s13 = "ck(){return \"IPu\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"Dc\";})(),(function fuck(){return \"Mw\";" ascii
$s14 = "return \"UXf\";})(),(function fuck(){return \"Ot\";})(),(function fuck(){return \"Fv\";})(),(function fuck(){return \"Xw\";})()," ascii
$s15 = " fuck(){return \"IPu\";})(),(function fuck(){return \"Py\";})(),(function fuck(){return \"QTc\";})(),(function fuck(){return \"P" ascii
$s16 = "){return \"Ar\";})(),(function fuck(){return \"Fv\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"IPu\";})(" ascii
$s17 = "return \"Za\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"Ai\";})(),(function fuck(){return \"UXf\";})()" ascii
$s18 = "urn \"ZVi\";})(),(function fuck(){return \"Jo\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MBg\";})(),(" ascii
$s19 = "\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"YQt\";})(),(function fuck(){return \"Jg\";})(),(function " ascii
$s20 = "n fuck(){return \"MBg\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"" ascii
condition:
(uint16(0) == 0x2f0a and (8 of them)
) or (all of them)
}