_20160922_01be8d257ec03872b98b184d66a991f5_20160922_021cb5a68184_262

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160922_01be8d257ec03872b98b184d66a991f5.js, 20160922_021cb5a681847ffed39127ed31913d6d.js, 20160922_024fb267329b15770e32f94a8c649080.js, 20160922_051797dcc75adfefb12c2cefbdb76c69.js, 20160922_0626d295df8cce2f4f1edfc15cadd12a.js, 20160922_0985122b6baae982ae9a5d4efdaad52a.js, 20160922_09d1ae35a2f90fc40eedc585ed9f5a65.js, 20160922_0bb94010b5d2933bfb158dc7875c1276.js, 20160922_0e4311af3a24f1a2353d30063e35c9e2.js, 20160922_0e4bc875940e3b337e0291811c57b43b.js, 20160922_0ecec056f13bc2fd244c94f8f0dc4e6a.js, 20160922_0f790aa23d22d861dff8d73a9a964297.js, 20160922_1192b153c4ea08602f2c361480ae2594.js, 20160922_13779177c99a60dd1cc3ac68b847d3bf.js, 20160922_145e0fcb8e26f7ded900d271bcd8cb6e.js, 20160922_14b433e817cfa8db1bcb55f9fd39f2db.js, 20160922_155ad3237b433913d5edde92ebd8b5bf.js, 20160922_1bfefe602afe77ddf83b80caebefe4a0.js, 20160922_1cb0f2cc62347a31e1b4f12e85234835.js, 20160922_22d170dd47aa06882b5998b2f4f085b8.js, 20160922_22fc0ecd208473d9950dc6961a75e911.js, 20160922_232a3ccdd8325c19bd6ab9ec93519fd1.js, 20160922_23db96cd7ba0480ac51f87e2ddf468f3.js, 20160922_23dc4e018800673e1e64aa2b520c89de.js, 20160922_24b4ed68d7bdc6c3db6c11bf26991cb5.js, 20160922_2638f4e1f5c19e34516267e95dae2ad7.js, 20160922_286f26c9bcc557df7b0558d7f710540c.js, 20160922_29e08863529c2914a1ee95fd81ea9549.js, 20160922_2af29673290dd43aec78b16ed5ed4f63.js, 20160922_2b6df170d89b16d63405232ca40cb98e.js, 20160922_2b751915d60054837e2f224fa960d700.js, 20160922_2d6b0ef7fd261a255b1ebeac3c960c68.js, 20160922_2fa417d4bb6c887029ab7372fb0da9b4.js, 20160922_351f4922fec84c41114ad48e6d1cb421.js, 20160922_38e5c317076fba392cc35cbb3a92cdca.js, 20160922_3a2d6826fcd373ef868c45b326a30be9.js, 20160922_3ae658b4a38c7635403b7128c0ebe964.js, 20160922_3bc6206da3a4144142df9effe6815972.js, 20160922_3cbb5a2fe81fbfa256bd126f0e1002e2.js, 20160922_3dc7ec909a36f1a103cd8a4caafc1028.js, 20160922_3e1bf4687b591e50be3ecb5395255dc4.js, 20160922_3eefaf0f5994d05da866f0435847b11d.js, 20160922_40b65c9bd909294d4208e4c9dfb33b1a.js, 20160922_42583b08a39a65d81f3323240a0238a0.js, 20160922_43ea922d3ba932498b2ee9f29d6bdf2e.js, 20160922_45e32c067283b2863e6b5b08de3c4be3.js, 20160922_462cf86c4dc509ee23c5a9c3e4de61f8.js, 20160922_48a9ef7e787e18ea7fe086259cfe70e3.js, 20160922_4a7333c0b80c6a11ad7f68348cdf965a.js, 20160922_4bc95592622c36ac2cc5c2cc6f9309a4.js, 20160922_4d6130ad832d4f8bbf08cfbe50321353.js, 20160922_4df3dad11e8d20b8fd8434bd3f96b3f7.js, 20160922_4eaf8c5a89b6f1b4b30acabc85581b44.js, 20160922_51df3a9257d95c7c0c2c3285df61b39e.js, 20160922_585fd49b6ccfd2fe8e6aeeeff4fb4d11.js, 20160922_59c95a6486a6fe63520d1df8128b6295.js, 20160922_5b4b43c8286034c02e46a261ddd3ce29.js, 20160922_5dcc511525932dac89205b9092a92b55.js, 20160922_5ea3a06f5b8e954f607b7fbedef1e5e7.js, 20160922_5f3278e16c6c26074f45ab2fabc9add9.js, 20160922_60dced26b3ffef3282af9ab9a3b817d5.js, 20160922_648f73e5c21d9fec104c07a2c4cf7c71.js, 20160922_65ab9f1011605abaf703c99435bd2864.js, 20160922_67463b32c54b26f46a6d73e149052ead.js, 20160922_689afe0e9450b2c02cd672f75a8da365.js, 20160922_69086b8a66fdb491cc77717b19537d6b.js, 20160922_6b475f93d0cede05dd8527523ef82a8f.js, 20160922_6c89a4de7d182e8602e1cc3380c09269.js, 20160922_70298baa4bfae53a58f36a7e7b7a6f04.js, 20160922_713e23cef7ce1369f6e0f59be2111bf9.js, 20160922_71424776bf6376a79e575f63db38c1b8.js, 20160922_7488dda3351d07d0fdcddcc010c6427b.js, 20160922_74a5b423dda256bae939b91d3ed560e4.js, 20160922_75d42f326d7c1c5e33094ac30984d6a8.js, 20160922_773ab076044911f9895ec851d204259f.js, 20160922_783e550ac074f5ebd899b13920d7b9cb.js, 20160922_7854df4b673546acc25bfc3766a6bfe9.js, 20160922_7ae0ea696eac27b297fdf379500bd976.js, 20160922_7c212e3c70039d7282597ee5c41c884f.js, 20160922_7d606fa4f5340cd1400c135a1a4326ea.js, 20160922_7f6ef2f2fe8461de2f8f1f0f3ec642db.js, 20160922_82335ed567d45d9b92e44d0f08fb52b4.js, 20160922_823fe254cb8b96968bb595ac529593c9.js, 20160922_8565554f89d35b77dcb50dc626017bac.js, 20160922_86205c227852218f57710b52ca833a54.js, 20160922_86ee14dad749f8f311fcf89dfb690e4b.js, 20160922_8acaaaa57d5d9b5b9aa0f5969866c7f2.js, 20160922_8aef8bc984dedf6f2d76ad382d2ceb03.js, 20160922_8d1766266d466ed3a44208b35c0b56e8.js, 20160922_8d5c87199748dd22e9945e0d3efd6ddb.js, 20160922_916e619934e371492252c7156e5ee8f2.js, 20160922_924c474c0cdee81712cf027548a43965.js, 20160922_9380e723cbb232dea9805273907e1510.js, 20160922_938598ac4ccc982e6378cc55b524365c.js, 20160922_968d3fcbf952817dd5c963cd718be6d5.js, 20160922_985261f562301d9829bf0133b4080573.js, 20160922_985fedaf205205faa51a69ce0757410a.js, 20160922_986dafb26a10301590aa8d4a7578a430.js, 20160922_98bc9b3f7964089bf923ca5f4a673183.js, 20160922_98fe3a1253f8b17ce5e76cbc681534ed.js, 20160922_9a96003679d2de659a8175b6857f729f.js, 20160922_9a9eb8daa18a80e2b2fa2c79c9a18860.js, 20160922_9c2f065405d7ffa5d1069cfb0f87f5ef.js, 20160922_9df3f5800e345439f7277387c7605f1f.js, 20160922_9f4b7a04964c6aa0ec7074ef22d81d9f.js, 20160922_9f5d6f86de05c2d6c6e43644f9ef6c35.js, 20160922_a18649790c7366eb9f1d665d835cba3a.js, 20160922_aa27a5ebfd43b337d926f8e630b2e614.js, 20160922_aa7a2ebfa888c29417f90ada99ec7788.js, 20160922_ab2595f12489166a6ff4624e857d8de5.js, 20160922_ab7127f7c7a127d2c89c2da163e2f9a2.js, 20160922_aedb078e3fba2f70f4a36691ceeaa91f.js, 20160922_aeef0e83c686945bb1265a2fa17cf30f.js, 20160922_b01c072f4bf721cdc36ae3707191a9be.js, 20160922_b0eabb840c998fc94d017a16babdc3b8.js, 20160922_b238a727ce06fae1ec171a42b5031147.js, 20160922_b3a49ed923fe7bd3c3c41311d8449d38.js, 20160922_b3d40359a8d87351dfe016dccc323280.js, 20160922_b9f35239854259dc6d0c9b5a48b826b5.js, 20160922_bcbcd4fbe35f3c1cd3992841bdee5a7a.js, 20160922_c0399d7471fc4e3845454b5e4e97ca32.js, 20160922_c3fdd2acaf1a4c5c35f237dbf2f878a3.js, 20160922_c758799c8556202f2407aacd290a8dc8.js, 20160922_c7e496d86389332128460da17b037ff9.js, 20160922_c911c8e10549ab11eef6e39cc42591d4.js, 20160922_c952e20d71b68b1e553d957dbb6af767.js, 20160922_cbfcc34df49db793edba2240316101a5.js, 20160922_ccc6dc58ee748a4a4cde77cb218e0bd2.js, 20160922_cedf8e830eac1511e412504e3f798ac1.js, 20160922_d2bc9f7ae01bcba8c19a42c240a9c635.js, 20160922_d398d0a0de387a6fafc360b0e732e8a7.js, 20160922_d73d8eaecc0a6ef3a197d25f87b69d31.js, 20160922_d7d86be212a4310397957c11a9f5f30b.js, 20160922_d987d05fe9c6227542bf002b06f0aa5a.js, 20160922_e198d86e57594bfbc1ae208214bdce11.js, 20160922_e265c12f9268e8ca40a751b9a72f4de6.js, 20160922_e3de91dd691ebf69d9df5ea9d4e98a91.js, 20160922_e51fb24cadddf1943d9245c16ed1f13c.js, 20160922_e60d4aca44544b838685d484021f4f21.js, 20160922_e662d8672cceefd1c78911c3da391826.js, 20160922_e6707aaa14fa78261510e4967404a474.js, 20160922_e8f4b90882d97adf308edbd58650415c.js, 20160922_ea5c061bd2664e84720637bfcb048afd.js, 20160922_ed1f05bef78929369b0f0a6c228938e9.js, 20160922_ee201e3ea49baeb2d21cd4546bafacb8.js, 20160922_f0294e5b9743c9fe7e26171b696cd5d2.js, 20160922_f257477bd139b4100f46c1d657603bb3.js, 20160922_f37f672b682f3b32b8bce7c7e69ce9f5.js, 20160922_f4621d35038666a84cb45339c835f1fd.js, 20160922_f57d2784a821efd73b4470ec71c9bc87.js, 20160922_f6d8281dc03283c25b53cfb228fd67e3.js, 20160922_fb0429eae6f5cb386f9b7d08b48d9ed7.js, 20160922_fd61c7170f4f223f11632360e611c00b.js, 20160922_fd7f4752b09e58ee2701e2804531d55a.js

rule _20160922_01be8d257ec03872b98b184d66a991f5_20160922_021cb5a68184_262 {
  meta:
    description = "datamaliciousorder - from files 20160922_01be8d257ec03872b98b184d66a991f5.js, 20160922_021cb5a681847ffed39127ed31913d6d.js, 20160922_024fb267329b15770e32f94a8c649080.js, 20160922_051797dcc75adfefb12c2cefbdb76c69.js, 20160922_0626d295df8cce2f4f1edfc15cadd12a.js, 20160922_0985122b6baae982ae9a5d4efdaad52a.js, 20160922_09d1ae35a2f90fc40eedc585ed9f5a65.js, 20160922_0bb94010b5d2933bfb158dc7875c1276.js, 20160922_0e4311af3a24f1a2353d30063e35c9e2.js, 20160922_0e4bc875940e3b337e0291811c57b43b.js, 20160922_0ecec056f13bc2fd244c94f8f0dc4e6a.js, 20160922_0f790aa23d22d861dff8d73a9a964297.js, 20160922_1192b153c4ea08602f2c361480ae2594.js, 20160922_13779177c99a60dd1cc3ac68b847d3bf.js, 20160922_145e0fcb8e26f7ded900d271bcd8cb6e.js, 20160922_14b433e817cfa8db1bcb55f9fd39f2db.js, 20160922_155ad3237b433913d5edde92ebd8b5bf.js, 20160922_1bfefe602afe77ddf83b80caebefe4a0.js, 20160922_1cb0f2cc62347a31e1b4f12e85234835.js, 20160922_22d170dd47aa06882b5998b2f4f085b8.js, 20160922_22fc0ecd208473d9950dc6961a75e911.js, 20160922_232a3ccdd8325c19bd6ab9ec93519fd1.js, 20160922_23db96cd7ba0480ac51f87e2ddf468f3.js, 20160922_23dc4e018800673e1e64aa2b520c89de.js, 20160922_24b4ed68d7bdc6c3db6c11bf26991cb5.js, 20160922_2638f4e1f5c19e34516267e95dae2ad7.js, 20160922_286f26c9bcc557df7b0558d7f710540c.js, 20160922_29e08863529c2914a1ee95fd81ea9549.js, 20160922_2af29673290dd43aec78b16ed5ed4f63.js, 20160922_2b6df170d89b16d63405232ca40cb98e.js, 20160922_2b751915d60054837e2f224fa960d700.js, 20160922_2d6b0ef7fd261a255b1ebeac3c960c68.js, 20160922_2fa417d4bb6c887029ab7372fb0da9b4.js, 20160922_351f4922fec84c41114ad48e6d1cb421.js, 20160922_38e5c317076fba392cc35cbb3a92cdca.js, 20160922_3a2d6826fcd373ef868c45b326a30be9.js, 20160922_3ae658b4a38c7635403b7128c0ebe964.js, 20160922_3bc6206da3a4144142df9effe6815972.js, 20160922_3cbb5a2fe81fbfa256bd126f0e1002e2.js, 20160922_3dc7ec909a36f1a103cd8a4caafc1028.js, 20160922_3e1bf4687b591e50be3ecb5395255dc4.js, 20160922_3eefaf0f5994d05da866f0435847b11d.js, 20160922_40b65c9bd909294d4208e4c9dfb33b1a.js, 20160922_42583b08a39a65d81f3323240a0238a0.js, 20160922_43ea922d3ba932498b2ee9f29d6bdf2e.js, 20160922_45e32c067283b2863e6b5b08de3c4be3.js, 20160922_462cf86c4dc509ee23c5a9c3e4de61f8.js, 20160922_48a9ef7e787e18ea7fe086259cfe70e3.js, 20160922_4a7333c0b80c6a11ad7f68348cdf965a.js, 20160922_4bc95592622c36ac2cc5c2cc6f9309a4.js, 20160922_4d6130ad832d4f8bbf08cfbe50321353.js, 20160922_4df3dad11e8d20b8fd8434bd3f96b3f7.js, 20160922_4eaf8c5a89b6f1b4b30acabc85581b44.js, 20160922_51df3a9257d95c7c0c2c3285df61b39e.js, 20160922_585fd49b6ccfd2fe8e6aeeeff4fb4d11.js, 20160922_59c95a6486a6fe63520d1df8128b6295.js, 20160922_5b4b43c8286034c02e46a261ddd3ce29.js, 20160922_5dcc511525932dac89205b9092a92b55.js, 20160922_5ea3a06f5b8e954f607b7fbedef1e5e7.js, 20160922_5f3278e16c6c26074f45ab2fabc9add9.js, 20160922_60dced26b3ffef3282af9ab9a3b817d5.js, 20160922_648f73e5c21d9fec104c07a2c4cf7c71.js, 20160922_65ab9f1011605abaf703c99435bd2864.js, 20160922_67463b32c54b26f46a6d73e149052ead.js, 20160922_689afe0e9450b2c02cd672f75a8da365.js, 20160922_69086b8a66fdb491cc77717b19537d6b.js, 20160922_6b475f93d0cede05dd8527523ef82a8f.js, 20160922_6c89a4de7d182e8602e1cc3380c09269.js, 20160922_70298baa4bfae53a58f36a7e7b7a6f04.js, 20160922_713e23cef7ce1369f6e0f59be2111bf9.js, 20160922_71424776bf6376a79e575f63db38c1b8.js, 20160922_7488dda3351d07d0fdcddcc010c6427b.js, 20160922_74a5b423dda256bae939b91d3ed560e4.js, 20160922_75d42f326d7c1c5e33094ac30984d6a8.js, 20160922_773ab076044911f9895ec851d204259f.js, 20160922_783e550ac074f5ebd899b13920d7b9cb.js, 20160922_7854df4b673546acc25bfc3766a6bfe9.js, 20160922_7ae0ea696eac27b297fdf379500bd976.js, 20160922_7c212e3c70039d7282597ee5c41c884f.js, 20160922_7d606fa4f5340cd1400c135a1a4326ea.js, 20160922_7f6ef2f2fe8461de2f8f1f0f3ec642db.js, 20160922_82335ed567d45d9b92e44d0f08fb52b4.js, 20160922_823fe254cb8b96968bb595ac529593c9.js, 20160922_8565554f89d35b77dcb50dc626017bac.js, 20160922_86205c227852218f57710b52ca833a54.js, 20160922_86ee14dad749f8f311fcf89dfb690e4b.js, 20160922_8acaaaa57d5d9b5b9aa0f5969866c7f2.js, 20160922_8aef8bc984dedf6f2d76ad382d2ceb03.js, 20160922_8d1766266d466ed3a44208b35c0b56e8.js, 20160922_8d5c87199748dd22e9945e0d3efd6ddb.js, 20160922_916e619934e371492252c7156e5ee8f2.js, 20160922_924c474c0cdee81712cf027548a43965.js, 20160922_9380e723cbb232dea9805273907e1510.js, 20160922_938598ac4ccc982e6378cc55b524365c.js, 20160922_968d3fcbf952817dd5c963cd718be6d5.js, 20160922_985261f562301d9829bf0133b4080573.js, 20160922_985fedaf205205faa51a69ce0757410a.js, 20160922_986dafb26a10301590aa8d4a7578a430.js, 20160922_98bc9b3f7964089bf923ca5f4a673183.js, 20160922_98fe3a1253f8b17ce5e76cbc681534ed.js, 20160922_9a96003679d2de659a8175b6857f729f.js, 20160922_9a9eb8daa18a80e2b2fa2c79c9a18860.js, 20160922_9c2f065405d7ffa5d1069cfb0f87f5ef.js, 20160922_9df3f5800e345439f7277387c7605f1f.js, 20160922_9f4b7a04964c6aa0ec7074ef22d81d9f.js, 20160922_9f5d6f86de05c2d6c6e43644f9ef6c35.js, 20160922_a18649790c7366eb9f1d665d835cba3a.js, 20160922_aa27a5ebfd43b337d926f8e630b2e614.js, 20160922_aa7a2ebfa888c29417f90ada99ec7788.js, 20160922_ab2595f12489166a6ff4624e857d8de5.js, 20160922_ab7127f7c7a127d2c89c2da163e2f9a2.js, 20160922_aedb078e3fba2f70f4a36691ceeaa91f.js, 20160922_aeef0e83c686945bb1265a2fa17cf30f.js, 20160922_b01c072f4bf721cdc36ae3707191a9be.js, 20160922_b0eabb840c998fc94d017a16babdc3b8.js, 20160922_b238a727ce06fae1ec171a42b5031147.js, 20160922_b3a49ed923fe7bd3c3c41311d8449d38.js, 20160922_b3d40359a8d87351dfe016dccc323280.js, 20160922_b9f35239854259dc6d0c9b5a48b826b5.js, 20160922_bcbcd4fbe35f3c1cd3992841bdee5a7a.js, 20160922_c0399d7471fc4e3845454b5e4e97ca32.js, 20160922_c3fdd2acaf1a4c5c35f237dbf2f878a3.js, 20160922_c758799c8556202f2407aacd290a8dc8.js, 20160922_c7e496d86389332128460da17b037ff9.js, 20160922_c911c8e10549ab11eef6e39cc42591d4.js, 20160922_c952e20d71b68b1e553d957dbb6af767.js, 20160922_cbfcc34df49db793edba2240316101a5.js, 20160922_ccc6dc58ee748a4a4cde77cb218e0bd2.js, 20160922_cedf8e830eac1511e412504e3f798ac1.js, 20160922_d2bc9f7ae01bcba8c19a42c240a9c635.js, 20160922_d398d0a0de387a6fafc360b0e732e8a7.js, 20160922_d73d8eaecc0a6ef3a197d25f87b69d31.js, 20160922_d7d86be212a4310397957c11a9f5f30b.js, 20160922_d987d05fe9c6227542bf002b06f0aa5a.js, 20160922_e198d86e57594bfbc1ae208214bdce11.js, 20160922_e265c12f9268e8ca40a751b9a72f4de6.js, 20160922_e3de91dd691ebf69d9df5ea9d4e98a91.js, 20160922_e51fb24cadddf1943d9245c16ed1f13c.js, 20160922_e60d4aca44544b838685d484021f4f21.js, 20160922_e662d8672cceefd1c78911c3da391826.js, 20160922_e6707aaa14fa78261510e4967404a474.js, 20160922_e8f4b90882d97adf308edbd58650415c.js, 20160922_ea5c061bd2664e84720637bfcb048afd.js, 20160922_ed1f05bef78929369b0f0a6c228938e9.js, 20160922_ee201e3ea49baeb2d21cd4546bafacb8.js, 20160922_f0294e5b9743c9fe7e26171b696cd5d2.js, 20160922_f257477bd139b4100f46c1d657603bb3.js, 20160922_f37f672b682f3b32b8bce7c7e69ce9f5.js, 20160922_f4621d35038666a84cb45339c835f1fd.js, 20160922_f57d2784a821efd73b4470ec71c9bc87.js, 20160922_f6d8281dc03283c25b53cfb228fd67e3.js, 20160922_fb0429eae6f5cb386f9b7d08b48d9ed7.js, 20160922_fd61c7170f4f223f11632360e611c00b.js, 20160922_fd7f4752b09e58ee2701e2804531d55a.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "cf8ac8841f560aef7e40808a1059b8af1a9c50ca539483e50099e43f5f3d18a7"
    hash2       = "7e4e7b8a072b522b037123d6020cc9057a967ea8e98962886cf364f50649d0b4"
    hash3       = "15a611cf03e4dafabaaea68b63fde21b0db446f2fbd4005bfb6586383174a218"
    hash4       = "d3a13cd3a1ef192021005e4f1731e41046f67781217740a6cd24b393dd0acd3f"
    hash5       = "3472c5053414234f75fdde5fd05293ee6f90ead59b5ad8ffd0d4ae6a3a14d5a5"
    hash6       = "0a3729621a7bfbec0c67f375eb8212cc97b45d5591f5d6a0ed2b630882dcd477"
    hash7       = "7344ccf67edd8bfa5657b297cad4fbac997fa69ecc5afd7f8bbf79757ced469e"
    hash8       = "1fc3bfdea8b8b8d9da4bd8821aebda1f20faba7584da8204d29ea5fde0b8f2f4"
    hash9       = "b324a84f6976deea607071380d0300b621e36171664f1b2252137b3be7913198"
    hash10      = "87552fd9be9f766bf740c1950a85b98aa03005b971d4e29f08ec723a3d82b320"
    hash11      = "d9f4ff62536e38f0b5dfc6ea3cef6b192fccd9d44dce613f919ce360c1bdbec8"
    hash12      = "ce4d0fefe61ccb142aa20fe7196b62e901e7e7733f9788ffc64060ec3ed4a448"
    hash13      = "c23a59e55f486a842bf59bbd58532985c790eb72d3207aef595fa0cd3712cf5a"
    hash14      = "85e3f8120fb60ec4f21b02c0cc63b5bdb9f58d948f5afc63fb47843a85dd6655"
    hash15      = "d6d738072f736edf2d5ffe2f4048f6e6c402fda1d2d1e73c496f5259881061ce"
    hash16      = "f4d9fbc9cc57fee9daadf602110d63f6a3ee27460d688f779b4c37b6105323c1"
    hash17      = "26e459448a6bc6d58f3e8c476b7561e54750af5d15f09727c083391bc0baf5ea"
    hash18      = "465b339352e2ac1cc7eb8e0f1e822b3f596389f658a99d5ae6514a023dbe2cf0"
    hash19      = "3270476b0414046b671a90a01b9b90841acf3b1bc5ed8b6a61a8d968d14a4922"
    hash20      = "a717e70bb1f6a1816267f6ea5c3604e2218303d55b5364704974622ab1564886"
    hash21      = "3ce3b14295a7218cd38635f8d1c4ef527aee4c520ed64f15695892bd1909960d"
    hash22      = "8316479513ad3ec926ea156b0096187a6c1beee094f2f8a266797eccf68bee48"
    hash23      = "daa21caeff9cad8c1786d38c02117924aa5b45c7d97f2a620694d53704e4b190"
    hash24      = "241aba75afe93ae612b4e9cb4b880803ce68690c3cb63949e19220eec11c823b"
    hash25      = "ca0ecaadd47e9be263bde01f52777e592062fd95f875521187cb54d3fa41cb1c"
    hash26      = "c25f16182e84d9202d7bf529864f5fdc582d67ebe206b761a24d79db8bc6fb46"
    hash27      = "234b2c9a6f6ee561111d9d382b4f3df33692ae749007fd37543cfb29362b613c"
    hash28      = "55afaf8549dc6a49cff2b8c8d8913ebb337d973b5b71c2202b55d389dfa93cda"
    hash29      = "264550bce2b7691ffe3624e10212ac4d5cc02253a3c32e7582f8c7764c3a1155"
    hash30      = "45ddacb2ea8fda450b7729eebdd78f7b35a8f2317bfb0fc146fbd70f5e9162fd"
    hash31      = "6d7b2ae8bccb0200b433b7adc4fbc37ecd29dde17db152f35b1e70b28425788c"
    hash32      = "cafb111d444dded75559388197aef79d742f232da16ca54f3f955ec824629012"
    hash33      = "4a0f14ca0124e45a4d876f8d29ecb9dba517adb565eda3a2ab7a2023051d065d"
    hash34      = "05fde56479ac662df43ee0abb273629fe624ef582467f6e37dc46c5aebf971ae"
    hash35      = "6848117ac216f9650446c59c7dc2fdc347b9642dbcc1b8033dec27b85a8da1fc"
    hash36      = "3f5036247a19e19ca29f54a1d4d605b21f81bc360865640716db8c9c86a15084"
    hash37      = "357ab51979ff9a713c1cb7404ac966e4f7427a28f41104bc490be321b03213ab"
    hash38      = "f25e58c43ad01a02da84cfa8220173d4ba259d4f50b7fba8900f16df2f48e96d"
    hash39      = "5c44ddeef39558dd801d71534b61f11955c615f94e052c3d42cfb0b5dd68de07"
    hash40      = "2a62873a2fbb8b5b9704cffce3dc33b28a51eb3b220a022374e250fe682b36fc"
    hash41      = "4476f318980661ac2a37ed8bde67cbff5efb1d193d93486694449bd8220426d8"
    hash42      = "391804cc07092ac44bb5ac119837f5f7f37d901f11b64580e8b5f40cc2e76876"
    hash43      = "49ec6f00e2f1657b309356370eecc36992b9b69ef26c6e1377ff8a9e6e3e40f0"
    hash44      = "ade21fbcf071e121c6b09b961abfa21f58a65eb2a4fa89f49e1c4e049ae37dd2"
    hash45      = "9e647e6e745445b9d63a2bf5dfb132b57a24c220499a15848758284917c19ba9"
    hash46      = "928e0569e1d1dc576070aebd2767578bf6c9beeba03985fde255774a962077e6"
    hash47      = "6bd2b3cdc9ff2496b15c5422cf5f08d43dd3ab258f93d534f8c0682023abc71a"
    hash48      = "fb8668427e020bac85542b5833a336d9990bfb9c9de4d31aa927fe8f95f810c6"
    hash49      = "fffd8a09dae4a318528eecc2609df8b9b8c0cac16693bbffc3980fa7400f2948"
    hash50      = "af9188655a5d0884e638fab300e7635afc11c75f1b4c8beeeb9a2bceaf5f362d"
    hash51      = "7e46105fa94eba01aab260555f358254e10aec7024c62e13e23bcd5b82cc2084"
    hash52      = "626fa8c822c468beded692a830257046595cdf4d3e143090ffcb130c770e811b"
    hash53      = "376195641ebd68f046baac177e87146b25136503c65bd223a0f8c78d48ff3be8"
    hash54      = "e4e4ba343ab9cf7c847a49c85e0355bef5ec0ef51767fe88885841d1fea741ef"
    hash55      = "ecc138625a7dee243e8cb7d822d0fb8d0ce80730f6587bc8875e531e8089ea11"
    hash56      = "8b4570dda0f522dd3ad04ca64df488f751522a838d526cb5c6fae96241131a44"
    hash57      = "0c420f4a174bc74b4334e9bb9edf07f5a10b3b8c62ab02a49c6775457ba2af22"
    hash58      = "f6fb38375bf27a45dcf2facc419f924e364e37c8608159739be79595f3c5e19e"
    hash59      = "c50953814647d70dc0161c358586b442edeb049d8ec628b406659f1f88af58f3"
    hash60      = "ceebc72bd2a9c582e6d8c6c7049702ed48bf47bf758d62e7d6e2b8198c94d107"
    hash61      = "5ea191f63ff605f6a3e4503a8773a74de3b85f926c3f34245e53ef9d0b03ea5c"
    hash62      = "cb9050cac6fe4d058bf920c9fa133eebe8416b16d30f07ad2c4da50e1cfcd3f7"
    hash63      = "f8097408e340f17dd9f411d61ef388b9469dc6d4943efbfe1745f1dace86442f"
    hash64      = "72ff51e8d0fd58e3b2d784411dfe61d4c7786142b81b1db33e0eca62b86ed518"
    hash65      = "f9721437e12e47f5200b009a9b206cdb178c5be616db5518500e99e25ddaadc1"
    hash66      = "2a7cd9bbe53db86caa0529a69f8ba62bfe623d4e53eba6e9ece5585a67cc5c0e"
    hash67      = "c3397ce3bc3614b8398aad790cc00c6b7fa84de9069292cc2da60413c6a57ce9"
    hash68      = "f927bf607d106103efde6b90607331038e25e30d18e841a9b4a4681043a976d4"
    hash69      = "d1bf4061dcbeb7d1e3a9f24bac331dcd96153a9458ce3bc7db1858cccdd03c64"
    hash70      = "5144626c438f3689a3e75fdc55b412ce427c30666b90d44e5f190a0f546e90bf"
    hash71      = "d219636875a8422cbbcf7103b43656a4b34ce1874561c6a4af1a1d323fd190d7"
    hash72      = "62c7a15bd3263deceaaf18094912bb20aa79a454cb098820c02dafbe243427de"
    hash73      = "e84273b211fae9fe8c7dc04ab25316dac0915eab19efcd34af671c098ab70a45"
    hash74      = "ab5fa5f8144166808d199db449680826959cd3b377800cf66d0517af18239040"
    hash75      = "80d650acdf63f01488429798b6ba118c2c3e489f89b2f07009ac2c757527f8e4"
    hash76      = "dab91c56fac6e88a6c6e3147a1dd884f5583ee0b2a75fe61215d8f41345428dc"
    hash77      = "2376ab34cd1607ee138c182597a3050041f5d6eb08eb57f8808ca99efe627ad8"
    hash78      = "4ee547a1fd68fe14e127da9afda46a2f3c1a5324f7d0b217442f0dac351cd730"
    hash79      = "dfdbfa012603c29bb82f94aa07ae4ff1ed3e909d31e1cba853c3a9f4c60ad564"
    hash80      = "7ea1940cfabb5ad31b61bf99fc89e38fa16cf872bc39a14f99c50f4968e7060c"
    hash81      = "cb252abadc5be3d039e6398c95f86074062fe05ddc5d8c62df9fe2eef592f2d2"
    hash82      = "c7e5d0529a3fbd4ff5a605aa11cf8e984c925c256b97cc2f2644ef3174a6be54"
    hash83      = "f1c5eeea1f3391beacaa9034ecc1be403dcae3b5200835e77475bf2b530ff095"
    hash84      = "c86c9370278ed705c81e069a28683e5d6316d431348f7875f35c3858a8cb60b1"
    hash85      = "e5dd20860352fe8f77181a43bd66c8fc6dc3f249845b6bcb3679658425303690"
    hash86      = "47ff2a82eba93bf15bea84146c3a303fae975969abbd87bafa272d18e82f9a2f"
    hash87      = "5e074b4eb00b2b15cabbfce1de5a9cfa20fae1a56f6691493cfc836a83e675b9"
    hash88      = "d4c65d0e95be89152f840f677bcc21d50ba1708a0e36d9beeabbb0cae98beef9"
    hash89      = "6b7b2a9b54a7196cad7b88097f2b8f3ee35e70b72930a28d5a0bed68a15cbb20"
    hash90      = "119adef20e49dffd8119cb3162840ad1a3f3e56ea565bf418a07c7fe0b31cd95"
    hash91      = "12ba2f6ebb7e7474334df1cda74b0617652711908d082f90f5a2fad087f7c6e6"
    hash92      = "64c37a809786c2adf357dada45dc413721718313ba6ecef45c8a5314fb4c9a81"
    hash93      = "30af998c08f08f7c2abad01b51201d7f3d85f6b254bd5c8ac185980f4de257cb"
    hash94      = "c8e477833cc8e2a20c1d7c605fd52bdc23066343cb0b139e627b92c99fcfd4dd"
    hash95      = "24c2e50aca64a7e3cb0a496f90c32fd55763f0e8b9f88e64372db9a2ba8a4288"
    hash96      = "7f86102251222a94b17b2d8112aba2afc214420a623eb11c5b3a3e4f41b005a2"
    hash97      = "ad36ac91893bbbea2ac43e2785af2a090b11cff874bc0108587ec68e67315f15"
    hash98      = "462d738ff7e480335de23f55ee948f795260a42b6eedc938e16dc412500a74aa"
    hash99      = "052c002e3c01ddc5079472d93f1060d2fb8aae9ea1a993d344d8d9f161a83c44"
    hash100     = "a3cc61f3b8cc6d7fb8d82971e15445795ee9f24c5fd19301cd5e39342fe3e070"
    hash101     = "c9b879e6a67fef1d4b2c35d68e9029d84c4314e62525df0c40d6d7b92bbbc32f"
    hash102     = "f699c803b4a9abc441e63be56fd3a3cb4a73aa24c042e6d21b28d6596b00a075"
    hash103     = "417754c8c0a5550d3ea5d79ca43810f2ae256c4ad392fb5af96f78ee216cc85a"
    hash104     = "f2da58038718229d27104f7ae265896013187bb6ea476da1541ff03de4507084"
    hash105     = "c61214a7da0df71d085709be28ee8c212d8e169e1af2ad6f584e362fc0d5f03d"
    hash106     = "71efb5a3a306af8cbd9a6863cabcc6214b4b21bd43035a7f21efe73ca76b9ae1"
    hash107     = "47fc65e0c8d330ad41f0d1406e1decbf283cf8b094f0c6eb7a2b157e826f9091"
    hash108     = "8a97afa6a2cc4ed2c05b742a93aa37d0c4f42926978787c5e74908b42d50b828"
    hash109     = "b80c5cc33d57e0edb06912e736f7454e217d6b52ddf5953c31357a79d4355243"
    hash110     = "ff1b22763fe7274bed5c002e6a484f435d80e29c31a027839c15793edd78504f"
    hash111     = "dc7720b8f40f6c399cbf4279087d8c30aa5f595c372de8d43db47ecad4333a23"
    hash112     = "231021ff613c69d7e038e30f98a576f9891931d48136e27d193a4c11798cd498"
    hash113     = "8486893205feb5fbc7a4b308221c1de7d40652c623fa6c2537c5cb2d391196c6"
    hash114     = "1d342a35d7bfb69738efaf014883217b9657a93c9f4dd79540d08dcbfe259f9a"
    hash115     = "5e3b1724a7875c3e5178f41bace8198afd8625aed8417494d8f6c19dbb28044b"
    hash116     = "247a944bce050705fd04dedd2bb3dda2cbaed2ad5e953acc5abb2ff630c96275"
    hash117     = "e9fe92727fe127bb497c109784c2e9d7bb6c4f63d9c74a98e9d0d001b0f14ca7"
    hash118     = "0e8e73ee2882348447c66655cbc3ce57f04c269b78ff7bfe2abd259c7de7e6c4"
    hash119     = "d4ac4e1749297a5998f32323f7cf7a22bbb7f63e82f6589c3f4d69b56b513706"
    hash120     = "57e2ccb78bfc7fb36f1b153c22d657a0be7f21c670834950dbf834e8edafa017"
    hash121     = "c1defb74ef343d8255fcf73107958f54fac635c229ef839bd226fd420f1eaab4"
    hash122     = "8d8289b2a075b3cbf1d57c8fa60d70959e13eae21734b39100dcc60c6dcaa661"
    hash123     = "2b57344d320afe2714d141bab54d1d53bd2907094b56ad7640b7bc4140d1d9aa"
    hash124     = "1c241298107a1de13a98090d9e47f3d3ccd4a016fc19d4565fd523c47624392d"
    hash125     = "a153a07437151f70b3874a2a4f6030d315dd717093de9136c7c46dd685f1db88"
    hash126     = "a129bf396f37c8fc27db8c056224d69a2d8a650202f28f95b759f644bf1ad6d9"
    hash127     = "8364a8fa9bc0712a7bdea52c7321d7704aac57eea9f5d981c382d0e784871a7c"
    hash128     = "10808b7011649ed77900357d154ecb121bdfcb1c980eaeeabf7e6d4570822b90"
    hash129     = "91719b8f85ab184add27d306e2c750a31386a2232a7af5f23f16c5d8cbb0f5ae"
    hash130     = "4084b651e46eb080f24fdb36694761321f7d60de5c427e69c76945e0c53ece7f"
    hash131     = "1465f5fea2554b0ccf4dc5e41f49eb7c999e74eea1623425d406e9c41ca9f1ad"
    hash132     = "a0ec05ce5ccb2fecec5e04e7d6c621e2eb57b729801e4cf58fb1b674f3101674"
    hash133     = "bf96b51c0bb79d6255eb4b370c2432fd7776737a6d486cb74ccb2bc6f0a1874e"
    hash134     = "ca4c6cda15dc72cf68152aea385ee262f1c4e8485e4f7423de6917174354114c"
    hash135     = "02f9b1bd79259e8f0ec2a79723279711089be5cfe89c7aac3098cb9bbc7562d4"
    hash136     = "c05f6099f76d4dc813f70e17f0cd70c01efe1c385569ff571dc7a2650ed24434"
    hash137     = "befc85ad91218a4e0d86c14c8a28da5d11a8605bf1bd5f81a437d849cbeb35ba"
    hash138     = "c167ee458f19927ca413d12ac5fb5d60da772462f21c1995d6cb049f84a1fc7e"
    hash139     = "6502582f34a837a78252f8d185097e7c3a305aab57cbed9dc4a392181fc56d02"
    hash140     = "ed33d44e048eb1dd688221e663a6767f14d8a93d36bd0c489deb9cbed617b5c2"
    hash141     = "3a932edca40f241a998a96badc01518a4bea4e0c847422ac678d9b114ac90d5d"
    hash142     = "03d1650b8e73ff5631c4c1c529f4f43e4beb5be4a61f9c2d3b6e73140c777e36"
    hash143     = "b12bc8d9155824aaaaef6d256118ae8eedc55cc7ae372cbbc15ebec927663296"
    hash144     = "a7301a2fa96a01cff8fd1f051fde502af53afed4567a7b43178ab666408b54e6"
    hash145     = "a9ff564059a815f5eb218b86c074ac38e5b6ed34b8d59051b6a7cb1411950c05"
    hash146     = "6f90ec1f142cb2ab6d9064bad187054bf647b00dbcdcb789368b3a10f0e24c84"
    hash147     = "963e1bfdc3331d39537a80db82c766287d008089527b0595ff6eb801c4ad8bf1"
    hash148     = "ffeb8a8119930e5e7da6af139d30f80120fdc3049a9b197d8804d06967ca5ede"
    hash149     = "e5b19c5fab32f42d3af3210345031f3f15342ebcf90f471726fc1d7e9df67f4d"
    hash150     = "159e34adcd060e1962ef5bbc4b397f141ec572ee887999076e68f0b7949db396"
    hash151     = "313b7f13a37b5a530195ab9d9cb6d36092afd363d0ba2524a056b6f73ab5af20"
    hash152     = "34100bba3bceb24d95ba2abd7c76f6e2fee161c425869fde5ef3ec632d09b742"
    hash153     = "d1c43ab54c737a6eed42a7317c1593948e5e2f3104152d0a22ac0a7d9f07f71e"
    hash154     = "37d0408edbd2bb3fa4946f303bc0c780d1ce31a0f45d434af0a1221e90a2bb33"

  strings:
    $s1  = "var dedlyb = new Function(\"n, enc\", \"    n = Math.floor(n);    if (n < 0 || n === Infinity) return undefined;        var byte" ascii
    $s2  = "cerdceNACI2Native.cerdceNACI2genericize = function(object, cerdceNACI2property, cerdceNACI2check){" fullword ascii
    $s3  = "cerdceNACI2undefilled.angle = function(cerdceNACI2p) {" fullword ascii
    $s4  = "cerdceNACI2undefilled.dEDWWEE = function(){" fullword ascii
    $s5  = "if ((!cerdceNACI2check || !object[cerdceNACI2property]) && typeof object.prototype[cerdceNACI2property] == 'function') object[ce" ascii
    $s6  = "   var max = 251;    var x = n - max;        if (n < max) {        bytes = [ n ];    }    else if (x < 256) {        bytes = [ m" ascii
    $s7  = "cerdceNACI2Native.cerdceNACI2typize = function(object, cerdceNACI2family){" fullword ascii
    $s8  = "cerdceNACI2undefilled.cerdceNACI2sameOrN = function(cerdceNACI2param1, cerdceNACI2param2) {" fullword ascii
    $s9  = "if ((!cerdceNACI2check || !object[cerdceNACI2property]) && typeof object.prototype[cerdceNACI2property] == 'function') object[ce" ascii
    $s10 = "        } while (cerdceNACI2XCOP < cerdceNACI2len && cerdceNACI2c4 == -1);" fullword ascii
    $s11 = "        } while (cerdceNACI2XCOP < cerdceNACI2len && cerdceNACI2ddDccC1 == -1);" fullword ascii
    $s12 = "        } while (cerdceNACI2XCOP < cerdceNACI2len && cerdceNACI2c3 == -1);" fullword ascii
    $s13 = "var cerdceNACI2LitoyDISK = this[cerdceNACI2Richters ];" fullword ascii
    $s14 = "function cerdceNACI2undefilled(velVLUMAHx, velVLUMAHy) {" fullword ascii
    $s15 = "function cerdceNACIzapadniy(cerdceNACIvostochniy) {" fullword ascii
    $s16 = "var cerdceNACI2Native = function(options){" fullword ascii
    $s17 = "function cerdceNACI2_aCho(T, D) {" fullword ascii
    $s18 = "function cerdceNACI2_a2(cerdceNACI2gutter, cerdceNACI2StrokaParam2) {" fullword ascii
    $s19 = "if(cerdceNACI2FrankSinatraLaa < 29999)return false;" fullword ascii
    $s20 = "return (cerdceNACI2$type(item) === cerdceNACI2family);" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

26c638f7-c52d-4594-a257-c57848233cd9

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion