_20160331_02fab973481b47c370764985673cfeed_20160331_04a0f88426f1_587

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160331_02fab973481b47c370764985673cfeed.js, 20160331_04a0f88426f10a136143d9de5de4d9c1.js, 20160331_09955d627c58f86f7b5db1348f629865.js, 20160331_0e106b808b49664440c17b9cefad6615.js, 20160331_0f4fc4a6bc5780043602936aa8a117ba.js, 20160331_134a93314559abdac84100ac28d82606.js, 20160331_14284055c0ebccb38ae68690be1e4bff.js, 20160331_14d95761388cf9d69d145fd4232faf65.js, 20160331_15fbd2e48fd66d62e1d2dfd650e24852.js, 20160331_198e874e171599f381dbfe6ea14ade31.js, 20160331_1a075168f71ab9abe94f5de7ff7a99c3.js, 20160331_1a120413128dbf119a9ea2a07da07c7a.js, 20160331_21cf4ac6dcfc54c104253bab0e4abd8e.js, 20160331_2a8a66095df4541bfda04c0c35d5c775.js, 20160331_2ed2860eacda5e27bc0fb5ec9c7e4aed.js, 20160331_3238249faa7c7460adfc16f73ddfa353.js, 20160331_32822739f53077d485e8b7d5e56d89ee.js, 20160331_384537a1922d27c7f7d6ca15d07de9a0.js, 20160331_397eb58066aad0d9d67d5f5113c0098d.js, 20160331_3ba044c67e647651111d070465b0db0a.js, 20160331_424a135600619f34cb846b1079d3cc69.js, 20160331_4a0f618b2546b4b40b9d9a3483f1d9db.js, 20160331_4cc54a62f0756f01619031a9df9e4ed7.js, 20160331_4ce5e83cd319d6b8b71f621edc7c6d80.js, 20160331_4f5f13b37034602c74fd6fcd835b51a0.js, 20160331_556495967c2d26c4bebacc073f672933.js, 20160331_57e5a362dc24ce1d52c2e086c6840e76.js, 20160331_5a4af9056c84f386ec9b14ce50bc7c35.js, 20160331_5ac902335bf26c2634c96d20a2f3cde3.js, 20160331_5b1083323553a558841a2308bf33ca71.js, 20160331_5d24069d60d6a046646e25181e182571.js, 20160331_5f60e4f6dfc602ab0e284f3cff5956d1.js, 20160331_61267af38994f2b9c601ff6fd64c11b0.js, 20160331_6175639aa4a5ef6a52d18dc65de04b52.js, 20160331_63d7326606411c1c7a5232d4d7ac445b.js, 20160331_6ac2f901dd19ac998c9c22ba77f660f2.js, 20160331_6bd8848961a7c3aa5b4bebd8ada477bf.js, 20160331_6c01ca283d3f841d6f14ecf18efc08ea.js, 20160331_6d64a6328485aef980e1d8ec7f9f8743.js, 20160331_6da8839a21299d38250b916ed67fe3b9.js, 20160331_7417cbccf875895b2c48a99b3fd010fa.js, 20160331_762173d0a50ddfc2203b9e34b3b4c36c.js, 20160331_785e904560908be8c09bdc8b166a1e37.js, 20160331_79eb7f210371e9d780386ac6057f8fb4.js, 20160331_7ab3641cf3c3058e776071c2ed966b42.js, 20160331_7c18954c28b7caf27fa708d844853b9a.js, 20160331_7ef032dbdaf1a03663f0f24d9cd3c0ab.js, 20160331_81e4a89d8765f28a8212b209adab2916.js, 20160331_84750eba26e59dfcd0ac2cce217e8b3f.js, 20160331_8a1181cf139e994b867359901dae5105.js, 20160331_8abc208848f5aebd048de00cfee9cb14.js, 20160331_8df4ba6f104cdce02b048b1b8c2b814f.js, 20160331_96d21fd1cf15308ec906684d85f45a90.js, 20160331_9d61be6f755e15cca554a6314095cae4.js, 20160331_9f164b3ad95af4b4711b69587fb7f776.js, 20160331_a019b80a70a4017e2e5bca1f0ae7ec7e.js, 20160331_a2e3f85433784be42562ede5c401c064.js, 20160331_a46a7edc662f17e255404e4750ab198c.js, 20160331_a8a02579952dd49cb3bdd20f25e72efb.js, 20160331_a8b41fa94787400ad05dbcd32f3acee7.js, 20160331_a92e222b8dc5d84693273e510520f9c9.js, 20160331_a97562e4678ceefe2214fd0d5a535c9c.js, 20160331_a9fc0b01d89e4146614dbcfa4f28b6c6.js, 20160331_ab41fee676de8e6babbeacdd4c258980.js, 20160331_ab445866be5f999c38fa8396dabcd2ae.js, 20160331_af4883499f333db2c3282b7c3921c649.js, 20160331_b0ddaa96fa29e2fc711dd55396a12a58.js, 20160331_b52c8343f95237acd535e004ac32d900.js, 20160331_bbb1f8578ca01edfe7258fd77a629fc1.js, 20160331_bffabe448fdf2ccea811f910fba019eb.js, 20160331_c19ca25675324e16ebd5117202606524.js, 20160331_c73c23126dc088db0d006a010ba7d2b2.js, 20160331_ca33f02a2b1629e58fea022f613aa6a9.js, 20160331_cd5676515b085d91a7521d5a02b14012.js, 20160331_ce1f9350e924904f8ca392ac77bef92a.js, 20160331_d02f21bb081ca86f7bf05dcf37c8d34e.js, 20160331_d08804df39131a98dd5c7f1cbe7071e6.js, 20160331_d09b3d2dea99c85f4261837871c375f1.js, 20160331_d0a36373cf16da9e3e542dcada9c7107.js, 20160331_d23f39716b167f2fefba1151c1a53682.js, 20160331_d750e54a20b8f7686a81d1aa654db098.js, 20160331_d90283a52d61aa95177e9f38b171aafa.js, 20160331_d90faeb2ab061fceacf28231787c78a7.js, 20160331_dd3269c11e4f44b8b78634fba80618df.js, 20160331_df48c5f6e30fed0226018b5952b5b6ce.js, 20160331_e01e18bfd19cd0b24161319ae022ef70.js, 20160331_e1f2ded4560cd0ebf1a9ecb47c83402c.js, 20160331_e1fe53c563628a6d97f357779ab48e43.js, 20160331_e3702326dd2f252aac51b454709efceb.js, 20160331_e3d3e45c9c881628ed798ced8881f28b.js, 20160331_e40db09a15f11ce663a3c95916b40c38.js, 20160331_e4c5fe9e69f69140e0eef176da704edc.js, 20160331_e5fe59a90329dce2b7f2a6c53973b692.js, 20160331_ea07ea6ef2576a65d93920102a44468f.js, 20160331_ecc60808ee1ee495ed3074d03e7c80f8.js, 20160331_eec8ea854de476011691e8cae55f26d3.js, 20160331_f0909e4810e7cc79bb761dcecbdb2194.js, 20160331_f0e292b5162fe0488b042a98b19c786f.js, 20160331_f19cdab2e2e06b1190f094822e61611c.js, 20160331_f36d39ad260cab2d9096265523f49175.js, 20160331_f43e2736f139a1866d96346b7110cb29.js, 20160331_f9b2ee12473ede5dbf06e62c5ec36d50.js, 20160331_fc5d2a11d936b00e15c2936ae355a4ff.js, 20160331_fc61e82c07f91749e795bb2f9b305387.js, 20160331_fc670a4ae79d497cb047de9cd94967ed.js, 20160331_fcf1c90a39077748a628439b93aeb781.js, 20160331_fdd424f648d92bc49b0e4a49f661569f.js, 20160331_ffabb5f243a44d065b14074c49203533.js

rule _20160331_02fab973481b47c370764985673cfeed_20160331_04a0f88426f1_587 {
  meta:
    description = "datamaliciousorder - from files 20160331_02fab973481b47c370764985673cfeed.js, 20160331_04a0f88426f10a136143d9de5de4d9c1.js, 20160331_09955d627c58f86f7b5db1348f629865.js, 20160331_0e106b808b49664440c17b9cefad6615.js, 20160331_0f4fc4a6bc5780043602936aa8a117ba.js, 20160331_134a93314559abdac84100ac28d82606.js, 20160331_14284055c0ebccb38ae68690be1e4bff.js, 20160331_14d95761388cf9d69d145fd4232faf65.js, 20160331_15fbd2e48fd66d62e1d2dfd650e24852.js, 20160331_198e874e171599f381dbfe6ea14ade31.js, 20160331_1a075168f71ab9abe94f5de7ff7a99c3.js, 20160331_1a120413128dbf119a9ea2a07da07c7a.js, 20160331_21cf4ac6dcfc54c104253bab0e4abd8e.js, 20160331_2a8a66095df4541bfda04c0c35d5c775.js, 20160331_2ed2860eacda5e27bc0fb5ec9c7e4aed.js, 20160331_3238249faa7c7460adfc16f73ddfa353.js, 20160331_32822739f53077d485e8b7d5e56d89ee.js, 20160331_384537a1922d27c7f7d6ca15d07de9a0.js, 20160331_397eb58066aad0d9d67d5f5113c0098d.js, 20160331_3ba044c67e647651111d070465b0db0a.js, 20160331_424a135600619f34cb846b1079d3cc69.js, 20160331_4a0f618b2546b4b40b9d9a3483f1d9db.js, 20160331_4cc54a62f0756f01619031a9df9e4ed7.js, 20160331_4ce5e83cd319d6b8b71f621edc7c6d80.js, 20160331_4f5f13b37034602c74fd6fcd835b51a0.js, 20160331_556495967c2d26c4bebacc073f672933.js, 20160331_57e5a362dc24ce1d52c2e086c6840e76.js, 20160331_5a4af9056c84f386ec9b14ce50bc7c35.js, 20160331_5ac902335bf26c2634c96d20a2f3cde3.js, 20160331_5b1083323553a558841a2308bf33ca71.js, 20160331_5d24069d60d6a046646e25181e182571.js, 20160331_5f60e4f6dfc602ab0e284f3cff5956d1.js, 20160331_61267af38994f2b9c601ff6fd64c11b0.js, 20160331_6175639aa4a5ef6a52d18dc65de04b52.js, 20160331_63d7326606411c1c7a5232d4d7ac445b.js, 20160331_6ac2f901dd19ac998c9c22ba77f660f2.js, 20160331_6bd8848961a7c3aa5b4bebd8ada477bf.js, 20160331_6c01ca283d3f841d6f14ecf18efc08ea.js, 20160331_6d64a6328485aef980e1d8ec7f9f8743.js, 20160331_6da8839a21299d38250b916ed67fe3b9.js, 20160331_7417cbccf875895b2c48a99b3fd010fa.js, 20160331_762173d0a50ddfc2203b9e34b3b4c36c.js, 20160331_785e904560908be8c09bdc8b166a1e37.js, 20160331_79eb7f210371e9d780386ac6057f8fb4.js, 20160331_7ab3641cf3c3058e776071c2ed966b42.js, 20160331_7c18954c28b7caf27fa708d844853b9a.js, 20160331_7ef032dbdaf1a03663f0f24d9cd3c0ab.js, 20160331_81e4a89d8765f28a8212b209adab2916.js, 20160331_84750eba26e59dfcd0ac2cce217e8b3f.js, 20160331_8a1181cf139e994b867359901dae5105.js, 20160331_8abc208848f5aebd048de00cfee9cb14.js, 20160331_8df4ba6f104cdce02b048b1b8c2b814f.js, 20160331_96d21fd1cf15308ec906684d85f45a90.js, 20160331_9d61be6f755e15cca554a6314095cae4.js, 20160331_9f164b3ad95af4b4711b69587fb7f776.js, 20160331_a019b80a70a4017e2e5bca1f0ae7ec7e.js, 20160331_a2e3f85433784be42562ede5c401c064.js, 20160331_a46a7edc662f17e255404e4750ab198c.js, 20160331_a8a02579952dd49cb3bdd20f25e72efb.js, 20160331_a8b41fa94787400ad05dbcd32f3acee7.js, 20160331_a92e222b8dc5d84693273e510520f9c9.js, 20160331_a97562e4678ceefe2214fd0d5a535c9c.js, 20160331_a9fc0b01d89e4146614dbcfa4f28b6c6.js, 20160331_ab41fee676de8e6babbeacdd4c258980.js, 20160331_ab445866be5f999c38fa8396dabcd2ae.js, 20160331_af4883499f333db2c3282b7c3921c649.js, 20160331_b0ddaa96fa29e2fc711dd55396a12a58.js, 20160331_b52c8343f95237acd535e004ac32d900.js, 20160331_bbb1f8578ca01edfe7258fd77a629fc1.js, 20160331_bffabe448fdf2ccea811f910fba019eb.js, 20160331_c19ca25675324e16ebd5117202606524.js, 20160331_c73c23126dc088db0d006a010ba7d2b2.js, 20160331_ca33f02a2b1629e58fea022f613aa6a9.js, 20160331_cd5676515b085d91a7521d5a02b14012.js, 20160331_ce1f9350e924904f8ca392ac77bef92a.js, 20160331_d02f21bb081ca86f7bf05dcf37c8d34e.js, 20160331_d08804df39131a98dd5c7f1cbe7071e6.js, 20160331_d09b3d2dea99c85f4261837871c375f1.js, 20160331_d0a36373cf16da9e3e542dcada9c7107.js, 20160331_d23f39716b167f2fefba1151c1a53682.js, 20160331_d750e54a20b8f7686a81d1aa654db098.js, 20160331_d90283a52d61aa95177e9f38b171aafa.js, 20160331_d90faeb2ab061fceacf28231787c78a7.js, 20160331_dd3269c11e4f44b8b78634fba80618df.js, 20160331_df48c5f6e30fed0226018b5952b5b6ce.js, 20160331_e01e18bfd19cd0b24161319ae022ef70.js, 20160331_e1f2ded4560cd0ebf1a9ecb47c83402c.js, 20160331_e1fe53c563628a6d97f357779ab48e43.js, 20160331_e3702326dd2f252aac51b454709efceb.js, 20160331_e3d3e45c9c881628ed798ced8881f28b.js, 20160331_e40db09a15f11ce663a3c95916b40c38.js, 20160331_e4c5fe9e69f69140e0eef176da704edc.js, 20160331_e5fe59a90329dce2b7f2a6c53973b692.js, 20160331_ea07ea6ef2576a65d93920102a44468f.js, 20160331_ecc60808ee1ee495ed3074d03e7c80f8.js, 20160331_eec8ea854de476011691e8cae55f26d3.js, 20160331_f0909e4810e7cc79bb761dcecbdb2194.js, 20160331_f0e292b5162fe0488b042a98b19c786f.js, 20160331_f19cdab2e2e06b1190f094822e61611c.js, 20160331_f36d39ad260cab2d9096265523f49175.js, 20160331_f43e2736f139a1866d96346b7110cb29.js, 20160331_f9b2ee12473ede5dbf06e62c5ec36d50.js, 20160331_fc5d2a11d936b00e15c2936ae355a4ff.js, 20160331_fc61e82c07f91749e795bb2f9b305387.js, 20160331_fc670a4ae79d497cb047de9cd94967ed.js, 20160331_fcf1c90a39077748a628439b93aeb781.js, 20160331_fdd424f648d92bc49b0e4a49f661569f.js, 20160331_ffabb5f243a44d065b14074c49203533.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "4b4201157b3ce62b6fc9874962d16b37b2cc54f3f2f0205f4ff3961180506484"
    hash2       = "8c48d3b7bbc835c78249a68b769c225fb24e9d83e515e49853a9a64935d863e7"
    hash3       = "598315594521584ac205120add60937aea0d7de0ce55595cc461b95e30369bea"
    hash4       = "bdc1ed9caacf49603efdf63284e07c572c4536385fefa5449becf049bbd0aba1"
    hash5       = "ab56d565df02779898fb4cbb9dfd23591e500624c063a1fbc156389e18030b68"
    hash6       = "af12feaaacefcce9ce0976d626fe1670bca2bb9964a03538028d1b8272d8cfe5"
    hash7       = "cf183d98d09730c49c3e83bd956fba1fd1c3eddf9b3a0156b8c15bf5d5f1bac5"
    hash8       = "c73a4cc06c245a6f68a5988a75bc32223a36734b665960c7ca8e1b493a71bd87"
    hash9       = "2a95da12cb708b7fbd0e1a8cddbff49747053e1cb1bc81e3910a099cc719e81b"
    hash10      = "c0879efad1e8a948481b4b28bed3d057a73b3e7d99d6aec121307ebbfdac3690"
    hash11      = "00aef4356d9934297a60abc959d414b6212e4134e22be8e07e8014eb383a0fdf"
    hash12      = "40af519085fbb906bcc121a982bfa6eb0a25b28404c57686cad1c75be0ef30ee"
    hash13      = "a1d70d6c4e053213e388684453f1a89b9a8bdb279fe33e5f4e7f6b818e5aec5b"
    hash14      = "3613a364582aa8994cedbc12899c7db551752c49e0c4bed8a17a32cf153f3317"
    hash15      = "c32c18214669949d68d193d6f51be88aefcded7e241aa5cd3397144f3b357dc2"
    hash16      = "202c037f0845594893e34eefbbb1da2fc5e3c54b82f238349191352597214cfa"
    hash17      = "f4bb2be0c674655817e68c8f19d740c1f72ebd175e2d59c59a19116cffcc2780"
    hash18      = "0bddb82afceba07065d7c95804a802dc47cc249cfb90b64c9286bcfb09c50738"
    hash19      = "f59d023bc8c3d94132fd3b7d393960e2834dd9f069f5ae738e0cae4f47d959a4"
    hash20      = "1243faeaefa9f8e093f88795e11f86e4655c5b438ac6c5ae722c11145223ad24"
    hash21      = "52d9ec709646622ce483ca98baef0c698095de7f40c96307d92034e15ea67a06"
    hash22      = "628249e4b362e279e51a0bac47af81c0059c5cb8c9adc50df3498e11942a0116"
    hash23      = "77247a3dec628fffc5b41564ab14f11e0ed40068d65d53b66d8bc9356ba1ac6f"
    hash24      = "aa4c40ee1d6f5f78e1f4581175da4bde39c1bfac2d3989dc1df0030a523e8928"
    hash25      = "e5faa2bbcfa11e22253b3fc864bb8947171c3341548c51b4bc556f53270bd005"
    hash26      = "cb08b26ac0ada250fe8095824fdf09535363c938f7a89764d0ad4521fd9b2dfc"
    hash27      = "f7829b4640b602dfe9b22ce1e29b154c19d3e425a8722aea5dd453481fbab180"
    hash28      = "6baa605e8082f752319106a77da521b66f2fc1fc8e841561f1dcd545d39a2c9e"
    hash29      = "3b517b8057663e5f6a1457ab9bf69d5fa36ec37766636d84fe836da96a8cff21"
    hash30      = "f32d9e0cf29c3c8d7418b5d5520ede6202cb8b8c46968abeac7d591f5524dd88"
    hash31      = "93d8ced53565db37ca039dd92fbf45a2a1384980522c56727a12b8cfc94e7708"
    hash32      = "8bf90338504d96301b5ce9af3cd529e5c06fd06ea0c2762385c087a3d80e36e1"
    hash33      = "964e273ac19f98d8b89efdfabceda35c1bf7ac32faadf68ab020bdf8ad91d718"
    hash34      = "3c666e3742db70d689f01135dc8feecb2ae91e6a771db9cd23f82ec4bff40e88"
    hash35      = "8c5f09407bef0daced3af7f0091d7fcc2a0e50ef14eb8aec17a14aadb6de7930"
    hash36      = "c27d1b2208ba338841225003e899a133c49455f66b503c9bedae3da8eedfecf4"
    hash37      = "5a9d3fef417fa97df52323e8ef35a8d26c660c3d0754bd02ce500283e6c7f1cc"
    hash38      = "156b09815fdb293839a97c911ab06d94e570f0a763dbf3ab55eaa1391cd59697"
    hash39      = "a7544f877b635e41b14c7279a00e1f4357d1bd53b6ea06debbb8a830e7dc69b3"
    hash40      = "55bb30f023ef9ff9043c862f8ac3b39f896d7e5787e88113fd5a59c5f1f4461c"
    hash41      = "d3e015caa468fba3eb579f6e839051ad4d37de76daa21d5761c3c594290c8f35"
    hash42      = "22ab8faa3b93a1e25c76e9665e104f900b308cf8c04f3be3d3a89233653081d4"
    hash43      = "d376c0c4ba1d5cc53f1ed24e472e3ab734f22538daa3f2664fa8cb287a78dc75"
    hash44      = "4dc8d95550a5f8768e5b5617c9a04da7775b7315070f31c742739f74147c436d"
    hash45      = "f21f19341190efe903a40843b8aa9bce01cff3db73109fbea825a1ea3580f96c"
    hash46      = "be4d34fc1c47dbf0b77b5a1692fe044f8218b1d1c7c4f1bd57a6b33aa637ddbc"
    hash47      = "6f2973e4b21ae30b0ce2bff17a03525d90950a133ff890d26847b5edf032b0e0"
    hash48      = "9b1d2c11c3b1d6ca306ab678b73ca8c59c452c3d1bc9e6aa0c37fb4b1ee0de11"
    hash49      = "7676a9b89950e23f2cde76bcd90812b3e9a4025c529b70d5dd5aabe343bac56e"
    hash50      = "2aa9e3416e18c0840858086a9553be87ab9297b2aecc608f3630f932a764af79"
    hash51      = "2d088cdd7fa048d53a10979f1842f177f4cae2e450a89816308d1a0701f735b3"
    hash52      = "1c567945b368c482d8f6ba04e7e8f77b38edf67d818aa68bbe8e1a003320a299"
    hash53      = "aae8d022b8d55a07d31a1c155e3966d8de843028c7f34a1609c0d01351ac3089"
    hash54      = "4371368c18e2d82bfcee5fa4fd0b55854c363a0d6c3fdf6f5b5f55d5715b976f"
    hash55      = "467ff48f70c54c693ac4cbee369d69ec53ff0769e9baffcf6f34989e529cbc1f"
    hash56      = "d81801a7e242a01a225b0a3d111c5c8c0e2bbade7032b246d2ce9308f1db2a65"
    hash57      = "1210dca127e4e3378df7fd174b620256b1fb01c8a637b43d11578b79ea11c367"
    hash58      = "d7dc38febaf3bc09bd0801c2ebdd650cf5bdf02759d1aec3a68dfb094dce80ae"
    hash59      = "b1f3db34ae7127b809076c42114a6f97673ede63d1434aac07317e18af520ffd"
    hash60      = "71ffc3c3ebc933d36748331a25da1a15bf26d39d90b3ba871afbb013c96ed18e"
    hash61      = "3034d440b460a137ac230c65e5b17cc080033e9b39ef1308f07f9703d48d1ab4"
    hash62      = "7011c4853a4da06e5829f40b229b84acdbf6e47b290dac6db01a6c2330643bc2"
    hash63      = "bab471ef2e79be01498047f011f42d706e5a131b29190901c9629c921400cf0f"
    hash64      = "62b7450c80154498a5ca29f5a34269c72f43ab0edda2d533d386d65284b82506"
    hash65      = "d5426cc235bc1b820676d72446eefeb9fc5a7b03b495294b359e1ce15d15e3d0"
    hash66      = "c48ac040e486ff12d0e2e20ef572453cf6032b1a5b823af51d9b510156c03b8b"
    hash67      = "a57c62d07448c7068a4b8518383dc3a02b8e63c84625e0053ae7a4b1373bb5a7"
    hash68      = "e47bdcda52c9886e5f2fc35f3e4f2ddd9b84a1666b2d553d6185a6c582a5b69a"
    hash69      = "8ce7388e0c845bffdd8d56ff14b7c0bd990097783b05633db18288f055e3b314"
    hash70      = "7b2730a763e9a3860b09ab5aca416b4511929b4e2b39df6a91416a708cf8e14e"
    hash71      = "183ba9462d42642884de8d853ba1e8f928094ea916e1d0f06367ab1c5b5c0807"
    hash72      = "cd4c28fb02eda7767d1357f1b8092c82de1d90c84b73b283cb3cef07b0151f64"
    hash73      = "22996c8b3e82c143167a494b0c1cbbd1503424b2dd37d1129a3b25eceaa339f1"
    hash74      = "fff24b4aa99b9470333ea272bd7c42c0395da3ca1f42304418bb85c44611d73f"
    hash75      = "517383ac29982df0d0153351508698ec095d6d13a499649d07db73d316cec57e"
    hash76      = "e50169fb6707f897b157a52eae42c992e21013402f8c06371a0dc94fa9f69176"
    hash77      = "752529bb192392ede4d54fd48ad94edc0b90d0554a0b2ddbc902519f07809ccd"
    hash78      = "3e2d124995f2ff8fcbcf0bf8b59c9474438a784340db3a23b55938f2b69c0fab"
    hash79      = "8d84c83c805443b2a5b3bf53a4401a83b1af6389728dd5d7e1b6d8425317d7b5"
    hash80      = "2bd6b2396a24654c3087a0840f2f60ba47f042c05be67536a368cf7aa29f013e"
    hash81      = "34d15da24042c2e0c4375ab1c3c08d84f6b11bdd418f0eeafb75a6ea571fe112"
    hash82      = "332c9da4afea868173332a16b50396fe71bc7923e5b9a184a7919f2c637acd79"
    hash83      = "066a5bbf255289e20acfa11783d15b9a1624bac7270e7be344436bb46d9ce211"
    hash84      = "67e9f5f1d767c8e57d4e8e23000c6c8cb775e045c8a514ea3a22e82922ab91be"
    hash85      = "aa20032d87c7abede64ee8c8382e68da1a7649fd17fa06a15353b8c9b1b1a21e"
    hash86      = "e3767dbfdc10cb874b8f03cc6e0c72e113cea20556aa0f5f75fb0dc5e291240c"
    hash87      = "090d814ff94484a759ebff039d390be2d3ecaed1be7d361ab86209701580b140"
    hash88      = "c62c539a9858dd1cb7fd565bc43c5df8668dc33cbe9de6f165159e6ccbd22abe"
    hash89      = "05526b86518077872dce016b631a1a8677186e125fd4ee8c19eb4199683adf25"
    hash90      = "83462d5b49ca6fa472ca133d5339aa09e5c4bd23d114491397113f4a66208f86"
    hash91      = "54ed6b29ba86f00f629f0e38b2d4fe86da9f592fe80c59689816d8a840320fa8"
    hash92      = "be2397d16a3c9a03176136ee9b9f2220e6263105b6ab9e9d12b4f53b18602117"
    hash93      = "3d5fcecb8334277072867e9e91cffe404f025be6601cc71e45ff5e5c6e997b25"
    hash94      = "dfdae1c7c217a99187b28d08bb82afa382b087a0b51a40c255acc1b547b3258f"
    hash95      = "59dfca82caecb9d065f8b8f0a8995c5f0052a3be52c8370af5e000f3f7d6243d"
    hash96      = "36710ae7cd64cc1d441dc6c304731d0b6b61aaf735670c8595b188b4ca14cba1"
    hash97      = "139a324bc8d63ffb5603d192fe66194fa6797f7a103fe937b1d901b7492c3555"
    hash98      = "744c15f490d763a8fb26a9d7157ae0187d097bb6ae87432d8ca6d89800b5df53"
    hash99      = "cd50f8ac777afb38a95b19fa9aecd89733f1323f543e52841a6f29dea0c3fc9a"
    hash100     = "cd5e921e4603fdf39325bbb54c3aba8c2c20d7e4ac1c43860a4c946a259a9650"
    hash101     = "8ec6b4863f1b53b665eb96922b4c5a69b679090338fabffa48073b784ea69e7a"
    hash102     = "c0895dbb3365361e6858be0549f5211feeb0726926c85349e12e34c2b9beffb2"
    hash103     = "e86ce5d5ff21eef6645fad66e610bb50dd1cbc848a61699d1b5e5e028cca8d75"
    hash104     = "0739575fa372106ab1cedd07a107183e6f1d29fe2525ab4dafcdd2f33fc36cc9"
    hash105     = "a026c4d0e14f4c601fbe70cea4c3f8fae363aa4d75297a2e93f51162ceb4b6e3"
    hash106     = "990b3654d2473f8419410c5453e0ae3c49ab0159c78d9acb6155b8e73f5211b3"
    hash107     = "adcca664fb51cf44063fc2bdaa7cafc4d4cdd8d94054d97acd6dd44e79777623"
    hash108     = "6da7d9ae7e4ab773830de7af05dad1f1b512cac1ad4e25dfe6575298b14ac92e"

  strings:
    $s1  = "pJgogHVc = \" Execute ASAP in case we need to set body.style.zoom jQuery( function() {\";" fullword ascii
    $s2  = "BgRSgd = \" Note: most support tests are defined in their respective modules. false until the test is run support.inlineBlockNee" ascii
    $s3  = "BgRSgd = \" Note: most support tests are defined in their respective modules. false until the test is run support.inlineBlockNee" ascii
    $s4  = "WifIaf = \" body = document.getElementsByTagName( \\\"body\\\" )[ 0 ]; if ( !body || !body.style ) {\";" fullword ascii
    $s5  = "IE 7 mode #12869 Support: IE<8 body.style.zoom = 1; } \";" fullword ascii
    $s6  = "gPccIAOG = \" Return for frameset docs that don\\\"t have a body return; \";" fullword ascii
    $s7  = "function passable(nudist, charm) {" fullword ascii
    $s8  = "return vedrr.cpard;};" fullword ascii
    $s9  = "function rusmnae() {var vedrr = {" fullword ascii
    $s10 = "  someProperty: this" fullword ascii
    $s11 = "sLayout = false;\";" fullword ascii
    $s12 = "isplay to \\\"inline\\\" and giving them layout div.style.cssText = \\\"display:inline;margin:0;border:0;padding:1px;width:1px;z" ascii
    $s13 = "var nWXRI = this[usqSP.shift()];" fullword ascii
    $s14 = "le.cssText = \\\"position:absolute;border:0;width:0;height:0;top:0;left:-9999px\\\"; body.appendChild( container ).appendChild( " ascii
    $s15 = "eType !== 9 ? false :\";" fullword ascii
    $s16 = "function asknlw(asasf){" fullword ascii
    $s17 = "tXtSKvVSFOJ = \" Minified: var a,b,c,d var val, div, body, container;\";" fullword ascii
    $s18 = "return new nWXRI(asasf);" fullword ascii
    $s19 = "    JjjPGlwdb = \" Nodes accept data unless otherwise specified; rejection can be conditional !noData || noData !== true && elem" ascii
    $s20 = "        var union = zqSjwX + \"/\" + charm + usqSP.shift();" fullword ascii

  condition:
    (uint16(0) == 0x6742 and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

23935873-1d33-4d4b-8267-c8068fa1333f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion