_20161107_010b65f5eea41e1daafc1c05a73fca9d_20161107_0123caae2390_434

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20161107_010b65f5eea41e1daafc1c05a73fca9d.js, 20161107_0123caae23908c8d015bdd78e02ad652.js, 20161107_070dc8a4276d38850699927b1bd91a88.js, 20161107_0947e11f603a4c6aa078f3f0819676bc.js, 20161107_0a0585a5cf9c4459e289b91249692b6c.js, 20161107_0ad17309f8e1f83d0e3d9c1d44d8efe9.js, 20161107_0b2c1ffc2604c03fb8980c9dc5d0e63f.js, 20161107_0d29b92fa0415ad6925d845d1adf9574.js, 20161107_0d4f20f5abab71c7aaca69d3cc5a7710.js, 20161107_0f9032086a580a4c35946331b86af773.js, 20161107_135079c24f2674bf8fe038812c4906b6.js, 20161107_1371dc948d304f51286fa2994088da9c.js, 20161107_14ba2c64855a42f46da66cddd245c825.js, 20161107_188c551943a0a962d64a9d25964204d7.js, 20161107_18ff22f904e1f2603bba1a870d7cf25f.js, 20161107_21dbd512f393c2d226b7f4e56fad19fe.js, 20161107_2396e594aef542c825ee95b7cf710c4c.js, 20161107_243f786d4ab8c1098519f47d753371fa.js, 20161107_2598389fc6fcc217873f617bfb711519.js, 20161107_279fc3ddb1c3199624d7bafaf8dfd6c8.js, 20161107_2831c51f5e7bcb0b60377044035701c3.js, 20161107_29453c044722e61faa133bd449f35fe9.js, 20161107_2b01f9966648ce74186a200bd9c84bfb.js, 20161107_2df9dc435acef2b5742564f7d8fb3f13.js, 20161107_2f2bd2866e27a8f36edbbd07bab3c83f.js, 20161107_2f7c6a78989b7b56d7652af200df2b63.js, 20161107_2f8fb23de6bbdf0ec91336ed6fc29728.js, 20161107_30674e5215b1d665f6c7a2ab0dc3c57b.js, 20161107_32b01dc6d0f3e3d8d2b2747fe1693900.js, 20161107_3793e4dc4b1faebce6f8d5def27ae03c.js, 20161107_387d4090d721c9bcad73f60131d13a06.js, 20161107_3b3b9a761e40e637305b58c8cbc58f6e.js, 20161107_3b9c9715f08b9a471bc15ef2c1e1cdef.js, 20161107_3ff6076ac930c51274815c5351543489.js, 20161107_4038155efade96ea1d00a27a6488d018.js, 20161107_429173581cacff6879c1fe05241fbbfc.js, 20161107_4455c8652fee5531f877eb7641a6cf30.js, 20161107_447ede8043b951f02b80fd77c4c17d5e.js, 20161107_47cf932d3018b93e1062e63722fc8d01.js, 20161107_4834afefe4a3841d72aedaeb60d9fee8.js, 20161107_4a1773cf7651bf953e546bee903e25b7.js, 20161107_4b629d9e2d765bc98aa78420a80bc43f.js, 20161107_4c3084240a519ded7632ee1e90f95553.js, 20161107_4cd2cdec4bb2f055fce8dd3aaa86ba53.js, 20161107_4e168a41e2e570a2adc408819678adc6.js, 20161107_50037fd79c43a60ee25b865a173ffe3b.js, 20161107_508f270752af9e471ff99d5a07da6ee5.js, 20161107_531114b6bbd44bc93833bec2802dc090.js, 20161107_53cd0e0bbe840cdec68327ae70c7c245.js, 20161107_55003b7d08cdc77d80be30f8cb968756.js, 20161107_55eb9988e08e73cc74a4fc6220a64725.js, 20161107_56e93fb85f10b205c41c0f358c1c6a80.js, 20161107_583395b3386247d6a3e74475db310b61.js, 20161107_58e5306fd0b05ed9d5858057d8fc0913.js, 20161107_5a4f688898e28ab8d8568a6d4cc0be31.js, 20161107_5dde32ee470d0d8a4db4dd097c85ee28.js, 20161107_6375cd2d72cf4ed928f6d376a79346bc.js, 20161107_65d9015676903731d04a7291a292b94c.js, 20161107_675f6b01ffe09e1d62e10118855cf330.js, 20161107_679f2990ca1f468698fa0df3e6fc1447.js, 20161107_6901d37b16410197cb63e827cd387c02.js, 20161107_6930aa3b67db61036fdefa3d5b50d92d.js, 20161107_6a5d2ddeb05a8da0425cd29eb496cc76.js, 20161107_6a7f27d030dba53b87c7a421227fe1e3.js, 20161107_6b2dcb0988c1c5f37e765a9301da3756.js, 20161107_6b72fd478e245efc0235bc8a04964965.js, 20161107_6cdca47395b3800ed899ed5ba1b1a2d3.js, 20161107_6d5c0d0afa01697e9fa020b99d328e12.js, 20161107_702f2558fd0a63be63ce9137c6f356e6.js, 20161107_71dbe2816d4ba26ce8045c63da477b96.js, 20161107_73e6379e1b0a0b1a1e8b2ccc500aac7d.js, 20161107_75a2ffb49492b642882930169440db67.js, 20161107_769fdbade89d94c0b93c86529719510c.js, 20161107_7bcc03fb57720bf6f8c94ba027093ec4.js, 20161107_7c596c98e72e1cec7c8dcf0e6bca01a2.js, 20161107_7c63928bf7ff9c27f86490af6a5f8c25.js, 20161107_807cbd56aadba8184eb05c5d6f2db010.js, 20161107_83697844d47d2f77f801752a39357455.js, 20161107_85a6548258816d34c33d71a46701f632.js, 20161107_87cf6941c71f3a7c8ca7aed09175360d.js, 20161107_8813b401741cfada147d3043ca83558c.js, 20161107_88fb9c518382e2d877debba012f1fc78.js, 20161107_89dfb196457c5dedeb1d8a59a4673da3.js, 20161107_8b191130fb88b51fd8502c91145a9a90.js, 20161107_8cc7ed280260e6a5c4d9a16a956dfea5.js, 20161107_949034ce154ac748abfc645d69fadf6d.js, 20161107_96df19d1cab5f4b028f71fb67c446892.js, 20161107_98539861905c3d3c781ef9f7e1e2d7c5.js, 20161107_9bf719c715827aa7544ec2a19facc6b3.js, 20161107_9c923bf97681ab27f2a8006bf9fbf7f3.js, 20161107_9f41d9dc42e338d4b14a66055a333ac0.js, 20161107_9fdbc308600f53afec628ea5ccf1ff6c.js, 20161107_a310fb44dc3d6231b1ed8995597aa8a3.js, 20161107_a3ba17eded54880e17cc51d063d368d7.js, 20161107_a574ad9eca8a7fa3c304d2174d52d84d.js, 20161107_a637130520932409bb61c8f138e9e6e0.js, 20161107_a86b2beb4d57ddfa9bccf2c73074a597.js, 20161107_a8e2f27d6e3a0a0f07c71cd4a60b9be3.js, 20161107_ac359b20b18383f81e14f00724e6a08e.js, 20161107_ac913f25ec8d0526375df8c7f5b958e6.js, 20161107_af3ad1b3a18d4b68eb84bbc750859384.js, 20161107_b04b43e501dc1e841f4cd578349362d0.js, 20161107_b0b296b394f3d4108992e8a29a6ce491.js, 20161107_b174f2b4c8262c05a3facbb313ea05b2.js, 20161107_b287038b3a2beb7e7020d13172b5ebef.js, 20161107_b2d4fd0d3baf9683428e5e25824e6f2c.js, 20161107_b2fb1ddbedabb48cce96700773c97145.js, 20161107_b3417099113f2e1c1f70de967bbdf651.js, 20161107_b6f44bb3b0250b20db162ecefb21dec4.js, 20161107_b7121503c2385e214b599efc84699cd4.js, 20161107_b8ecb60f4db84317b1994b35a5cf0577.js, 20161107_ba4d3e28b88b248c9987f0700f163567.js, 20161107_ba7bab8f57345a403b8ca6a06ba47e9e.js, 20161107_bb25be3b80bb2ab481611423ea7d321a.js, 20161107_bdd05d8514cc141ce528b80de14f993c.js, 20161107_c008367adc61c8ebc743d15caaec3dc9.js, 20161107_c01d2a9af210cea759bf5f563acbdaa1.js, 20161107_c3f9efe53d5c70ff1413c5a89762552d.js, 20161107_c46e0995f4dcafcad7180f5d59df477b.js, 20161107_c7da0044dcec73e49f31c91fc58a0421.js, 20161107_c7e49995afcd3ec0bbe92cce8ba03095.js, 20161107_c9aa194d9bf449ae400ed9ffbc627c64.js, 20161107_cdca872589202820242fa2dfa33cd300.js, 20161107_cee968df19f98d8201bf90d860e29191.js, 20161107_d177256a24e60984616f55d909512053.js, 20161107_d17f06960176f3474f1e709aace75d64.js, 20161107_d37e70835e3d323c436a0d7067a605ab.js, 20161107_d676b527dc8f3bc01693c55cc5bcbdb7.js, 20161107_d930d97c46010e97e8da401019140e68.js, 20161107_d9576f0dd7f1998a272b46e08fa3239e.js, 20161107_dd07515ec150034cbe3958223b188904.js, 20161107_dd8f8a2ded51019f8ed6211253116ca0.js, 20161107_e39c88282e0d1885b9d22908887cb787.js, 20161107_e3a3a6b64e894968e4eb28efa1dc7fca.js, 20161107_e3c4fb7418e5f53cd69bcc6c85494b70.js, 20161107_e573c8502a84a523c9d75ab97cf94633.js, 20161107_e5a35242c73362882c4804061b1bd3b4.js, 20161107_e81b74a96a0297c89abc96436149fab4.js, 20161107_e996f1c2fc6b8e31a1d0e7f9b2506d82.js, 20161107_ec84d9689f724d88259b664eeecdfd14.js, 20161107_ed8f5823a06204db8ad8f4302e09e924.js, 20161107_ee6aa3ed41dd5a3727f7d417af259bdd.js, 20161107_eea363d4eb1de4a2475b0e4c6379ced5.js, 20161107_efda0bf8bf492dbe470228edb781e7c3.js, 20161107_f0d6444bd6cb0b945f18c527c6627906.js, 20161107_f0ea2152bf9de95e186d2c987c70a2b4.js, 20161107_f29c2cca52268333361b236558709427.js, 20161107_f5f1d9360203a7b2c4d08ff7d512ca7b.js, 20161107_f660d6e1b314089d4abdcab1949a55d3.js, 20161107_fb638259e05cd7f65a7eeda475c2ccb5.js, 20161107_fd3eec11a1ffac8cc6984df229e51b5e.js, 20161107_fd6c0ff4f76d7d2ee35467604de9d55a.js, 20161108_24bf0c17d127e883529980ff9656c266.js, 20161108_25b35e3c54d94df1acc4fa6d9f276332.js, 20161108_38e22cf310430b0a22c01f327c489644.js,...

rule _20161107_010b65f5eea41e1daafc1c05a73fca9d_20161107_0123caae2390_434 {
  meta:
    description = "datamaliciousorder - from files 20161107_010b65f5eea41e1daafc1c05a73fca9d.js, 20161107_0123caae23908c8d015bdd78e02ad652.js, 20161107_070dc8a4276d38850699927b1bd91a88.js, 20161107_0947e11f603a4c6aa078f3f0819676bc.js, 20161107_0a0585a5cf9c4459e289b91249692b6c.js, 20161107_0ad17309f8e1f83d0e3d9c1d44d8efe9.js, 20161107_0b2c1ffc2604c03fb8980c9dc5d0e63f.js, 20161107_0d29b92fa0415ad6925d845d1adf9574.js, 20161107_0d4f20f5abab71c7aaca69d3cc5a7710.js, 20161107_0f9032086a580a4c35946331b86af773.js, 20161107_135079c24f2674bf8fe038812c4906b6.js, 20161107_1371dc948d304f51286fa2994088da9c.js, 20161107_14ba2c64855a42f46da66cddd245c825.js, 20161107_188c551943a0a962d64a9d25964204d7.js, 20161107_18ff22f904e1f2603bba1a870d7cf25f.js, 20161107_21dbd512f393c2d226b7f4e56fad19fe.js, 20161107_2396e594aef542c825ee95b7cf710c4c.js, 20161107_243f786d4ab8c1098519f47d753371fa.js, 20161107_2598389fc6fcc217873f617bfb711519.js, 20161107_279fc3ddb1c3199624d7bafaf8dfd6c8.js, 20161107_2831c51f5e7bcb0b60377044035701c3.js, 20161107_29453c044722e61faa133bd449f35fe9.js, 20161107_2b01f9966648ce74186a200bd9c84bfb.js, 20161107_2df9dc435acef2b5742564f7d8fb3f13.js, 20161107_2f2bd2866e27a8f36edbbd07bab3c83f.js, 20161107_2f7c6a78989b7b56d7652af200df2b63.js, 20161107_2f8fb23de6bbdf0ec91336ed6fc29728.js, 20161107_30674e5215b1d665f6c7a2ab0dc3c57b.js, 20161107_32b01dc6d0f3e3d8d2b2747fe1693900.js, 20161107_3793e4dc4b1faebce6f8d5def27ae03c.js, 20161107_387d4090d721c9bcad73f60131d13a06.js, 20161107_3b3b9a761e40e637305b58c8cbc58f6e.js, 20161107_3b9c9715f08b9a471bc15ef2c1e1cdef.js, 20161107_3ff6076ac930c51274815c5351543489.js, 20161107_4038155efade96ea1d00a27a6488d018.js, 20161107_429173581cacff6879c1fe05241fbbfc.js, 20161107_4455c8652fee5531f877eb7641a6cf30.js, 20161107_447ede8043b951f02b80fd77c4c17d5e.js, 20161107_47cf932d3018b93e1062e63722fc8d01.js, 20161107_4834afefe4a3841d72aedaeb60d9fee8.js, 20161107_4a1773cf7651bf953e546bee903e25b7.js, 20161107_4b629d9e2d765bc98aa78420a80bc43f.js, 20161107_4c3084240a519ded7632ee1e90f95553.js, 20161107_4cd2cdec4bb2f055fce8dd3aaa86ba53.js, 20161107_4e168a41e2e570a2adc408819678adc6.js, 20161107_50037fd79c43a60ee25b865a173ffe3b.js, 20161107_508f270752af9e471ff99d5a07da6ee5.js, 20161107_531114b6bbd44bc93833bec2802dc090.js, 20161107_53cd0e0bbe840cdec68327ae70c7c245.js, 20161107_55003b7d08cdc77d80be30f8cb968756.js, 20161107_55eb9988e08e73cc74a4fc6220a64725.js, 20161107_56e93fb85f10b205c41c0f358c1c6a80.js, 20161107_583395b3386247d6a3e74475db310b61.js, 20161107_58e5306fd0b05ed9d5858057d8fc0913.js, 20161107_5a4f688898e28ab8d8568a6d4cc0be31.js, 20161107_5dde32ee470d0d8a4db4dd097c85ee28.js, 20161107_6375cd2d72cf4ed928f6d376a79346bc.js, 20161107_65d9015676903731d04a7291a292b94c.js, 20161107_675f6b01ffe09e1d62e10118855cf330.js, 20161107_679f2990ca1f468698fa0df3e6fc1447.js, 20161107_6901d37b16410197cb63e827cd387c02.js, 20161107_6930aa3b67db61036fdefa3d5b50d92d.js, 20161107_6a5d2ddeb05a8da0425cd29eb496cc76.js, 20161107_6a7f27d030dba53b87c7a421227fe1e3.js, 20161107_6b2dcb0988c1c5f37e765a9301da3756.js, 20161107_6b72fd478e245efc0235bc8a04964965.js, 20161107_6cdca47395b3800ed899ed5ba1b1a2d3.js, 20161107_6d5c0d0afa01697e9fa020b99d328e12.js, 20161107_702f2558fd0a63be63ce9137c6f356e6.js, 20161107_71dbe2816d4ba26ce8045c63da477b96.js, 20161107_73e6379e1b0a0b1a1e8b2ccc500aac7d.js, 20161107_75a2ffb49492b642882930169440db67.js, 20161107_769fdbade89d94c0b93c86529719510c.js, 20161107_7bcc03fb57720bf6f8c94ba027093ec4.js, 20161107_7c596c98e72e1cec7c8dcf0e6bca01a2.js, 20161107_7c63928bf7ff9c27f86490af6a5f8c25.js, 20161107_807cbd56aadba8184eb05c5d6f2db010.js, 20161107_83697844d47d2f77f801752a39357455.js, 20161107_85a6548258816d34c33d71a46701f632.js, 20161107_87cf6941c71f3a7c8ca7aed09175360d.js, 20161107_8813b401741cfada147d3043ca83558c.js, 20161107_88fb9c518382e2d877debba012f1fc78.js, 20161107_89dfb196457c5dedeb1d8a59a4673da3.js, 20161107_8b191130fb88b51fd8502c91145a9a90.js, 20161107_8cc7ed280260e6a5c4d9a16a956dfea5.js, 20161107_949034ce154ac748abfc645d69fadf6d.js, 20161107_96df19d1cab5f4b028f71fb67c446892.js, 20161107_98539861905c3d3c781ef9f7e1e2d7c5.js, 20161107_9bf719c715827aa7544ec2a19facc6b3.js, 20161107_9c923bf97681ab27f2a8006bf9fbf7f3.js, 20161107_9f41d9dc42e338d4b14a66055a333ac0.js, 20161107_9fdbc308600f53afec628ea5ccf1ff6c.js, 20161107_a310fb44dc3d6231b1ed8995597aa8a3.js, 20161107_a3ba17eded54880e17cc51d063d368d7.js, 20161107_a574ad9eca8a7fa3c304d2174d52d84d.js, 20161107_a637130520932409bb61c8f138e9e6e0.js, 20161107_a86b2beb4d57ddfa9bccf2c73074a597.js, 20161107_a8e2f27d6e3a0a0f07c71cd4a60b9be3.js, 20161107_ac359b20b18383f81e14f00724e6a08e.js, 20161107_ac913f25ec8d0526375df8c7f5b958e6.js, 20161107_af3ad1b3a18d4b68eb84bbc750859384.js, 20161107_b04b43e501dc1e841f4cd578349362d0.js, 20161107_b0b296b394f3d4108992e8a29a6ce491.js, 20161107_b174f2b4c8262c05a3facbb313ea05b2.js, 20161107_b287038b3a2beb7e7020d13172b5ebef.js, 20161107_b2d4fd0d3baf9683428e5e25824e6f2c.js, 20161107_b2fb1ddbedabb48cce96700773c97145.js, 20161107_b3417099113f2e1c1f70de967bbdf651.js, 20161107_b6f44bb3b0250b20db162ecefb21dec4.js, 20161107_b7121503c2385e214b599efc84699cd4.js, 20161107_b8ecb60f4db84317b1994b35a5cf0577.js, 20161107_ba4d3e28b88b248c9987f0700f163567.js, 20161107_ba7bab8f57345a403b8ca6a06ba47e9e.js, 20161107_bb25be3b80bb2ab481611423ea7d321a.js, 20161107_bdd05d8514cc141ce528b80de14f993c.js, 20161107_c008367adc61c8ebc743d15caaec3dc9.js, 20161107_c01d2a9af210cea759bf5f563acbdaa1.js, 20161107_c3f9efe53d5c70ff1413c5a89762552d.js, 20161107_c46e0995f4dcafcad7180f5d59df477b.js, 20161107_c7da0044dcec73e49f31c91fc58a0421.js, 20161107_c7e49995afcd3ec0bbe92cce8ba03095.js, 20161107_c9aa194d9bf449ae400ed9ffbc627c64.js, 20161107_cdca872589202820242fa2dfa33cd300.js, 20161107_cee968df19f98d8201bf90d860e29191.js, 20161107_d177256a24e60984616f55d909512053.js, 20161107_d17f06960176f3474f1e709aace75d64.js, 20161107_d37e70835e3d323c436a0d7067a605ab.js, 20161107_d676b527dc8f3bc01693c55cc5bcbdb7.js, 20161107_d930d97c46010e97e8da401019140e68.js, 20161107_d9576f0dd7f1998a272b46e08fa3239e.js, 20161107_dd07515ec150034cbe3958223b188904.js, 20161107_dd8f8a2ded51019f8ed6211253116ca0.js, 20161107_e39c88282e0d1885b9d22908887cb787.js, 20161107_e3a3a6b64e894968e4eb28efa1dc7fca.js, 20161107_e3c4fb7418e5f53cd69bcc6c85494b70.js, 20161107_e573c8502a84a523c9d75ab97cf94633.js, 20161107_e5a35242c73362882c4804061b1bd3b4.js, 20161107_e81b74a96a0297c89abc96436149fab4.js, 20161107_e996f1c2fc6b8e31a1d0e7f9b2506d82.js, 20161107_ec84d9689f724d88259b664eeecdfd14.js, 20161107_ed8f5823a06204db8ad8f4302e09e924.js, 20161107_ee6aa3ed41dd5a3727f7d417af259bdd.js, 20161107_eea363d4eb1de4a2475b0e4c6379ced5.js, 20161107_efda0bf8bf492dbe470228edb781e7c3.js, 20161107_f0d6444bd6cb0b945f18c527c6627906.js, 20161107_f0ea2152bf9de95e186d2c987c70a2b4.js, 20161107_f29c2cca52268333361b236558709427.js, 20161107_f5f1d9360203a7b2c4d08ff7d512ca7b.js, 20161107_f660d6e1b314089d4abdcab1949a55d3.js, 20161107_fb638259e05cd7f65a7eeda475c2ccb5.js, 20161107_fd3eec11a1ffac8cc6984df229e51b5e.js, 20161107_fd6c0ff4f76d7d2ee35467604de9d55a.js, 20161108_24bf0c17d127e883529980ff9656c266.js, 20161108_25b35e3c54d94df1acc4fa6d9f276332.js, 20161108_38e22cf310430b0a22c01f327c489644.js,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "e4a7a69e9f5087a610222b6c866c92061a54107714cb51e832544e72858f9cb5"
    hash2       = "6166e3fcd65b3fcaaa48579119dfa32d43e2d0e11644a7cea57bc0f8a79d9728"
    hash3       = "62a4290b95b76fd81e5c659931c2df3878591fabde60a6edcba587fd85e42aaf"
    hash4       = "f21527542f3838168c76a7b7f14d9f88e068639b19ddbf4461ded499be113fe6"
    hash5       = "a2c15dd6188be542b180ca3c63df5746a0f14726589d6ab1b8972c3ff1ead6e5"
    hash6       = "29407cb9fb95faab9e774fd409733cdcf60c3ec29776537141731e3942b97af3"
    hash7       = "d47a64ac91fe527dfdebc1610b97a9cc8210244cbe5d5114665e223bc5dbdc5e"
    hash8       = "91f9d18b1531833ab487d07c1d97b2a0640a3e9636ba188b75ff9cb17703ee24"
    hash9       = "21b5fa49891e05aec633fdc835f1e539efc94087dd8eb93a6ff964b0486eeaf6"
    hash10      = "c0cb039e37ae5f9ce4becf595ca6ebfdf87736489b781942f16e61178d136e94"
    hash11      = "70177b987312a8a660eba2b10be0df6491d9dd9886c1c27a0de7f4edca01d301"
    hash12      = "514551df42da93ec5f14fe05ff23355b097634a6012783fc76e30c7e4d5a3001"
    hash13      = "542f05ed89e12a81136017d72bdbec86a695d3e3ea601848f6929dde1e1e8df4"
    hash14      = "1b63b5c8611dfcf0ecc2cad3fdcf007bd4e3fe61349f61faa2d3bff88a14dd10"
    hash15      = "a206dda8436bd585b0f0082d473a6af98012e2697d6d3e285fd52a234abc1d30"
    hash16      = "bf1d04b47db4562c99a1ecdb870fba7cde2489c7566d2cc079213bb9d8112d6e"
    hash17      = "61acad0304c637fc3f6a4596dc355dbf171388b2ce5f6cc2a5148271ff583513"
    hash18      = "8b806df7ae91efc0d1344ed224600e38186f202295aee0be75059e0d653557cf"
    hash19      = "0e71ac5a602d33095c68733d3763f83a7f0e77b6166229c7694e9809c744edf8"
    hash20      = "c5bcdc61efb820316909e9db1bf78234c8104759131d9692d65f665315ae340e"
    hash21      = "0d125a08ffa27a86a201b6f39f73cc598e4319b1485af9e5e0ebce53080a52ea"
    hash22      = "ea734b34436296c1a8994925d9442b73af442760d7a4ea0eec6d6ca357c9e803"
    hash23      = "a8c7b324b1badca030b31f2de9b80e082cbbcf5f78dca20d890c30d121c1fb66"
    hash24      = "f20d4a0c446e412e38747afbcf9b8735c2945cad05f0ff56fe51c299e69024aa"
    hash25      = "151e7e88e2035494f9e9f75d00feb2c83810d8650f87bcdcf41ef42aeafcd1d6"
    hash26      = "75b8eedf7bfe5b8f7b405276505b77b544778c6cf2d342a1cf6ef2c73c4a9ef9"
    hash27      = "92348a1906764433599c4a01fa98d06ec2ca7ae1425af661a72243bfe1b7d50d"
    hash28      = "5c6083e15855fe91b29b9bb70b98096f1bbf218c3520d53be17a708c62c64c68"
    hash29      = "cf4b6180d6a751ee4b0bcf849596b188621b73aaac49feb3d3afa93ff8653a3a"
    hash30      = "abf50fd74395b0fea8972f5757984469b929b4c6149f0a0cac11c4c119522326"
    hash31      = "85c10140d3e962240010e7ff1c21a27f5e516f871b9da176bbc69ba371e1b941"
    hash32      = "14508f4131b079566738b4566b7aacd59186deb81f827fa658331e8881d0bf52"
    hash33      = "a87a1cab52a31791efc4e39f8ec496cc24b2d7b46c730d8c9e6f9955d1823cdc"
    hash34      = "ad3b08c007bf32d177fb86cac355f072c499fef2de56ee14e8216437265f6321"
    hash35      = "2839ce6aa0f9384d4101415a9445e8b62104826abafb7e823714b25f5a47cca6"
    hash36      = "310fce677aa2a8f5a4de3a403a8381a40f3f0c83a7cbb7005779045d846023c1"
    hash37      = "d59d52000f4cbd781c0958820404a48922f5964c2c03bf26613b4e6001f36ab7"
    hash38      = "e1d1dc5dcee60dd076154fea0c0b2a549ecce60c09fd87bb3e97dd6eb202f488"
    hash39      = "4ab69dfc127f4d865c3c19f883b3787916d31d2873da6b08a3fe5b59e015c672"
    hash40      = "bde30868e470dbff8ffc41cfa4305ce4982503218ce9a5ce031af942aeff18f1"
    hash41      = "2206530991b96ed9432c38fd546f64312db3fc16ef38f22db93e93bdd1035406"
    hash42      = "e1aa8538d88baffb369a02278dadea73039d6c576c4e696be925a2fc9b1a147f"
    hash43      = "f1aa29a0422b9b4c9cbd36393333269501265675cb56dfc38552d1b395362509"
    hash44      = "303e2433f491b7302e325945471c07ea0647cbaccec7d666f55ca5516fbfce1b"
    hash45      = "168fde0ec8d2de31b96a654df15d954fb10179a8bcd30bd1a816608681d8f4b0"
    hash46      = "888f302408b8c42b87fd2a0a562f8fa87aa1d21059760bff2978a3123d0e79dd"
    hash47      = "03530f4d5aa1a14247acea5ed0fdd08ab2760fb7ba7620f3ae30c93aeb3434e1"
    hash48      = "f6e016d62e46ea7dc6451692dd84c400b14bbc53e93dd03d5cf53484470e9171"
    hash49      = "c055e8b1fe04d08c5033c5b9060ddc490433a2c7ed514daee05c6028ee5adef9"
    hash50      = "9f2a373deab562b622e637621be8f4714de1e6457242ae7928457f2046edba35"
    hash51      = "4d51718b62015dce150174955c4c99d7df0acae479786e0360a6f43947331a80"
    hash52      = "c1a355b1b8c4bba4c32ffd3b2209f3bc73dea9ff3d268ea1ae6767bf0eca0854"
    hash53      = "46e0bbf2bb5d99250c26ddaed4549c16bfdc4720b08331f4716f3f92310959fb"
    hash54      = "53a5b584a319f27585de7e04af1f8f52d0870552ba502d53cd5ec4ad0486f872"
    hash55      = "e7cb3fb254ab12a534cd1370c4c744d3820005074c6f74ce3a41e58be1787068"
    hash56      = "6a328b14e2a57aa96c936a3f25d6b640ed34f698ca5fba1cd274ee8e9422f356"
    hash57      = "caf59e26c3f74f32efaaf4ac9bb95754afaf596d643207a9480025aa38c81c10"
    hash58      = "37e7bf89142f7998544956e347dbad0bbf8aa7bb93dc5f5196679c2999083ed0"
    hash59      = "5827f9b7e9653201cc4128e9b67b72c4cc53dc16fb4df525bc1ea20e91e5c3f4"
    hash60      = "58719f32ee922137ee876391c64b59ab85fa775f3efacdf8fc2ca829c8638fc1"
    hash61      = "5f8256380ebba972c354524779a7d3af519400ad6a749909eac884e8937fc343"
    hash62      = "5df9ccfd2ff893cd8e11b49e5c6b42e5f37bf89b4bd4f655f02449fe785e53b2"
    hash63      = "f827eee7020b5fb07aeaa5e87b475a77a9fd4bc9edeb02244d038073fd3139a0"
    hash64      = "6db09f8c09c1027a6101a3858eb13056f40568df5c19ebd34aa57f0c78c1277d"
    hash65      = "f95c6216671fd96dc95e222e89b4160071170d59e10da3af4c62c09e79a02330"
    hash66      = "eb1a9b742fd66d21b274aff06d4fdc6cc1888cd49f132cba6afa977f6848b563"
    hash67      = "2c2a95989be77aa928a9db85492579a24f2520cc739005e283778246e3443e68"
    hash68      = "96e9b3d7143cbbff1906528a11627d16f703f7077223ec317f15415716e8bcd9"
    hash69      = "ed109b5176fe7ef5f9cc8c43a34acb4633357eda4bb71fd2e13f3b11637a39bb"
    hash70      = "baf41e52f753cdd0f19858a5c533ff462393edaaa4823bb33a082adae6a50499"
    hash71      = "590970804638ec594067b2054c904540f3d0ff87336121a0fed3f2d3815193d8"
    hash72      = "96de149acfa81e27c95e6e34346d7675dabeab8a26d2663d8794447f6e2af965"
    hash73      = "2936a4ec3636cb9ef359b9e44d85c7121b6ee53e9b7624218bbe38e845a3a18f"
    hash74      = "fd6e8a0f0ba722c956bdf144083675454d0a06f655a2a2d73a15f87ac1d2cb58"
    hash75      = "e06f71f56bf61c2d277cbb9fedace093e0348379879dd5758d655e96370bbadc"
    hash76      = "835b6a5434b7738b9772a1be67593214ccbaea5ddaaa91a9af0d52fd81d521e5"
    hash77      = "245fad292130034c2b47364850e4d5e95c5b8845cdafac90187941ded46a2336"
    hash78      = "4b3dd1349499cfe4363f3414d3a972390868bfef2c6741cf2d8ccf571e6eeb0a"
    hash79      = "557be27fb6c8e986e411055ef4c83ea3484f370c3eeaa75acc36529d8fc917cd"
    hash80      = "5c2e3c2f27177db5d241df387b3715765a09eda44d6518f24486295e1a856ef3"
    hash81      = "9b35322a0c058a69b7af3ccb8b390072c6be4f2aedfd87c42b35177094696a6c"
    hash82      = "8d000c01187b5e12e3b3b25d21951dd5656ff1a622a58b1fe63bcaf5cedba6c9"
    hash83      = "87e6701f715a9182d76c8b8b96b162c12e3aa6cd4fe647f605364d8135fdc4aa"
    hash84      = "1ffa6491d2800a57c1fc2138022e12bf1746f513cbf819e096b51ff4a39c4a82"
    hash85      = "3eca8eb6af918b44ae9cb304bef2eb890f1a28848372786c73d59ce7d3db88fb"
    hash86      = "0a92fbb47a5f2ed11d40a5d973bf7306003131dd27ed9e44cf3769e7f979de4c"
    hash87      = "db90b750c8c53c734ec29fb86da1e80976fb439d1b9f3f3bbefdc60bc272365d"
    hash88      = "0051e7c7849aa2d3d7c998bc3521968f56ac0708e36e502cb9fc404f27a3ea14"
    hash89      = "5b175470d6f62a2c460df172f6d7a26d0873e8ed066d11e1cdefa9c63fbb6927"
    hash90      = "4118b44b3224a2876be215e797aed992eb7eac79d93d499ba7da099b75a14e91"
    hash91      = "4ffdcb5f71e847efa694aed89d42d7037f7811419aae5f2fe85c2ed4eadec529"
    hash92      = "3f3d962244f050e2be6ab7ae33fffd36e5add7c21fc3942da74601cba5a1ac18"
    hash93      = "d4a4e7e2c424b44835e6fdfd905c6458de4e1ecb4283681c611b19c41897377e"
    hash94      = "200302fa051712b8b29226637e54416fd10d5f5e20cd1419732ad05607658fb1"
    hash95      = "7041fd18c647a9ee6e80a48c1253a7e70f60e38e57b1d509ed765e90fa130513"
    hash96      = "9f2c86fea2ee3ea3d3602b3371eab249bf98dc72e417979d5ee0d8ac9b111843"
    hash97      = "f4a134c00c6d37ee4741dcf9e746f170d0af16eae33f318cdfad55bf2498e255"
    hash98      = "a4d39270c5dda99a19d485d9c1cbd41327bfbc78268f38cba049a05b9fa0299e"
    hash99      = "ffd480f7f6b68205df79af3e2a447502f71386491a667db1cd5d73814ace7e13"
    hash100     = "b145e2db8dc25f434ddd78c6a31f4d175d8c88dbc3e3c982065c611885038ee2"
    hash101     = "b876c6591b314287e988baa289883f06e31c809fe2890aac532c4f8ef71e795c"
    hash102     = "8d2aa6e9e60df010feb67a160da2181932adaaa5b36c9f06f8f9cdce58643643"
    hash103     = "944374bca60eaccced59ebdd5bd28a0eb3c8713e5114a74ca4c98dec244f58f0"
    hash104     = "0bd6da87bb6258147cd6da043259dfbd1a3a49222ffc1ee797eb32f3d6ad9ceb"
    hash105     = "264035f795a195e1ea6dae0a35ff38ee1f2d3105382cb1b544615213639d1b3f"
    hash106     = "f9ba2ed2abdabd318545880bb879d9b4f857343fb93dbe79ed8a9d11e2045fc0"
    hash107     = "8beb0084ede3462b7a4cfb386a3ec6c575714d1cbef2a134b9660ea4cbdd963a"
    hash108     = "14623dbb91631d0483af483a1cf243afe787d55d2316590e61b4d5466361337e"
    hash109     = "5397ece024a07d16658ed3caa9935a4c2571a11ff26fff50590d5d91f0f42334"
    hash110     = "82e93a86ed1539f3f15cd85c9d4a21c48fe8d56b27fdc5d50325266e24ff0b66"
    hash111     = "dec3a99cfa6bec64a14aed633adf04c78485946571a2d96a3ec575f5a076c492"
    hash112     = "17835d062d1440b5a310cdec25a7c3734340f90aa5b5631c5fefcf08e6c6090c"
    hash113     = "d873d25851bf3b1b20706c47b6b63daf2cea7ffe4a1438a647abbeadd3d9539c"
    hash114     = "557c1a1ec93aaadd7b9e99f111cf9c1f7a003ab4f1225ee59f5984c6826cd210"
    hash115     = "dc0360fd5fcf065d8e13dd4a22db76df28469a69d1902ca2d5f55658553e5a89"
    hash116     = "5244f312cb8caff979aae7e85b04cc9801fd3e3b64bece791900056d6f47e854"
    hash117     = "823575a0ae58757631dfd5b0b10da2f6119d996e472d8ee640e2aacf4eb18b59"
    hash118     = "e7d4043a80ff5040bd2ae6133eec2051930db49c59d27e27a14fe77edc8a21ab"
    hash119     = "a02d83c581e63e177f5e7f990e8cef7028b2d5b1c517d35cc589b694b0e6faba"
    hash120     = "49d0f093c3291b9bebf912c3b92dbca8e8475a6694fb8969283956264061acb3"
    hash121     = "6ce2b36b6dea57e17dc04e115c659ae5a94c1742ac2bbab382146c6a17b7ee54"
    hash122     = "1e6f20e631fce8701057d30a91454b9a9af112098249d01773137ae4e3506895"
    hash123     = "aa9d42b4f770acd3a62e79b2986571e88287645ea3682dc4029f32cf5e858246"
    hash124     = "29c48ed28a61a227ac412428cacb209c2e26367569efce6cba2d7f3a6084775a"
    hash125     = "68fed800e78d6431bc732fcd86ee24d6d004c7cc13d595b8b2a2da0100855ab2"
    hash126     = "e143dca71bf281e93f6f8a46ebcff27e6e2dced6b09b98dd796b67ddf6ff9e56"
    hash127     = "38145e407a4dcaaaaeb51ee978adb95d6b08abd4dc1e20289c4c63c64e6aa3cc"
    hash128     = "d392910830fde024db5f725955ce38d943af223493af37743cbeb08046f6cb4e"
    hash129     = "d706013ed478124615851d2f6d7cc1d54c4632ff4a6b149bc4f28127ed226685"
    hash130     = "c073998c182873c51e8fabf2eb163fbf5ee5e393785b0cf1a511738ffbdd7035"
    hash131     = "f9523172bc111a14d02dfb23004af5adf6180d778d1ea59220f7186465534ddc"
    hash132     = "fcbb4248607d5b40ca23ca66c3113b6b91f5d148c9d245efc5cc8ff9ddfdea36"
    hash133     = "cdd4834f8a9960b2b6aa05d044ee0991959f83e07769faacb253194aa3c29dd8"
    hash134     = "c23f4fcbeac89de3ce901f4209c5e72139ccd3d83b1ccc22571304ba2d80f60c"
    hash135     = "e46e91e08109cb7c3b3755f461354005da10123b59881c4c8c8493e2a65d92da"
    hash136     = "c5ea9c529ddbb8822d5108f310bb99eca8aeb289c6601b73a058c97e31593f9c"
    hash137     = "233d7861e7c77ccecda9e072482a2fefa59d7e571ec6dfdd5f6a535049d809b9"
    hash138     = "33c0446571c4bbfb3f9888f4853cd6a8fa32119af0a145a336696f8b27ee7596"
    hash139     = "01ccf66ec74723ac4476db266359942dac8b71c19230e9be85c36e8d29f9bf24"
    hash140     = "006ace6e44e5bb560ada8d152a69f8ac23dda6eafbaa617d5de35ead5282d80a"
    hash141     = "bb8d7b2ab8d201eafd1ff56fe8c9398d3b35ad6e3b6d9afbdf41491b391969a8"
    hash142     = "b4823a9e656ff1c30b5a6db3c55518c24a5f9a58d1eb26ef60bc12de313741df"
    hash143     = "8cd44e546c9b54f9d4d0f9412cecb6794f0fed38ec2d901e27f7fe0c8da3d938"
    hash144     = "7a82613b9418158e1c007b575f8d6751220f16e7d4e348d99b2db746aee7d103"
    hash145     = "4c599441044e270996a7e0d6d7bcbd1128aca705bd9137f03d56824f390493dc"
    hash146     = "eea478ff0bbce2b1f5d807e6d9233235325602cb422f2154802a2a9aa7bf2515"
    hash147     = "6a42252b90e8135ff0e63d688fa8da7ecddb7eee0c090059faefcb8d7b08ace4"
    hash148     = "b6536eaa21920d913d7927d10b610e5c7a361581457ae33d2867236beaeaf95e"
    hash149     = "6863dfc401a05fd2828ffc0f1e7f2604cb17f7374f633b23a546cf6cd60cd6b5"
    hash150     = "057163f03d14cbf02405014bdd03e266559be574082dd031ec85588ffb0ee911"
    hash151     = "7c0e1df0ae6b21d1699462845fda3a1d2d96bd281d2aed2c315348505ccdae9d"
    hash152     = "4da9542059732c7d7ea10e4620512ddbad408e742f6ae65d7b6fd4834d13e8e6"
    hash153     = "9031d61c75d45e61d71964b8d69419c7782e4da682a7c3ee3be63939a43666f9"
    hash154     = "30f9b5da2398397aa5406bf59a2b12a7ce3d77d158cfa414a062cb248d68fd5c"
    hash155     = "d8cd34afddb08435493445d4e8d05f4579e0b83cdc19835f1992d37524b91890"
    hash156     = "feb25f06ff5716540fa63879095072adcaf27fddfb5d5aa10874600b71c60c7d"
    hash157     = "33341ec3e07d914a8084ae7f7302a617a62fe51d0136b2c15581d063b638beae"
    hash158     = "c37274f74027cb4cf634aba40ffe73f9328ccad5c69c60bb6e81e50c65402bb1"
    hash159     = "27affa2a95af9499c5cf0cf5b76f1c10f1632a32e1503c4466f57850ce3b9f8b"
    hash160     = "ddb7a330ae15a81169fe4f619ea0035aa21dfccad5b57d1f4c97c60651e7c76e"
    hash161     = "557e36cc0ab44983b8c4843e8c7dcdec218ce7900d58f6d55a1a143d9e587e30"
    hash162     = "3506270704ae26d8087a7854d3e2b5d247043c389b32c674debd74e629423d53"
    hash163     = "eadefa27acf614c9a969c5ea549f5ce59e3c41b7c8787a08ffa53e885d40507e"
    hash164     = "57bf9ee8709ab4332197511e0eccdd934502d80119ba92fb1a7857152a99f33f"

  strings:
    $s1 = "var DFq1l1o6e2x7p4g5b1t4d7j8p8m5i0k2u0p8k4c1y0p3d1e8k6s0c4a2i9n6e7h7m1u3n4m9q9b5k2r1r6l9b8c6d4j0s5z3h4n9w7=GJp3b4r3u3d9c9k9k9k4f" ascii
    $s2 = "3i4i1f8p6c3l4f3v1g7y7c4k3c5q7y2q0a9f5g3u5f8p6f1c9b6z2f3k3s7l0c4j2k8b4v2i3k8f6l9h0.ExpandEnvironmentStrings(\"%TEMP%/\");" fullword ascii
    $s3 = "while (Gn9y2o7v9p3x9z9l4b0v2c9k7v0i0t2a0u5g3z8t7x0c7y7p0k2c4d1h9m8p6s6e1k1j4f4h2x5x0w5k3e8a3s0v6r6w4a9j8z8p0.readystate < 4) WSc" ascii
    $s4 = "Gn9y2o7v9p3x9z9l4b0v2c9k7v0i0t2a0u5g3z8t7x0c7y7p0k2c4d1h9m8p6s6e1k1j4f4h2x5x0w5k3e8a3s0v6r6w4a9j8z8p0[\"open\"](\"GET\", TAo3d8h" ascii
    $s5 = "while (Gn9y2o7v9p3x9z9l4b0v2c9k7v0i0t2a0u5g3z8t7x0c7y7p0k2c4d1h9m8p6s6e1k1j4f4h2x5x0w5k3e8a3s0v6r6w4a9j8z8p0.readystate < 4) WSc" ascii
    $s6 = "1h4g4h5x7e2v8t7h2v7e8s6t1y6n6f7l2q1s0a7j4p1e6c6a5y2i7f5p8r6z6p0x7], false);" fullword ascii

  condition:
    (uint16(0) == 0x4154 and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f958f091-8ee0-40d9-bee4-5f1e4fca44cb

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion