_20160505_01f02ca0db23c590350b351238c11d70_20160505_02532968d8ed_301

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160505_01f02ca0db23c590350b351238c11d70.js, 20160505_02532968d8ed8054fd5701db9a0dccb9.js, 20160505_077704859b17dd15fc281c8703605570.js, 20160505_079bc2f31ba266711dc617e18970835f.js, 20160505_115df575037e9e3f89c1a3933874c9f4.js, 20160505_127c383444a0d48c8b5302543d844587.js, 20160505_13f316c041d5cf77c39eaa87a9231b85.js, 20160505_1aba8374faad2d1a0f47b43e28364849.js, 20160505_1aefd66c1984369886ee168ca17e9537.js, 20160505_1b07df0663900b616ed70dcd72113c20.js, 20160505_1bccb7ff737fab2651628112b7d2be86.js, 20160505_26b7b6896cf145c240179dae4860d9d9.js, 20160505_2730113fa1f424966f85672713020025.js, 20160505_28be816cb6d5d8e5f36279aad05e7903.js, 20160505_2c319cdd1f5e4be3d4f9ea365f718fcc.js, 20160505_32c62373a2d3ee64ae22e9af14c8bb17.js, 20160505_32fc6fb5b77cc29acc7225fdc5094475.js, 20160505_33174acaab4aa67a67be019bbd5a3d32.js, 20160505_35734ea384bdc34c85ea224a46630b59.js, 20160505_3b64e8a903db384bdb76eb2c2d0cab93.js, 20160505_3f6fb5ed7e261e3dcad52459a8b96a75.js, 20160505_428eb7929c3501014b3add609701d31d.js, 20160505_43a42d4f4ae676d0ddf6b96ca54d831e.js, 20160505_45a12e3a7a3056a2419e086f445a6ed2.js, 20160505_4b9729eb911280f37860d17b170177ac.js, 20160505_4d94ae13acc38ece3d3e8b823caac7da.js, 20160505_54f5faf8ebc44494a1e5b6f8abcf703a.js, 20160505_571e3a144c09aef75167cb2f06382910.js, 20160505_6acce4d668c7fcb65208a59543d638b9.js, 20160505_7acb347facdf48d56fc94207c3e23149.js, 20160505_7d5ad3371d28129c274330780981a8b2.js, 20160505_7d7237fc787ddc100ed1649291426f0a.js, 20160505_7e88d7de638c3d47d8cf4e43c6c3d784.js, 20160505_83486d5260c4c9a610ac4f1d30bd0936.js, 20160505_851e310cc4f08bbad61c8c1d337e9020.js, 20160505_891ea9bc00fc22d403132b808f07c1f6.js, 20160505_8bb99d15a06d2e52d1c9764a1564c8e2.js, 20160505_8db8d21b832a85194236c236ae7b7bd4.js, 20160505_8ef58203c3b04aa07213b32827d3716d.js, 20160505_a7849742aa7939ce0b2f5b885827c620.js, 20160505_adf64b98a1d3f3875be4a09f0aa3202c.js, 20160505_b03928c795f50e7fc302656b7740d198.js, 20160505_cae3c0ead7d76382ed6d3735c4717482.js, 20160505_ccfa3e88b3989229898509e3aa16ab7e.js, 20160505_ceef3db10a24ff3bf1452320310db77d.js, 20160505_cf9cef9fa66e34885a682cc78e2b37a3.js, 20160505_d9c45c04ce0997eb9d12a228136168a4.js, 20160505_e065bd09ac1b7e639ae56508141ed6c8.js, 20160505_e81e85442d67dc39dc8e3aaef6dc47d7.js, 20160505_edcc5d004d5e326f0f0e25be4d197f43.js, 20160505_f0414abf8b0622be473cb25785628cd1.js, 20160505_f2bd097cf7d14abc320f0cd7d8016030.js, 20160505_f566182d79b67b16b23d8d6ff3eea108.js, 20160505_f7cff5de101f5314c1cb04bcf23888f7.js, 20160505_fa3c4100a539ea0629a8319908c7de51.js, 20160506_1704cdf091c13d6219f7f5560b482bbe.js, 20160506_bfc1c1e677ac4bb5106e35773d7d490e.js, 20160506_c31f568e1a8a7c5f0691a1b6031ad321.js, 20160506_e7dee8d986362c0421f029331208322d.js

rule _20160505_01f02ca0db23c590350b351238c11d70_20160505_02532968d8ed_301 {
  meta:
    description = "datamaliciousorder - from files 20160505_01f02ca0db23c590350b351238c11d70.js, 20160505_02532968d8ed8054fd5701db9a0dccb9.js, 20160505_077704859b17dd15fc281c8703605570.js, 20160505_079bc2f31ba266711dc617e18970835f.js, 20160505_115df575037e9e3f89c1a3933874c9f4.js, 20160505_127c383444a0d48c8b5302543d844587.js, 20160505_13f316c041d5cf77c39eaa87a9231b85.js, 20160505_1aba8374faad2d1a0f47b43e28364849.js, 20160505_1aefd66c1984369886ee168ca17e9537.js, 20160505_1b07df0663900b616ed70dcd72113c20.js, 20160505_1bccb7ff737fab2651628112b7d2be86.js, 20160505_26b7b6896cf145c240179dae4860d9d9.js, 20160505_2730113fa1f424966f85672713020025.js, 20160505_28be816cb6d5d8e5f36279aad05e7903.js, 20160505_2c319cdd1f5e4be3d4f9ea365f718fcc.js, 20160505_32c62373a2d3ee64ae22e9af14c8bb17.js, 20160505_32fc6fb5b77cc29acc7225fdc5094475.js, 20160505_33174acaab4aa67a67be019bbd5a3d32.js, 20160505_35734ea384bdc34c85ea224a46630b59.js, 20160505_3b64e8a903db384bdb76eb2c2d0cab93.js, 20160505_3f6fb5ed7e261e3dcad52459a8b96a75.js, 20160505_428eb7929c3501014b3add609701d31d.js, 20160505_43a42d4f4ae676d0ddf6b96ca54d831e.js, 20160505_45a12e3a7a3056a2419e086f445a6ed2.js, 20160505_4b9729eb911280f37860d17b170177ac.js, 20160505_4d94ae13acc38ece3d3e8b823caac7da.js, 20160505_54f5faf8ebc44494a1e5b6f8abcf703a.js, 20160505_571e3a144c09aef75167cb2f06382910.js, 20160505_6acce4d668c7fcb65208a59543d638b9.js, 20160505_7acb347facdf48d56fc94207c3e23149.js, 20160505_7d5ad3371d28129c274330780981a8b2.js, 20160505_7d7237fc787ddc100ed1649291426f0a.js, 20160505_7e88d7de638c3d47d8cf4e43c6c3d784.js, 20160505_83486d5260c4c9a610ac4f1d30bd0936.js, 20160505_851e310cc4f08bbad61c8c1d337e9020.js, 20160505_891ea9bc00fc22d403132b808f07c1f6.js, 20160505_8bb99d15a06d2e52d1c9764a1564c8e2.js, 20160505_8db8d21b832a85194236c236ae7b7bd4.js, 20160505_8ef58203c3b04aa07213b32827d3716d.js, 20160505_a7849742aa7939ce0b2f5b885827c620.js, 20160505_adf64b98a1d3f3875be4a09f0aa3202c.js, 20160505_b03928c795f50e7fc302656b7740d198.js, 20160505_cae3c0ead7d76382ed6d3735c4717482.js, 20160505_ccfa3e88b3989229898509e3aa16ab7e.js, 20160505_ceef3db10a24ff3bf1452320310db77d.js, 20160505_cf9cef9fa66e34885a682cc78e2b37a3.js, 20160505_d9c45c04ce0997eb9d12a228136168a4.js, 20160505_e065bd09ac1b7e639ae56508141ed6c8.js, 20160505_e81e85442d67dc39dc8e3aaef6dc47d7.js, 20160505_edcc5d004d5e326f0f0e25be4d197f43.js, 20160505_f0414abf8b0622be473cb25785628cd1.js, 20160505_f2bd097cf7d14abc320f0cd7d8016030.js, 20160505_f566182d79b67b16b23d8d6ff3eea108.js, 20160505_f7cff5de101f5314c1cb04bcf23888f7.js, 20160505_fa3c4100a539ea0629a8319908c7de51.js, 20160506_1704cdf091c13d6219f7f5560b482bbe.js, 20160506_bfc1c1e677ac4bb5106e35773d7d490e.js, 20160506_c31f568e1a8a7c5f0691a1b6031ad321.js, 20160506_e7dee8d986362c0421f029331208322d.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a7530b84a2d4d58b1bac2069cd3463a324f832cf084f63a01b5eb3891d21552f"
    hash2       = "8d0c3dfafb916d4cbaf001ab2c0835a8b5dfcff2a4588f77633fe0a916360f82"
    hash3       = "e3da89eccabd4f7646972c8ef4fdc41765b4bf95ee9e8cacbf16e4b4d40a2194"
    hash4       = "1609ae9def8142d303557b4431a41191e11617f0567f81d974cff8bb7e7f797a"
    hash5       = "df67bdac6fc2dd1977119dca20a89ebdd0255827109f56350f350bb04665e68d"
    hash6       = "67c46ad8c68092062ff4571d6f7f83df49762e26988d1a072b9dfd1cb131d4a5"
    hash7       = "6fd1b44e2bc117ef408863e4d0e0e3d0e3302cbf0ba80cc5c02eaccec1a830ac"
    hash8       = "d3033086d25b613bb55a1bc28809a9950c9f6f12b9a5ef9b513348244b1525ac"
    hash9       = "fb29952e674e1715c573166dfafa680705ffd43dad2ae872375ef29de3f51d78"
    hash10      = "7da4c32d60e213935c95d9a325d0e59230d8f9e6eaf45f9256691ad3495cb5f3"
    hash11      = "11e2e70152b4909fbb391d066f86af8e3a173140cd661a443ff3f19837f629ea"
    hash12      = "500a7b9057fc89444dd4d7c2a3c277c04e17d4d546e5b8ea3e1b3aaf91badb1e"
    hash13      = "59c8a82723f4787024a04d20540bdd5dc8ee3edbd93c408e50874a55c475120c"
    hash14      = "2c28de53c3c0bb30776dc7ce4ca61c3f97e25cfe87b91bb22ac132cb982b9ef3"
    hash15      = "1fdcdeb6f72e1d47da7e5f36b37ec6a1c865d8f2aa2b96946d13ef0144f2c024"
    hash16      = "236579d65fe33299964c8512b8b9de71a92d3e7c2ebe72e051d438d6dd1cc4fc"
    hash17      = "5f398696b58fdc68f4466c281bbe078e1706c4f152466e27483c21a42505fea1"
    hash18      = "246892da52098c69b22f5864888624103662ee482e2ccb5b7bd141fa42a5b563"
    hash19      = "238faa43b4e818d661f63d5e8465c312b29cf38ec0f7df846d9e3f3236725a59"
    hash20      = "7360f5f27083c98ddf30acd501bdad72a2ee57bab1b54fc5d73327dc2dac3c28"
    hash21      = "6c1a3b355f287fa43913f7bfdaa50356d007bb4d71e97477eb2d70abd68a5c75"
    hash22      = "8f356c2b1d2ee395016b9f09044bec8785fc63d9f218164f130958513b205c1d"
    hash23      = "bf97d30bc221597671fd37707bfc4d8a5e72264163d3681c2515535a42e44ce3"
    hash24      = "1ed5ab63cddaa003c0d3ce659606cdf07991c6a518274888290a88ac48296c85"
    hash25      = "be0fe813a45b51b7a5006bb0ec22e24880d525932796901f340eb1731f2818df"
    hash26      = "c602827cea42a0f1b146881c81e532d93bd67701fb401801e460c36e16fd76f9"
    hash27      = "fd121e4cf2a058d2255c8951a4b94e33f916431d98a134cc07f14de11eee405d"
    hash28      = "0f904215562fd1b14f9d8f2827cf9186d2ca38f05a87da9138c71454df2e8977"
    hash29      = "7d481b025827841b7e83a5bac0b6e52a5fe9b30e6126cc94886556cf4462056c"
    hash30      = "b62da3dd87b1ff60c64dc609e66bd373ce4567d880f0c37e92090066525ac2c6"
    hash31      = "fb82c7877bc9e9ab5d1d1492de2fc06a9fc096e45808c39990e7b23ca83ddcb2"
    hash32      = "fc610bb66e88aa1cb33b1365775456b2987cdfa02cae7201d7c1ac097a327ade"
    hash33      = "dc12d918308f8adcfdc69f00e5d5df7e7143cf754b1af89f3fb8277b50b15ccd"
    hash34      = "d3ea5154a1dc5b52bbab651798d7372f108e72c956619707f77264f4b8ab1d0d"
    hash35      = "a9f8792c3b359e3d408f6f0c14df896ef85731570ca210ffd8c2268f74ce4106"
    hash36      = "43fab5b626d1d070ccf279a73f767fc3e96877edd502d2783c450fbbc2775140"
    hash37      = "164552556b4a29a34881deda01ba9189807129fbd2b42c0e302b9688c96c0700"
    hash38      = "42ed29e5dcd1b4d562aded32a13fd330d8cf12e5eff0937f5cd5e304e9a0d12d"
    hash39      = "94032e05e2656a5e8d86b5e3e2f79306ee76a22a4e10f115cc08e5fdecd12b25"
    hash40      = "0588f8e733fab52c58970d94c1d8ad47ac7c1127fa9811d1fac7377fbaef8175"
    hash41      = "9bb7a585845fd7443a87da4160e596063f7ccecf018840663a9c05fd4d401315"
    hash42      = "f6e461f95a8de6c53e1035e491413c7d1a9b00dcd41760c97496f384fc5ea310"
    hash43      = "3d29a522d588486c328684aaf49af6e122be046b35f9e3c04078dfef710b418a"
    hash44      = "314cf683973df06363b28c294e0f7cc91ed19f90770c57eda2cab359d15648d3"
    hash45      = "ba5a106e51ddd2ec8f6129884457435e0113a0ed95294aec072480073d06ab17"
    hash46      = "fb160749a09cbf1a58f55d6f0cb1294f2ecde697db1781295861b8f21e97139b"
    hash47      = "37e6eb237c15540e9e319e3c2393ce42177b1e27921d41b9e53a2d383185b304"
    hash48      = "2e6b0a395d28fb0c33ffa7abbac14dd3eb4676abce885f6813db2cfc757b1546"
    hash49      = "9a14adf4edabdf6afb67c4c17db8bb56631f6bba82e78f64213e451d65c68121"
    hash50      = "4e347dd42dccdfffca5274904514a3370f5a6a0dfe5fe6defda4054c3cb03ea5"
    hash51      = "65929156b28a0e4743614404a635587d1fe5e108e0b041b4b4e50e7a97338e96"
    hash52      = "1923368b44cf0d1e6375a15394885ec18b47349e6823483f3aab6d61e4065566"
    hash53      = "a0c6e9da72434d88f8d552afe9cc718886d2807f529ed3d41f2444492e565f90"
    hash54      = "59b1f8425f00e4f8fa2710bab6d733f7a2ba1bda2dafbcc8a73f29cfeb622613"
    hash55      = "6d9682d133015e0865a03469cbf5ff4f8cfb7d68aff8a37702fe09182b8dd1bf"
    hash56      = "24ae8b779ce38c5e4eeb290276d94b3ce49d47427a96458a668f29d5e9e9c105"
    hash57      = "7a7a1c92a1db89a357b15d4a1bef48e43c66e1c05f8c8d830620c49eddb135fe"
    hash58      = "068d96a014cebb64e397e45e5ac2de7f9cd6122a77cb58f710db676d8d5e6114"
    hash59      = "f7095e8e160270b7be7463afb6f1f9e3b863c4688abdd38daf00122565002efe"

  strings:
    $x1  = "eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};" ascii
    $s2  = "   eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36)" ascii
    $s3  = "  var hasher = Components.classes[\"@mozilla.org/security/hash;1\"]" fullword ascii
    $s4  = "GmvCOh = \"}/* * Helper functions for managing events -- not part of the public interface. * Props to Dean Edwards\\\" addEvent " ascii
    $s5  = "if(WScript +\"\" == \"Windows Script Host\"){" fullword ascii
    $s6  = "GmvCOh = \"}/* * Helper functions for managing events -- not part of the public interface. * Props to Dean Edwards\\\" addEvent " ascii
    $s7  = "  var stream = Components.classes[\"@mozilla.org/io/string-input-stream;1\"]" fullword ascii
    $s8  = "oaegScr = \" add: function( elem, types, handler, data, selector ) { var tmp, events, t, handleObjIn, special, eventHandle, hand" ascii
    $s9  = "  hasher.updateFromStream(stream, stream.available());" fullword ascii
    $s10 = "String.prototype.provisionally = function () {" fullword ascii
    $s11 = "String.prototype.parseColor = function() {  " fullword ascii
    $s12 = "oaegScr = \" add: function( elem, types, handler, data, selector ) { var tmp, events, t, handleObjIn, special, eventHandle, hand" ascii
    $s13 = "this.chars = function( string ) {" fullword ascii
    $s14 = "  var hash = hasher.finish(false);" fullword ascii
    $s15 = "uvbkmKSBc = \" Don\\\"t attach events to noData or text/comment nodes (but allow plain objects) if ( !elemData ) { return; \";" fullword ascii
    $s16 = "function base64decode( str ) {" fullword ascii
    $s17 = "   NPQynFqCF = \" handleObj is passed to all event handlers handleObj = jQuery.extend( { type: type, origType: origType, data: d" ascii
    $s18 = "function hex_md5(s) {" fullword ascii
    $s19 = "var chocolate = 0;" fullword ascii
    $s20 = "if (arguments[i] != undefined) return arguments[i];" fullword ascii

  condition:
    (uint16(0) == 0x6176 and (1 of ($x*) and 4 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0c387813-71a7-4378-aaa9-8da8b12200ed

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion