_20160520_0098d75b0247ffd42ea8eba890c9981e_20160520_036a76e033b8_595

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160520_0098d75b0247ffd42ea8eba890c9981e.js, 20160520_036a76e033b89a43cc043a6a2f901c84.js, 20160520_0778b3af6af6d87b328d3827ce30f87d.js, 20160520_089074301e3a2a77c415a5a93c764103.js, 20160520_0c1d026d65329af7b07f1572b63cd593.js, 20160520_0c35a7027f1f1df99c5ac8edae450942.js, 20160520_0f321443dd33ffcda14d6399233bd0f4.js, 20160520_125e8c3119b8164564fd9f774f40365d.js, 20160520_14af9f53b2d271541cf99fbb09533c2e.js, 20160520_1595a6869efa1ffeea561f2bd6191d9f.js, 20160520_18eec7ff92f2af824b0bdc6913ef8ed7.js, 20160520_18fed270a8a18fffda4d1ec7306574f2.js, 20160520_1aeb07465d7627ce37d3f210a1b04856.js, 20160520_1b0ce3c7265a402b060c5922e596f80a.js, 20160520_1b90edbd6ed2d212a7bafa0d47491b64.js, 20160520_1f5c926d48288114871522158ca3555b.js, 20160520_201b2baee1654890e313a096b12beb3d.js, 20160520_2022569fb477bc238b1e9ac135b6446b.js, 20160520_22bb3dbf2dbb4b0a8c8c51ac23fd70d7.js, 20160520_234af0a496b5b79573c5751fba3a2d3b.js, 20160520_24f12e492540adf5f3478b59ef07e560.js, 20160520_2545dd1bdec2dd782f9fd754c591852f.js, 20160520_25f9377a4a3f898aaf79e226c38a4eb2.js, 20160520_27fc761969fefd48bbddaed6cdd20357.js, 20160520_2800794e784342895b1db20ec08c05cb.js, 20160520_2a7bd6363c3c4e21a3405871e2c16377.js, 20160520_2b8f4cc074c0b4cf883abec689e320d3.js, 20160520_2ba6c190cf5bd5308f2699b41c8f5374.js, 20160520_2ec019e1c03206eedf06222e38289480.js, 20160520_2ee6a4b7fa9bdeb28fc55309b437a02e.js, 20160520_2ef0ba5c01b670f95338dc9492beb7a6.js, 20160520_2ef2b4c5d9117c66691b702b1aab99cb.js, 20160520_2efc698df5528db2d95588a5cd42e960.js, 20160520_3113b8f5bfa9cd278c5d0927e6f77301.js, 20160520_32e681f8b2656b18ef3ce28ae02e8253.js, 20160520_348c1f6b7503a9948232784fee88695d.js, 20160520_393db343726e609800dec373139ccb27.js, 20160520_398b9fcf3f3f6188b1e6d7e4b5864964.js, 20160520_3a41cc1d1e3914069febe2cdf5555d7d.js, 20160520_3a77ea8887b955dee6a73011687b1b26.js, 20160520_3b3fa18c76cef86487b8493556eccfaa.js, 20160520_3bb8aa5d8fa233543919755b0389c3ee.js, 20160520_3c3d13e09244c7756fe68edb6b853660.js, 20160520_3d76a728a7c89586277df6b254cb1561.js, 20160520_3de677fd1dc2b166f43365f3078fa7a4.js, 20160520_3eae1bb0af2a4cedfa29c821b51527f9.js, 20160520_446a4dcfe13ab5895caa1eff2f8a196a.js, 20160520_459f1278d5f2a75f043ae6fc2f1a7781.js, 20160520_495b43152091193b7e77cc6d100f9078.js, 20160520_49e3fec676f3f0141c0bdcc95e2cfff2.js, 20160520_4a208d8cd726768c477b2cfba7980ec0.js, 20160520_4c6f456282f1b1c42fb021440c4056af.js, 20160520_4cfd97af347a9ddde053c2ca2ffb9798.js, 20160520_51e5f95acb245e11f66c3c412939c4e4.js, 20160520_560b169b0dbdac93e1f7348516bc0089.js, 20160520_578a9ffe14792af9a547bc95fadf7695.js, 20160520_5c1fa1d6dd40b7b6e395560f43d736a0.js, 20160520_5d6bad2adb20e452cd7c74b21e0a0184.js, 20160520_5ddbcd9d61e9b876220f6fff863d312a.js, 20160520_5df0296a41362859a7e6a622ff21b49d.js, 20160520_5e9facaccc08fce34bdf6d6bfd25397a.js, 20160520_645615a5cd3e39ea0a9fbe52c9508d0d.js, 20160520_65251a9c5c52236389d1ca43a8a9ec10.js, 20160520_676d82a915c4a2b4a2be5a281057ed0f.js, 20160520_68f95b29ec234f22659843626da6cfa0.js, 20160520_6c51cc9c1c6242c53f4c5a14472f330a.js, 20160520_6d9dc49eadddd95faaf1deba5709c028.js, 20160520_7283e03aea669dec9b85968e1cc73510.js, 20160520_7747f90ee9ee0e8d0a728c0915dc0165.js, 20160520_786221f084ed896c32819ae1e77e7c61.js, 20160520_7d194bd331d8a45c97cdc6cf864cbd04.js, 20160520_7fb8d5bfe0df44bad64412f094f7c949.js, 20160520_86c92e7949dba1aafb740c50fef553a7.js, 20160520_8a9d605e10a9c0e477c0b24f51707c42.js, 20160520_8dac6dac81f88e3faaf89c5f8ac79617.js, 20160520_8de24393eb4d3ccc6b6b36d0578bedc1.js, 20160520_8f1d062e6b5929e77fba7d5e1e42f42f.js, 20160520_8f3f8a2e09c0c01ebcf8b223f86c73a1.js, 20160520_90e9f5183490b72b3e88ac53811c2702.js, 20160520_9325ac6ca10adea04f695a0b50d97996.js, 20160520_9497f002f3e48527cfd6f833f303689c.js, 20160520_9515fe27505a82c51d634e2743f83fe6.js, 20160520_95d6295833988018f4b2a0dc45645464.js, 20160520_9adb2d4090b032372a06e0a971c8100d.js, 20160520_9c05556cb1930e6b542a1909503402c3.js, 20160520_9d529702284bae9f41bf87ed88a65035.js, 20160520_9e1f7c1546da2f4aa46c542450140766.js, 20160520_9edc9597218f2ea4fca64225ee9f202e.js, 20160520_a14e19ce022f4dfe0f8ab4d0234a3593.js, 20160520_a1b85dedb49d0f99d105ad13c7c541ad.js, 20160520_a29a8126311b757b930d03f8d4dd9c4d.js, 20160520_a3f4f5f7a097a3421e06e91e4e5628eb.js, 20160520_a4e090d16f42e75c443641b3f19ef07e.js, 20160520_aad59d30d99292a0bd7e0dab2d27e226.js, 20160520_ab29610f85969fbbfda2b0b46d2ed235.js, 20160520_abc383c7783a3295e9284fd0aa034df3.js, 20160520_ac6a045ffe4fb7850e9c603cd78ddf07.js, 20160520_ad23fca439f5a0e39d51b6d75360f685.js, 20160520_ad94e8fb21fe30a475e1d2a183d79dd6.js, 20160520_b115bb90a3b185003016f2caecaee3c3.js, 20160520_b20129f6fe377b4bfd44950e8646ec0f.js, 20160520_b4fabfb2c80204f1997798a83e63a387.js, 20160520_b6eb84f9c2892d0fe30dbebacb177587.js, 20160520_bbb7bca9bb0487e5920d14a9a99704c1.js, 20160520_c1e17ed75ab76275a238e7379c2191ac.js, 20160520_c28a02f073ec1cdb41907c08b4d08597.js, 20160520_c7478dc1f41dfce75982110f9ef094f5.js, 20160520_c958318fbc981a7e428495b36a74b785.js, 20160520_cf987fe4468052d1a6f6165a4a8edf95.js, 20160520_d11d23e524b5472446c7baf6f9df360f.js, 20160520_d1f7a898b2afead3f705304f0ed3166e.js, 20160520_d228d6979d04b890a44c46e13de8c487.js, 20160520_d5a9463b271bb523c4df5bb4768aab8c.js, 20160520_d65a4358667df68456d553053ca9212c.js, 20160520_d6c16e0e382b2ee7211ea8da38bb5265.js, 20160520_d79818b8e8f1cc5bb4b120c3d9555da3.js, 20160520_d7dd7a37c35b5a0eec2ec74aae3b3a51.js, 20160520_d7f7a9ec1634e55088b933f2311e8bbc.js, 20160520_d99681365cc337ca898d30c902ef3c62.js, 20160520_dbc937890a19b3e88826afaeda6c847d.js, 20160520_dc09e6ec6f1e304b10547c3f31af4b4f.js, 20160520_dcba55fa5d4f801276e6a25940c4519a.js, 20160520_deb5b27dced317acd6c0a1201e5e5b82.js, 20160520_df3ae121b55e024bf3f1668338731111.js, 20160520_df845ebd337c7f0217d5a3416847670f.js, 20160520_e0f720fcaccdbe3f1c0044430ec83fbb.js, 20160520_e2cf36b4108d47e7801489ef9b964841.js, 20160520_e2e75b1a1c1f093c438b6abbc8bfadde.js, 20160520_e3e35e34f0c22d5ea54c71cb810c6f74.js, 20160520_e537c06ec1b7896fc63685b0bac82408.js, 20160520_e5fc4299e4bfb8b563ad77ffc4c7a086.js, 20160520_ea6699f1ccbb14ec43ba78f683665758.js, 20160520_eb145eb97180698af052ef4fe2c52b0d.js, 20160520_f07b5e9a61d0da4fdd11d690ca565388.js, 20160520_f156eab2648dd9ec754b489810171d8c.js, 20160520_f7d317c5684607785e1a5f113d77a607.js, 20160520_f992cddfa4df7a606e2a201c71d85c9f.js, 20160520_faf22a2ec9cc8435ce06ea5d4d7094cf.js, 20160520_fd24b1e402820177b4c68b2645240958.js

rule _20160520_0098d75b0247ffd42ea8eba890c9981e_20160520_036a76e033b8_595 {
  meta:
    description = "datamaliciousorder - from files 20160520_0098d75b0247ffd42ea8eba890c9981e.js, 20160520_036a76e033b89a43cc043a6a2f901c84.js, 20160520_0778b3af6af6d87b328d3827ce30f87d.js, 20160520_089074301e3a2a77c415a5a93c764103.js, 20160520_0c1d026d65329af7b07f1572b63cd593.js, 20160520_0c35a7027f1f1df99c5ac8edae450942.js, 20160520_0f321443dd33ffcda14d6399233bd0f4.js, 20160520_125e8c3119b8164564fd9f774f40365d.js, 20160520_14af9f53b2d271541cf99fbb09533c2e.js, 20160520_1595a6869efa1ffeea561f2bd6191d9f.js, 20160520_18eec7ff92f2af824b0bdc6913ef8ed7.js, 20160520_18fed270a8a18fffda4d1ec7306574f2.js, 20160520_1aeb07465d7627ce37d3f210a1b04856.js, 20160520_1b0ce3c7265a402b060c5922e596f80a.js, 20160520_1b90edbd6ed2d212a7bafa0d47491b64.js, 20160520_1f5c926d48288114871522158ca3555b.js, 20160520_201b2baee1654890e313a096b12beb3d.js, 20160520_2022569fb477bc238b1e9ac135b6446b.js, 20160520_22bb3dbf2dbb4b0a8c8c51ac23fd70d7.js, 20160520_234af0a496b5b79573c5751fba3a2d3b.js, 20160520_24f12e492540adf5f3478b59ef07e560.js, 20160520_2545dd1bdec2dd782f9fd754c591852f.js, 20160520_25f9377a4a3f898aaf79e226c38a4eb2.js, 20160520_27fc761969fefd48bbddaed6cdd20357.js, 20160520_2800794e784342895b1db20ec08c05cb.js, 20160520_2a7bd6363c3c4e21a3405871e2c16377.js, 20160520_2b8f4cc074c0b4cf883abec689e320d3.js, 20160520_2ba6c190cf5bd5308f2699b41c8f5374.js, 20160520_2ec019e1c03206eedf06222e38289480.js, 20160520_2ee6a4b7fa9bdeb28fc55309b437a02e.js, 20160520_2ef0ba5c01b670f95338dc9492beb7a6.js, 20160520_2ef2b4c5d9117c66691b702b1aab99cb.js, 20160520_2efc698df5528db2d95588a5cd42e960.js, 20160520_3113b8f5bfa9cd278c5d0927e6f77301.js, 20160520_32e681f8b2656b18ef3ce28ae02e8253.js, 20160520_348c1f6b7503a9948232784fee88695d.js, 20160520_393db343726e609800dec373139ccb27.js, 20160520_398b9fcf3f3f6188b1e6d7e4b5864964.js, 20160520_3a41cc1d1e3914069febe2cdf5555d7d.js, 20160520_3a77ea8887b955dee6a73011687b1b26.js, 20160520_3b3fa18c76cef86487b8493556eccfaa.js, 20160520_3bb8aa5d8fa233543919755b0389c3ee.js, 20160520_3c3d13e09244c7756fe68edb6b853660.js, 20160520_3d76a728a7c89586277df6b254cb1561.js, 20160520_3de677fd1dc2b166f43365f3078fa7a4.js, 20160520_3eae1bb0af2a4cedfa29c821b51527f9.js, 20160520_446a4dcfe13ab5895caa1eff2f8a196a.js, 20160520_459f1278d5f2a75f043ae6fc2f1a7781.js, 20160520_495b43152091193b7e77cc6d100f9078.js, 20160520_49e3fec676f3f0141c0bdcc95e2cfff2.js, 20160520_4a208d8cd726768c477b2cfba7980ec0.js, 20160520_4c6f456282f1b1c42fb021440c4056af.js, 20160520_4cfd97af347a9ddde053c2ca2ffb9798.js, 20160520_51e5f95acb245e11f66c3c412939c4e4.js, 20160520_560b169b0dbdac93e1f7348516bc0089.js, 20160520_578a9ffe14792af9a547bc95fadf7695.js, 20160520_5c1fa1d6dd40b7b6e395560f43d736a0.js, 20160520_5d6bad2adb20e452cd7c74b21e0a0184.js, 20160520_5ddbcd9d61e9b876220f6fff863d312a.js, 20160520_5df0296a41362859a7e6a622ff21b49d.js, 20160520_5e9facaccc08fce34bdf6d6bfd25397a.js, 20160520_645615a5cd3e39ea0a9fbe52c9508d0d.js, 20160520_65251a9c5c52236389d1ca43a8a9ec10.js, 20160520_676d82a915c4a2b4a2be5a281057ed0f.js, 20160520_68f95b29ec234f22659843626da6cfa0.js, 20160520_6c51cc9c1c6242c53f4c5a14472f330a.js, 20160520_6d9dc49eadddd95faaf1deba5709c028.js, 20160520_7283e03aea669dec9b85968e1cc73510.js, 20160520_7747f90ee9ee0e8d0a728c0915dc0165.js, 20160520_786221f084ed896c32819ae1e77e7c61.js, 20160520_7d194bd331d8a45c97cdc6cf864cbd04.js, 20160520_7fb8d5bfe0df44bad64412f094f7c949.js, 20160520_86c92e7949dba1aafb740c50fef553a7.js, 20160520_8a9d605e10a9c0e477c0b24f51707c42.js, 20160520_8dac6dac81f88e3faaf89c5f8ac79617.js, 20160520_8de24393eb4d3ccc6b6b36d0578bedc1.js, 20160520_8f1d062e6b5929e77fba7d5e1e42f42f.js, 20160520_8f3f8a2e09c0c01ebcf8b223f86c73a1.js, 20160520_90e9f5183490b72b3e88ac53811c2702.js, 20160520_9325ac6ca10adea04f695a0b50d97996.js, 20160520_9497f002f3e48527cfd6f833f303689c.js, 20160520_9515fe27505a82c51d634e2743f83fe6.js, 20160520_95d6295833988018f4b2a0dc45645464.js, 20160520_9adb2d4090b032372a06e0a971c8100d.js, 20160520_9c05556cb1930e6b542a1909503402c3.js, 20160520_9d529702284bae9f41bf87ed88a65035.js, 20160520_9e1f7c1546da2f4aa46c542450140766.js, 20160520_9edc9597218f2ea4fca64225ee9f202e.js, 20160520_a14e19ce022f4dfe0f8ab4d0234a3593.js, 20160520_a1b85dedb49d0f99d105ad13c7c541ad.js, 20160520_a29a8126311b757b930d03f8d4dd9c4d.js, 20160520_a3f4f5f7a097a3421e06e91e4e5628eb.js, 20160520_a4e090d16f42e75c443641b3f19ef07e.js, 20160520_aad59d30d99292a0bd7e0dab2d27e226.js, 20160520_ab29610f85969fbbfda2b0b46d2ed235.js, 20160520_abc383c7783a3295e9284fd0aa034df3.js, 20160520_ac6a045ffe4fb7850e9c603cd78ddf07.js, 20160520_ad23fca439f5a0e39d51b6d75360f685.js, 20160520_ad94e8fb21fe30a475e1d2a183d79dd6.js, 20160520_b115bb90a3b185003016f2caecaee3c3.js, 20160520_b20129f6fe377b4bfd44950e8646ec0f.js, 20160520_b4fabfb2c80204f1997798a83e63a387.js, 20160520_b6eb84f9c2892d0fe30dbebacb177587.js, 20160520_bbb7bca9bb0487e5920d14a9a99704c1.js, 20160520_c1e17ed75ab76275a238e7379c2191ac.js, 20160520_c28a02f073ec1cdb41907c08b4d08597.js, 20160520_c7478dc1f41dfce75982110f9ef094f5.js, 20160520_c958318fbc981a7e428495b36a74b785.js, 20160520_cf987fe4468052d1a6f6165a4a8edf95.js, 20160520_d11d23e524b5472446c7baf6f9df360f.js, 20160520_d1f7a898b2afead3f705304f0ed3166e.js, 20160520_d228d6979d04b890a44c46e13de8c487.js, 20160520_d5a9463b271bb523c4df5bb4768aab8c.js, 20160520_d65a4358667df68456d553053ca9212c.js, 20160520_d6c16e0e382b2ee7211ea8da38bb5265.js, 20160520_d79818b8e8f1cc5bb4b120c3d9555da3.js, 20160520_d7dd7a37c35b5a0eec2ec74aae3b3a51.js, 20160520_d7f7a9ec1634e55088b933f2311e8bbc.js, 20160520_d99681365cc337ca898d30c902ef3c62.js, 20160520_dbc937890a19b3e88826afaeda6c847d.js, 20160520_dc09e6ec6f1e304b10547c3f31af4b4f.js, 20160520_dcba55fa5d4f801276e6a25940c4519a.js, 20160520_deb5b27dced317acd6c0a1201e5e5b82.js, 20160520_df3ae121b55e024bf3f1668338731111.js, 20160520_df845ebd337c7f0217d5a3416847670f.js, 20160520_e0f720fcaccdbe3f1c0044430ec83fbb.js, 20160520_e2cf36b4108d47e7801489ef9b964841.js, 20160520_e2e75b1a1c1f093c438b6abbc8bfadde.js, 20160520_e3e35e34f0c22d5ea54c71cb810c6f74.js, 20160520_e537c06ec1b7896fc63685b0bac82408.js, 20160520_e5fc4299e4bfb8b563ad77ffc4c7a086.js, 20160520_ea6699f1ccbb14ec43ba78f683665758.js, 20160520_eb145eb97180698af052ef4fe2c52b0d.js, 20160520_f07b5e9a61d0da4fdd11d690ca565388.js, 20160520_f156eab2648dd9ec754b489810171d8c.js, 20160520_f7d317c5684607785e1a5f113d77a607.js, 20160520_f992cddfa4df7a606e2a201c71d85c9f.js, 20160520_faf22a2ec9cc8435ce06ea5d4d7094cf.js, 20160520_fd24b1e402820177b4c68b2645240958.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "8db9243c69a5f301716b09e7d9d885fee4e321cd72c626f664cbde14795f8e64"
    hash2       = "cb5eb5f74680a77b7b7555191b1c2cb04f771dd818f393da2d82bb0871ceae18"
    hash3       = "57f1c8dc3df710af63d02d8e41a43be8824a1b50e3854510fe6ec9c262213ba8"
    hash4       = "e7cfc1aa912af1d281c6eb87f53e135610d0fa51ee1a8b66aefff2f4367241fe"
    hash5       = "1b39718cdfe2dfb157f28c67b5b4dc7eded39118221202d2b817ae2a2c685536"
    hash6       = "45831c4bf2e3adc087da0617b5803b52605e660265af9161ec38039a6400c47e"
    hash7       = "864336456307d8bf218f9d44d81d4a36079ad7781a294ab0c2c5824e473745bc"
    hash8       = "a88419c0113f20e1c2fa5efeb5bd3bd38ddabceeedcdd97c2d44b9477ef7b336"
    hash9       = "1489a9d9c64c75a6cff69742cfa80abd75423c2f21686e5fb75d4c022c56726f"
    hash10      = "73ffe4715c37e3708297b84a873d6e0b530cbfeaa13f8672b0fb1bee4725374e"
    hash11      = "1cf533ea706d8715bc52088775cbc0c104e9903e70501449c5f2d05ae2fd5fe8"
    hash12      = "400fbcae7e56a6731cf1684da9c376f06f49492ca6baa37f24bdbaef776acacd"
    hash13      = "27767e8fa174f85c965090c2e2171da39f521cd83f54c795c9822f9bfb313625"
    hash14      = "9b244daa9f4120a1fec62c8e611114a13365b5505d6f9871048a7afce691c82d"
    hash15      = "38b49673793efd836e7d471df766aef50ded31c18280caf31be40244212fb27e"
    hash16      = "2023dffe7e6485603d25928ae2ce8977ef2d47b2164c3512af625366012d1b14"
    hash17      = "b118f639e7fa1b2c3c7cca240796a764a1e69906824340e72bb3cd2066f72914"
    hash18      = "8b1f2b85f022d6d2a3676f3cbe8b8a338f443d629773c51a7c427cc70d900d66"
    hash19      = "671419f5a67f9f6ea2af5712406c7814ae4ad6703b975653030a3ff88d4b0f94"
    hash20      = "0beabf3fdfcb71b282cb1d3a4c77d3fccf7e46d7f31114b003d88b145113b1d9"
    hash21      = "9d29cb5ceb50cc0c1747e35285e080b94145ba38f7e10d5ad18c3aec6c5b82f3"
    hash22      = "a09043ba64955c94eeb0495144a3a7b5c65cf6e6dfd9b75093ac4753566799d9"
    hash23      = "d60ebc9f6f0c8038beb624efc4fdda76e0e5ea69b6c1a48824d1eefde39c98ff"
    hash24      = "15bd85f0d2bd3ced7676b92937fbc8616b016684cb20867a2e2c1072cecb1b51"
    hash25      = "0cc340aa5e839cba1185ce5fdf84a279189a49617befb65cd168823cfa100358"
    hash26      = "5340ceeec7adf72778d08771d62594e1e31e1edaab84efed988a2708f9699336"
    hash27      = "389f0e148a74658bf25e954cd50742bd987162ac94bf1bc874faf2300825dd02"
    hash28      = "352cceed8945bd878a4bc77016e0cf5c407fd80121af9bd946084f9ca0a9af28"
    hash29      = "a583359ef64aa6d622c8dd7ad8c115bd08f6103fb31919d8db9662124cfab671"
    hash30      = "43bca06a9ac310ab81c8768e24ab513abe85d4bc8e477380815c9649e5970cd0"
    hash31      = "41629fa1e3be89db49402a7ecf9ac41e70ffa859015a05f20a303fe97fd21c2e"
    hash32      = "52288069b70fdcab83e221aff0997314767b2cf73c5303df915301ad3f603c7f"
    hash33      = "82cb5d8347d0bbcbb3b9413b14ca8c1fa5b1c2ead063af2abd4c861ba7a8b68a"
    hash34      = "414da078aa75181dae4f03f01e1ba4b64914f6ad976f2eb4909d5cc5d73e1de7"
    hash35      = "87a9659bbda1e7f25717bdfcb414e6bbf72a71e4727631561f42b7506e4bd12e"
    hash36      = "611a56060d0e28bddf3de4c9cab9698e11dc8df50665b0f32a8749b4ecf745c3"
    hash37      = "04b3e3d4eb99cda54f06009a1e2a648c5da082527b5b73fda9e269063c7525f0"
    hash38      = "226494154fa80c69cdc9823b8d7f1d5189051f5ca7f949dc25d1146b4ac4edd0"
    hash39      = "a9f006f4deee2d3bd73b8d54ab94a87314c25617677883a02d5d5163432d0c16"
    hash40      = "c33a5b04d41659957f2011e1d122d5043c573f81be4ef18e01e81d7ebb375663"
    hash41      = "aa80e7975e8fd35ae905eaa510a5c94245599fd4b8bb4d173fc2141c199dca98"
    hash42      = "48917d9c676a893afafde52e1268817460b9a4e99dcd51528dd446d84134fbd0"
    hash43      = "a3a5d054d48b8df0a081ded1f876daf0f39776d60a75eada103b0851f803cfa1"
    hash44      = "cc75a350dbe058c38b0a97638feb6e202364851f7309abd51bd7c7f9c7eed850"
    hash45      = "dc9cee14a9664bb0edd469f4de8e6af0d8e0089224c009755268cde05c227baa"
    hash46      = "fec46fdfcfbe8ffd6655b2776a7ac8114ae8f19498a0b6140f6771d70a0c9796"
    hash47      = "ec16d8dab1160a4003a8e020b58e18ec722cf776cd8fb499d6e04ebd0ef99cf1"
    hash48      = "825ae7132fbdedaa9f9ced87ba3582c29a2bd4495dc33283bb1553e46e31fb6a"
    hash49      = "96723e127b8b4a276231f649b500f8ccc9a7555239ea6a188900fda7489ea2b7"
    hash50      = "3f0bacb071c286d349172bccaa3130a53c8d50b9d76177a83297307793cc22cd"
    hash51      = "4e01214e9e5d1b2b930450c5527f0d7a173dcb22e72bd5423e1cd0c581377ea9"
    hash52      = "0b142597ac08fae9ac5cacf8530ab53e8986eb7b08d65775b5da6eb1dafeb8fd"
    hash53      = "ad7d73f4a8742901772f584beab277b964bd29942412281dd124c4c5ac9a6671"
    hash54      = "36f17d4429714f71c6ae4b7d7722e0d22d4651fe26f3f4361b7c0affcb291a67"
    hash55      = "a5117f3d97f7a12b82224f41aacb8b0f62f7c8141b0ae464b05354379e67d077"
    hash56      = "db7ae120c3166bc83f56aa8555f1c0d842ca65834c5eddc41bf9f607fada6e66"
    hash57      = "15b1e213c88daca08debe394e92d41537bd7ced5e87778443d1e625e3c63f169"
    hash58      = "6270311c99f11d0f99b3daae964d756621c087ae7b61cdcbeefafe0c9ea12f56"
    hash59      = "1f3e8f44d09237f80f05ee10f3939c37a9345b758b79491804fde6f165a72253"
    hash60      = "40ebffc8420d6b4adc55d8b4a971a8b52a47035f94de1212cb200655851e75a5"
    hash61      = "539f5d903eb7c7e24806ecf7b35796dd43916f639212c181b47e0be1ea24139d"
    hash62      = "1da5f298519708cf4c2bdcafad5f6628237494ef1ff235d25d61242adca5b850"
    hash63      = "c350c9d9ec67d6e172c6c76f010928d4267878171ac0a9e602c3fe377bb2452d"
    hash64      = "38b01295d3f22443a39f0b3493111f27df89fd7aa161085e90080e76993ff4cc"
    hash65      = "9363322e34876b22ed75e2d2e49ca253db5e5ac16ce7edf85da3c4cdc7fb2747"
    hash66      = "2e6512d8679bb6fac6f65829ed96fc9fd3165cd8301bfc1acf1b54a021444148"
    hash67      = "379ec93bc508ed4665feda0205b626279774018e872f1376a8854dbceeb860ed"
    hash68      = "c8d4a94173d84a76cc7f0914900829c2fcdacf1387cd0cede08cea10e40be128"
    hash69      = "bb89b634d53f332ef2e05ec2279a79b4e0c511c1157462a16a15a167ca073ade"
    hash70      = "71bc32890898fce82ec96c776524f0f5073ef5ee374850e4372d673c133de39c"
    hash71      = "a266dd1b8f83669a47501510b1b4cecdfb2cd1bcaa6baf22d20404a4398644cc"
    hash72      = "f9a8e24673b3ee0215bd63dd337037c6a26249854fc9e05a272bff9dc67608cc"
    hash73      = "dcb53e79b58370958d20d106b851cdbafcee38e4c748db6d53386217b8571bc8"
    hash74      = "b16f14cd91d92efaf37aac79422a80da199365ef934e51b14393ecc5303d28ee"
    hash75      = "a4992a490190463a775c537adac090f6685b50117ed8e6d67f0320a21f92a872"
    hash76      = "5893f817de7227bab0eab82530a394387dffed09e24fd1654515d1154267546a"
    hash77      = "01d119c57c76e4a22d2db2f291fead077cdb3f2d21ef6ebd3490030dd633455a"
    hash78      = "89650bafb817c9ad4937c3e188b5a03231a5b00bf08bd93eb3d8990afb42271c"
    hash79      = "332e8c0e921c03358252b279094c5bdf1a1e89a1d485cd7140ec86e4127a1eb7"
    hash80      = "8a098f7623893e20e6ef07333ebbd82ceabb2534ef9d8c5c5729e59a0cd3c35a"
    hash81      = "1746e919899964563fc3e9f765cdcefe8df8a18aae975377295064d0eacc3fb1"
    hash82      = "354dbd4e9c13531db7d097e104ea2dde4ffd1fb23e5fe14f90618a7499c82f56"
    hash83      = "5e11a03a6902f61c71833719f750f8b02a31246231cd7d8ff3a9385f963ad150"
    hash84      = "9db45295b44dc37ab7d53e00fd64ab2129d5c3d04f8d0b915e6f0f53177e4d9d"
    hash85      = "071c2cbf90aae40fb5d474b474dfc684632858283068a10a81dfcde41b229d89"
    hash86      = "f70dabb66e16ce97bb6f15f500d857cf1c36f4d6579977faa3d35e819409b2df"
    hash87      = "1265e82825fc6aa45580093bb6de701e20899be345e5f3bd17ed71827d3ee3be"
    hash88      = "eef1f414d6ae4be0bad363ea7c2d5004711b63e212aed9ec7ad48eb1e0c0c4df"
    hash89      = "023c7734607fc9f43ac38489fd09c3bcaf4d1f68dee949ecbeca832824213ef6"
    hash90      = "b6763c5e7a3bdc92361af89ee4b5605a793b741e222ed93ea8e8f4a41400c325"
    hash91      = "9de29a4de99a1b9eb80f4f525e369bc3b2dc00d4c3fd62b07f08aa40feeae80d"
    hash92      = "bef6e7b64d3d9d75988bc9d0a01ba94aaa6e3b425e690847fbb7b10d50f95b8b"
    hash93      = "b9d2e51ade6424c4094c8cde4f352c82d19653c08aaa42e27d46d613e399cee8"
    hash94      = "68b42b38ea936c3d8e4dd449b7ba2f90badf9c2c41b4e5f2c8b25b012ea15dcb"
    hash95      = "9a135fca9cbde9f9b9dd3398c0ad8a35ef1e995fcd96fd5a8fbb4e51a10bbbb2"
    hash96      = "6cbf4992aeeb72a64fbccd2a91f2f96f414d84247d4365ce39d2bc1f134f434d"
    hash97      = "0e1c3f81f867fbd5f3aeece7a1797adeb5fcff7a6825e54c4669d463743a243c"
    hash98      = "3ca7f22bd9a5e7545e11b20cde1c33fd6dc41441b2ffae0ff7c373fd447e4312"
    hash99      = "a62fd856f598b766600689282c44602d153b8346fe3804aa1c2b204c08f9a799"
    hash100     = "5dc4510c64cb5805a4b349e337885c5572fe24bb6b690f0633421af55e66d15a"
    hash101     = "6584e5cc8701ee511173f9d1ff10513853677dfab041a78c8aa17babf9333a7c"
    hash102     = "ddfcb9158b1cb270329b7319046ee85e56f0712a4432e0bc26c7b43b3babe630"
    hash103     = "b059ce3f235c690182bb4702c4c6d1f9cf2a47886e0285e9996411eb84fbcc9a"
    hash104     = "a852d264fde3058312fa177ff7c25c324908782b365403562ec2526228b530e5"
    hash105     = "ff1aabea81d8869268793fc84057d1f64d97382d8d1207d2a4eca9ade544f5e5"
    hash106     = "4f84dbc4148dbd44deb3dccec231953a1211408d24730e5ddfefb6331dd2e08a"
    hash107     = "651390d259d138add93af6f5f51a6b68ef195dca19bd294235b3ed7f4b9ee668"
    hash108     = "df076bce71008b481ad58e8fe80d390ac0f4184110bf6dd815c6c72c7ce311e2"
    hash109     = "1232c10d480bd6d67eb96d45fbf2a6ca005c99eec621d7e474ff50b16798ec6f"
    hash110     = "adc8e8ad2f1c972f1123d19fd9412c83eefde878d9518ffb35a4c69f8c99d324"
    hash111     = "288e320cf9add85e3788d6798ca352fbef808ca282870e3b570591cc2cd33f9f"
    hash112     = "bb6879ef2be0e4f2899c669aa6e18835ce158fb92f84ce04f3cc9ba896dea749"
    hash113     = "2272c2481403fdb9ca3e203c4ced14572e66787eaa737b2c82b61b7fafa82fcd"
    hash114     = "219ef87aa7030dadecc33f61ae5daf4634f8ce2b19c11140ce7b4fea98e4d29e"
    hash115     = "ad0c42e65ee0fac2ee5dbc0e9a7b59b61714b033e398897a52b898660f2ae54b"
    hash116     = "219a0631a594a4178c833289362511f9213b337f89d3f603a105edce4d096bf6"
    hash117     = "4fe5a6484117207c7edc3461fb1e68e44d621a4baf96173058f661e4849f53ef"
    hash118     = "3668da6ab0cad5dda60fa74de42ac008951766bd3e1ea1fb2ac3cf44a7aa03ef"
    hash119     = "e5b1bcf9a6ee5a14564e5648c03bc6c61b0354fe943dd18590837678684d20b7"
    hash120     = "9521220beabb8baf08c6ec36c32798cfa98325149c879feb4a964fcb2a55b648"
    hash121     = "86631d3b76c00e7050b318bce97aa6ae52921e6cd384b484b6a61bfd73936e97"
    hash122     = "7021cbfe03b06c736d9b7a18519103db3795ae41d79893fa9ef405a0ff859390"
    hash123     = "83da1fd8ea82cdf996d3550f72940a3d4c22462fa52b3dc728e729ac1f2e82d7"
    hash124     = "f975899abf9663cca25106cddb49f0eb5a1f73fee7bef5225d57ca7860b9e181"
    hash125     = "3d89ed7d7d19a0d0fc1761ed39b76274a4b864e14c7694026ff269c0f91722a1"
    hash126     = "29f12b01589365de2e2cfd6b8fd5a35fc8d9c4a8f7235c742238f8aa40a26a24"
    hash127     = "65cb93b9eb7c1244a330a9988f9d72823b80224b9f014e44c18b39e0f7643f75"
    hash128     = "7ae813f17d20d303b81e16d9a6c5fb1c8f005db9067862506f7009bb94e2987f"
    hash129     = "03c834894ac4591bfcdb71cfcac34d2ac673659a621cff5b4dcb6dc80628c926"
    hash130     = "ee31a692cfda6c2b1bf329093a4779369ce6aeb23d8ec2dde81bd88e5b947361"
    hash131     = "af351b6f559ae2ceb17b47bde803d6c5430518f06981c3a915ce6db23362d05c"
    hash132     = "81845a685d60a7901fbf134e137694743f0ccee198b352cddace91f72351b599"
    hash133     = "e9183f6ba47215d3368a105c3a6417b0102e5e45863117f9e0501c9f297f7fb0"
    hash134     = "1d58f13f2b49ec04cfa6b2a1d3aed8240ce5d6a45effaa1bd8236b2442de75a2"
    hash135     = "d762990bcba15639a4e68c3d382d44ddf4c606dbd450f2c481933b41baff9fff"
    hash136     = "f64175eb138942a4469dca939255cdcf6a756ddba0b8d9eb2c109f4c36b1214a"
    hash137     = "ef7d338baf5560dd9f6526c3548c6740d97ecc510ee94a87fa09ad2c1ad90b0b"
    hash138     = "02aff81cfd0a972bca85fd93d8fe2e630bea2941dbff62c70fcff1ca25de80f5"
    hash139     = "363becceaf56e082ce253828df06c96151a202285703b3ed4837f743b1d79e6d"

  strings:
    $s1  = "______zaa12f4 = \"%TEMP%/\";" fullword ascii
    $s2  = "var rotation = ______zaclearball - (2 + 0) * (1 * 1);" fullword ascii
    $s3  = "such = ______zbb13f4 / (-1877 + 1877);" fullword ascii
    $s4  = "function one(______zafont){______zbone[(\"3\", \"2\", \"R\")+ \"u\" + (\"1\", \"n\")](______zafont, rotation, rotation);};" fullword ascii
    $s5  = "______zbsuch[clearball](______zabosnian, com, (true, false));" fullword ascii
    $s6  = "______zbappendchild = \"start \"+christopher+\"\\r\\nexit\"" fullword ascii
    $s7  = "function appendchild(bosnian) {var ______zathen = (123, bosnian); return ______zathen;};" fullword ascii
    $s8  = "______zbnotion[font](______zbsuch[notion]);" fullword ascii
    $s9  = "function b13f4(______zarotation) {______zarotation[______zasuch](______zbone[\"E\"+\"xpandEnvir\"+\"o\"+\"nmentStrings\"](______" ascii
    $s10 = "font = \"wr\"+\"i\"+\"t\"+\"e\";" fullword ascii
    $s11 = "var ______zbb13f4 = false;" fullword ascii
    $s12 = "______zamultiplication = rotation;" fullword ascii
    $s13 = "var ______zbone = function multiplication() {return cenetr[______zaappendchild]((\"fdasfadsfaszxvc\", wheelb)+\".Shel\"+\"l\");}" ascii
    $s14 = "var ______zbone = function multiplication() {return cenetr[______zaappendchild]((\"fdasfadsfaszxvc\", wheelb)+\".Shel\"+\"l\");}" ascii
    $s15 = "} catch(______zanotion){};};" fullword ascii
    $s16 = "while (______zamultiplication) { " fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f88875c4-eded-44a0-adbe-fb38ea2359bf

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion