_20160921_1b24f7151bebd3644ff0608076bd2de9_20160921_3823f4aff4d3_514
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_1b24f7151bebd3644ff0608076bd2de9.js, 20160921_3823f4aff4d341a62056d936e59de44c.js, 20160921_4031e49cbb76e44dd58fa572b63a00c7.js, 20160921_4809ff2679793c2b9af03e18ec3702ef.js, 20160921_4f8422c91e79e3073e201b0b279b1fbb.js, 20160921_4fa304d7c11deb5fb9cd6514d5a983de.js, 20160921_510713862e5c8c05841e5272407127f3.js, 20160921_531eaafa1b0a00d86f2203fbd289dd63.js, 20160921_5c25506bc44b50a0c8028dec6521139d.js, 20160921_5cabcf77c626e288d5cbd9104a914ae8.js, 20160921_5ed9729c3ab2cb9d37d8a088af1aba59.js, 20160921_6db2cb585eb933d83d07b47d979b00ec.js, 20160921_6fabf8ef6df7ba14509fab6de95d721f.js, 20160921_73e0cbee151147d27e01ecc015f640b4.js, 20160921_7e15ac2755366d4644a83de8ec9c1a47.js, 20160921_8c8c9fad8af659443108d1078847a668.js, 20160921_91424e3b4f105c156aa0fa6f22c2306f.js, 20160921_91734b00fd54cd3dd10c5f20c35d7864.js, 20160921_91af5c220d1ea27d72d05f472ba8fa16.js, 20160921_a160e4a385807ffcdde4f99a0c57b6b2.js, 20160921_aab5fb25ea8971982ac223655d50aba2.js, 20160921_abc9044816c2455dc24ac338746b6bd5.js, 20160921_afb633ee817d9b15b91ed82a059939fc.js, 20160921_b6d1e9aee3a026c6f266b107f0b88f18.js, 20160921_b74bfd3dc7404d3d5a6512718aa52504.js, 20160921_c979e38640433b8c93e1c145417c85cb.js, 20160921_ce3c0604d52e9dc9119cefedfee34385.js, 20160921_e0f7b2a32a0967097baa59c67369ba3a.js, 20160921_e8d738510e4d2e0efb6c7aa18a7a58d8.js, 20160921_ee80dc6199fa2bd2aea50402a233f984.js, 20160921_fa8c93ef210d8b4c6831cb1425f1dc9b.js
rule _20160921_1b24f7151bebd3644ff0608076bd2de9_20160921_3823f4aff4d3_514 {
meta:
description = "datamaliciousorder - from files 20160921_1b24f7151bebd3644ff0608076bd2de9.js, 20160921_3823f4aff4d341a62056d936e59de44c.js, 20160921_4031e49cbb76e44dd58fa572b63a00c7.js, 20160921_4809ff2679793c2b9af03e18ec3702ef.js, 20160921_4f8422c91e79e3073e201b0b279b1fbb.js, 20160921_4fa304d7c11deb5fb9cd6514d5a983de.js, 20160921_510713862e5c8c05841e5272407127f3.js, 20160921_531eaafa1b0a00d86f2203fbd289dd63.js, 20160921_5c25506bc44b50a0c8028dec6521139d.js, 20160921_5cabcf77c626e288d5cbd9104a914ae8.js, 20160921_5ed9729c3ab2cb9d37d8a088af1aba59.js, 20160921_6db2cb585eb933d83d07b47d979b00ec.js, 20160921_6fabf8ef6df7ba14509fab6de95d721f.js, 20160921_73e0cbee151147d27e01ecc015f640b4.js, 20160921_7e15ac2755366d4644a83de8ec9c1a47.js, 20160921_8c8c9fad8af659443108d1078847a668.js, 20160921_91424e3b4f105c156aa0fa6f22c2306f.js, 20160921_91734b00fd54cd3dd10c5f20c35d7864.js, 20160921_91af5c220d1ea27d72d05f472ba8fa16.js, 20160921_a160e4a385807ffcdde4f99a0c57b6b2.js, 20160921_aab5fb25ea8971982ac223655d50aba2.js, 20160921_abc9044816c2455dc24ac338746b6bd5.js, 20160921_afb633ee817d9b15b91ed82a059939fc.js, 20160921_b6d1e9aee3a026c6f266b107f0b88f18.js, 20160921_b74bfd3dc7404d3d5a6512718aa52504.js, 20160921_c979e38640433b8c93e1c145417c85cb.js, 20160921_ce3c0604d52e9dc9119cefedfee34385.js, 20160921_e0f7b2a32a0967097baa59c67369ba3a.js, 20160921_e8d738510e4d2e0efb6c7aa18a7a58d8.js, 20160921_ee80dc6199fa2bd2aea50402a233f984.js, 20160921_fa8c93ef210d8b4c6831cb1425f1dc9b.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "33f3c9ce370f10b37d492f9d2cda8602f5d90eb1573205e1a4da03da8066ff45"
hash2 = "d0b475c02138425371c1df69faa8ac5c3d739764950c4a65034372b4455ac04d"
hash3 = "42519dff3fd2ed2dc9bcd0f12a16fe310be93f90efd5d40110f336dc5010d050"
hash4 = "2c2d464143196a0237396460d274213cf5b3de772f4205aee0525b67ca1bfd6c"
hash5 = "f1cc54af4d213d0cd37c81b29d25c29bf00892e3458ef2e236563c69fd58b94a"
hash6 = "cef5a1e67f57d9f24065ff0145644e0185df6abc29113310c6782b30e0a9236b"
hash7 = "9f9cd81d24cdba49fd83fed4aa0c3ce028729b44e223720bae200336b5992e5e"
hash8 = "d28500022264ce61d9d988db6f8ddee46acc7dea6f898510f532ee48f87a0c93"
hash9 = "b6178db9a292199c6992547ad654bf7056fa7f33310f29988e468f0cad5ed707"
hash10 = "9493e4251106014081e4b141c6296c51b00c9ba7a799bcb978ea6226cd127d34"
hash11 = "c5908838424a9cae8eb5587cff7048056b427db1deb512dcbe9ca852a402e03d"
hash12 = "b98c5953d102d77c680619bcfd3ba762b3a28a14355f65c479544c745a7c9a12"
hash13 = "a6962383b3793edac58fef061128f9047afb39eaa645d3f7977a775ceeb02e56"
hash14 = "0ad4b632b07e5e4526b874097c116e5183b155ec4b9cf40e3f13ece0ce027344"
hash15 = "97eaf7c50f22bfc94f97a02e5e83a8f1fb3583717fb9f4a6666ae882ea4d6f55"
hash16 = "05c35ee4072476c50081705469d125bb2570dea942839cab58bf87874667da59"
hash17 = "b4a035e38404ad09be99953980865cdbcda5dd05b664dff96722afb53b0c9e29"
hash18 = "cdae8af0c395dfe20c83f759c05d2fd6ae2859606871798c6b3a7a12257c7f70"
hash19 = "d8a5c3b8bd7307238c3f0a133635143674d5db84b7c5615a145a8bea310c68de"
hash20 = "c3eeb2af6e453aec7ede2bba435e7dcf60f7497a94584d1908a2235d79c28a34"
hash21 = "0387ef653c0ac9c5d0aaf638bde80688e7b6b279a435dcab3ff679313abfab3c"
hash22 = "2bb53920235afb1c2d16f013bc118d1df64065eefc10c1b2b9e7a4b133850850"
hash23 = "7a4e330bd3ec71aa3dc8fd3d5b2fa656b04d49cb5ee4e5478a50a6336c5bf9e5"
hash24 = "e95dafe7c61e6b4aa30cf1d0f5e7ac22599967edab3c0a7152e74671d99054e2"
hash25 = "359d333ab8fc51d27349ecaec71f8baf8e8aafae5bfe2d6afd26f4ed76e802db"
hash26 = "62a468202853ba6a8adb456e8c12b66f8794360c094a85e6d4d2cf43d13a75ce"
hash27 = "27a20a400d7aa13737d230acf36a2170494c7da92e72552775d19562ba331fdc"
hash28 = "d527617da74d553b6d56b37f7b101c14280b85e5e40e1f565fe396f8b97b29a2"
hash29 = "e1cd4a36522d2ad8fc8435b6cb64d8e572d8b31d4203885fa375f539a3ea7891"
hash30 = "b51d9165093e08385081a749ef6331a3556fe2739b6c8f85b62e7f6ec1b4f662"
hash31 = "7e7bb1d2ade80c23d5462f8e4a470a3c3245b07b8a709a3c911ff76a8c32da35"
strings:
$s1 = "\";})(),(function fuck(){return \"Ik\";})(),(function fuck(){return \"ZVi\";})(),(function fuck(){return \"Xg\";})(),(function f" ascii
$s2 = "k(){return \"Wo\";})(),(function fuck(){return \"Py\";})(),(function fuck(){return \"Av\";})(),(function fuck(){return \"IPu\";}" ascii
$s3 = "ion fuck(){return \"Xw\";})(),(function fuck(){return \"We\";})(),(function fuck(){return \"Mw\";})(),(function fuck(){return \"" ascii
$s4 = "\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"Ve\";})(),(function fuck(){return \"ZWu\";})(),(function f" ascii
$s5 = "ction fuck(){return \"Mw\";})(),(function fuck(){return \"Ar\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return " ascii
$s6 = ",(function fuck(){return \"Xw\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"Za\";})(),(function fuck(){re" ascii
$s7 = "ck(){return \"Xw\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"IPu\";" ascii
$s8 = "ion fuck(){return \"IPu\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return " ascii
$s9 = "Jh\";})(),(function fuck(){return \"Jo\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MBg\";})(),(functio" ascii
$s10 = "tion fuck(){return \"Ug\";})(),(function fuck(){return \"Av\";})(),(function fuck(){return \"ADy\";})(),(function fuck(){return " ascii
$s11 = "n fuck(){return \"IPu\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"Za\";})(),(function fuck(){return \"X" ascii
$s12 = "y\";})(),(function fuck(){return \"XCr\";})(),(function fuck(){return \"AUx\";})(),(function fuck(){return \"Vb\";})(),(function" ascii
$s13 = "Os\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"UXf\";})(),(function fuck(){return \"Xw\";})(),(function" ascii
$s14 = "rn \"Jh\";})(),(function fuck(){return \"Za\";})(),(function fuck(){return \"Dc\";})(),(function fuck(){return \"Fv\";})(),(func" ascii
$s15 = "){return \"IPu\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"FJs\";})(),(function fuck(){return \"YAv\";}" ascii
$s16 = "(){return \"Xw\";})(),(function fuck(){return \"XHj\";})(),(function fuck(){return \"YAv\";})(),(function fuck(){return \"Xg\";}" ascii
$s17 = "n fuck(){return \"Za\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"Zy\";})(),(function fuck(){return \"X" ascii
$s18 = "\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"USf\";})(),(function " ascii
$s19 = "ck(){return \"Ve\";})(),(function fuck(){return \"Av\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MBg\"" ascii
$s20 = "on fuck(){return \"IPu\";})(),(function fuck(){return \"XFd\";})(),(function fuck(){return \"XCr\";})(),(function fuck(){return " ascii
condition:
(uint16(0) == 0x2f0a and (8 of them)
) or (all of them)
}