_20160318_04030b9fe2f4d78c0d85e15a76c89dde_20160318_053bd713a308_437

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160318_04030b9fe2f4d78c0d85e15a76c89dde.js, 20160318_053bd713a3083f83e04afddbef455349.js, 20160318_0851fa2dfda8cb449c0898545a80913a.js, 20160318_20d9e3fa9b09c5274baef98dee6c94ff.js, 20160318_25b8280b874d8a90157f39db84ea1e58.js, 20160318_2d90eee06edc727bb01cb5478dff3716.js, 20160318_3323d74502d29250351568244e017f57.js, 20160318_3af04f80491951d524734b2dd544ac2e.js, 20160318_44a0fde30539ac6f79142a8d59ba39ee.js, 20160318_4576eb550310aed1021cf5e4c8929b6c.js, 20160318_54a0a852c27c1a1d7b7044e4c27e62c1.js, 20160318_585f4dc7ce6b96a9e4097cc9b15e1a81.js, 20160318_5d1597f79deb6b57f06ce64979546ab1.js, 20160318_5fa7fab5a4a5533dfef0f6a9150e6260.js, 20160318_712759aebb6c001a3383e43bec552fbc.js, 20160318_80820a9a84ae0756b3247d81d4be94c3.js, 20160318_813d7b81ef1e89a59898be071337542d.js, 20160318_84429c4d0aa495e63b11f4aee364a577.js, 20160318_846d55540cab0d7de364063e2f01e5df.js, 20160318_8898449f3eaca4186dd68b1c60113b84.js, 20160318_8a4d108417d75b0ac94cf8591a6fcd2f.js, 20160318_8cbaf4da52de462ac92c03f0998dcf16.js, 20160318_8f35e31f2f2f858055d110a3c0d38804.js, 20160318_92412db6aa80850c0d6dce2f2f96ef7a.js, 20160318_9e4092f0a55ccfaf876424fe44d6c8f3.js, 20160318_bff61a844225468889928586f8443465.js, 20160318_c069816817916a192a501242b8af4d77.js, 20160318_c522abf8a8561913e07498b00de8fb07.js, 20160318_cda64796647c078a9030bc5402c4fa30.js, 20160318_ceb65bbc31a99984839940ab27cc2e3e.js, 20160318_dc33008258c2e6ea319d68b4baf7bc73.js, 20160318_efc43c950182bf3a05fdd61067b0c484.js, 20160318_f19d987f1578e090286d53817be20e10.js, 20160318_f7eca2fc03fd6f4d9f7b16dbcd3482f0.js, 20160318_f86623df8364b37b77c5811ae84fe3ea.js

rule _20160318_04030b9fe2f4d78c0d85e15a76c89dde_20160318_053bd713a308_437 {
  meta:
    description = "datamaliciousorder - from files 20160318_04030b9fe2f4d78c0d85e15a76c89dde.js, 20160318_053bd713a3083f83e04afddbef455349.js, 20160318_0851fa2dfda8cb449c0898545a80913a.js, 20160318_20d9e3fa9b09c5274baef98dee6c94ff.js, 20160318_25b8280b874d8a90157f39db84ea1e58.js, 20160318_2d90eee06edc727bb01cb5478dff3716.js, 20160318_3323d74502d29250351568244e017f57.js, 20160318_3af04f80491951d524734b2dd544ac2e.js, 20160318_44a0fde30539ac6f79142a8d59ba39ee.js, 20160318_4576eb550310aed1021cf5e4c8929b6c.js, 20160318_54a0a852c27c1a1d7b7044e4c27e62c1.js, 20160318_585f4dc7ce6b96a9e4097cc9b15e1a81.js, 20160318_5d1597f79deb6b57f06ce64979546ab1.js, 20160318_5fa7fab5a4a5533dfef0f6a9150e6260.js, 20160318_712759aebb6c001a3383e43bec552fbc.js, 20160318_80820a9a84ae0756b3247d81d4be94c3.js, 20160318_813d7b81ef1e89a59898be071337542d.js, 20160318_84429c4d0aa495e63b11f4aee364a577.js, 20160318_846d55540cab0d7de364063e2f01e5df.js, 20160318_8898449f3eaca4186dd68b1c60113b84.js, 20160318_8a4d108417d75b0ac94cf8591a6fcd2f.js, 20160318_8cbaf4da52de462ac92c03f0998dcf16.js, 20160318_8f35e31f2f2f858055d110a3c0d38804.js, 20160318_92412db6aa80850c0d6dce2f2f96ef7a.js, 20160318_9e4092f0a55ccfaf876424fe44d6c8f3.js, 20160318_bff61a844225468889928586f8443465.js, 20160318_c069816817916a192a501242b8af4d77.js, 20160318_c522abf8a8561913e07498b00de8fb07.js, 20160318_cda64796647c078a9030bc5402c4fa30.js, 20160318_ceb65bbc31a99984839940ab27cc2e3e.js, 20160318_dc33008258c2e6ea319d68b4baf7bc73.js, 20160318_efc43c950182bf3a05fdd61067b0c484.js, 20160318_f19d987f1578e090286d53817be20e10.js, 20160318_f7eca2fc03fd6f4d9f7b16dbcd3482f0.js, 20160318_f86623df8364b37b77c5811ae84fe3ea.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "b896b96d2a064274bbf73fb6bc82fb09bc6043179480020da27e3b98dcc0b5c4"
    hash2       = "d666dfa0ab58dd3df49f038c962603da4e4292175fd60f02a4c5d44b7652128e"
    hash3       = "224a54f92b0a06f2c079bbd7253af270b7de6a0993c30dba3d3ca687d68c502d"
    hash4       = "8412d1bf25a5278089bbe07eef1eb776d3aca0d93f786c2d9cf7327259b5049b"
    hash5       = "b79bcdf8dbceca7193d65a979c0f51cce7cdbe54a20f668b6c0784eb47ed5a62"
    hash6       = "3dbf99b592c39b02b0abc349377bb71daf1fd52a86a350cc0e3a9fac3920e9f8"
    hash7       = "ef771c42ffb70d7c0690cad9b6ec6763bb9efe20d86cad425cd44b2a8758fb60"
    hash8       = "78b69b5f5d584fafaf437a100ca59e5e67a388a57de7bd9c89172252bf481a2f"
    hash9       = "1cb82f22131c6fa90b5adce87b36ebb4b274bbe277e14133deff7f9d8cbbd79b"
    hash10      = "fda17c0438bd4f93d96971925304cd85a03710d9c26719d89b5dfb54e62bafb1"
    hash11      = "8f7a0a7b356a95dcb04b92b706f6a84ea55cf7b2dec2ea9639c364a3b63bbe98"
    hash12      = "6cabc54f71d1b54842fc25f29ee7390b406ae14408e0d1d8d62922af9b25bbf4"
    hash13      = "c36aaf73c4356ed0132de7df7559f1b7078d441f602980fb35be12ffe30a4565"
    hash14      = "9ca262e31107184a666b771834641e2accfcab7b2274ae4c41ddc3fc9027e5bd"
    hash15      = "39e1334b3af1d2b35a8512745d60b302ed5f125f75026f5ae04be80394caccba"
    hash16      = "6430ba5167b18081c90456fb4693c552cfacc248c4382d5a4aa43e501ace811d"
    hash17      = "dbcfa41ab5e5278502970a496b70b62fcf1a012aebb41c11ee0cb66bb9925d4d"
    hash18      = "3e70ab05e1f3210fa0c0ca82e59bacb5c669ab9014feb5905457bdddda14752b"
    hash19      = "ce06b0367a54e5d5d241391885bf92c73a5cf38534ceafaf4ff882fd614c6e1c"
    hash20      = "3ee2bd9d9876eef66d0420e5561939cfc397fc064f6a91379a52c4c90c49c460"
    hash21      = "549b27eedb7f475ae307b283fdebc4ea8312405f940c823d92a9d69ebc8b84ca"
    hash22      = "81c1c16c39a327875427226bb125caf603f41e12d6c6251a425b961512258d3f"
    hash23      = "fef8046f5f680a782b3cdef048897985019edbf4c4f30100462ebefe22737132"
    hash24      = "144df23ba5e0e2761393ecb3a63f38d08ef3e9401a756637bdeaaddced4ac51b"
    hash25      = "ea1ec0847e1ce2a45b4709dc89ae8a3d48328488978a987b81c9ed7763f66801"
    hash26      = "04b76359610c5de959318b5df9bc4a79bc1e7c7e3dc2009a501bcbbf7276db4b"
    hash27      = "c35e6063dfcbc71ad5d1cacba669e474c2c79087b06b7de533f9dd2e359a55b6"
    hash28      = "42f977d13395a6107ea07ca3fd02e1344f44bb72cfa8dc294c9e0ccca29b2199"
    hash29      = "5660e50eb712543a8c1b1ae592f472d9b83b267f267079d85e7313814aa244c6"
    hash30      = "0af763b05f4ed01bf172737389130a77a9e55637e40eb069db44d568b4d57828"
    hash31      = "26bae5796216f8e5cce1ae731011fe159a57247a757fe83b505578bc839a6279"
    hash32      = "a9244921802287a33005b76034b5686043e315acb2ab46670734857977736dea"
    hash33      = "4f0c53cde08bff76b82e1c088ea0654e2e1e24067d694ebcdc62aa416d4a3804"
    hash34      = "4a7caae077462b934c105c1a6acb64fd241594c7b382a3368cd5cdf3feca82d1"
    hash35      = "2fd0fa7dd2de4d5babd11208c4f6d78893d3128932f8754920a7337e5108e73c"

  strings:
    $s1  = "CcrsBekMrUe = \"} Move matched elements from seed to results to keep them synchronized i = matcherOut.length; while ( i-- ) { if" ascii
    $s2  = "ufQwqend = \"} if ( seed ) { if ( postFinder || preFilter ) { if ( postFinder ) { Get the final matcherOut by condensing this in" ascii
    $s3  = "ermediate into postFinder contexts temp = []; i = matcherOut.length; while ( i-- ) { if ( (elem = matcherOut[i]) ) { Restore mat" ascii
    $s4  = "        yOQMDiX = \" Return special upon seeing a positional matcher if ( matcher[ expando ] ) { Find the next relative operator" ascii
    $s5  = "cherIn since elem is not yet a final match temp.push( (matcherIn[i] = elem) ); } } postFinder( null, (matcherOut = []), temp, xm" ascii
    $s6  = "    UpSJgn = \"} Add elements passing elementMatchers directly to results Support: IE<9, Safari Tolerate NodeList properties (IE" ascii
    $s7  = "cher( i > 1 && elementMatcher( matchers ), i > 1 && toSelector( If the preceding token was a descendant combinator, insert an im" ascii
    $s8  = "matcherOut.splice( preexisting, matcherOut.length ) : matcherOut ); if ( postFinder ) { postFinder( null, results, matcherOut, x" ascii
    $s9  = "pbvYKhb = \" seed[temp] = !(results[temp] = elem); } } \";" fullword ascii
    $s10 = " \\\"length\\\"; Safari: <number>) matching elements by id for ( ; i !== len && (elem = elems[i]) != null; i++ ) { if ( byElemen" ascii
    $s11 = "plicit any-element `*` tokens.slice( 0, i - 1 ).concat({ value: tokens[ i - 2 ].type === \\\" \\\" ? \\\"*\\\" : \\\"\\\" }) ).r" ascii
    $s12 = "(if any) for proper handling j = ++i; for ( ; j < len; j++ ) { if ( Expr.relative[ tokens[j].type ] ) { break; } } return setMat" ascii
    $s13 = "j )) ), j < len && toSelector( tokens ) ); } matchers.push( matcher ); } \";" fullword ascii
    $s14 = "m, \\\"$1\\\" ), matcher, i < j && matcherFromTokens( tokens.slice( i, j ) ), j < len && matcherFromTokens( (tokens = tokens.sli" ascii
    $s15 = "ufQwqend = \"} if ( seed ) { if ( postFinder || preFilter ) { if ( postFinder ) { Get the final matcherOut by condensing this in" ascii
    $s16 = "        PjlCmWYN = \" The foundational matcher ensures that elements are reachable from top-level context(s) matchContext = addC" ascii
    $s17 = "TFrkRPQhhv = \"} Add elements to results, through postFinder if defined } else { matcherOut = condense( matcherOut === results ?" ascii
    $s18 = "        russLuscWe = \" for ( ; i < len; i++ ) { if ( (matcher = Expr.relative[ tokens[i].type ]) ) { matchers = [ addCombinator" ascii
    $s19 = "TFrkRPQhhv = \"} Add elements to results, through postFinder if defined } else { matcherOut = condense( matcherOut === results ?" ascii
    $s20 = "        russLuscWe = \" for ( ; i < len; i++ ) { if ( (matcher = Expr.relative[ tokens[i].type ]) ) { matchers = [ addCombinator" ascii

  condition:
    (uint16(0) == 0x6675 and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8abb25ae-152f-4b39-aa7c-8a7225df622a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion