_20160921_016c552b04b5a3cc8c83233d34c7fc80_20160921_037dfac14c35_382
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_016c552b04b5a3cc8c83233d34c7fc80.js, 20160921_037dfac14c3541d1a412418c64cad2f2.js, 20160921_073b3e31779f349650fc6977a0add94b.js, 20160921_0a459915b243d5878c25fef831b72789.js, 20160921_0d3dee472bd7a0a1e2c48044e2c47f0b.js, 20160921_0fe6501a0417801a0e1868963016e9be.js, 20160921_10a3e0605b8ced0a0dee77069aa99014.js, 20160921_16200453422b5793a6a93d4bb423b0ea.js, 20160921_17bab7cc945fd06123e7b9b16dea263f.js, 20160921_17ed90b369ab37cb5f1e7dcf8f6bb253.js, 20160921_1af58d1231756b320d04226685b5a131.js, 20160921_25c11e2eab44b5e0380e0bd805a72790.js, 20160921_27fb26e7e153703634890a2f9e37ef7b.js, 20160921_2fddda42e5911e6501568e734d430149.js, 20160921_32423c6c4f53c5e0240449620e4b98c9.js, 20160921_334dc22c3620386c4119de547e0c0f38.js, 20160921_382a0f9b1ae693f8ade627fd2d6a8b52.js, 20160921_3941d41b2f7cb84a9ce802558f71cf2e.js, 20160921_3974cbb8b2af1f98b68ab31621da93d9.js, 20160921_4787695fef4453a16be881bbe0f96c1a.js, 20160921_4ad5ed78dc05b02005f65ab785b9c74a.js, 20160921_54325d6949c5c03d42a42e11b24dee5c.js, 20160921_54ac484c468ac2ca7fe6c7210ca717bb.js, 20160921_5d6863feab411af8217516a1b111aa40.js, 20160921_5f0fd6cffcc723799fdcc54a3c2a7ba5.js, 20160921_60c26fdfafa2666b92246aea46e32175.js, 20160921_649e29a058d10c3bf9a5a5a06eb3b603.js, 20160921_6748b4ad3c83a7c4aeacfc0817a81797.js, 20160921_68d4a1cff7c2dbc758cf0077184d0d52.js, 20160921_73b5a50d06622b8411077815f2717627.js, 20160921_86391eeb92939f7926213db5cee16e4d.js, 20160921_8aaa596582e26eec62319f01660d922b.js, 20160921_994c4aa8813658fbb0b792d8aa221e53.js, 20160921_9a54c73297e1211ec78765c2c1c7c05b.js, 20160921_9d32b55f93b83e117524c4df15361eee.js, 20160921_a1cbb43a1e22a4b1fd63ee1a724173eb.js, 20160921_a39f22c0c39a7d5bb3c55dd00a36b5b1.js, 20160921_b18e047e5b3fa2131425e272781d97b4.js, 20160921_b2867778b87ab68774c77840f21eaed0.js, 20160921_b8c98d7e4e5c69c2f4fa4fec37a59dfb.js, 20160921_c86a534fb694b7c269b48a9dc32f8a87.js, 20160921_cb7b906c44a337d403a375918e9db0c5.js, 20160921_cdeac57ac549120611856c7af0c490f6.js, 20160921_cff7808833d9e819d4a4f10450848a81.js, 20160921_d6e5226f779c21f4fc4b67aeddca2869.js, 20160921_d999dcba53f56b5a9c1abcc062fbeb80.js, 20160921_da7f7f057c35b886425ec822f654da90.js, 20160921_dd28b3b2e4fae279f1dc4ba30acafda9.js, 20160921_f9054cc04d83c2e4156f98873a8df799.js, 20160921_fbc9133aa5350aa4ce872cb5927c8f4f.js, 20160921_fd5fc067457571e92a95bd16158d41e6.js, 20160921_fe8abdad2bc00d1378e2964402e33217.js, 20160922_2c550b6efe6ec163893e1c555d256b4e.js, 20160922_6bc7e7cb9bbab9434a7d6dc7718c610f.js, 20160922_7706788d60398ea7d883afb2532d218f.js, 20160922_b06824c3d57db547b98db8d6b10525d0.js, 20160922_c593174721c6fbd1b57bf98d8a85a6fd.js, 20160922_ddc158d1b0906f773c8ee4447daa25e5.js, 20160922_e83e21df386eef1a99bc7a65e7e6f6f4.js
rule _20160921_016c552b04b5a3cc8c83233d34c7fc80_20160921_037dfac14c35_382 {
meta:
description = "datamaliciousorder - from files 20160921_016c552b04b5a3cc8c83233d34c7fc80.js, 20160921_037dfac14c3541d1a412418c64cad2f2.js, 20160921_073b3e31779f349650fc6977a0add94b.js, 20160921_0a459915b243d5878c25fef831b72789.js, 20160921_0d3dee472bd7a0a1e2c48044e2c47f0b.js, 20160921_0fe6501a0417801a0e1868963016e9be.js, 20160921_10a3e0605b8ced0a0dee77069aa99014.js, 20160921_16200453422b5793a6a93d4bb423b0ea.js, 20160921_17bab7cc945fd06123e7b9b16dea263f.js, 20160921_17ed90b369ab37cb5f1e7dcf8f6bb253.js, 20160921_1af58d1231756b320d04226685b5a131.js, 20160921_25c11e2eab44b5e0380e0bd805a72790.js, 20160921_27fb26e7e153703634890a2f9e37ef7b.js, 20160921_2fddda42e5911e6501568e734d430149.js, 20160921_32423c6c4f53c5e0240449620e4b98c9.js, 20160921_334dc22c3620386c4119de547e0c0f38.js, 20160921_382a0f9b1ae693f8ade627fd2d6a8b52.js, 20160921_3941d41b2f7cb84a9ce802558f71cf2e.js, 20160921_3974cbb8b2af1f98b68ab31621da93d9.js, 20160921_4787695fef4453a16be881bbe0f96c1a.js, 20160921_4ad5ed78dc05b02005f65ab785b9c74a.js, 20160921_54325d6949c5c03d42a42e11b24dee5c.js, 20160921_54ac484c468ac2ca7fe6c7210ca717bb.js, 20160921_5d6863feab411af8217516a1b111aa40.js, 20160921_5f0fd6cffcc723799fdcc54a3c2a7ba5.js, 20160921_60c26fdfafa2666b92246aea46e32175.js, 20160921_649e29a058d10c3bf9a5a5a06eb3b603.js, 20160921_6748b4ad3c83a7c4aeacfc0817a81797.js, 20160921_68d4a1cff7c2dbc758cf0077184d0d52.js, 20160921_73b5a50d06622b8411077815f2717627.js, 20160921_86391eeb92939f7926213db5cee16e4d.js, 20160921_8aaa596582e26eec62319f01660d922b.js, 20160921_994c4aa8813658fbb0b792d8aa221e53.js, 20160921_9a54c73297e1211ec78765c2c1c7c05b.js, 20160921_9d32b55f93b83e117524c4df15361eee.js, 20160921_a1cbb43a1e22a4b1fd63ee1a724173eb.js, 20160921_a39f22c0c39a7d5bb3c55dd00a36b5b1.js, 20160921_b18e047e5b3fa2131425e272781d97b4.js, 20160921_b2867778b87ab68774c77840f21eaed0.js, 20160921_b8c98d7e4e5c69c2f4fa4fec37a59dfb.js, 20160921_c86a534fb694b7c269b48a9dc32f8a87.js, 20160921_cb7b906c44a337d403a375918e9db0c5.js, 20160921_cdeac57ac549120611856c7af0c490f6.js, 20160921_cff7808833d9e819d4a4f10450848a81.js, 20160921_d6e5226f779c21f4fc4b67aeddca2869.js, 20160921_d999dcba53f56b5a9c1abcc062fbeb80.js, 20160921_da7f7f057c35b886425ec822f654da90.js, 20160921_dd28b3b2e4fae279f1dc4ba30acafda9.js, 20160921_f9054cc04d83c2e4156f98873a8df799.js, 20160921_fbc9133aa5350aa4ce872cb5927c8f4f.js, 20160921_fd5fc067457571e92a95bd16158d41e6.js, 20160921_fe8abdad2bc00d1378e2964402e33217.js, 20160922_2c550b6efe6ec163893e1c555d256b4e.js, 20160922_6bc7e7cb9bbab9434a7d6dc7718c610f.js, 20160922_7706788d60398ea7d883afb2532d218f.js, 20160922_b06824c3d57db547b98db8d6b10525d0.js, 20160922_c593174721c6fbd1b57bf98d8a85a6fd.js, 20160922_ddc158d1b0906f773c8ee4447daa25e5.js, 20160922_e83e21df386eef1a99bc7a65e7e6f6f4.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "a691692f0982e93fd21c441e8c6d39328f1ea5990ce24999b2df98ee3488f667"
hash2 = "bdbf3b67df915739d64604188a4862042efa316e641ef50d228a41f9327767cc"
hash3 = "60d01505d8ea4f2da2961c36fda33950e39ba720d54d967d434c0c5003ff7d2f"
hash4 = "9f8d1944044e8a67a527f50e4aeb45e9358929b0d0f7aaf1730d2782f07a09de"
hash5 = "9ffda0cd0cd96558031ec49484507d0af3efe8f0ec6fee33e947b4b9515ab24f"
hash6 = "2926229ccbf6b86ba0ed1aa3ab5b137a43467ffe25d09479a7998c2fdc4b2b30"
hash7 = "462b92b513dfa104fe3c095cbf98c34389b13ed004671baf4f95430e8487a108"
hash8 = "d968eb9bb2807e5889794bf130036c2c81716cd0166eed67a45c9ef3f81607c3"
hash9 = "a1dd80ed4e2509af999afcf84c8f78ecc409616f9d6e072d25cb980d8bf9e464"
hash10 = "81de0ae14e0c288b697a0e3c7f3ced9b68b8377e75dff5322d654841e642a8a7"
hash11 = "de59166ad132c3c5ad12a85d2d837c1aec192afb497be23c517c637a08d25171"
hash12 = "912d9aec3079fb6a2e4f83d3826286707a52a653de6ec6eede9711d5b416a790"
hash13 = "867c0b561ad28bc562227169c7a21fbf367232ec2d2454d4bd819e1a42cc1b62"
hash14 = "39e075f0b6da6e9616ecc55632d12b76e677c40d3e27c38908b71f907b17d8e1"
hash15 = "1627aa0e729ffe8aba0e7faa8a6286c25a744600e193b72dbc3254fcc98a6003"
hash16 = "a69d8e08a2b4320b4183bfad7a1baa8fc49b7361116aeb9e3a542ae416cd93d5"
hash17 = "4170edc38601b30ac37c9e43a569e4e01000505e73d89702266efb685dc6a8ac"
hash18 = "af803579fff33b5e316911dc121155eb553434eec287816287bbd86b427b3f7f"
hash19 = "707fba854060aa6294a0cf0c11b8eed992c56785375920bc41b7e95f514ab760"
hash20 = "6a11e3d64ee2711e84433d2b8035ce0dafbcffa760c2026e3cfe9ba310008f90"
hash21 = "7e5f9d362688f19111d3dbdf393d51e133fcc63eb7db27536cb31d1205ccc9e3"
hash22 = "0fa3791b48292bf705ed06d701118840e9c87ae1f9ac323fe09b8ad04cedc171"
hash23 = "5b883334540a4216b3582d1f2fa0a27f21b9c64a87944c8e58d9fab0f609eef3"
hash24 = "0dbd74ce266dbd495fb6fc7810ec67099f628d975c524a9190f91ccc4bf433bb"
hash25 = "f215df78f73f84c8424edec81b4a9e43c0b766f9010caf095301b900f03214fb"
hash26 = "e4cfca41d64bbf1a0959643523d4734a108bc3ecf6147c83f60db030586c6f25"
hash27 = "6565dca0eb9e0e467a96242f29a80c650cc40a8892572ce8c28bfd197ace7fd0"
hash28 = "f5e85f2791984d17e00bdb2b7163597d52bf88d9da5a0caedc977a31026ee9f7"
hash29 = "4d2799f014910856c25b225165971fbe59cf99c8eb1db930d774de46f64d76c2"
hash30 = "ff8a171dec88d707916b1928e49d84c61474fe9b0faf2916e72eadb2b404d04b"
hash31 = "1238f360c84929f303678fcd3899297cac43bef18dc5a731b7a6272fde7fe4e6"
hash32 = "345c67f8d573844507dfad7f05cf340f1a2bb19331e3e0d242c508445594aac6"
hash33 = "b7087906f833cc4e256e80f75293dfea38a9cf9102994a76779be7198f94535b"
hash34 = "3d2e8d0924bbdcf83eaa5ef9fde5baf8f4e12cf5c14d5f8ceb77a4c3e708abd3"
hash35 = "3fe6572823305aa2316dd2ce562c85b9f6eb40f26ee354b5e0ff97b66cffd652"
hash36 = "4154e4928eccd35fa0d42dbefe4a742700d77124216f8b5756b8ef63634071d3"
hash37 = "6a56bdeaf1decad9c4fa4ee5ac7e377d80dfd12601d1317d02f12d9d9fb19646"
hash38 = "033421645eb5cdfdccc02e470b5304f91fa62121d1e117f1aebca723440cec70"
hash39 = "ae46b7285b241d53af42d1248b27d7d1186f12901d6fc0284d48665a3b217777"
hash40 = "f1ea05bc317ec861954db64b30bd293d8ee2f663106d48389d91cfb77247fb1e"
hash41 = "921432f56757fdaa414b8b2f729fdd46e41c954a0a96b706c646c1d5ab09e5cb"
hash42 = "2a06a7a374bfacf6c8c177295f8ab5c8e4e8db511406cc33fcef97866f72f9dc"
hash43 = "53694193718c2cb2f90fada2d6a11f07ab2c3f8451a0f41ae580b87a142e212e"
hash44 = "542990d73514ef4ff7fb1540013f789833830036dc9c9c2ad8c49c1bdabb1f2a"
hash45 = "42ec93947d9a157ccd37a3c75c7a06b75fa756fee925b759536deb0993f07a5b"
hash46 = "3bf893eeec71a95167368eb58abcbfe36362779b946b3e0d29c9032ec427ebd4"
hash47 = "b6935463e925cb13fc2413b3d7559cf8e9f5072c15dc73075977046a3e27e417"
hash48 = "841abb0789337235f3a5367c6d4aa3806741a639f1faf0d54e41f125ecc1be02"
hash49 = "7cfaa97d52690e3fa38d039126186e468701b138b24622f48887707d5da022f0"
hash50 = "520ea6f275b172709ff81bfec4d8a5a9f734ab080b25e7c50bfe2a36800af6e3"
hash51 = "e32ed831874bb280ae970e019573b598cf97788865b3fea13118546e435353f9"
hash52 = "39d0496129988da40dbbddcff6610a39be1f05ddd7f48a13058b749810c8400d"
hash53 = "deabc297df80ed9899178f4a02c9538b2fe3ee2038528e07da89655f0d68b1a1"
hash54 = "1ce9e0dc49979ee9e18675311cb94170c53d3836b9d2c99b0e6d51f9cc27fe15"
hash55 = "53ed2c9df290c888bf2af9ce5d017a8ed1c6b1bb1c82aa0376f1bc204aa27eb7"
hash56 = "73bcfec2ac113640d73b2ea0f0c348d7bc7d672d6be74cb4398f8669b599694b"
hash57 = "c85cab0d5b0c79fe38ee2b60c2ea7eca36bb7dbe9442cff0a497346184cecee8"
hash58 = "da7f290c48869e8adc8a27e6344a762283ddaa55eae77000c5439a118d259a98"
hash59 = "ff3bd7f3bb53e5b0bbfefd44c539b38a506a76e4dae03eaa91c64f99e34b846b"
strings:
$s1 = "n \"Nx\";})(),(function f000(){return \"Qj\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})(),(fun" ascii
$s2 = "(function f000(){return \"Oe\";})(),(function f000(){return \"Yz\";})(),(function f000(){return \"Br\";})(),(function f000(){ret" ascii
$s3 = "(){return \"Br\";})(),(function f000(){return \"DYs\";})(),(function f000(){return \"Tn\";})(),(function f000(){return \"Oe\";})" ascii
$s4 = "00(){return \"Tb\";})(),(function f000(){return \"Km\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\"" ascii
$s5 = ")(),(function f000(){return \"GGn\";})(),(function f000(){return \"Um\";})(),(function f000(){return \"ZIi\";})(),(function f000" ascii
$s6 = "turn \"MBb\";})(),(function f000(){return \"Yz\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"GGn\";})(),(" ascii
$s7 = "\";})(),(function f000(){return \"HJm\";})(),(function f000(){return \"KDh\";})(),(function f000(){return \"NYh\";})(),(function" ascii
$s8 = "Gn\";})(),(function f000(){return \"Go\";})(),(function f000(){return \"Yv\";})(),(function f000(){return \"Nx\";})(),(function " ascii
$s9 = "})(),(function f000(){return \"DAp\";})(),(function f000(){return \"Oe\";})(),(function f000(){return \"GGn\";})(),(function f00" ascii
$s10 = "on f000(){return \"ZGq\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})(),(function f000(){return " ascii
$s11 = " f000(){return \"Oe\";})(),(function f000(){return \"HJm\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"GG" ascii
$s12 = "{return \"Go\";})(),(function f000(){return \"Nx\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})(" ascii
$s13 = " \"Uo\";})(),(function f000(){return \"IAa\";})(),(function f000(){return \"BMj\";})(),(function f000(){return \"GGn\";})(),(fun" ascii
$s14 = "n \"Nv\";})(),(function f000(){return \"Km\";})(),(function f000(){return \"Qz\";})(),(function f000(){return \"GGn\";})(),(func" ascii
$s15 = "})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Vu\";})(),(function f000(){return \"SEo\";})(),(function f00" ascii
$s16 = "unction f000(){return \"Sj\";})(),(function f000(){return \"Mc\";})(),(function f000(){return \"KXg\";})(),(function f000(){retu" ascii
$s17 = "turn \"Br\";})(),(function f000(){return \"Sv\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"GGn\";})(),(f" ascii
$s18 = "turn \"Um\";})(),(function f000(){return \"Oe\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})(),(" ascii
$s19 = "ion f000(){return \"Wy\";})(),(function f000(){return \"Oe\";})(),(function f000(){return \"HJm\";})(),(function f000(){return " ascii
$s20 = " f000(){return \"ZFe\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"M" ascii
condition:
(uint16(0) == 0x2f0a and (8 of them)
) or (all of them)
}