_20160510_034445b097dd4b8fb8c30059b2589d90_20160510_03cffa092f70_601

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160510_034445b097dd4b8fb8c30059b2589d90.js, 20160510_03cffa092f70d891d149321e450f110b.js, 20160510_054d609f8e8fe55dc57d4130e31fcb74.js, 20160510_0d7447f5f3f724a686c52c39a442e0f1.js, 20160510_0ea8aa7a1f9a69511e58f02ab8e3dede.js, 20160510_12145ce7e4e30ae2a23dd319b0995ef6.js, 20160510_1735b844ccde6bcc9499214482ab8bc1.js, 20160510_1bfc7bb3f44d6210be9c85c54c067f75.js, 20160510_1c1ab4157a4039bde455907cbc575f60.js, 20160510_1e457b2803e353648b0dad3b29b5bd8f.js, 20160510_20d6dfebd51e7418a78a29929c8905e1.js, 20160510_2246cc1455631ef884655fdb1370e89e.js, 20160510_236f7c058f739eabd0962d5ec97f537a.js, 20160510_24e154a56a09ff76da183b606aad7ad8.js, 20160510_272718c0d1af68f374f1e8f983449fde.js, 20160510_28023232d319169a6efe6267e552d33b.js, 20160510_28accdf1e3beb338d44d1b2dae0b29f4.js, 20160510_340ddf85440fc09ec19a31cbcfe7a971.js, 20160510_3426a42415a7bebbd94f7e27d85738df.js, 20160510_3b4fa1b4d855756dc03fd4a3f8fc7957.js, 20160510_3f15625806a29d83f02d6280c64c908a.js, 20160510_3f4ac1ce743fef104870effe2b4c188b.js, 20160510_3f9db3a2a9edb6b48968806afeeada45.js, 20160510_42707ee62f53047e8cb0eed8adbfd072.js, 20160510_484844ce81dbc80813bc376e6c5fd460.js, 20160510_4a105afb99e66ade5c108eeea7789849.js, 20160510_4a9a6222dff14b1e099697447dfdf900.js, 20160510_4d0c9eb75314afaeff116e6fbdb847e0.js, 20160510_50bb0062da1916b62129cfca61c459d7.js, 20160510_53f397af6b3b88cde0dbb1209cc916c3.js, 20160510_568ac45255f97821964058e1a4c2dce3.js, 20160510_56ac5f7ff9ccb2d6c13e95e864dc5284.js, 20160510_586b6e8331d77b261bac82e05ac9eacd.js, 20160510_594594a0da4a341bc2d9f9857e72923b.js, 20160510_5cca0e230758c6c91c184a6f7f27c3fd.js, 20160510_61097ea44b492ed13435d1f609a6ff0d.js, 20160510_6563f42f5be1321e712453b545e41fd2.js, 20160510_6cc84459016a3b047fa7c0dfdf52bb16.js, 20160510_6eecade5d03725055997ebdfd9c450f8.js, 20160510_753e17796624c013906fe0e27eff7859.js, 20160510_771430a1cb2409084990cd4e68b48e20.js, 20160510_78a79978d524b2394416c6a73e0461b0.js, 20160510_8256b732f5ef3689c2d14d379ebf75e9.js, 20160510_8a85179aa728f68c99cead14d4dfc038.js, 20160510_8ac86b7539691686a610ed72f309d6ad.js, 20160510_8cbfc022ef4a3d19ecc3c02b43d962e9.js, 20160510_8d2e39fc5bd7d610e89b715a89f0c1d4.js, 20160510_930f0b2904f6294c7a57131928f69d48.js, 20160510_938a166dfd5102dc961fdea68813a350.js, 20160510_9592686addb2874d5411119d3f24fc07.js, 20160510_9793e7f084fc1170b207c84c8f8124cb.js, 20160510_9877b90eb46bfd29b6fb0af1d8ba0e49.js, 20160510_98811bd2e95fc35511279856f4c676ac.js, 20160510_9b163348711928e2300b9c7a858b8a96.js, 20160510_a056f813e81e154afd72182448e8677c.js, 20160510_aafcd658be38d0fb485c09bbde7cb4ff.js, 20160510_ab9f0f97ba492af146245a29aaded407.js, 20160510_ada26a7524c791723df8ead57ca135bb.js, 20160510_af241484dd7a80e5490387162f98ca77.js, 20160510_b0f4db49257f08b99550cb5e370b8ae1.js, 20160510_b1b4d4e4dacfe64935c13b3e73dc7887.js, 20160510_b63d8638b52afe07b0267e2823a047ef.js, 20160510_b947b1aa19948822b4b6b3b483707f68.js, 20160510_b982cc197b0d955b337581f4fd4bb1d9.js, 20160510_baef0e0512aa5960bce3a475bd5dbee4.js, 20160510_c2fd23fc878e7ebac48febff7312d9d8.js, 20160510_c8120e06e8ec7468aaf17dc97c4349da.js, 20160510_c974d74e3a00944f09015a261e3afe62.js, 20160510_caa323af24db7685f7d60562a8d2d4a7.js, 20160510_cd7d377dc8ac39ba8118dffc7b5bd0b0.js, 20160510_ce57be62e950563e1018fb5ebfea18e7.js, 20160510_d13c4d638479b22e4cc1080a6c41c8da.js, 20160510_d18c05347ebdb9ae10e163eea1a3367e.js, 20160510_d22bbe8c7f0dbc85390f50b2da4552ec.js, 20160510_d634154b327e1e201ea81b785dab9c32.js, 20160510_d9b81173305e68d1068547e8f17dee94.js, 20160510_ddf4e8ee9ebaa497d095c5d1bb8a99c2.js, 20160510_dea2b0ce5651fdfcd53f81f27ea18b8c.js, 20160510_e167a5a5c33f865059070a5b61f44600.js, 20160510_e4224a634a264777cf9a5e2124a07390.js, 20160510_e706b09e9a5b07f8f8534511ce5b86a5.js, 20160510_e77383f6bccfb6d0f207bda5d6367999.js, 20160510_e90420b2d95a5670809d9d9903957913.js, 20160510_ea6ac95af2c986cdff36a358d9f2f207.js, 20160510_ec4dd9d3f5e8bc35807addb81a31b4f1.js, 20160510_f62dfa2466a482162b284e512b0047bd.js, 20160510_fa94b1d5a5d4a21683aa6b6196117e62.js, 20160510_fe5ad6e55361cf7e6187b4ef7e3f645b.js, 20160510_fe7eeec7d72cd03bc8554459f3a429b7.js, 20160510_ff0f37f03da7bf4598b5bece47fd6dc8.js, 20160510_ff5e7f5e0af8863b2ff7cfce9c5b7ace.js

rule _20160510_034445b097dd4b8fb8c30059b2589d90_20160510_03cffa092f70_601 {
  meta:
    description = "datamaliciousorder - from files 20160510_034445b097dd4b8fb8c30059b2589d90.js, 20160510_03cffa092f70d891d149321e450f110b.js, 20160510_054d609f8e8fe55dc57d4130e31fcb74.js, 20160510_0d7447f5f3f724a686c52c39a442e0f1.js, 20160510_0ea8aa7a1f9a69511e58f02ab8e3dede.js, 20160510_12145ce7e4e30ae2a23dd319b0995ef6.js, 20160510_1735b844ccde6bcc9499214482ab8bc1.js, 20160510_1bfc7bb3f44d6210be9c85c54c067f75.js, 20160510_1c1ab4157a4039bde455907cbc575f60.js, 20160510_1e457b2803e353648b0dad3b29b5bd8f.js, 20160510_20d6dfebd51e7418a78a29929c8905e1.js, 20160510_2246cc1455631ef884655fdb1370e89e.js, 20160510_236f7c058f739eabd0962d5ec97f537a.js, 20160510_24e154a56a09ff76da183b606aad7ad8.js, 20160510_272718c0d1af68f374f1e8f983449fde.js, 20160510_28023232d319169a6efe6267e552d33b.js, 20160510_28accdf1e3beb338d44d1b2dae0b29f4.js, 20160510_340ddf85440fc09ec19a31cbcfe7a971.js, 20160510_3426a42415a7bebbd94f7e27d85738df.js, 20160510_3b4fa1b4d855756dc03fd4a3f8fc7957.js, 20160510_3f15625806a29d83f02d6280c64c908a.js, 20160510_3f4ac1ce743fef104870effe2b4c188b.js, 20160510_3f9db3a2a9edb6b48968806afeeada45.js, 20160510_42707ee62f53047e8cb0eed8adbfd072.js, 20160510_484844ce81dbc80813bc376e6c5fd460.js, 20160510_4a105afb99e66ade5c108eeea7789849.js, 20160510_4a9a6222dff14b1e099697447dfdf900.js, 20160510_4d0c9eb75314afaeff116e6fbdb847e0.js, 20160510_50bb0062da1916b62129cfca61c459d7.js, 20160510_53f397af6b3b88cde0dbb1209cc916c3.js, 20160510_568ac45255f97821964058e1a4c2dce3.js, 20160510_56ac5f7ff9ccb2d6c13e95e864dc5284.js, 20160510_586b6e8331d77b261bac82e05ac9eacd.js, 20160510_594594a0da4a341bc2d9f9857e72923b.js, 20160510_5cca0e230758c6c91c184a6f7f27c3fd.js, 20160510_61097ea44b492ed13435d1f609a6ff0d.js, 20160510_6563f42f5be1321e712453b545e41fd2.js, 20160510_6cc84459016a3b047fa7c0dfdf52bb16.js, 20160510_6eecade5d03725055997ebdfd9c450f8.js, 20160510_753e17796624c013906fe0e27eff7859.js, 20160510_771430a1cb2409084990cd4e68b48e20.js, 20160510_78a79978d524b2394416c6a73e0461b0.js, 20160510_8256b732f5ef3689c2d14d379ebf75e9.js, 20160510_8a85179aa728f68c99cead14d4dfc038.js, 20160510_8ac86b7539691686a610ed72f309d6ad.js, 20160510_8cbfc022ef4a3d19ecc3c02b43d962e9.js, 20160510_8d2e39fc5bd7d610e89b715a89f0c1d4.js, 20160510_930f0b2904f6294c7a57131928f69d48.js, 20160510_938a166dfd5102dc961fdea68813a350.js, 20160510_9592686addb2874d5411119d3f24fc07.js, 20160510_9793e7f084fc1170b207c84c8f8124cb.js, 20160510_9877b90eb46bfd29b6fb0af1d8ba0e49.js, 20160510_98811bd2e95fc35511279856f4c676ac.js, 20160510_9b163348711928e2300b9c7a858b8a96.js, 20160510_a056f813e81e154afd72182448e8677c.js, 20160510_aafcd658be38d0fb485c09bbde7cb4ff.js, 20160510_ab9f0f97ba492af146245a29aaded407.js, 20160510_ada26a7524c791723df8ead57ca135bb.js, 20160510_af241484dd7a80e5490387162f98ca77.js, 20160510_b0f4db49257f08b99550cb5e370b8ae1.js, 20160510_b1b4d4e4dacfe64935c13b3e73dc7887.js, 20160510_b63d8638b52afe07b0267e2823a047ef.js, 20160510_b947b1aa19948822b4b6b3b483707f68.js, 20160510_b982cc197b0d955b337581f4fd4bb1d9.js, 20160510_baef0e0512aa5960bce3a475bd5dbee4.js, 20160510_c2fd23fc878e7ebac48febff7312d9d8.js, 20160510_c8120e06e8ec7468aaf17dc97c4349da.js, 20160510_c974d74e3a00944f09015a261e3afe62.js, 20160510_caa323af24db7685f7d60562a8d2d4a7.js, 20160510_cd7d377dc8ac39ba8118dffc7b5bd0b0.js, 20160510_ce57be62e950563e1018fb5ebfea18e7.js, 20160510_d13c4d638479b22e4cc1080a6c41c8da.js, 20160510_d18c05347ebdb9ae10e163eea1a3367e.js, 20160510_d22bbe8c7f0dbc85390f50b2da4552ec.js, 20160510_d634154b327e1e201ea81b785dab9c32.js, 20160510_d9b81173305e68d1068547e8f17dee94.js, 20160510_ddf4e8ee9ebaa497d095c5d1bb8a99c2.js, 20160510_dea2b0ce5651fdfcd53f81f27ea18b8c.js, 20160510_e167a5a5c33f865059070a5b61f44600.js, 20160510_e4224a634a264777cf9a5e2124a07390.js, 20160510_e706b09e9a5b07f8f8534511ce5b86a5.js, 20160510_e77383f6bccfb6d0f207bda5d6367999.js, 20160510_e90420b2d95a5670809d9d9903957913.js, 20160510_ea6ac95af2c986cdff36a358d9f2f207.js, 20160510_ec4dd9d3f5e8bc35807addb81a31b4f1.js, 20160510_f62dfa2466a482162b284e512b0047bd.js, 20160510_fa94b1d5a5d4a21683aa6b6196117e62.js, 20160510_fe5ad6e55361cf7e6187b4ef7e3f645b.js, 20160510_fe7eeec7d72cd03bc8554459f3a429b7.js, 20160510_ff0f37f03da7bf4598b5bece47fd6dc8.js, 20160510_ff5e7f5e0af8863b2ff7cfce9c5b7ace.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "47978224e8ee069c2bfb4ada10ef1a25cbb2bf2cd043a1473c859867a2be8187"
    hash2       = "55c726f6553ba2a7bfe963c2f200ed8a5d920d6620cddc3e8628ef5e272cf304"
    hash3       = "2ba021911f181862d90f5671a0f26bdc48491893564cfee08545f12d02d72b22"
    hash4       = "9bf098fe1b95575a49ddd60b7de28b91d5264acc3f1d82ef2d64cd0a0f541fde"
    hash5       = "cd8cfdee1e507e6bd33d0e9373fe074b1e5b8d26cc41ff28adda779165f97c88"
    hash6       = "ca4db3cfe6c9a8eb8a4bcf26ef4ec90d06f542605bfffcaeaf6f593803f64a91"
    hash7       = "368090ac0f219acf4ef205f2d2d4fab4c900bac0dfe1d00178d85958c073217b"
    hash8       = "8840f30f1b0c12499ecbb7850f44e13ac0f7bbde30c44699b9dd6cd9b443d66e"
    hash9       = "a66e21736aae7ad75d142bb5299661a05742c8ff8bf049414b7537ef11cd42f2"
    hash10      = "e4eb6e247a64c2dcf9a0069f71a72bd1f3aaddccd5fca464213960a9053452d7"
    hash11      = "ca7943a6fa6beb9e0e2010d60fe170c9878704d5863f3b3a21103673d1a620ee"
    hash12      = "c9281dc97ec108ee88bbdae12e6cf8486ba38378540642850b44f00cb951ad6c"
    hash13      = "a94132a452e80f66ecfc0faee8b55649bbdcdc93d757fcd69f27d98c95d2d2e3"
    hash14      = "942dfc970828e589954819ca4ed8bb998de2bbad836f129c7462fe5abca1e248"
    hash15      = "4155bb778457a071fa3d0c323d2a7a9ea741b6a20ef9f28644856938fd02fa26"
    hash16      = "d7c30e580fdc50b8d4ea2a81d0cffe636fd860cd154343d8be711675dff963fc"
    hash17      = "a1aed742d105d3621edb4c4b94d63a33e7e06ca659d060842b1146fa681a54f2"
    hash18      = "b64101610c53e0f2a6bb75c8644e9fd56f9b562dabc6bf8647c33ebd0f3e95d4"
    hash19      = "d6df3519ff9ed7c526276c60f92541ec7cdd8ac544cb9dc75d536b07f22c2a16"
    hash20      = "df2a282801cc926c7bcabca78388ddc71ffa4eed1431ae159b76826ce86b01cc"
    hash21      = "b32b10caf23315581bcf8acdc3e68b2a19ed4d1d96af12fb7528caf5581485ec"
    hash22      = "dc7849f30263d8bd85906b517685a13acce6301b1a3183752a1f2dc23410aba8"
    hash23      = "b9a253c82bae2dd3c8ada1a1a2b8f030c1cfcd70d9cf40288d52a3408bd49a04"
    hash24      = "9dbae22db754453a35f8bf980f36d75334f61afb795fd20a9a794143d0b62d05"
    hash25      = "9f4032489c19ebfb76ea927954ab583ce50aee978a7a7ebfb768eb0ac6dc7baa"
    hash26      = "962fc9af2f0d5918fcc84268bff95cb6373a9923ff321610ffd290e4b612f96f"
    hash27      = "032ad8d3eb9c1a90713e8d5aad9cfd5471ba7a2c97aa1e685724409ff5ea1b52"
    hash28      = "621269707559f972ee3932dc240675961c8df0ac4a64d9b6b59b8bdc244707f0"
    hash29      = "5bbb943104403eeb7b21488febd48d38b58e26d5614f06d9fc7c8aa566537654"
    hash30      = "0f3c01993fa625cc761f41260e0b8607455fc51e44238ad5f7c56de7ac0454ba"
    hash31      = "d33dbb6ce30c2dd2a4b4f564fd4f8a91890459899c792a2e3ac7d4c54d6ea69e"
    hash32      = "b42affd7052994272b882a253313574f4fd40da3a6c79ba8ec9805cb9e92e619"
    hash33      = "c133c67689e5b1105f194e1c87a25cb8a27649f3f8690b9199f43631e2bbf05f"
    hash34      = "bcae2c3aaee40d0ae4f4e3d6b6d7e92090787df57f69f44285200814791c7b9b"
    hash35      = "161fd3796ca98c66327587281d9e6c0845a9e0bf34bb1909f753d5c318ab67a5"
    hash36      = "f37e018a0a7ec6f67ea48b138d66adf3e2f101d17ba2293bc3bce7d174b610aa"
    hash37      = "57fdc21605380295b2b8aff7a926b3cc800591d385e651d0f9ada227f4bbfd3e"
    hash38      = "939b408e18e8d418c930a2902cfad2829b90f0234c1d23d9ab5a78d83a54d08a"
    hash39      = "cf001bac73a00427fd2c54fe311997f962d5d4ddd87baba76123353c89fa492b"
    hash40      = "f5093a830827ee716976c9dd897af846684f3a31c87436517ce4c0f28f139b0a"
    hash41      = "dfec7fe504ab96a6d7ef01a7a2bd56aeef09f2c48f7fb538eb01fb7b0a3194f9"
    hash42      = "d281c29a67ff02c1079284ec9523eca1893eff03e4676f4a44376a12d5332a65"
    hash43      = "f4bd1307bbcd8de5a0039bc24a0a45003a7eebb1f87c6f3ef7b3d34bce4ea377"
    hash44      = "87ea1c8afd7f8b15001a1f047da55169e607e34b357be0df93c093cf364240dd"
    hash45      = "b20f6d7d5099b37cd9b7d0a78cb33c353cc931e9e4b107072ffbe8e06e42292b"
    hash46      = "d4cef01150328be2474e6f0ff961221bef28d993ffd640b5000ec8db16aba461"
    hash47      = "8354ece1e3f19b5b52056cff6b98bbc10b5c77f9e09cb6e6d46de39d088800aa"
    hash48      = "e1f883445b3985c6d4581c76c4034c32911a15aab2276b474b580df2e8c3fdd7"
    hash49      = "3bd28d0371e67484565616adf2696891a1a0549d442df414c34d0b283409489c"
    hash50      = "3f06d7c56d33b6363b1cff95387961e7781bdf1d01c850d72734fba8be4bb5a4"
    hash51      = "0d26b664b1b33eb1c1a6b441574d3f67e38803b73e7775b3fa848739f391b432"
    hash52      = "02aa558c97765bc4c75e22fbc5860b6adf396c898460d2ecbfff1cf3985668a5"
    hash53      = "8bd485087426480caed9fcc511fe7cf224b88d35301c7b9b3cf6a2d628279184"
    hash54      = "cc9faf165ed0eb342b55fbb9e4d09b1339e6b4f29385a3e5db0b71e023006343"
    hash55      = "0d84a380531a0e31b07b08abe92d23077b21ef11131a064298026453cdaf2929"
    hash56      = "1a8fe3db562b2a90c9528ca7b2ed82790ac8406f39888c958ec5549caaefba43"
    hash57      = "b6cba34cac5596fa6dfe3f785eec125dbf9a718b1b628826e5ca6c746d6dde5f"
    hash58      = "b906b021556de07e33c9764a688d594c617c501aef64c4ffdc58344c50e2d6e7"
    hash59      = "d979a5d90fd91fc5aa60c9e578815ddce9ae76a211cfa16c9385fb59f0ea78f6"
    hash60      = "90915162631405507e2b6eaef7d2f2805f604b787e72b5a77e8c3f7130348dfc"
    hash61      = "a9af07e45be738fa555d91ef49e9ba0a6c7d3c2363f60116866951f58d43b679"
    hash62      = "e6da4485ae63782587a8002c65ad5d0cc8acfd7ad446cb9cbd3272a574991a09"
    hash63      = "50b459afea2d8e35a736a613e5af6f95b7c797b89e71376b4736910b9907e1dc"
    hash64      = "a5f19412ce97140cf1eb1591be3912e13aad84f8311669931c9aa2c1fa6fe51f"
    hash65      = "ce5e3cc48df774b62fcc7ad54efc20b1aa65ee0436b4a2980082febe98907a75"
    hash66      = "9aac9fc8955b6e63c8975488fdb9eaf9b62b3afc7485c1e7dd8bf691cea2e126"
    hash67      = "e781e780c03dd5da9c22efc51e788a18bd98a8b878e989ca1b70672cdbb96ee1"
    hash68      = "878c555a9dd356c1847a270175af033097fca383f85ff187972931233a51f4dc"
    hash69      = "ff3ee15ff058886a5140b96e63f9cd04b56b3ca6bad88d103937e6e3a9c274af"
    hash70      = "ce834d5226332b49b978d098400fda85947060a6f95f14c4455ce9e4d748e6b7"
    hash71      = "c18ea5a7dd8005a5c9f19f96b10e5ddbbe932bbc3bd8b4c08419180abf50eb26"
    hash72      = "e2a236535cb1c3a9089d3c357a7c33b6b7b77a7395bd893635855092915bef18"
    hash73      = "5f76f7c736fb68874b05a695840541277292d4869b972fd0c147e5aa673bdee4"
    hash74      = "ab24a0bd0009ddaec349fa79ee0bdf5f73fd99432afb2b2d73a5f6b967742ba7"
    hash75      = "1ccda13acb4c161882f52542b24185b8d8fbed13bb246370413ced10f6865b80"
    hash76      = "ae0f98962c2410139cf093cb750dd28a5b01a8afdc013a8c3cc936e3feef1c67"
    hash77      = "3ee8f198fe3df54f3af8ff0c32ac516eb1d8f103da09808ff377c1b0c6a0f594"
    hash78      = "878be77eaf60fde1660b2467bd2dccf3d6ce3b5089ff1e0900880e210fb63223"
    hash79      = "ec28085a2395dfb717af6c32c02f53e6979416990e25e46a19c4475264a07d9f"
    hash80      = "95863d447d83853f57838c2349be9c0af3998088e124503f2334644f51375cdb"
    hash81      = "8fe75deb2989ed7607ba85959498a2042354f6aa98e51459696038969875f0d3"
    hash82      = "073e8156b3ebc34eeab4137349854b137527844d6c466f934a687b63e7d0a01f"
    hash83      = "b6e3e40cc139547e010b7c6ed89a48843b84958ee9da212abfe394ebe4c90334"
    hash84      = "d2b2dcf2b24cd5f52f5de47f6e11ee79b58fecd120b0c9148159c01281960b33"
    hash85      = "7b96c730eb399d72392895ca7933ba3d83526c6601075e8f6a223dde62bb4512"
    hash86      = "0cf7603447a3ed7747986e232fa259b64753c0adcaca68b307af63a5d8cebf13"
    hash87      = "55c7267d25c57ced4ff4ed1903b6358a4cb9d3c83c4caf774583ea50ac90854e"
    hash88      = "77330a34ef594d57a71ffe98651ea0d1b9ca63ecd734b002c68080bf71ed09d8"
    hash89      = "09187210d6c928de2ba42caeb0fdb116e694ae5953b499e1883badc356bc5364"
    hash90      = "72e710d682912e9b2ca8a9aeb141ed495a9c9cb905ec7936c3be6db36cdd9a05"
    hash91      = "414079894165b67cb59a8ddccd8c7994da0ac5fcb994fbf452207d1ffc63c4b7"

  strings:
    $s1  = "var IntialInput2 = function IntialInput() {return total_height[Moves0]((\"Trafdscks\", \"WScript\")+\".Shell\");}(), duded1 = 93" ascii
    $s2  = "var IntialInput2 = function IntialInput() {return total_height[Moves0]((\"Trafdscks\", \"WScript\")+\".Shell\");}(), duded1 = 93" ascii
    $s3  = "if (projectionA2[\"r\"+\"eadystate\"] < 2 * 2) continue;" fullword ascii
    $s4  = "function duded(Sunday1){IntialInput2[(\"Ifasd \", \"Gef.H.\", \"R\")+ \"u\" + (\"fudfk\", \"n\")](Sunday1, IntialInput0, IntialI" ascii
    $s5  = "var normalPosX1 = false;" fullword ascii
    $s6  = "soon = \"o\"+\"pen\";" fullword ascii
    $s7  = "duded2[soon]();" fullword ascii
    $s8  = "function normalVelocity(){return Moves0;};" fullword ascii
    $s9  = "soon1 = \"start \"+normalPosX+\"\\r\\nexit\"" fullword ascii
    $s10 = "var soon = \"\";" fullword ascii
    $s11 = "}while (normalVelocity0);" fullword ascii
    $s12 = "projectionA2[soon](total_height1, Sunday0, false);" fullword ascii
    $s13 = "} catch(A6F3){};};" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0bf8c0ee-977a-49d7-beb4-24214ad11622

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion