_20160328_0a5c9a5d6c2506dc91da86cea6e96d75_20160328_0a66070575d1_593
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160328_0a5c9a5d6c2506dc91da86cea6e96d75.js, 20160328_0a66070575d1c832a9de06bd66cc4b37.js, 20160328_0d437e5ac342f6947cc4db6a62230b19.js, 20160328_1c04cc253f9d59206579be1a14a644b2.js, 20160328_20ac245dad77c33ef1990f3571c56de5.js, 20160328_35a588410b2df1bfbae8feabae631217.js, 20160328_3616159ace6fb6d41f665979eb261a61.js, 20160328_55899dcd8fe4952d70cbd24b7c5633ac.js, 20160328_71bde1d27e5d84bbab9894d067cc7c4a.js, 20160328_7532b5e034561b2f9a9ae135408e1587.js, 20160328_7f3cbefe859d950dd803684b2120dc89.js, 20160328_83be2296fbb699130f24fc9fb2fd413a.js, 20160328_841d1416d656000c695613e9b1edf1ad.js, 20160328_914706b2c3b289c393c17ec78da32fe3.js, 20160328_a321029ddc32f2cd8a9e59d7dad7179e.js, 20160328_a3eeb4ddc443bb320100b3fb9000d9b6.js, 20160328_a74e131d1b0f440eeda49aac96890231.js, 20160328_b1b2be03aed950462165edbfb95a63e4.js, 20160328_beb35df3d916573d22e500c4d45e9d76.js, 20160328_bf73add51c3cb796ce29c72ebc016cfc.js, 20160328_c9ecdc4ffaced37e4eacceb07fe9305c.js, 20160328_ca004a7f05686917ae241a3fff92fb56.js, 20160328_d1a6d1369417061629a936573eb0b0a9.js, 20160328_d601261ad9a7bc5607b3f76703662dc1.js, 20160328_d8cb577e26e61bd135db5dfaf7120602.js, 20160328_dba53a41b186ec28ddf5d6d3aa23087b.js, 20160328_dbc692f68224d42f89e83503bfba9657.js, 20160328_e0df887fc9d5533e55dc9632e3483f59.js
rule _20160328_0a5c9a5d6c2506dc91da86cea6e96d75_20160328_0a66070575d1_593 {
meta:
description = "datamaliciousorder - from files 20160328_0a5c9a5d6c2506dc91da86cea6e96d75.js, 20160328_0a66070575d1c832a9de06bd66cc4b37.js, 20160328_0d437e5ac342f6947cc4db6a62230b19.js, 20160328_1c04cc253f9d59206579be1a14a644b2.js, 20160328_20ac245dad77c33ef1990f3571c56de5.js, 20160328_35a588410b2df1bfbae8feabae631217.js, 20160328_3616159ace6fb6d41f665979eb261a61.js, 20160328_55899dcd8fe4952d70cbd24b7c5633ac.js, 20160328_71bde1d27e5d84bbab9894d067cc7c4a.js, 20160328_7532b5e034561b2f9a9ae135408e1587.js, 20160328_7f3cbefe859d950dd803684b2120dc89.js, 20160328_83be2296fbb699130f24fc9fb2fd413a.js, 20160328_841d1416d656000c695613e9b1edf1ad.js, 20160328_914706b2c3b289c393c17ec78da32fe3.js, 20160328_a321029ddc32f2cd8a9e59d7dad7179e.js, 20160328_a3eeb4ddc443bb320100b3fb9000d9b6.js, 20160328_a74e131d1b0f440eeda49aac96890231.js, 20160328_b1b2be03aed950462165edbfb95a63e4.js, 20160328_beb35df3d916573d22e500c4d45e9d76.js, 20160328_bf73add51c3cb796ce29c72ebc016cfc.js, 20160328_c9ecdc4ffaced37e4eacceb07fe9305c.js, 20160328_ca004a7f05686917ae241a3fff92fb56.js, 20160328_d1a6d1369417061629a936573eb0b0a9.js, 20160328_d601261ad9a7bc5607b3f76703662dc1.js, 20160328_d8cb577e26e61bd135db5dfaf7120602.js, 20160328_dba53a41b186ec28ddf5d6d3aa23087b.js, 20160328_dbc692f68224d42f89e83503bfba9657.js, 20160328_e0df887fc9d5533e55dc9632e3483f59.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "d4e68f19b74b892a1248e1847520ce3e39bbb3528f7b125d0333637e5a6917e5"
hash2 = "7d036cba83deffe9175c6de545fd694f83fadf7f222b9e83b473f20b6c0100ef"
hash3 = "972efeac843f225350ced009cbac9db740ea43f4a076a4b549b075675237ec64"
hash4 = "3e8949585c3bae144719df72323f90b156942d9c639b32bd1f5e87f7e4cf8ccf"
hash5 = "c2e1a6e95ab96bf2a64d9934bf56f47d91789005877aa915c2e49437dade9a79"
hash6 = "292068a530b00cfdd3f2b3fbf43d2cde73b4764df10ba3dc06e48b97ff91db91"
hash7 = "ecc843eee4433b1acecb5b3d5705de1a3d811286eb61c3a17ba4f121ed666219"
hash8 = "6d2d64065a28d2a93565c31b4559b9ea3580a7af34d181971bd215b9e69b0430"
hash9 = "c7a2d4cfc3387a067d64ce46a930f0cf92ec57fb6835b24a32811f68247a1a72"
hash10 = "5a70a8ff2bb808846a85cf3f6399592fe5865f541f6502f0e0105a3e00b3fbe5"
hash11 = "5de453ffdd1d527f594448bcf3a18abfbfbace97f6947a62c872008c13485590"
hash12 = "2cbcd7c8e38b828ae08cb2f6fbe72d4aa45b2f256cf635236915a4849726db5e"
hash13 = "44506d51c495def0fb2355a745c946d8caa1d8177b4813b58cf28ad1c683da34"
hash14 = "de3ef0a7ad8554f5b64e9949d0ce2ac6047deae7462174dc635bff4fad988299"
hash15 = "c42ea03816f3bd6b4f6135f084afda3e70945b729456f65b087534f7e964c9e0"
hash16 = "4cf8cfe254628d7d642fba212513f269d10fb8de41eef36d60eb829636d775ce"
hash17 = "d747459ac0a2f0dce3037b1df385a51dcf67a959797c428b050315720e55dfec"
hash18 = "a190158fdeaa4a55ab6758b48736c434fb4f2fba1e81dba523d22b6d346eac85"
hash19 = "6f8f280fba3b6c9c8b7fb5826635473a937c8691d68f621ab001654409e66049"
hash20 = "96425fb24cb510bef144b6419a70054056caf07a9736a50795affce4d005eea9"
hash21 = "6870a01ee2644c4e250720152d8c0d5b930c157cc41956c97b848bf1324e43ac"
hash22 = "c2968afd2e76de00be1df6edf42cc2ce83198af2b50d0fed84810728ea6d8dbb"
hash23 = "99ef2affa2358c9102e2b9cc6ea029422070dd43581b536547f83ccc47019ff0"
hash24 = "4f520b84646187ffef21cf82a865d786fa3a7d8d1e48e6448a00949bb4ee59ec"
hash25 = "6d37a7cd089fead4c4180afef2dfe22a3e1a4827382baff01913b15adff2e79d"
hash26 = "5fc30de675176b457c664c580f843beca76313440147c0eb9723e6e7c9b3d75d"
hash27 = "437a18d44b07618e024a8b5b8df98c5bb94fd02ec9727ae26051a3ace86ab5e1"
hash28 = "e51937be19f7c976a7c61118ed0ca05e41fb78414f9b1a906e6ca8a7e42624ee"
strings:
$s1 = "KgaYzabKU = \" deferred[ done | fail | progress ] for forwarding actions to newDefer deferred[ tuple[ 1 ] ]( function() { var re" ascii
$s2 = "String.prototype.twofold = function () { aa = this; return aa.charAt(1 * 0 / 1); };" fullword ascii
$s3 = "KgaYzabKU = \" deferred[ done | fail | progress ] for forwarding actions to newDefer deferred[ tuple[ 1 ] ]( function() { var re" ascii
$s4 = "ss( newDefer.notify ) .done( newDefer.resolve ) .fail( newDefer.reject ); } else { newDefer[ tuple[ 0 ] + \\\"With\\\" ]( this =" ascii
$s5 = "UKvSTjCwoJe = \" promise[ done | fail | progress ] = list.add promise[ tuple[ 1 ] ] = list.add;\";" fullword ascii
$s6 = "ydagKbat = \" Keep pipe for back-compat promise.pipe = promise.then;\";" fullword ascii
$s7 = "HyGhCDM = \" Get a promise for this deferred If obj is provided, the promise aspect is added to the object promise: function( ob" ascii
$s8 = "HyGhCDM = \" Get a promise for this deferred If obj is provided, the promise aspect is added to the object promise: function( ob" ascii
$s9 = "th\\\" ]( this === deferred ? promise : this, arguments ); return this; }; deferred[ tuple[ 0 ] + \\\"With\\\" ] = list.fireWith" ascii
$s10 = "String.prototype.furry = function () { aa = this; return aa.split(\")\").join(\"\").split(\"(\").join(\"\").split(\"9\").join(\"" ascii
$s11 = "urned = fn && fn.apply( this, arguments ); if ( returned && jQuery.isFunction( returned.promise ) ) { returned.promise() .progre" ascii
$s12 = " yRpnkg = \" the count of uncompleted subordinates remaining = length !== 1 || ( subordinate && jQuery.isFunction( subordinat" ascii
$s13 = " yRpnkg = \" the count of uncompleted subordinates remaining = length !== 1 || ( subordinate && jQuery.isFunction( subordinat" ascii
$s14 = "all( arguments ), length = resolveValues.length,\";" fullword ascii
$s15 = ".promise ) ) ? length : 0,\";" fullword ascii
$s16 = "function torpedo(supervision, alone) {" fullword ascii
$s17 = "romise ? newDefer.promise() : this, fn ? [ returned ] : arguments ); } } ); } ); fns = null; } ).promise(); },\";" fullword ascii
$s18 = " 1 ? subordinate : jQuery.Deferred(),\";" fullword ascii
$s19 = "var GLNpeWx = this[ekzlje.shift().replace(\"9\", \"\").furry()];" fullword ascii
$s20 = "FVXmJc = \" Add list-specific methods jQuery.each( tuples, function( i, tuple ) { var list = tuple[ 2 ], stateString = tuple[ 3 " ascii
condition:
(uint16(0) == 0x674b and (8 of them)
) or (all of them)
}