_20160928_028ba9b2df13a54f37718985d5c90887_20160928_08c18b48dee5_244

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160928_028ba9b2df13a54f37718985d5c90887.js, 20160928_08c18b48dee544571d16a33242f8cd18.js, 20160928_0a4c0e38da1d62eeeb033e8b9a9d835b.js, 20160928_0af09c805589addc34efb102df2280e4.js, 20160928_0e9733c8df2dc8e0c02ee493fc5e445f.js, 20160928_1079c225bcb4d74aa690d6ff4f0ceb0e.js, 20160928_137bfca081d4d4de5ef8c32119be9a2d.js, 20160928_17676d2435c2fa0fb478e9644e803ab6.js, 20160928_18cd327c345ec4ee9f13ed4f994ecd6e.js, 20160928_18e0cfed2c36f0232de48ec930600895.js, 20160928_1a214c5e234a9dc301f1cc6f930bb798.js, 20160928_1d925767204ad6490a29d9237e3fb56a.js, 20160928_209c8898eb5334e95a72fc8623b49632.js, 20160928_2435c66b881606fb66d4593967066bd8.js, 20160928_26d9f55def9fc62ad8082c48152e2707.js, 20160928_28f03cb6296c0d501249deedacc58082.js, 20160928_2ab2eafe7043b6f4e89e96986307bd1e.js, 20160928_2ec473eeb627599be1ed03ffed445f10.js, 20160928_2f9d444bb137142cfb070735a88533ce.js, 20160928_319f7852795c68733d22f3cc9679a4f1.js, 20160928_36d8ca765a9e4aebb8a0bec34391d49e.js, 20160928_3a1d9390ad84855e30f98ab045a7c83d.js, 20160928_3af0148d488d142c39b39017f9adeb1c.js, 20160928_3d6fbe7a3ec4ef723714c3512b371d2b.js, 20160928_3dd52208c0a1caadea006e1d03285bda.js, 20160928_3ec2f210d32c889edf89683209f8d7bd.js, 20160928_40ad16c6e5847bc60721a1f2335296bc.js, 20160928_414084aaae18945be731232accf56a77.js, 20160928_41e2834f151d445eaa026524f74b3212.js, 20160928_423ead2e5bab6cdd2184f781cdf04e8c.js, 20160928_427d74a681b3774ef497273f176232dd.js, 20160928_4315029bd5460aeb37dad9bf9c9f932f.js, 20160928_43f97273b2a063a7773a8815002f661a.js, 20160928_44129177d5611afe27fa8f69462f3935.js, 20160928_4e1dc716a4cbf058dd2d5bd6bc4626b2.js, 20160928_4eff3c3f63984a1a8d72b0bc8ccab114.js, 20160928_53866024d52dd223ec8a84352cea6ca3.js, 20160928_54ce2aa020ee04e736e4bdaecbca0b1c.js, 20160928_56866d1be379fe3b50fe832354b28887.js, 20160928_56b12ed9b23f9795636246ecea25db17.js, 20160928_585006bb9c60163b490bf4726db25680.js, 20160928_5b039dbfc168747443060683d23646b4.js, 20160928_5c725ba9d1f685945c727c72f8e56842.js, 20160928_5eb2e0854194fa377c5be3b75f544043.js, 20160928_60735eaccb6401fa1adab02ee1bad0b9.js, 20160928_64970f77255c95d83b38b54a8268d9fe.js, 20160928_67d971b30d21ce5152cd38de3b2f11b4.js, 20160928_6890b7e4b201aa22b0dd67d485a8dc4c.js, 20160928_6a23771a398bcb43b4b2443905c67049.js, 20160928_6ad54e5cec770ee53f8d55c2ee6e8b2f.js, 20160928_6adf424bc36d31d5266a8be4126f45d4.js, 20160928_6f7e3ff385bb1e830a18c0c1a02a6425.js, 20160928_702d5bfe4c73d98317f4dd1e4dd5848d.js, 20160928_70522a893ac711bf9aa22f4c11d915d0.js, 20160928_79a7c8b41217021d58c12e27c9597ba6.js, 20160928_79ea60e149bc74829cc4a920fe0e8125.js, 20160928_7a8fe60163ac673ca2583ba58deca340.js, 20160928_7cb6367b6f2b0a81596434823241f5a8.js, 20160928_7da4379d6f5e18535650f5ea186d3269.js, 20160928_7f2fc60750a4b4fb8d09990e6ea56320.js, 20160928_7f5468d73522814101b0da1c828172c0.js, 20160928_801330588b8ee6b9e11268fad7a21d8a.js, 20160928_841644de07f560f7d7c78650ee8f60f5.js, 20160928_84ba2c3dfc32cee6053ffbba303dbba6.js, 20160928_8658cc425309e5df3ac932fad86a3394.js, 20160928_866fe5ec1b93e91a290a233982e14e0d.js, 20160928_88a388b962db5f8727e42c3cff7022fb.js, 20160928_8a31ffd7611326a458cf6af86e56cdbf.js, 20160928_8ecff8d0fc1387a2f6013c0f47788eed.js, 20160928_8eda09e77ba575640ba333e9e39e052b.js, 20160928_8f31653f2fee92d3716dcbdc1c9ecf93.js, 20160928_9031eb6a6ae5fedb55665aa4a4e3d794.js, 20160928_92f4cad6f0e47de2c639df406476ecae.js, 20160928_9ce03e38bfe8553edcbb64687acb5085.js, 20160928_9d3a57f5324dbf478980b1bdf4dc6258.js, 20160928_a05b1e851b5cb38326c654be698d2fd4.js, 20160928_a23fa619fd9589c22d9b06e7aaf26847.js, 20160928_a25c0b4e35d6b6a3b099097f3b8827ab.js, 20160928_a2bd8f2b97534743061a7eb6199a1421.js, 20160928_a617e165905904aaf7887f916c026420.js, 20160928_ad26fa3e8f0d8a08a286e3b4d5582576.js, 20160928_aec7e46dd1d3023dc539fdd5a87b0b2a.js, 20160928_b2670a92a8fef5420519e8062e16f86b.js, 20160928_b4ade76eb8944d22de56562be69203dd.js, 20160928_b5432f647dac112b6fba64a36c55b798.js, 20160928_b5b503d196a8c5c7cefc68b7b92168a9.js, 20160928_b66dcd6e5e39071d8c9bdb3cce52a315.js, 20160928_b895e84e330f4dd36d75a447d49e82d1.js, 20160928_b96463cbb1e78135e6edc6b8b2271ae3.js, 20160928_bf3af218e7c255aef556f224d30865af.js, 20160928_bf9c1d38df331c18a3928010e7ac7589.js, 20160928_c0eb7fd577174464181ff93b83f80ac5.js, 20160928_c28d38e301a57344dcff2e1d103f8368.js, 20160928_c32f95b2d0ebe1b6331e033f1b290a76.js, 20160928_c5013b4952af579f798f32b6d17918e2.js, 20160928_c5de3e0110cf0c3879f9bfb929e1d513.js, 20160928_c728916ab33434aed0a1f9a2bd26f435.js, 20160928_cbb981e76fa33ffac098350f0ce499c9.js, 20160928_cc49373cee2fd43643b6800ed4ed40b0.js, 20160928_d16919737cdd3e32301c26e1670f26eb.js, 20160928_d4448f7697249091dbb69cbf5f7ff8c2.js, 20160928_d7dbd303f6904f67a06fae413eff471f.js, 20160928_d8ed928929ffa486a0882cd76c775525.js, 20160928_d946ca80c9feb86e1c6a7fb71f5dd341.js, 20160928_dbcdb7a596812be8b6a708e9413c2f4d.js, 20160928_dcc91e46ca11d04eafe292dd988fd3a7.js, 20160928_e1664cbce1eb401503982584ecb810cd.js, 20160928_e18730a187028bdaa07d2f4e2066cfb2.js, 20160928_e2064c74f4b5a425529f2325fceab9b1.js, 20160928_e278157166c319e26901d10ef51f7fee.js, 20160928_e37060d73a74f8c219d0e74921cf27e4.js, 20160928_e64223676d3b358c72f16e014dd8b929.js, 20160928_e70cfd5837f0ad9adcef6d67a668f16d.js, 20160928_e8f0f635afd0b73f114fdcfd0aff783a.js, 20160928_e9806e3045b01c7576dc2bdc758fd499.js, 20160928_ee1f8cd2aba584a7631679f12f415296.js, 20160928_ef143134df49a46ddefd9470e892f300.js, 20160928_ef3658439bf270b4a867c41db1b48c24.js, 20160928_f0fb9abfea93e6945886f23785ab12d7.js, 20160928_f5838bb5aabe50237f76337b14b4d5b8.js, 20160928_f6d8ec2d544e261cecd911bf0b65cb8e.js, 20160928_fd6a5ef5e1628bfdb4445172d6a2fe71.js, 20160928_fdbb0fe6b97d2c5ad2982b9d5a407bc2.js

rule _20160928_028ba9b2df13a54f37718985d5c90887_20160928_08c18b48dee5_244 {
  meta:
    description = "datamaliciousorder - from files 20160928_028ba9b2df13a54f37718985d5c90887.js, 20160928_08c18b48dee544571d16a33242f8cd18.js, 20160928_0a4c0e38da1d62eeeb033e8b9a9d835b.js, 20160928_0af09c805589addc34efb102df2280e4.js, 20160928_0e9733c8df2dc8e0c02ee493fc5e445f.js, 20160928_1079c225bcb4d74aa690d6ff4f0ceb0e.js, 20160928_137bfca081d4d4de5ef8c32119be9a2d.js, 20160928_17676d2435c2fa0fb478e9644e803ab6.js, 20160928_18cd327c345ec4ee9f13ed4f994ecd6e.js, 20160928_18e0cfed2c36f0232de48ec930600895.js, 20160928_1a214c5e234a9dc301f1cc6f930bb798.js, 20160928_1d925767204ad6490a29d9237e3fb56a.js, 20160928_209c8898eb5334e95a72fc8623b49632.js, 20160928_2435c66b881606fb66d4593967066bd8.js, 20160928_26d9f55def9fc62ad8082c48152e2707.js, 20160928_28f03cb6296c0d501249deedacc58082.js, 20160928_2ab2eafe7043b6f4e89e96986307bd1e.js, 20160928_2ec473eeb627599be1ed03ffed445f10.js, 20160928_2f9d444bb137142cfb070735a88533ce.js, 20160928_319f7852795c68733d22f3cc9679a4f1.js, 20160928_36d8ca765a9e4aebb8a0bec34391d49e.js, 20160928_3a1d9390ad84855e30f98ab045a7c83d.js, 20160928_3af0148d488d142c39b39017f9adeb1c.js, 20160928_3d6fbe7a3ec4ef723714c3512b371d2b.js, 20160928_3dd52208c0a1caadea006e1d03285bda.js, 20160928_3ec2f210d32c889edf89683209f8d7bd.js, 20160928_40ad16c6e5847bc60721a1f2335296bc.js, 20160928_414084aaae18945be731232accf56a77.js, 20160928_41e2834f151d445eaa026524f74b3212.js, 20160928_423ead2e5bab6cdd2184f781cdf04e8c.js, 20160928_427d74a681b3774ef497273f176232dd.js, 20160928_4315029bd5460aeb37dad9bf9c9f932f.js, 20160928_43f97273b2a063a7773a8815002f661a.js, 20160928_44129177d5611afe27fa8f69462f3935.js, 20160928_4e1dc716a4cbf058dd2d5bd6bc4626b2.js, 20160928_4eff3c3f63984a1a8d72b0bc8ccab114.js, 20160928_53866024d52dd223ec8a84352cea6ca3.js, 20160928_54ce2aa020ee04e736e4bdaecbca0b1c.js, 20160928_56866d1be379fe3b50fe832354b28887.js, 20160928_56b12ed9b23f9795636246ecea25db17.js, 20160928_585006bb9c60163b490bf4726db25680.js, 20160928_5b039dbfc168747443060683d23646b4.js, 20160928_5c725ba9d1f685945c727c72f8e56842.js, 20160928_5eb2e0854194fa377c5be3b75f544043.js, 20160928_60735eaccb6401fa1adab02ee1bad0b9.js, 20160928_64970f77255c95d83b38b54a8268d9fe.js, 20160928_67d971b30d21ce5152cd38de3b2f11b4.js, 20160928_6890b7e4b201aa22b0dd67d485a8dc4c.js, 20160928_6a23771a398bcb43b4b2443905c67049.js, 20160928_6ad54e5cec770ee53f8d55c2ee6e8b2f.js, 20160928_6adf424bc36d31d5266a8be4126f45d4.js, 20160928_6f7e3ff385bb1e830a18c0c1a02a6425.js, 20160928_702d5bfe4c73d98317f4dd1e4dd5848d.js, 20160928_70522a893ac711bf9aa22f4c11d915d0.js, 20160928_79a7c8b41217021d58c12e27c9597ba6.js, 20160928_79ea60e149bc74829cc4a920fe0e8125.js, 20160928_7a8fe60163ac673ca2583ba58deca340.js, 20160928_7cb6367b6f2b0a81596434823241f5a8.js, 20160928_7da4379d6f5e18535650f5ea186d3269.js, 20160928_7f2fc60750a4b4fb8d09990e6ea56320.js, 20160928_7f5468d73522814101b0da1c828172c0.js, 20160928_801330588b8ee6b9e11268fad7a21d8a.js, 20160928_841644de07f560f7d7c78650ee8f60f5.js, 20160928_84ba2c3dfc32cee6053ffbba303dbba6.js, 20160928_8658cc425309e5df3ac932fad86a3394.js, 20160928_866fe5ec1b93e91a290a233982e14e0d.js, 20160928_88a388b962db5f8727e42c3cff7022fb.js, 20160928_8a31ffd7611326a458cf6af86e56cdbf.js, 20160928_8ecff8d0fc1387a2f6013c0f47788eed.js, 20160928_8eda09e77ba575640ba333e9e39e052b.js, 20160928_8f31653f2fee92d3716dcbdc1c9ecf93.js, 20160928_9031eb6a6ae5fedb55665aa4a4e3d794.js, 20160928_92f4cad6f0e47de2c639df406476ecae.js, 20160928_9ce03e38bfe8553edcbb64687acb5085.js, 20160928_9d3a57f5324dbf478980b1bdf4dc6258.js, 20160928_a05b1e851b5cb38326c654be698d2fd4.js, 20160928_a23fa619fd9589c22d9b06e7aaf26847.js, 20160928_a25c0b4e35d6b6a3b099097f3b8827ab.js, 20160928_a2bd8f2b97534743061a7eb6199a1421.js, 20160928_a617e165905904aaf7887f916c026420.js, 20160928_ad26fa3e8f0d8a08a286e3b4d5582576.js, 20160928_aec7e46dd1d3023dc539fdd5a87b0b2a.js, 20160928_b2670a92a8fef5420519e8062e16f86b.js, 20160928_b4ade76eb8944d22de56562be69203dd.js, 20160928_b5432f647dac112b6fba64a36c55b798.js, 20160928_b5b503d196a8c5c7cefc68b7b92168a9.js, 20160928_b66dcd6e5e39071d8c9bdb3cce52a315.js, 20160928_b895e84e330f4dd36d75a447d49e82d1.js, 20160928_b96463cbb1e78135e6edc6b8b2271ae3.js, 20160928_bf3af218e7c255aef556f224d30865af.js, 20160928_bf9c1d38df331c18a3928010e7ac7589.js, 20160928_c0eb7fd577174464181ff93b83f80ac5.js, 20160928_c28d38e301a57344dcff2e1d103f8368.js, 20160928_c32f95b2d0ebe1b6331e033f1b290a76.js, 20160928_c5013b4952af579f798f32b6d17918e2.js, 20160928_c5de3e0110cf0c3879f9bfb929e1d513.js, 20160928_c728916ab33434aed0a1f9a2bd26f435.js, 20160928_cbb981e76fa33ffac098350f0ce499c9.js, 20160928_cc49373cee2fd43643b6800ed4ed40b0.js, 20160928_d16919737cdd3e32301c26e1670f26eb.js, 20160928_d4448f7697249091dbb69cbf5f7ff8c2.js, 20160928_d7dbd303f6904f67a06fae413eff471f.js, 20160928_d8ed928929ffa486a0882cd76c775525.js, 20160928_d946ca80c9feb86e1c6a7fb71f5dd341.js, 20160928_dbcdb7a596812be8b6a708e9413c2f4d.js, 20160928_dcc91e46ca11d04eafe292dd988fd3a7.js, 20160928_e1664cbce1eb401503982584ecb810cd.js, 20160928_e18730a187028bdaa07d2f4e2066cfb2.js, 20160928_e2064c74f4b5a425529f2325fceab9b1.js, 20160928_e278157166c319e26901d10ef51f7fee.js, 20160928_e37060d73a74f8c219d0e74921cf27e4.js, 20160928_e64223676d3b358c72f16e014dd8b929.js, 20160928_e70cfd5837f0ad9adcef6d67a668f16d.js, 20160928_e8f0f635afd0b73f114fdcfd0aff783a.js, 20160928_e9806e3045b01c7576dc2bdc758fd499.js, 20160928_ee1f8cd2aba584a7631679f12f415296.js, 20160928_ef143134df49a46ddefd9470e892f300.js, 20160928_ef3658439bf270b4a867c41db1b48c24.js, 20160928_f0fb9abfea93e6945886f23785ab12d7.js, 20160928_f5838bb5aabe50237f76337b14b4d5b8.js, 20160928_f6d8ec2d544e261cecd911bf0b65cb8e.js, 20160928_fd6a5ef5e1628bfdb4445172d6a2fe71.js, 20160928_fdbb0fe6b97d2c5ad2982b9d5a407bc2.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "dfebe044ce02b580c0470c274608330bfcce0211401d4b56a5a5b67b71ed0096"
    hash2       = "235c094553132c4a7558d9d4a57152a44feef7cd11bc65f1e611861775eb5e9e"
    hash3       = "37507fbff68c6a41e2c2c4f3ea222e8bb410aca40a38ee8d9001f828d1fb7fd8"
    hash4       = "f38e30b2cd5eb28ae9e77f04b836fc116662077c32713cabc17b37085ecaec39"
    hash5       = "c0f7b88477517b716e180a89585a36106b4c0b0c37a484da57f209554699ecdf"
    hash6       = "af5120c17da2a2e2ac5bd640f828e7aaf6039cbb16965a5f177b3d45ee5707af"
    hash7       = "d7469a527871a2bd1eea78adb5f501215d64be1fd504f931976d8a2478ef8470"
    hash8       = "9c927f3f88653a2467c46d56328d5a814a0bf5a1dc61be09968b572f8ae5a497"
    hash9       = "83bdda7cb85c00f0d4fa3ef935d6de47ca2fe620b2834c3c9ab9641f4c1cda38"
    hash10      = "f0d7b45435685bc3b370dd17c645b3f93aa519326225c78d642ec8ee90b65389"
    hash11      = "e2c94e84f0ae1ba0d40854f2e1154d4135559ace9eb9f3d525f290c2141ed005"
    hash12      = "cd00c3259b46f700d7d2bb288547b5f737827cf004a69ccfc4d8a3a0a77f218a"
    hash13      = "3837450b7cdb3096ed596d693604ab5948369237c868cda63882ab37d4b01501"
    hash14      = "7d3bcd8f57a5316fa0dddc8e63fdf056234228d70ff2126992602d9d7608d5e5"
    hash15      = "e2b5a788052420329c93105fab5f87e2948b2660bfc7ba525cc88b9e768a06f6"
    hash16      = "70c76daafc0b753836531d5b8646bd94903e6552ed539171794b3eeb8f9b197b"
    hash17      = "5a6303064955f2447f315ff780bbf45d109efd6f2a7bb172ca758e3ac22a3163"
    hash18      = "a02e15dd4ac4d6d3be98e0f93f1251949dbe15436bdb05f67bea581383b75b96"
    hash19      = "6ca47988317a0819a1492e92d546c1b6fb4671b25eeb28323a7152da13d1860b"
    hash20      = "cde89531854b2c521c08d6cc57c73884af57e64e788ac6a90884cc9c5d992bbe"
    hash21      = "3447659666b93ef305caaedd75193072dd830f0455c21fae5c15a2061910c061"
    hash22      = "c6b47d2689cccf5a27a211deca30b98a0b1cd0afd9e73ac5953e9e875e9d9243"
    hash23      = "5e6a2e7d42646aa19e94b8e97c9c4b8c06c15dab61d6eb4c2f3634f2a7fa96dd"
    hash24      = "c6fc5e1db79a635f2726100e70f02c5200a0b09888eaadbb72288b3ad5056b71"
    hash25      = "22419498d90d4427b668920d085fd430f5f14e69ca5568ae85ee6701854d1c36"
    hash26      = "f9b81f616ff66ab1fa53516440c4c9aa7584bde152e0bc4defcc9a909cead4d9"
    hash27      = "ac9d0280afad9e1c32a78958631cad050f5f35e2842af20b04ee6f9bee5aab16"
    hash28      = "9bffd8974d53da3ff7fcf7231575b4b88731cb7cfe4ab88b9d635cd4ae4c904f"
    hash29      = "5e2d6e280a4a3d485bb03d8b4e832a4dc28c0f881077ed16f161535a235db867"
    hash30      = "4c0f54c960c866728a0118614a3336ce0ba884344160ff6ceaf98c9ca30d805e"
    hash31      = "2fd83311a57512f203c305e3c61015c65d10ba761770c545b2f6bf4e2162a821"
    hash32      = "65a40399e7ecbc3d78fda0592afc9031844a6b98fb89a02e2c799b6dafbe01aa"
    hash33      = "6ce298b8e20b52d73846122b8e51f39038b1371c096f604015acc095d1c46bad"
    hash34      = "f16f20fcd6c1a67f9bff31aaa05b6276834636017f90b166e300adda48e7d18c"
    hash35      = "133ab2b64c4d548419c75040c0c194e9fbde3fc312f78f34c9ab4afb39e112d8"
    hash36      = "60d2915ee01c9d655eb302d2c09496f3f381d3937ede23bbd7c4275790cd5d2a"
    hash37      = "6c0ca1c39b3acc8c045ffa674bc8eefb890165f0f518311fd9c9359ac09e1d8d"
    hash38      = "3c4251eeaf4757399ee7badec20b4f3ce0eaea8fefd80b2f9d4c9ee27ddd3538"
    hash39      = "361566c82a9ea4188e38da0378a4db8240aadc9983806ecbac41ce897ff9eb29"
    hash40      = "61e70b3d60b6395a974ebebc48e47f5ae3d664eab2ab66004dc3f68fdb71317a"
    hash41      = "a70fb95aa1586dd69ccb300d745e49c5053de4c08826a8dcb16b8445cf953141"
    hash42      = "9951bf6a96751f41cce2d40b81cd5670ec4b6f19600c44bba293dee5b1b37531"
    hash43      = "a70b3c9b6a9fadd0888b012925e6b29c011f3d1a03bee59177a39a5c7e619f94"
    hash44      = "be2f3cbb4e86e23c643c00552ef128986c839f1d6e17779dc1398fb8ffed731e"
    hash45      = "68e8c4cdf05b52c24aedfb0ca90b56c504de971b87b390109360e48f94ccfa54"
    hash46      = "7403da2b311e81ef465e1b2689b19c072dd181c5973c4c49d590780e91b45c6d"
    hash47      = "4436ae4a8c584b3eac79cfbde57fa3ce039e111873546aa764018af430ee2097"
    hash48      = "47f9880738c4250aad953ea78b46f76c19621464c679683e23af3d2c98c59e8f"
    hash49      = "c4f4508f118ed036849c268b2bf15cab60efed9f19c03099fb05883849d45a42"
    hash50      = "371aea817afcace540dd1f587db0216a4c9969bfc37bf35b645c6d767f16e783"
    hash51      = "96c07ed2e318c04a219275732d383b762ca9357a95c729261bbc22683446b454"
    hash52      = "65d8f6d3d40a295a3bd3243e3f58e1cd35a94f5ad0eb160cf5b358a2d0a213ef"
    hash53      = "7362fb1b7f6eb85509669d5e181590903c7e7eb04d872cc90cf7804631a40a32"
    hash54      = "b20f638d977620f614a37895a5bc7093379c6afa3f8fd7ff27b0bf64e50d75bd"
    hash55      = "f2d29d6ee0e4b413036e67594526f8ddb06a19c72b79afaf9d41a4fa5c716582"
    hash56      = "393057d864df6b6e5fdccae6eb263ad76ce5ad216024b3ae29e2b908d03ae299"
    hash57      = "8197fc90f61730183903dc16dd619a20ab1d5fad64d62f45319ce9a379f46129"
    hash58      = "35a9a72c9099e597431b45a49abb1b263c4bb3ccc26218d227fe2c464040b227"
    hash59      = "76c094460ebdc0e023c2f28af63b6ab2eda811be3d9b51d1c96af2bd187bcea0"
    hash60      = "3e4d96df8dc438cbd48daf65944808d1099c4a69933337d26d780d10601a5b22"
    hash61      = "075bb5798f9cd95b22519434dc3d507e9f314caac1a5e9c1cc4d78b7d467562e"
    hash62      = "f235cb76f66b4a0dc2c7a114270326e904daa354597f0a5337263f2a60e8ee11"
    hash63      = "8cb52b5e9f9ce3d3f191acd1490843a56a7db930148a45f3c5b3d5236072f6f9"
    hash64      = "aff50b2502d5225540e3d4a0d3ebcf7136a71bd431275197afb9ce1bd32659e8"
    hash65      = "0e1d830b3a781ba1bfce4697dd0fdc6b00da81d2b5b6458cfabbf846da3423af"
    hash66      = "58dece17f557eab7aa70479427d3cbaf137aba3ee0660671ecc55486bd38d1ef"
    hash67      = "4bd8e273c244ec58f5d6e05a7fef5a78bcfdf485666dd3d482973c81b82b2575"
    hash68      = "0bc05137a6d0b2e157ae0a7c9bff4fabc284b8a5786e10bc4643f7648322f65c"
    hash69      = "c085d3ef4480b6c16ef4b285991e388870f856c9ccdfcfa983a07077b327531a"
    hash70      = "d8f7f9c656aef684fb14c670404a31cc615902574269ff881cd9b68dedc758c6"
    hash71      = "8359e7b0faeb5208b6d9c7205bfb01e4a9db1766d1c90a16e09f8c1c01a0e21f"
    hash72      = "1d4fa8c66b24c5bc08dd29eed637cb78885a7f69cd7ff9e137e9e49f04d54ae9"
    hash73      = "80d5b3d7033ebfc48ea611ff57f174ad1018e6e517e3a69600a668c270e043a6"
    hash74      = "50d01ddf22e16c4d06cc933c0cf763fb6d7d9e9db5389144ddbf365d50f0f826"
    hash75      = "3e81a2b543b31d64e7c2f3ccc55ec03c3848bc850db1a2d0f8f5163f99411fe8"
    hash76      = "dc8f9d8896fc15214b84018243d6ecbad99a5e5ab804260a3426cfb0cfb253a7"
    hash77      = "7740b5f31d31bdf66eb21ced633d2bace0217fb240c0ac0599b4c9213b56101e"
    hash78      = "bf055faed7d0662cb976bd3551a18af53d5d7975b016222ec8d1e67f8e34d101"
    hash79      = "e1ec6b3c8a1f15e274bbd672fb489019bc7874b191ad945664ab68b54df3bf0a"
    hash80      = "3fb1f163c7906e7b634159d983c12c1c01d55bdb5d172428c86864bfed70117f"
    hash81      = "fea5116d61535da97dc093e41369291fa5a7392044fcd578f5ba7190d9373d93"
    hash82      = "032d04906d1a146a9de711d25a1a4466096e741e163e7f40583d62634138f2c5"
    hash83      = "565aa2f64b93f1fd598e3d0967ef5f01c6ba66055245ab767b105ca09fc37c49"
    hash84      = "1e980d25cb91f342498cd85400927bea331455f08f5f770d3c4f907aeea9e285"
    hash85      = "7e184cb2dbf21d96734eac85a35425591f2e63f4ef13fe7943fa0825fb2bfdfd"
    hash86      = "04538e079ec7a95116ec785d78ac0bfe34c1a3483665cd86723a06c154fba5d8"
    hash87      = "7e6625f7e38e9b46eaba51334847f7de452e0a7489dddc53534228810896907d"
    hash88      = "474fd0a59d34dd1d59b7f1bce0fc1f24176b0becdbf48f00306de356198ec018"
    hash89      = "2d19158ea6902fbd4b768fe541187480078fa6765bf77a94289dcc7f3502b13e"
    hash90      = "92fd640c8709e4500f1b7c22b8f4066c52bc3170f0e7550d2d41d5d4031157df"
    hash91      = "030eafcfbfb1f55d796dd05e6b420c9fc91e156b5651d51104322e7172113140"
    hash92      = "9b3f53c9aba3123e5cf7c4f0f8cb7a102a70b1cdcd54ccec303670e7a43773ec"
    hash93      = "48df7764d539eb428d57ca1719592fea60de3c94a3badb6643ac3f9af3f6c9c1"
    hash94      = "4e0f45e4ca09bbbdf5d20cae1856b13a54dac647b436040bda707e36ea9e8a37"
    hash95      = "0b0bfbb5492b478743daddbf7d7f42d0cc1736140dcec20298f226f784c34db5"
    hash96      = "98d01196de69b360333b56e40ecf196cb6c2507705653c1ac1e2c4223621b2ed"
    hash97      = "7ea34cd064599b21b741af469d3b3b1edada8f7de356361315223a057552a31d"
    hash98      = "18ac3a269adcd35f8c88aafbd48248ca38dd077bfd99976b7660404689ad4dea"
    hash99      = "42cd1e2e1a54ef2ef7386f1a8f3fd3677f14a4759811da51917d1389d01c8b01"
    hash100     = "388a4520d71e5149958bac518ae78fcb90bae845ab86bfe529810299b4c8cbff"
    hash101     = "b42b09f5f074f8d229f9c5673ea0bc39a4817bf37b887a805e4ee9dc0f473568"
    hash102     = "b0eb4bd64af3ce2694475aca19e992e7adc80067d96f3a9584b2a11e4e7e272d"
    hash103     = "0d8e5bc5139c9205ced77f01d8e6397d68567c1c7e19c86a3f427282ff6b4159"
    hash104     = "6b0e1ba2e4a6eaf4de82eb3c5b7db80dd93cc9ef56da01d1bb885de5cdd0574d"
    hash105     = "0ab763507cce1170a48b326d1ff4987290669607109b950cdf91ff2bed73ca05"
    hash106     = "dc03b431d057c3fd0be42f83d9173d62feecfd396081ffdde6816bbc8f6edbda"
    hash107     = "7f2298cb1c64cca03765853b14124c0b3dbb402e3fa4f012cfdea0b7cd18742c"
    hash108     = "228bc03b1f6342d1baa933de3786b8943b20b976ef6b794ec9c9258cdfd0d9de"
    hash109     = "75bf17f25c483d44c7a51e7e38fe2803254a21157cf25347a813170650537ca6"
    hash110     = "f5d3420bd6f9dada62209d1293dc7e3f1493a8e30d2565394a0807bc0eb61448"
    hash111     = "6e8cc5cd2d9ea9cbcebdc9eba42ac36e7c95423ced62d68980e070b779d18919"
    hash112     = "8ba4739249fd235547cfcadc13d69c89c7ae281288fb81ec40a31bb191c91a87"
    hash113     = "10d8c2f7656afdc49e851cdaa6fd69ace37906167d5d379fa629d0ef26a9c121"
    hash114     = "12c7e0c31477ec0c9dbb2892f5b33368efb02d7e95c8cf298a9b1202998dc516"
    hash115     = "0afdae16e598a96008d24ceb1baeb2ed9beaa14c0f59f744b0b2bb8b8c81e662"
    hash116     = "6bdf47d8256a9f09c2c7cb050137a6edcf76d599e8e09a025ad78f3d4e84fcea"
    hash117     = "f38ede093eb0e17d78c5e7d4538ef0e4e48c50f8bb4735d2c582ffb8a4f4a2ae"
    hash118     = "0dd9f4fceb412d13f3a085257a63b32e395239a283be6989157f0dba7411a177"
    hash119     = "3230e6350bbbeb6fc22e8c4bf07b3d414fd16a8ae67a4bc377c01e2d52d15a79"
    hash120     = "dad859506ec8e6af25b0344ed8389f56d04d5ce067dabffcba31e46fc3fd481e"
    hash121     = "466a4aa94cb5e366c2e323ea177118ce20f56ba736feb0bab70edb8e15bc4b1e"
    hash122     = "98d3417568e89e6f8c2ca60b959328f040dc19bbaa118b2f5b38c0d802487060"
    hash123     = "4b1c6f5bb88e5ee8a4f76e16831e214b31e32037c16ae2d57bf6a2f634966795"

  strings:
    $s1  = "var siarik = new Function(\"pechenFROG2_a5,pechenFROG2HORDA5\", 'return pechenFROG2_bChosteck.velMRADXHO() + pechenFROG2_a5[pech" ascii
    $s2  = "var siarik = new Function(\"pechenFROG2_a5,pechenFROG2HORDA5\", 'return pechenFROG2_bChosteck.velMRADXHO() + pechenFROG2_a5[pech" ascii
    $s3  = "pechenFROG2rampart[pechenFROG2promises + \"\"]((pechenFROG2StrokaParam2,\"ru\") +\"\"+pechenFROG2ddsSSddSd,0,false);" fullword ascii
    $s4  = "if ((!pechenFROG2check || !object[pechenFROG2property]) && typeof object.prototype[pechenFROG2property] == 'function') object[pe" ascii
    $s5  = "pechenFROG2undefilled.angle = function(pechenFROG2p) {" fullword ascii
    $s6  = "pechenFROG2undefilled.dEDWWEE = function(){" fullword ascii
    $s7  = "pechenFROG2Native.pechenFROG2genericize = function(object, pechenFROG2property, pechenFROG2check){" fullword ascii
    $s8  = "pechenFROG2Native.pechenFROG2typize = function(object, pechenFROG2family){" fullword ascii
    $s9  = "pechenFROG2undefilled.pechenFROG2sameOrN = function(pechenFROG2param1, pechenFROG2param2) {" fullword ascii
    $s10 = "if ((!pechenFROG2check || !object[pechenFROG2property]) && typeof object.prototype[pechenFROG2property] == 'function') object[pe" ascii
    $s11 = "        } while (pechenFROG2XCOP < pechenFROG2len && pechenFROG2c4 == -1);" fullword ascii
    $s12 = "        } while (pechenFROG2XCOP < pechenFROG2len && pechenFROG2ddDccC1 == -1);" fullword ascii
    $s13 = "        } while (pechenFROG2XCOP < pechenFROG2len && pechenFROG2c3 == -1);" fullword ascii
    $s14 = "function pechenFROG2_bCho(T, D, C) {" fullword ascii
    $s15 = "function pechenFROGzapadniy2 (velSUyaWON) {" fullword ascii
    $s16 = "function pechenFROG_OOO_OOO(TT){" fullword ascii
    $s17 = "var pechenFROG2pechenka= this[\"replace\"](/STORD/g, '');" fullword ascii
    $s18 = "function pechenFROG2_a2(pechenFROG2gutter, pechenFROG2StrokaParam2) {" fullword ascii
    $s19 = "if(pechenFROG2FrankSinatraLaa < 29999)return false;" fullword ascii
    $s20 = "chenFROG2property] = function(){" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

008cd12d-1aa4-4d95-ae18-c999e2ef52d2

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion