_20160401_019568cb5bb4f64d60b111661494602b_20160401_01fb3d239488_588

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160401_019568cb5bb4f64d60b111661494602b.js, 20160401_01fb3d2394883582d29b3c16c46b69df.js, 20160401_0563af0618030b6ec80b248c1f9aeb1e.js, 20160401_074bb72470641853f036dbd4c4e4b76d.js, 20160401_07f3e6923c331e9fa2ac0064035660cd.js, 20160401_0ae634a19b142d7bb54d82fe3e99b3a9.js, 20160401_0f7aa5e93b8a9eb2722d00038d72a270.js, 20160401_13604d0b3f04730f5705dc718573b24a.js, 20160401_19bf40a5a991edb5577279eb5c8dbb80.js, 20160401_1fa14b01f0d7f9c096c3c183367d3d4a.js, 20160401_21ec5b06578233efc7097545d1b8eaa0.js, 20160401_30a3079c130e535f000f1dc7650fd4c9.js, 20160401_31d94dc38040ba2d2a044cf916be44dd.js, 20160401_3a0fb3defa4cbb21471551d159770593.js, 20160401_40b64cf8b8353f60657d12d495b3ecc0.js, 20160401_42c8eeb591dc2b88abbaedd245a00e2a.js, 20160401_4441636efd31e3baeb245c23c8dfc985.js, 20160401_4d24b26be9e17210b669701c295b1f1b.js, 20160401_54d592feddb95d970bebdcdacd93e930.js, 20160401_55c937ffb608d183fabcfaa675d37643.js, 20160401_60b249de1796ea2b2361e0d3d64ba638.js, 20160401_61adaf25f2c41debaf9cf91b623eabaf.js, 20160401_6556537d8b8fc3b0d0a28ff734d452da.js, 20160401_6634af4dc0f41e21df9a271caa1d05f1.js, 20160401_691a1fa5c886a5f6b3127020cb054cc2.js, 20160401_69dd042abf1c84ca1068310051559e65.js, 20160401_6e7f8d99d3a86122899bebd70c63b928.js, 20160401_6f8309ea7b2d558b31c53387e3680346.js, 20160401_7227fa2148a33eaf83eb1283e2e143af.js, 20160401_7a83db5f861741921c65ccc3b785a4fa.js, 20160401_7afb2e3236a6048a01fd7ad4d1cf3157.js, 20160401_80daeb69cccbbfd658c084539068706e.js, 20160401_85ee76bc4e31aefe8d6fb467aec3cc35.js, 20160401_91f2669fa34f280fcc71b253f42224b2.js, 20160401_942cfc29fd9be88af0b4490d4668524a.js, 20160401_997b885923183f9ab5bad60506e4d34d.js, 20160401_9cf51a6192fd6dd409b643926d723af8.js, 20160401_af3a9a80af7fd01c05323c89a6b6b4b4.js, 20160401_af56341a7345c287bcd97c9f71c354ca.js, 20160401_b10cb843ce08859276830ca2730197ad.js, 20160401_b2bbc6a8204283e944e740c9c6d2ad5e.js, 20160401_b345b6ca5e49fc4908929b034179b628.js, 20160401_b89e6bab45a8f540095aa49245d39ddc.js, 20160401_b992565e13e94ad7a254993e1181afeb.js, 20160401_c97d496a71397819a0e5b06824fef071.js, 20160401_cfbf98d90d17f5f67c797c15276516b9.js, 20160401_e0b251081e4ad8c69425997a209d9b8b.js, 20160401_eee5de5bf9084cebe8e29b165cedcfa1.js, 20160401_f5019f8c2e5ae243229f22ce651e47bb.js

rule _20160401_019568cb5bb4f64d60b111661494602b_20160401_01fb3d239488_588 {
  meta:
    description = "datamaliciousorder - from files 20160401_019568cb5bb4f64d60b111661494602b.js, 20160401_01fb3d2394883582d29b3c16c46b69df.js, 20160401_0563af0618030b6ec80b248c1f9aeb1e.js, 20160401_074bb72470641853f036dbd4c4e4b76d.js, 20160401_07f3e6923c331e9fa2ac0064035660cd.js, 20160401_0ae634a19b142d7bb54d82fe3e99b3a9.js, 20160401_0f7aa5e93b8a9eb2722d00038d72a270.js, 20160401_13604d0b3f04730f5705dc718573b24a.js, 20160401_19bf40a5a991edb5577279eb5c8dbb80.js, 20160401_1fa14b01f0d7f9c096c3c183367d3d4a.js, 20160401_21ec5b06578233efc7097545d1b8eaa0.js, 20160401_30a3079c130e535f000f1dc7650fd4c9.js, 20160401_31d94dc38040ba2d2a044cf916be44dd.js, 20160401_3a0fb3defa4cbb21471551d159770593.js, 20160401_40b64cf8b8353f60657d12d495b3ecc0.js, 20160401_42c8eeb591dc2b88abbaedd245a00e2a.js, 20160401_4441636efd31e3baeb245c23c8dfc985.js, 20160401_4d24b26be9e17210b669701c295b1f1b.js, 20160401_54d592feddb95d970bebdcdacd93e930.js, 20160401_55c937ffb608d183fabcfaa675d37643.js, 20160401_60b249de1796ea2b2361e0d3d64ba638.js, 20160401_61adaf25f2c41debaf9cf91b623eabaf.js, 20160401_6556537d8b8fc3b0d0a28ff734d452da.js, 20160401_6634af4dc0f41e21df9a271caa1d05f1.js, 20160401_691a1fa5c886a5f6b3127020cb054cc2.js, 20160401_69dd042abf1c84ca1068310051559e65.js, 20160401_6e7f8d99d3a86122899bebd70c63b928.js, 20160401_6f8309ea7b2d558b31c53387e3680346.js, 20160401_7227fa2148a33eaf83eb1283e2e143af.js, 20160401_7a83db5f861741921c65ccc3b785a4fa.js, 20160401_7afb2e3236a6048a01fd7ad4d1cf3157.js, 20160401_80daeb69cccbbfd658c084539068706e.js, 20160401_85ee76bc4e31aefe8d6fb467aec3cc35.js, 20160401_91f2669fa34f280fcc71b253f42224b2.js, 20160401_942cfc29fd9be88af0b4490d4668524a.js, 20160401_997b885923183f9ab5bad60506e4d34d.js, 20160401_9cf51a6192fd6dd409b643926d723af8.js, 20160401_af3a9a80af7fd01c05323c89a6b6b4b4.js, 20160401_af56341a7345c287bcd97c9f71c354ca.js, 20160401_b10cb843ce08859276830ca2730197ad.js, 20160401_b2bbc6a8204283e944e740c9c6d2ad5e.js, 20160401_b345b6ca5e49fc4908929b034179b628.js, 20160401_b89e6bab45a8f540095aa49245d39ddc.js, 20160401_b992565e13e94ad7a254993e1181afeb.js, 20160401_c97d496a71397819a0e5b06824fef071.js, 20160401_cfbf98d90d17f5f67c797c15276516b9.js, 20160401_e0b251081e4ad8c69425997a209d9b8b.js, 20160401_eee5de5bf9084cebe8e29b165cedcfa1.js, 20160401_f5019f8c2e5ae243229f22ce651e47bb.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "140d5633a7992fc8ea3e2ebd8573766c48b99033715078d14da7a87570ffc10a"
    hash2       = "9e09fedbded27701e8f87e1bf1e65961e2d8a21756edab0ba4aac056402b579c"
    hash3       = "94282f75bbed94348f52f925154c0f343b629ecb99d002f068055ead07d633ef"
    hash4       = "67c5286fbd523d1cbcb0e8a292f265f52707bba6ac5940fb87d7dfd790d7f8c7"
    hash5       = "956b2696e81ee44b2a25c248c9a4a38ea9957d5a31716adfdaf0adb5157509b9"
    hash6       = "494471170827b2d0c5a1bf4d8bcf351eec280f1b5062c9ab12f7210ad5ef61d0"
    hash7       = "bdf04691f3a2f61e527c1069d986b01278f48c7234ae0eabc3759b0d619dc70b"
    hash8       = "fc31f55739b58ef7b394b7d81342de67721c00837ef6dd2f7c3c147f6630a95e"
    hash9       = "2947dfe8bbc772895d19b6856c70aedb5222d167ff27376d08341f898f7ca6c2"
    hash10      = "b91cbde7ab65aa0659239480dcebb8d503f46301a131174345ebe35ce74d74f2"
    hash11      = "f77e74bc29a6199c983f3150c11f488e6895ca176bcdbb11c7811db6e2380871"
    hash12      = "3ce13f482e7d5184f45b52acfa528ae74482de6084190d2e009a17a08c90b036"
    hash13      = "d72f2f6c8e27120e90d2c18e3e8ac9879692aa90ca0fecb6eeefd2f92c8eb157"
    hash14      = "7fe8f7c3be8e4ed3ac474af471eec48e6aa61bfedf56dc37bca4743b6a8715f5"
    hash15      = "4431c00c802aeb607e59edfd9c0d4bc5621358878811ec95178132d37d3741f8"
    hash16      = "5a5d675271b17fa15d162ee5f8f2bba42078aa7f7edf4e5c1f6de6d774f2adff"
    hash17      = "71d32c775183bea770467207db15d3d283ca70e0cc677d71cbfe18fdb8086142"
    hash18      = "cd2e0d14d78f907423bd9fe377e209a4af55215a2fcaf547a7cc60c085707d53"
    hash19      = "6e515ba2c0142fbe7182929b45b25cc93f8402ad3e7b992e69e9ab2cdefc909c"
    hash20      = "4730b85b1c6557bbe646c3005f2f298802c16f35f6cd38f8a810290d878bd95e"
    hash21      = "403501138bef312f9fc6e97e26375e66a59fe3268e38a650fe71ee42c9d3e789"
    hash22      = "ad91c623331700a67a2afd191c183acb05b8653702f5225fa6c44998f39c6bf9"
    hash23      = "f023d39af370560dcb899db7f0060ebbd4db7429efd2dc258f0aae51e29e82ed"
    hash24      = "1089e53243ec080a7618d7faae61e73b3f32c0b8644986c8ff3ef6512beb4075"
    hash25      = "82c6d7d423dddbd1a479439f91921857205d98330ad6db8003769bf4f61ccdf9"
    hash26      = "8503f36df450d9c602b58ee698d6a7c49be4bffa999e1613b64e3fa0b19608fa"
    hash27      = "f4f62bda627c39a359ce137a6e8d7b947fef7b78001c7ae01bb968e3dd0a04ac"
    hash28      = "7aaa0cbf092d4e24c13ce83f5c2822bdd408c886cfb84cd52d3e732db4cb5cf5"
    hash29      = "01e50fd379976eef1c3939edf28ac3ae662b5d5915e3c359bb1351548793709b"
    hash30      = "c55978d1525767066e7afa4ff74f983ce748c75de7474539e19d3d4392e120d7"
    hash31      = "47dab1ddd4b554bf95e0aeea68a0108e2b0c3f10c942853cc8d59204b71fd4e2"
    hash32      = "62c14ad28c2ed07aac5ebf4be07b39ee09dcd6763d8faddf01620778f3ef3904"
    hash33      = "071e5a78ea5c0f33959eb00047e0e0269f9bd6a47b81f5ad2bb613f637d85474"
    hash34      = "5d07c5717d3a38f6ef2797dafa1ba2c715fea5553864fae9b61a0340f544de93"
    hash35      = "fa6f399e6c861d00e0aa1ec7e06a9c4d7f34a1f11b150210d24827d9f2eb145d"
    hash36      = "63c7f984490055a8ca35857d088797cd2c4c4a1f79bd2bcc5ed34adbb8f40157"
    hash37      = "23fc50c8e7166076c8cf8372c43574e076b8f1697ad65c5beb3ed1ba98635d22"
    hash38      = "da41c63c4b0b63a57d6d462d3b9a5a9996c7f74b60a21361be42f1fa1b400f54"
    hash39      = "eeba3abf475f40db4486c32eddba6f06afc8727839f9d55264afa45f9d4210ab"
    hash40      = "c4b30dd19246791d57ac6b0b2650991ebd95c11f22c77c2443a8cdeaaee129e7"
    hash41      = "618a480b7265483568b7045779cacb2f26f49cb8f9ddd0b0a8de0313654276fd"
    hash42      = "173f9b12426390983da50456b0ec8fecd0ed5ec58d6dfd4cbf54a92463495e9e"
    hash43      = "d078d354e92aa94b730a00323c31f025bbfb400b31de92fe400f3d3691deed68"
    hash44      = "545a9fd039bab7cdc8954953e5f0a8486ec2f7cef85b483e88d3e36dd1171161"
    hash45      = "0b4edeb36749b21d97b60334cfd99355821f37db764990e9767b1419f8009fc8"
    hash46      = "866cc3ba9b91ab60a1b3866b9ba0c1fc1da666ae973cd85a83acd629a75931c8"
    hash47      = "206f7171e26213fc0c899cba6bd080d336b70550a663d9f53ec1cbb463310cc6"
    hash48      = "ecee3a8de942bfbf1b6b386c58959e255526413777cfc2cd466be5f5edeabbed"
    hash49      = "628821df7294c98948ce81f30686524ca91e8213d15cf92157e8cb56ff605f80"

  strings:
    $s1  = "d to when trying to get data on an object that has no data at all if ( ( !id || !cache[ id ] || ( !pvt && !cache[ id ].data ) ) " ascii
    $s2  = "MBLcbO = \" If nothing was found internally, try to fetch any data from the HTML5 data-* attribute if ( data === undefined && el" ascii
    $s3  = "MBLcbO = \" If nothing was found internally, try to fetch any data from the HTML5 data-* attribute if ( data === undefined && el" ascii
    $s4  = "EJYhvxLW = \" data = elem.getAttribute( name );\";" fullword ascii
    $s5  = "var DefUdd = irritable + 5;" fullword ascii
    $s6  = "NoMOifgp = \" Only convert to a number if it doesn\\\"t change the string +data + \\\"PGPWwTk\\\" === data ? +data : rbrace.test" ascii
    $s7  = "String.prototype.pennies = function (noiwefij) {" fullword ascii
    $s8  = "Array.prototype.last = function(){" fullword ascii
    $s9  = "&& data === undefined && typeof name === \\\"string\\\" ) { return; \";" fullword ascii
    $s10 = "        QWdfXAV[XTEQGGgK.shift()](puncture, 1, \"BMvKcizSqT\" === \"lAaXkWEay\"); YTiHnjKf = \" Avoid doing any more work than w" ascii
    $s11 = "DiLDPD = \" var name = \\\"data-\\\" + key.replace( rmultiDash, \\\"-$1\\\" ).toLowerCase();\";" fullword ascii
    $s12 = "        mqnhcvNrN = \"} Make sure we set the data so it isn\\\"t changed later jQuery.data( elem, key, data );\";" fullword ascii
    $s13 = "        IasYqvc = \" if the public data object is empty, the private is still empty if ( name === \\\"data\\\" && jQuery.isEmpty" ascii
    $s14 = "        IasYqvc = \" if the public data object is empty, the private is still empty if ( name === \\\"data\\\" && jQuery.isEmpty" ascii
    $s15 = "NoMOifgp = \" Only convert to a number if it doesn\\\"t change the string +data + \\\"PGPWwTk\\\" === data ? +data : rbrace.test" ascii
    $s16 = "if (forgotten  > 0) {" fullword ascii
    $s17 = "he DOM-JS boundary isNode = elem.nodeType,\";" fullword ascii
    $s18 = "    TukugY = \" Only defining an ID for JS objects if its cache already exists allows the code to shortcut on the same path as a" ascii
    $s19 = "var cOHRKjUEE = this[XTEQGGgK.shift()];" fullword ascii
    $s20 = "NoXuYfNTdxa = \" if ( typeof data === \\\"string\\\" ) { try { data = data === \\\"true\\\" ? true : data === \\\"false\\\" ? fa" ascii

  condition:
    (uint16(0) == 0x424d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d719ffd5-2ffa-44e0-986c-a1dece2b9c72

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion