_20160720_1b8a9ba0ebf75efc8ef97434d4071741_20160720_24657eeb4b61_466

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160720_1b8a9ba0ebf75efc8ef97434d4071741.js, 20160720_24657eeb4b61eca4bbfca8b19fec100f.js, 20160720_29dcc0a962d055ad0e665044e0036d24.js, 20160720_34c63fbe482e67f74d8eb54f681f9be8.js, 20160720_37e197152d0c43bb926d09af238de33b.js, 20160720_3933f676b963c48bd3baacf1b6743298.js, 20160720_3fe11b12a594992f2de241accbdceb7e.js, 20160720_451def32e037b0dded504b1c478bf3e3.js, 20160720_49c3fa9954a772e3ff14360274e99b94.js, 20160720_4dbbe5ff23af319d92a8f66b9c51dc84.js, 20160720_55a1a77bb58e209c504d141eb129f945.js, 20160720_6aff12ac00b748e67d83994ee2df395a.js, 20160720_8cf53e8b5dce0483272a7d3477606e48.js, 20160720_a733fe0cc555bc61d747d99bbaaa4a83.js, 20160720_aba9b49770206adb500d22859a0b4303.js, 20160720_b5416462f72d50eb4be66126dd94928a.js, 20160720_c4151327fb7741608a7fd6804c173858.js, 20160720_c615dbc43e18e387cecd458359d080ad.js, 20160720_c91d9040f113744b6de99b0a62f1b176.js, 20160720_ca9eadafb1c658b8ad6630ff32d43db0.js, 20160720_d409d8bedc2f64778f8a02245c15bf91.js, 20160720_d69502e0c0ee5bf52f31b669e09a2870.js, 20160720_d6c7e765d721893ef615fa476bca9575.js, 20160720_dae38c227e9c61cd1fc8feb6491999b4.js, 20160720_e3f3baeec6d1cb7b7a80ba56865aa8dd.js, 20160720_e42fc546a07478ed148f47b19f512719.js, 20160720_ef64b84c571f5a99dd3fe72bed5ae03f.js, 20160720_f092ee8792d8968db5edb0fccc6c466c.js, 20160720_f413a55cc9846d3834bb8ebbdddfc2b0.js, 20160720_f52c01e25def6379b94228f9e0c91397.js

rule _20160720_1b8a9ba0ebf75efc8ef97434d4071741_20160720_24657eeb4b61_466 {
  meta:
    description = "datamaliciousorder - from files 20160720_1b8a9ba0ebf75efc8ef97434d4071741.js, 20160720_24657eeb4b61eca4bbfca8b19fec100f.js, 20160720_29dcc0a962d055ad0e665044e0036d24.js, 20160720_34c63fbe482e67f74d8eb54f681f9be8.js, 20160720_37e197152d0c43bb926d09af238de33b.js, 20160720_3933f676b963c48bd3baacf1b6743298.js, 20160720_3fe11b12a594992f2de241accbdceb7e.js, 20160720_451def32e037b0dded504b1c478bf3e3.js, 20160720_49c3fa9954a772e3ff14360274e99b94.js, 20160720_4dbbe5ff23af319d92a8f66b9c51dc84.js, 20160720_55a1a77bb58e209c504d141eb129f945.js, 20160720_6aff12ac00b748e67d83994ee2df395a.js, 20160720_8cf53e8b5dce0483272a7d3477606e48.js, 20160720_a733fe0cc555bc61d747d99bbaaa4a83.js, 20160720_aba9b49770206adb500d22859a0b4303.js, 20160720_b5416462f72d50eb4be66126dd94928a.js, 20160720_c4151327fb7741608a7fd6804c173858.js, 20160720_c615dbc43e18e387cecd458359d080ad.js, 20160720_c91d9040f113744b6de99b0a62f1b176.js, 20160720_ca9eadafb1c658b8ad6630ff32d43db0.js, 20160720_d409d8bedc2f64778f8a02245c15bf91.js, 20160720_d69502e0c0ee5bf52f31b669e09a2870.js, 20160720_d6c7e765d721893ef615fa476bca9575.js, 20160720_dae38c227e9c61cd1fc8feb6491999b4.js, 20160720_e3f3baeec6d1cb7b7a80ba56865aa8dd.js, 20160720_e42fc546a07478ed148f47b19f512719.js, 20160720_ef64b84c571f5a99dd3fe72bed5ae03f.js, 20160720_f092ee8792d8968db5edb0fccc6c466c.js, 20160720_f413a55cc9846d3834bb8ebbdddfc2b0.js, 20160720_f52c01e25def6379b94228f9e0c91397.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "39c577030d664e87b9eede462f40d04c3c782906b0eac2c08082107c2c822d75"
    hash2       = "4d9b31e4fd9e04d728f7bbae93feb4ddb7951041e32c3246a581e872f3db6826"
    hash3       = "616fd8cc6f83655ec7b6d02409d69d4797b6f81890907ac0f99792310e1f5371"
    hash4       = "dbb1dbda92eb1f798361d00d2d5f5ddbba093d642ca68c34c2c33fd0f3a029be"
    hash5       = "aff4f092a06f7250b6a8f24f0c5e1162483bcfe519206d6bc324ee908d69202b"
    hash6       = "a19d9d950fb302860e070b043bd02b107cba71d5b604762a76d69ab888f9adb2"
    hash7       = "6dfcadff95cb6461505af5ac6b2411549f282a4268e936b35a0c1915b8135d98"
    hash8       = "60510b9949297827bc90097e8ea84ca067458754468c0b10d9e21f2cfb0a4619"
    hash9       = "db8061d61ea7870a81e42538343cf9afec0e3bfeac4401310803ed7beb664a9c"
    hash10      = "d5cb0f8b538854b3ddaa0e3f9943b755d40a6ca59bed4a51106dde642c64ee52"
    hash11      = "1008bdae20a2836e1ca9240fa4edc7d96f032ee50f3733238a7adf49aae43327"
    hash12      = "d74280fb1dbf7e9ee60b7216ed4f4b2b2a3af3e8c7f033621c30878a5d122457"
    hash13      = "1134e55234b785222a968a541ec8ebbfadecf9e4209faf58ad3767b9cca3e87b"
    hash14      = "dfd66bca17cd78051a18e2a305b7416831cdd8f3b2c533282fe2a54796807557"
    hash15      = "4dd30237662bdd4c60ca07c1a3e7efd07915fa2eae4505e39675e8a709128f5d"
    hash16      = "5b577902494528000252fd7f9558d6a51d433ff913edf6af1c9e489911e41c9b"
    hash17      = "e751cd1c7ad2b4a8f3f3342758cf8ec4f05ed519da0a7e353c8ff76641e8b45a"
    hash18      = "a114578de7d01b1ca2e8d114599b7eda2e7a9892e6b5b55f8e9e267b1ea0007b"
    hash19      = "57d0f49729684524d86b432683c66e658d5155273fca9b45e2e4001ad5578614"
    hash20      = "a5b606022f7a6c12d6a30bf4a0cf7021b7c33bb9d04497475cd324eda6b225b2"
    hash21      = "138e8e2129f12a6416a1f1c08a5d1cb1e2b74d596bcd41364834fc247d4dc917"
    hash22      = "9e06498c3863686cc399429876c0536f20d43e2cb627384e1121b2a12fe50ca4"
    hash23      = "54161e58e232dc32e8c9f712507240ec81865f1d0e947557670e32d3ba7b8d42"
    hash24      = "7cfc0dfbe5577111d4058ee6a29b266fd1a9e283d0570d12162e88038b2e9d2e"
    hash25      = "b97aa1e31b8ca4a3bf15bfcb0df67dac57b21412b235f5f202057b97f2cb0ed9"
    hash26      = "a32631b39a27f55ba15b7c6147be1eb9a7294b483c186010bdfeb45f27a377b0"
    hash27      = "b004e0c1e0948b9a03fa3429b65455c6573f06639a5d52b1a7955828941d02a2"
    hash28      = "c06c8a6ae0a1df4b77464cb6a4837385ecc6ca2303738904dd952ec143631694"
    hash29      = "cf389e859e92f1942d740a8f59ba79d512524caee6444831c949a5cd3320ebd6"
    hash30      = "335f843cb2d6849a8254cd10a879100cc8c108e0e597b201dc4f651330cfda6d"

  strings:
    $s1  = "return (n >>> 0) * 2.3283064365386963e-10;" fullword ascii
    $s2  = "return Math.floor(range * (rawprng() + (rawprng() * 0x200000 | 0) * 1.1102230246251565e-16));" fullword ascii
    $s3  = "function Mash() {" fullword ascii
    $s4  = "{return true;}" fullword ascii
    $s5  = "function rawprng() {" fullword ascii
    $s6  = "var o = 48, c = 1, p = o, s = new Array(o);" fullword ascii
    $s7  = "var mash = function(data) {" fullword ascii
    $s8  = "var mash = Mash();" fullword ascii
    $s9  = "} else n = 0xefc8249d;" fullword ascii
    $s10 = "}return random;}());};" fullword ascii
    $s11 = "var random = function( range ) {" fullword ascii
    $s12 = "function uheprng() {return (function() {" fullword ascii

  condition:
    (uint16(0) == 0x6176 and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

278670d0-f552-4a74-bc74-455af3bd1f38

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion