_20160518_0156640fd3653d77f15c6f1429489761_20160518_01844820b954_610

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160518_0156640fd3653d77f15c6f1429489761.js, 20160518_01844820b9540610a4742d6492227a29.js, 20160518_03e3da78d37a16708d379c0ec9f2448b.js, 20160518_05346892b176c0e569a1764f402b83a8.js, 20160518_058b8035a61c75bb83b247018abced2a.js, 20160518_0b11ee474fb81071b6c8c6a60d2bcc95.js, 20160518_0e26432006dc9fd2be3dc80423de9741.js, 20160518_0eaa122eccda05f43a2b1e862bf4ca6e.js, 20160518_10d4aa3a92f76bb4fce0583e87759990.js, 20160518_1350db100e4d26e0aba1f40b2b8fe3fd.js, 20160518_1371cc0a83a7d7821230eaf345b96106.js, 20160518_1393f86b5925a57509dd046c7a034974.js, 20160518_1498b20e3084c1b1f9347a5ea7ad508d.js, 20160518_14e42385007e47f9ddf8071c5761ecf6.js, 20160518_158cd7acac1fa244c6a22591859ad38c.js, 20160518_15f7d9268e32d1055e2a004c2c71f95a.js, 20160518_16433e6b9f92a1ca251c095693365d9a.js, 20160518_167c2d865cb66bee88d770a8920df318.js, 20160518_17c51b1a97296bc218b13a702a6bbdee.js, 20160518_19a02ce3ad81112281d6a90085dd5d5d.js, 20160518_1a6f108f9a4116b1f16b2f53e11a10ac.js, 20160518_1a8b14954bc3ee6c12d65674132b853f.js, 20160518_1df7886e500ac7b0dfc04f059df43bdb.js, 20160518_1f3dd4ccc25087ceddc9a63c207f9f86.js, 20160518_224db8b993c009b956a49188027c5768.js, 20160518_29d9fef8c03be9adcd534013acb5cb5d.js, 20160518_2b39082f1e22e1240fc69910ae751609.js, 20160518_2c79e8b4b8532fae2c7866618249bf12.js, 20160518_2cd34c0dd3af417abb585ddff9a0ca37.js, 20160518_2d90ec2588af35d77db75305a07f5f1b.js, 20160518_2db51c6cd80c7977b77a362d1aa6515d.js, 20160518_2e227a684703aea1e5506ffd2ca826ef.js, 20160518_30e5e80f9159585bba57008cda45ccd0.js, 20160518_366c96bfd887e0bb0b842a3f7b279772.js, 20160518_3759621489b1a93c01a59d580f84c867.js, 20160518_38abde542cbfccedfadefce7990bf8e5.js, 20160518_3e48ed469f82f263f75bb55a2720a983.js, 20160518_40d57cf3a5e569a50bff8ee415b49f6b.js, 20160518_46b47bfd885785917bcc306e129a5fab.js, 20160518_4a87fd5845741bdff923895f74edfb24.js, 20160518_4bc1502645d020aa6e890489d02276c4.js, 20160518_4d58cd085cff7e7f0124c6410c300868.js, 20160518_505effd4979f1b3af54b93a3a4421692.js, 20160518_51774708cca67f55220c13b8e5164827.js, 20160518_52dddf013ef3fb2ed104dd35f0961c75.js, 20160518_53aeb32f58561653331f4ae33002aeef.js, 20160518_54fb322452d68ab7bebf79258f017bcd.js, 20160518_557c4231bb467ff41be53bf2be63092a.js, 20160518_56a411089f8a0531752882ff90fc153f.js, 20160518_57c9baff2d5abce3ebd45d7751d99b06.js, 20160518_595ea88d1d4853d0e404ee535c340069.js, 20160518_59cf21b004405018810b354732c1aef6.js, 20160518_5c8a5e612270ef836b32555f1e81aac0.js, 20160518_5ff1282af13d28b7d8b692f4365ec50f.js, 20160518_60177fbe9a81fa7c1df2b48cc013d076.js, 20160518_601a41b1356105896dc5bf23033191c9.js, 20160518_61200134589485ea3669a7f07577a842.js, 20160518_62e8d74a30dfa609e3e646614301f55a.js, 20160518_63683f0948a6903f2c5e2b30a586af13.js, 20160518_63e8d048573ec3759c7e48c85147dd41.js, 20160518_64c1ea67a28155e6eb2967d9f2f1b7f2.js, 20160518_6509cd6dedfe6381e8bca38b3c836231.js, 20160518_65ce0c4c67cfdad0378ab86aefca381c.js, 20160518_65f7c1385f88ebcf71c6a8cde10212d5.js, 20160518_6602485d0927a844920e0bd40251696d.js, 20160518_68521913210d9056410ae452f354ebbb.js, 20160518_6b2f980e0bd765eb3acd52c26470fe27.js, 20160518_6b417be3a102295bab47c7c43fa055c0.js, 20160518_6ba4b930d5eb8f5e5627c8b86fa43192.js, 20160518_6d1bbba2a79a1e95fb354ccf6d1ff887.js, 20160518_6f7b7af14ea260056ae686c7b1a2f0d6.js, 20160518_6ffd92126c21b25e3a899d1453ff633b.js, 20160518_7007f049b2e8ecb05ff2ad29c089e2a4.js, 20160518_712e5205ec4064c225ba47565740ce1a.js, 20160518_74016659b17948cd20eba68c54be2905.js, 20160518_75a29bd2cfbf1a0f52e5a51dd49a36c3.js, 20160518_7730218a280e78e4e884627bf11c9c44.js, 20160518_78a3af933132eb51b4004e762f5463e6.js, 20160518_79c9035281a31b18b9eb9f27885af03e.js, 20160518_7b334214a4be7766ca1d4577d69dfe00.js, 20160518_7d950cb8ec32d1e7d485815869506a04.js, 20160518_7e117e0744b3a01acaf7af0ffe8520a9.js, 20160518_80980112fc859a85cedd28c2cfebe848.js, 20160518_84b8f969b9e962681c952b38fa772113.js, 20160518_84c396e3d4baee8db2df56a1a4cd37a5.js, 20160518_84cb32b4183c4005fc04486699416395.js, 20160518_85d47dcd99aa6d2248923a470a8277eb.js, 20160518_86a54a268ccb7ff46882f20a68c7464c.js, 20160518_8be16ef5dad5aa2f984de7d4e00e623c.js, 20160518_8c707844e8e95c4700f81375ec48c957.js, 20160518_8d2afb6676ebb5780110bd96d4a83de3.js, 20160518_8d96d34e54820f52d4e3af0cae67cefd.js, 20160518_8ec6eab83aaaca71b3de01ec46fd7f22.js, 20160518_8efcc0cb2aaf69bcaf2766ef612892fd.js, 20160518_90b69adcc8c0b3c1b55396d0d5c66158.js, 20160518_90d8661248fa4cece0661bf443799eac.js, 20160518_92e779245b082efd94ee53e942f0c8c4.js, 20160518_96140a75c60895584a041f703c7bcfc6.js, 20160518_96bbae8c440ccffa3c96e6f2f11b3376.js, 20160518_97ea8342b3f053a20ddfee6cafaadfeb.js, 20160518_99e40a90ebe71bc65eb1b0ca74761968.js, 20160518_9b0be20ba2fb37ace28bcd760741d73c.js, 20160518_9c2a855351b060468854399bc7e64c02.js, 20160518_9c53ca88dab5dccf556a2c034dd304df.js, 20160518_9d9a1f9b441144b56a20e65b4a31cb03.js, 20160518_9e603987e8bcc05e7ce31cbca89689f8.js, 20160518_9ed9721281e9f3fd76e36130a83b4451.js, 20160518_9f1eea616bef392a76c4bbfccd5a5906.js, 20160518_a40a9ff309289243d0707ea2d7aa6850.js, 20160518_a59c6294406de20ad3296e8eed362274.js, 20160518_a701edf4dd8f8875429f9d90e7b94b2e.js, 20160518_ab6738062a89b2d80b5d2de19aee00c5.js, 20160518_ae1754d4195ab7496317cb2caa09a82b.js, 20160518_b523726ad23f7a5b5b9e8fe769743ede.js, 20160518_b6c33519f70b94636bcc4c502b4dbf5b.js, 20160518_b74c594a5a4be49e597982143d5a53fc.js, 20160518_b773a4f49968da63c4c4eebdd2e31083.js, 20160518_b7f28aa5a0a65bc1f3400a2fda4191db.js, 20160518_b92fdde5632086fcf22581d35a2b7abf.js, 20160518_ba6a79c9fa56a7c01e1cbd7d77e5cd07.js, 20160518_bd24fd8f4d37ada6776da04f32f0be87.js, 20160518_bf70d7d2248e63d0dba192f2d4534e42.js, 20160518_c20c8b97c5f0022a1076974a01c60deb.js, 20160518_c20df48e33e408398b30381e396e0ed3.js, 20160518_c3f401b77a81fbecb9efd1881eb2c3ca.js, 20160518_c691e93b676e4aa902e2bb7d00b2fff9.js, 20160518_c7734d1c76b3a62e11f7230354f1e8e0.js, 20160518_c7e2b56afb0323a402e7100cefd7c920.js, 20160518_c935395310a75fdf534c0150fdbf567c.js, 20160518_c9425a9dec74ea782bfcb0acb77585dd.js, 20160518_c99cf5f367fc3ba2199dd016f47b76f2.js, 20160518_ca01cf9481c3335f56c7ddc9e810a425.js, 20160518_cd4d5013ad4f0469f442a6c389ad880a.js, 20160518_cece7f7ef0ed031e33894a91134cd6d9.js, 20160518_cfdb432f249d940c051202fbed24e4dc.js, 20160518_d0cd4b4b8db8d4cb62fd8410b943950e.js, 20160518_d357c0dbc6d5c9e2129add5caad6b8ee.js, 20160518_d5692992c85a27e3e800a3737d0e2126.js, 20160518_d57f93cb586230240d9013e317916ada.js, 20160518_d65d54637152783d68e8a22407d35aaf.js, 20160518_d9a1381677b3c290fd2768c65a061ef4.js, 20160518_d9e95bb9f5b91d093b4d15634f861d11.js, 20160518_da8befa724eac781b39979aec4136197.js, 20160518_db00ea9c09cf68ed495a999b4e2e268b.js, 20160518_dc21e4d5e524eb0add7fa85aaaa5d5f0.js, 20160518_dd313890a7ded9c3815b3303ca04b445.js, 20160518_dd5981dfc5ccb7eb422a98bba4752648.js, 20160518_dd9340ee0e2f26c3cdc10b729fbf3984.js, 20160518_e2d8a8f00eb5a69e67e395d938216fa3.js, 20160518_e316ca10992a55eb8cd2c0eb97e9308d.js, 20160518_e4bbb4276f097ea0788252508eff396d.js, 20160518_e6af91f42e29ce01888f77732c4fcfef.js, 20160518_ebc06d8e3c0696a26f0ab801a8f24a43.js, 20160518_ec7682e84d5491c309529d7686929ea4.js, 20160518_eff714b7809c83016dae3916d3d285e0.js,...

rule _20160518_0156640fd3653d77f15c6f1429489761_20160518_01844820b954_610 {
  meta:
    description = "datamaliciousorder - from files 20160518_0156640fd3653d77f15c6f1429489761.js, 20160518_01844820b9540610a4742d6492227a29.js, 20160518_03e3da78d37a16708d379c0ec9f2448b.js, 20160518_05346892b176c0e569a1764f402b83a8.js, 20160518_058b8035a61c75bb83b247018abced2a.js, 20160518_0b11ee474fb81071b6c8c6a60d2bcc95.js, 20160518_0e26432006dc9fd2be3dc80423de9741.js, 20160518_0eaa122eccda05f43a2b1e862bf4ca6e.js, 20160518_10d4aa3a92f76bb4fce0583e87759990.js, 20160518_1350db100e4d26e0aba1f40b2b8fe3fd.js, 20160518_1371cc0a83a7d7821230eaf345b96106.js, 20160518_1393f86b5925a57509dd046c7a034974.js, 20160518_1498b20e3084c1b1f9347a5ea7ad508d.js, 20160518_14e42385007e47f9ddf8071c5761ecf6.js, 20160518_158cd7acac1fa244c6a22591859ad38c.js, 20160518_15f7d9268e32d1055e2a004c2c71f95a.js, 20160518_16433e6b9f92a1ca251c095693365d9a.js, 20160518_167c2d865cb66bee88d770a8920df318.js, 20160518_17c51b1a97296bc218b13a702a6bbdee.js, 20160518_19a02ce3ad81112281d6a90085dd5d5d.js, 20160518_1a6f108f9a4116b1f16b2f53e11a10ac.js, 20160518_1a8b14954bc3ee6c12d65674132b853f.js, 20160518_1df7886e500ac7b0dfc04f059df43bdb.js, 20160518_1f3dd4ccc25087ceddc9a63c207f9f86.js, 20160518_224db8b993c009b956a49188027c5768.js, 20160518_29d9fef8c03be9adcd534013acb5cb5d.js, 20160518_2b39082f1e22e1240fc69910ae751609.js, 20160518_2c79e8b4b8532fae2c7866618249bf12.js, 20160518_2cd34c0dd3af417abb585ddff9a0ca37.js, 20160518_2d90ec2588af35d77db75305a07f5f1b.js, 20160518_2db51c6cd80c7977b77a362d1aa6515d.js, 20160518_2e227a684703aea1e5506ffd2ca826ef.js, 20160518_30e5e80f9159585bba57008cda45ccd0.js, 20160518_366c96bfd887e0bb0b842a3f7b279772.js, 20160518_3759621489b1a93c01a59d580f84c867.js, 20160518_38abde542cbfccedfadefce7990bf8e5.js, 20160518_3e48ed469f82f263f75bb55a2720a983.js, 20160518_40d57cf3a5e569a50bff8ee415b49f6b.js, 20160518_46b47bfd885785917bcc306e129a5fab.js, 20160518_4a87fd5845741bdff923895f74edfb24.js, 20160518_4bc1502645d020aa6e890489d02276c4.js, 20160518_4d58cd085cff7e7f0124c6410c300868.js, 20160518_505effd4979f1b3af54b93a3a4421692.js, 20160518_51774708cca67f55220c13b8e5164827.js, 20160518_52dddf013ef3fb2ed104dd35f0961c75.js, 20160518_53aeb32f58561653331f4ae33002aeef.js, 20160518_54fb322452d68ab7bebf79258f017bcd.js, 20160518_557c4231bb467ff41be53bf2be63092a.js, 20160518_56a411089f8a0531752882ff90fc153f.js, 20160518_57c9baff2d5abce3ebd45d7751d99b06.js, 20160518_595ea88d1d4853d0e404ee535c340069.js, 20160518_59cf21b004405018810b354732c1aef6.js, 20160518_5c8a5e612270ef836b32555f1e81aac0.js, 20160518_5ff1282af13d28b7d8b692f4365ec50f.js, 20160518_60177fbe9a81fa7c1df2b48cc013d076.js, 20160518_601a41b1356105896dc5bf23033191c9.js, 20160518_61200134589485ea3669a7f07577a842.js, 20160518_62e8d74a30dfa609e3e646614301f55a.js, 20160518_63683f0948a6903f2c5e2b30a586af13.js, 20160518_63e8d048573ec3759c7e48c85147dd41.js, 20160518_64c1ea67a28155e6eb2967d9f2f1b7f2.js, 20160518_6509cd6dedfe6381e8bca38b3c836231.js, 20160518_65ce0c4c67cfdad0378ab86aefca381c.js, 20160518_65f7c1385f88ebcf71c6a8cde10212d5.js, 20160518_6602485d0927a844920e0bd40251696d.js, 20160518_68521913210d9056410ae452f354ebbb.js, 20160518_6b2f980e0bd765eb3acd52c26470fe27.js, 20160518_6b417be3a102295bab47c7c43fa055c0.js, 20160518_6ba4b930d5eb8f5e5627c8b86fa43192.js, 20160518_6d1bbba2a79a1e95fb354ccf6d1ff887.js, 20160518_6f7b7af14ea260056ae686c7b1a2f0d6.js, 20160518_6ffd92126c21b25e3a899d1453ff633b.js, 20160518_7007f049b2e8ecb05ff2ad29c089e2a4.js, 20160518_712e5205ec4064c225ba47565740ce1a.js, 20160518_74016659b17948cd20eba68c54be2905.js, 20160518_75a29bd2cfbf1a0f52e5a51dd49a36c3.js, 20160518_7730218a280e78e4e884627bf11c9c44.js, 20160518_78a3af933132eb51b4004e762f5463e6.js, 20160518_79c9035281a31b18b9eb9f27885af03e.js, 20160518_7b334214a4be7766ca1d4577d69dfe00.js, 20160518_7d950cb8ec32d1e7d485815869506a04.js, 20160518_7e117e0744b3a01acaf7af0ffe8520a9.js, 20160518_80980112fc859a85cedd28c2cfebe848.js, 20160518_84b8f969b9e962681c952b38fa772113.js, 20160518_84c396e3d4baee8db2df56a1a4cd37a5.js, 20160518_84cb32b4183c4005fc04486699416395.js, 20160518_85d47dcd99aa6d2248923a470a8277eb.js, 20160518_86a54a268ccb7ff46882f20a68c7464c.js, 20160518_8be16ef5dad5aa2f984de7d4e00e623c.js, 20160518_8c707844e8e95c4700f81375ec48c957.js, 20160518_8d2afb6676ebb5780110bd96d4a83de3.js, 20160518_8d96d34e54820f52d4e3af0cae67cefd.js, 20160518_8ec6eab83aaaca71b3de01ec46fd7f22.js, 20160518_8efcc0cb2aaf69bcaf2766ef612892fd.js, 20160518_90b69adcc8c0b3c1b55396d0d5c66158.js, 20160518_90d8661248fa4cece0661bf443799eac.js, 20160518_92e779245b082efd94ee53e942f0c8c4.js, 20160518_96140a75c60895584a041f703c7bcfc6.js, 20160518_96bbae8c440ccffa3c96e6f2f11b3376.js, 20160518_97ea8342b3f053a20ddfee6cafaadfeb.js, 20160518_99e40a90ebe71bc65eb1b0ca74761968.js, 20160518_9b0be20ba2fb37ace28bcd760741d73c.js, 20160518_9c2a855351b060468854399bc7e64c02.js, 20160518_9c53ca88dab5dccf556a2c034dd304df.js, 20160518_9d9a1f9b441144b56a20e65b4a31cb03.js, 20160518_9e603987e8bcc05e7ce31cbca89689f8.js, 20160518_9ed9721281e9f3fd76e36130a83b4451.js, 20160518_9f1eea616bef392a76c4bbfccd5a5906.js, 20160518_a40a9ff309289243d0707ea2d7aa6850.js, 20160518_a59c6294406de20ad3296e8eed362274.js, 20160518_a701edf4dd8f8875429f9d90e7b94b2e.js, 20160518_ab6738062a89b2d80b5d2de19aee00c5.js, 20160518_ae1754d4195ab7496317cb2caa09a82b.js, 20160518_b523726ad23f7a5b5b9e8fe769743ede.js, 20160518_b6c33519f70b94636bcc4c502b4dbf5b.js, 20160518_b74c594a5a4be49e597982143d5a53fc.js, 20160518_b773a4f49968da63c4c4eebdd2e31083.js, 20160518_b7f28aa5a0a65bc1f3400a2fda4191db.js, 20160518_b92fdde5632086fcf22581d35a2b7abf.js, 20160518_ba6a79c9fa56a7c01e1cbd7d77e5cd07.js, 20160518_bd24fd8f4d37ada6776da04f32f0be87.js, 20160518_bf70d7d2248e63d0dba192f2d4534e42.js, 20160518_c20c8b97c5f0022a1076974a01c60deb.js, 20160518_c20df48e33e408398b30381e396e0ed3.js, 20160518_c3f401b77a81fbecb9efd1881eb2c3ca.js, 20160518_c691e93b676e4aa902e2bb7d00b2fff9.js, 20160518_c7734d1c76b3a62e11f7230354f1e8e0.js, 20160518_c7e2b56afb0323a402e7100cefd7c920.js, 20160518_c935395310a75fdf534c0150fdbf567c.js, 20160518_c9425a9dec74ea782bfcb0acb77585dd.js, 20160518_c99cf5f367fc3ba2199dd016f47b76f2.js, 20160518_ca01cf9481c3335f56c7ddc9e810a425.js, 20160518_cd4d5013ad4f0469f442a6c389ad880a.js, 20160518_cece7f7ef0ed031e33894a91134cd6d9.js, 20160518_cfdb432f249d940c051202fbed24e4dc.js, 20160518_d0cd4b4b8db8d4cb62fd8410b943950e.js, 20160518_d357c0dbc6d5c9e2129add5caad6b8ee.js, 20160518_d5692992c85a27e3e800a3737d0e2126.js, 20160518_d57f93cb586230240d9013e317916ada.js, 20160518_d65d54637152783d68e8a22407d35aaf.js, 20160518_d9a1381677b3c290fd2768c65a061ef4.js, 20160518_d9e95bb9f5b91d093b4d15634f861d11.js, 20160518_da8befa724eac781b39979aec4136197.js, 20160518_db00ea9c09cf68ed495a999b4e2e268b.js, 20160518_dc21e4d5e524eb0add7fa85aaaa5d5f0.js, 20160518_dd313890a7ded9c3815b3303ca04b445.js, 20160518_dd5981dfc5ccb7eb422a98bba4752648.js, 20160518_dd9340ee0e2f26c3cdc10b729fbf3984.js, 20160518_e2d8a8f00eb5a69e67e395d938216fa3.js, 20160518_e316ca10992a55eb8cd2c0eb97e9308d.js, 20160518_e4bbb4276f097ea0788252508eff396d.js, 20160518_e6af91f42e29ce01888f77732c4fcfef.js, 20160518_ebc06d8e3c0696a26f0ab801a8f24a43.js, 20160518_ec7682e84d5491c309529d7686929ea4.js, 20160518_eff714b7809c83016dae3916d3d285e0.js,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "b3dec3ff7d9a00e6d2dd7eb28c7cb27bbd73448d2162714fea35a55388884953"
    hash2       = "242dabf5d41235dfda17c3d27064be10003722278f434822d6a09049fa85c5d9"
    hash3       = "2ed89e6f7209558ab3318904011c99f9d2489fe2b3b4b9f3162f66bd3257c23e"
    hash4       = "39fd3f82a97b629e807c5e1f44446a9941ad194bb793f756691ef3f9a0cd1bcb"
    hash5       = "8080b7d0027faa6f19f7f21d9f8ba16c099a2a057f4dddd81833a595b1cc8739"
    hash6       = "79ae942d8769f4d6eec498e5a4eada6fccb0d0add2727833ce0d0c44eac65db2"
    hash7       = "51647006a58c6323c117fe3b04ac26b4c8ab6431aa720cc8e0d7ccccfeca3380"
    hash8       = "ca1cbc003738985f1bd6462a133f526b16c9b4ea890bc015e41d8df3988130f7"
    hash9       = "7492e94452509a2885f8f224044ad123c3ce95d7168f9c64af6da65d38780391"
    hash10      = "7e2fc4a2288f537b8059b50fbb7bc752adf35f4b698ae2f7669a83c0ab1aa4e3"
    hash11      = "0cf538a4ab6993ba1ac166b45de8a414f5f2ba130658f6ba051d7f99c8d8fc4b"
    hash12      = "84e7c144de8802ecfacbca4d0c9cbed2f45fca53b189aed11654d763cf39f71a"
    hash13      = "8578003f8774551af3f1558500f3d31bb7d5003cae66ec7dc5179d28dfef66c5"
    hash14      = "6c9c83a1297664f910244a038e3ce574b15ff94675f0a3b56f90b23c93b98152"
    hash15      = "440c7ca6c72c82fd8a66b829deeacfa68e819eaae2abe5ce536d6278eb88180c"
    hash16      = "f2c3acbbdf19345a48810b8569e01d51dc041386a44f20a1197fe8075320a4a6"
    hash17      = "0804f7ba5a9f1ae3b4b446f52b1c20302578ca1b361bc9ed03c374102f66d7ec"
    hash18      = "371c09e65092adf23a844972c33fe2aa52380338e197f104135a763b00e18980"
    hash19      = "7127d8231c0c9941774defcd351bf9b868f86aef03f43fa1bdb9c76caa0b7c48"
    hash20      = "9cdf8e5a456994a6cebbae03bb8f24364e56ff58b1775045ff8c5f6ddbb46a62"
    hash21      = "a438f005ce21ff9688a213d82b23578a85a49ddc8886aaa9defcf8f1b32b4b3f"
    hash22      = "1c69f124751d0bb18f5f2c86a98f67523e1fb66cd1d4a62f6c0750da50727742"
    hash23      = "20e53c835d2200365faf75d1e66da114f0a5bf7f1b01adbda07782398a2a5b74"
    hash24      = "9d46e04c5deda19e56d4efebb59965f508ad0df8cadf7c3631b4b78df3a22585"
    hash25      = "e67f6e5fcf65aaf9956d2a0fbea37fb433ef85b74efebbefaae273ceec1af392"
    hash26      = "97396a80a49aa2ba20e00e468283e085e5326fcd0ba6999683fa7b51ede29dc3"
    hash27      = "e80fa74eef7dc7264f831816bc7203104c56fbe9d4ce0c2c757c2e327c02c677"
    hash28      = "9fb8037fa3af5a9bff4d56a732fd364228af2145c31051d08dd3c33849df1f1b"
    hash29      = "311c888286aebc9aa0a55211993611adf5fe3de8e04549a77c4adb3ccaaac6ac"
    hash30      = "0f3980b5d1078adf3200569fd9a272a9a71f6270dadd578cbfd34910e0b0c86a"
    hash31      = "6e04e56729ff9d5a08b4e9b3ebbe5ff2bba0bfb31320a1fdae96c5073242c751"
    hash32      = "387f7c7c1e4671de7cd233101eef090a777e6655df8d0ad6afa9ca1858b4696b"
    hash33      = "297e0b13174a453c263c58dab2239a5ad0062ae3dae33844cb29eddb947538b0"
    hash34      = "5a596dd447af11033edc137a7a29ad580fe66a65ac040bef2a90bd014ac11202"
    hash35      = "5002996cfb97d359fd3cb9cf96feb228e93505192fd8896cc0c3c8c4cf5e4daf"
    hash36      = "5b49b6b5bedf083ce6d5df0dea4813a9ff63f4b2325f2278a6ea225e43bf3e6b"
    hash37      = "b058a9ef9171498bec62961d86dee341fdf2f55b4b3101894bbcaa50ba1cdd4d"
    hash38      = "6d9aeb8ee3c93f067210253d76cceb646f0e0e99bdfd81392a59e9eb6469c8f8"
    hash39      = "97058b521869a0ea91071e2bdaa27e28bffac2fa471ab9693028ccfa1c1ee390"
    hash40      = "2c89c2711c75cbdd296b3bc2e02e6e3f5aae24d51abd031c57e24620e84fc1eb"
    hash41      = "259a5464a6ac4e6975f801f84bb55f7005d7bcf420cb24bd998cc3285780484f"
    hash42      = "7fda31c60f8fac14595dcf34d6cc730e67976ede748334b05ec0eb4c6e3c8850"
    hash43      = "cb8d298aaec8bc80dd4756bbbcc2e288dc65208230d7fb11973df54f5485c9da"
    hash44      = "200a1c7e23a17c57b2bfccf5bebb182681d8b0a9da3ca32d06d834d03900299f"
    hash45      = "62b0b00899d73e4cab1bddc2b215e25f1ba707874f7e39cc522e2222ba1d65ca"
    hash46      = "27017f27929fd657bbd89ff010c14e1e9789734a7a9c7f5d3c198289fd7f555f"
    hash47      = "c4402e34f512aad66ad3b42f75a718d8d9d523162a5f408f995eebe4cb95ade6"
    hash48      = "f63398491f7c363d6de7ae9944ae23ba9f14d7a75851ce85a6fa87fb0dc72b4e"
    hash49      = "c0cc1883ac5239fd3264d74e1c6fb119d4eb99c3ed6e38096a84e29735b78fc1"
    hash50      = "250a301b350629c8be5e7aaa73f1b19ea02efb12c2a12d34b2dd45f8a5091a63"
    hash51      = "2de467046ec0ee5104982a8a108855cab53624bb2b7069a45bfab615b83aca62"
    hash52      = "b186f642cd25931f10a390846ad60a4d3c7dc8aa925c0db91b0db73544da640d"
    hash53      = "c6ad1c315feceec6616b58269b31528b186d6e9b1e591063634360c5b7e28fcd"
    hash54      = "eda3ee90800527738da21711fb96dc37400cdea72607bf5364cce3789bb75fd1"
    hash55      = "c6857c8bc5ba697b03f21c401b503e28d77008342b9c3aedb6033648b344867a"
    hash56      = "2c86887bd3e97fd7e3386aab3bb4e0c280e8fa753b05436dd88d6669ae9bf431"
    hash57      = "1208037da7fd3eb8685f32c1a04832239b1623ce121ae2cbe353aea29e28f946"
    hash58      = "ea73e9a13889af1242c32f4365c2c3a3f14c1f50e9856cf7d4dff25ff208bf85"
    hash59      = "357674e89a6cbe202f3f6ad1117e58037a35005a84aac1b5e13a75ef36609c73"
    hash60      = "c836fb202610a0e7e22f4663a0d9c2a7d4347650e541251b044ee0adb96f8efa"
    hash61      = "4fcf28fd411e046dcbdb8c4b3bebf299aedad6a258813b922c8a2812cd16ef2f"
    hash62      = "689a124f5bbd5b857db5d456f535a96a686d02f0b1641badf1c7b8519bf1b915"
    hash63      = "5bccdaf5056352d90e75396ba93511a91fe34857521932ca8870165f96f67ee6"
    hash64      = "8e4ba9006fdd31aeee698dbc2d23dd53350edb9b53884eb7a9755b15c0a222d7"
    hash65      = "57f7a4454953ee45437d9effb626e878120bddfcbe4da8c0d11526722723a07e"
    hash66      = "ce47c3930f0821a3954bc2b25e0055d5909b3277e7ab07cf0905e9c0f2f87db1"
    hash67      = "237ff520f0f831e6b57e121dc905151019e5bc6a2eba3ac3a83e6a185aab4a76"
    hash68      = "3e47b1f74f19588b043981a2da7840c020e246b65e7b3faa279cfd38822e9123"
    hash69      = "769de800663224058c81d8e6cf4a91c8f9e6596afb6cf91650c30c393e84dd31"
    hash70      = "3eb2acdeebf377e951006a058f8c08502654d85eccae9d7badf19dcb51ac0301"
    hash71      = "f8422f71d835e0e5ceecfa9c96f2c0c7bb528fc49ffc5c491b138a1de5bb18ea"
    hash72      = "2370d53ecbf71d53e5528cb62d0995b65c8d9edbecfca38460b7bfe192035983"
    hash73      = "6ee3bac1ca645287aa2a6b0dd09e28ec980fbc907757e31897772af3f07bcf78"
    hash74      = "0bbcf6d353bc1d2d7a65c51b5475c4ed281f90acebc002a7fa39263a95630a0b"
    hash75      = "5369f2b05b1ebcdf4db2ca10dc6fb3fcda0aed0fb367d5ed10a07976cf10e2f3"
    hash76      = "bab1af4a02ac216467efefa716f4c49a59fff8d74234c9588a06490c209eafed"
    hash77      = "445fb69ccde27c6b76df57517747d00586243316d9d301e5bceed89f78d343e9"
    hash78      = "45ef5c2c218bfa7f75362c325002c0197db000856c48080d6754695e3b028597"
    hash79      = "5c1baace8f9bc7ca6932c3f4257cab46e851da0b96eccf600bb36d9adab4de80"
    hash80      = "8bad1fced4ecb0021dbf75f3fddcb4b982b08bc6f8f4acd7e1c2b77229389daa"
    hash81      = "b2775c3e1146b2589a2454a5605dc8c42d55561ee96479e83a79438d0605593d"
    hash82      = "91166b16ce7b2246bd6fd84c96534eadefc5a870205d236d615c858915e44bb6"
    hash83      = "6b7982f786deb9e09dfd63af9752a16edd4c9251f30cf54d5ae5b92f239c475b"
    hash84      = "d7b179df540ecd2a71b3a03625ce6016f3acad4ab6c0a018514fe86abbd637e7"
    hash85      = "2cc2533e128f4e06851b1b8ae3331f33594e48077251dae1853ad925d792986d"
    hash86      = "8b4bd3a37cde23aa0f1692b6264e8bb90860d28930929aac43d540a05ba0f39f"
    hash87      = "5a142ef88d4458f0e6ee92b91c3785906ce65b01986a31e2d1b3dc407a697523"
    hash88      = "34355d00956b5548e6d7afa466b8a6cf3c3cd43a46d6f06275d91f50c58465ad"
    hash89      = "1ef1694fcdc4f5b989737cb3dcfe5cb534b16eb1227fdc342b4d1d50c5349c34"
    hash90      = "5e1945ce6711aded53e680d8bcc1c26ff32ef00879539b3029bbde8d52a8b2bd"
    hash91      = "3aed71198f34d39104f2eeed15978b7d7dadb4ca09af57e1c864c5fc45c3e04a"
    hash92      = "d03ef95ad0d1db74a6caf0de059873ebac1028cbfc29b7b91e2a29bec9586541"
    hash93      = "e815acd90e47e41e45df671ae37fdd91bda5770b94ca056b16af1d866abaa9fa"
    hash94      = "91b7d95043e0aae31f02df5a72edf9a5870c565a3589edcb0142ac0da114096f"
    hash95      = "bd2282a4deee74f8f9626d02694a021c5e024f496ae3ca1ee27c2c59f5b61dc5"
    hash96      = "ef0e874d99963dd92de3b00cda6b6979dc641dd16a8efe2eac582577e36b099f"
    hash97      = "0ed855e81551a316786d2dfa421a087f12e4ba36f2d6c0d1b97e5515c31bd772"
    hash98      = "7ad58c33c6f88d58f4b2b0cd28ab59b2292bab1831f9c530347354431bf8c8b2"
    hash99      = "36de25235218c433fd4100e80a7fdd95c1c37815169c1eeb774a5891b345f1ae"
    hash100     = "f9b093f924ca8bfefbd9ed998cc114dcf40887b94790377b4fd4def7bddb271c"
    hash101     = "344bb365ab8b567b322ed353ba152ca5ab548ef262acd9d59fef146561a44c2c"
    hash102     = "d1f96f7d2610baffc0daca9b2dc911cb7325d37d786275c772fa0b886b952c68"
    hash103     = "785d701802326cb4ed67a0d0a84c178a2e3a27b416091f54995ea8be46d50d55"
    hash104     = "47ca71d6077b975a9dfc6230d66367ef0404ebbf51cefa2c762953293bd1d5c4"
    hash105     = "57ba4634ab2e3e999a5021ebccdf3b883ebcf0357ae175463fa85f2cdb41b6b2"
    hash106     = "7591ab5ef7c6660f32fbfb9804dbb387b9e247e3317828a699123e3fb203d4e7"
    hash107     = "075a840ee4295e112645ca8f85732ceb3d352da10a96488dc9a5da0161288126"
    hash108     = "f9460e76d5bc29d599bd5b6be9c6da3686b8c4d434628c3aa1916ea621ba5ec5"
    hash109     = "9f6cbb3c4f81cdbd181e7dd6a8e5d2b974261ca7a31bc653c6f9eb247dfe6ce0"
    hash110     = "a122304843950fcf5e8f9f7ffdb81bd21b717f49ba8868c4d68d303ec21c7154"
    hash111     = "7d7b0f0afeee0420775c89d4b1a1b73b48da403e0a6b1ac1aeed3f2457a68aea"
    hash112     = "d154b83d3f6969727899a3fdee5d4d41dd0aba384550ecbaa2ac0e0ad2e5bab0"
    hash113     = "34c2842c18e12f5885ec272cb90bd5a94bfd57453ccf9c8d5c354698635f68e2"
    hash114     = "c9a00806c16dc88497a9d44b7f741bbbd78d1adb11773f81161eda88317c374e"
    hash115     = "90cc77b510288b7def290206f642da0a76ea0dda69fe45098a046e6c536bee6a"
    hash116     = "cdc84bf792e10aa64e3d75d0922a4d950aa3bc938546affb66b20e8a2d577eaa"
    hash117     = "171e08d97da8aa6c6ec145a0032b017537cf0e45a3a33c89cd22aed87eaf525b"
    hash118     = "43a0d10adc10fb1639541bf52cd934973783d9b2c1a6a2856aa495b61a38256a"
    hash119     = "0da61639cf6e4a22dbcfca865610d7042531534b7fa0d6580ede9ac956edeedb"
    hash120     = "f4d4a3607374552414999568cb200ef3026a339e75c7fe4e2bde782e6af72c2f"
    hash121     = "cd4b1ad2ac7438304a02da291a0e6397cab984ac59827d3872b27a6ed1464fc4"
    hash122     = "1b5d0861350407c4af8de8c2518d2d22d26fa8837bdf61465714068804ee4eea"
    hash123     = "21e0b41bd3e0d53c25e261d0202d1cb4c7e085861fba6be752278b8ea52ff329"
    hash124     = "fb981efbcc5dd1adb2ac2c690822352c9d6d6b5eac013c104e1336c3defe94a4"
    hash125     = "f67254f3cd0772a8d898ff35970fac90507652f1752d1b3baaed4d87e86473b7"
    hash126     = "54023e6b7de2d0cbd393794b78bb3696898cad272347fe0a3c4c108fbf658e54"
    hash127     = "e450f01acd3f1d5dafdd1271e734d878c91b11bb626fb9e32b4bfeca86ac3287"
    hash128     = "2db08a497cbf99b7d87dad1124c120a1dbef88c22d4bc83363cf579574c52df7"
    hash129     = "58b59c0313a80dacad12b7ccdf8e1491281f7c49ad2a2d68dc1c4044a8edcee9"
    hash130     = "eafb3e6ee6fdfb1b050673159497ddf5f644ad0686fe700b20a1590a6e2cb5a2"
    hash131     = "c2825891320b1ea1f51d1431e33c997eddf912d5f8e49bf1038f2c489e8de667"
    hash132     = "aad8a3bbd6a184a8b7af492ed3bd4965e76b4b6658ef60b74201592f670a9983"
    hash133     = "f8bb3c9c29950ecef21cd00bc585ba71cc3a61754fbfc25e7f4c8e5acd7df31d"
    hash134     = "f1eef3679c71788de7c2cb6a5a02422d99a11af104bf827793acbccbe77492a6"
    hash135     = "3024218e1dd163e11bdbc5d62e88a722d2fc88037bd48e4b320f9335d168eea8"
    hash136     = "62dbcc7eb210a5f64ccb0909f1c6b98b463112d80329bfd54d5db06456645667"
    hash137     = "4532ebc6f43eed2d4e368dd2beb424573712106c68da04c6abc96b4f3b18d576"
    hash138     = "e1bd1c3e1d022553973b2eeb61cf80b9616cf3061f7f1773230f178b2238afa4"
    hash139     = "72b42636ec7a0c8957fd52e9004e6407a3322a1edc1a0f2a01986fdf9f659f1d"
    hash140     = "09dad1b73399d584115f8d4b7138cb2f48df21ab21cff59f4840253c7ca8226f"
    hash141     = "416a23f6a42a08ad26b881846215dd4cd339ca83c50725934bb893446663e976"
    hash142     = "0bd188f7844bfc8bbf48122590f290a513c5e7587100d890d529941d5dbb5b5c"
    hash143     = "5b62accca61868e9767e86593f5a9111c11651c2dad2d7ba7601e036baef047d"
    hash144     = "614f15f721da6d67971ab8309abcc3f3e257cceab58b0e52e8c3492b6abb328c"
    hash145     = "13db6ffb6c68183c4c6bd2343ed35186ce15e2b7fbd8ff695b9e5926c7a945da"
    hash146     = "d143a856249547ec29b6ba6a0e452cf02a0bdec6eb2cab5d9c103840bc80f811"
    hash147     = "06b98b3153f0d19333fda63b1c9b1848eb10cab20862a1a698df2041eeb162b2"
    hash148     = "2f4c768eb520704a5e8cda454b23a5c69e6be7e8085930d63d0425befed44fec"
    hash149     = "55ff51af65dbb51b87d95323a9474eb19b2a11be17f888a2b8bbb89887db01be"
    hash150     = "e93d899a106eca0959c3e2e9c81aea961e92ded7589e918612f7c034e69b4664"
    hash151     = "05ae3922eada3dc286c718d2cd662cc66e26131c01cfc5246bdd58f316bcb3ef"
    hash152     = "ed399c5c0c31239ee64ee6d090d3e2c45ec5cdd48216a009eb45359fd1a70220"
    hash153     = "8e3004eb0f8efe7b04c6c7313e8a5936f04cad6c18be527fca1e9dbda1044a3f"
    hash154     = "3268233888dafb80d1f1789dbdc1dcdfcf5e0f958c6d58928c9b8fa4a2ca3359"
    hash155     = "089fe76a4bcc2bf0f6ee7583a93f5b3e96c0c477fdba5b4fef5460fb26e130f4"
    hash156     = "c3b1bae8ac365b979c0bc43a79d20c805bf90596bd0bc2f7573ce4d2aafc6449"
    hash157     = "c24e65409a086535b3ac59d17143ea02bc4dfd8601f0e13b1e44180448d87b9f"
    hash158     = "3d2d3711e85d340e0c919742ea59ad388d1ea1780aed1327f316e7c51f598aff"
    hash159     = "6b9f3a78f87fdde52bcef4fdf0ac5be2bae724a7bca201f9931bffc9b17d4b83"
    hash160     = "db9bb2c47b200752b1459c6b8654fdc04dac573d0ae57e9f50f871716ba2f558"
    hash161     = "1e3627a5fcf352031067d744215e2e6a6c4d869718328ca0560f928468202d22"
    hash162     = "58b3a2bbadcc4c391fab8a28e5f5acadc08f09d2ff04d1899cbbf59ce86001e3"
    hash163     = "7f605e1b9a7ff9cb9359f8de8a05336b93755e471c4456182e3de9b1bb714d20"
    hash164     = "78357c928dbfa657f377e82664dfaec41714acacbb1b0b4fa3f63fc3b970721f"
    hash165     = "95e69e80fb834625a5549d321091431923def6f68443dc40adce4866793fff7d"
    hash166     = "35cac06134463a5a26523ba02f80e3325e0271d27e0ab86f3a6ff01f2b8dff0a"
    hash167     = "b3f6eaa8675f1c9320ee7f1790f0da9f074cbbb0ae9b2164adcb7520d69ecdbe"
    hash168     = "3c0470f9ff6bc08fd9abb2897f5e4b103a5f827d51de0c93a33e69da3f6034b3"
    hash169     = "032631dfa683eb126e1a9b1c658720da2b2b31e056bdcf79d1f500959e8c7120"
    hash170     = "7b2e6411e3747a2bc2de139ed76f1db13b7dc31c0b1d3411fd0de4efcfad027f"
    hash171     = "858fcb078addc8021ad3771b25d8b26f40fbe2043e46d5ba43a7bb216c37ecc8"
    hash172     = "882a94e597019fe75bfaa3173e5478985ca0d17b10223ad245c0b7e632c6f997"
    hash173     = "fb41c31d2e784c7eec1c1eb279f8be8538587084163f6ed400f892fcca815730"
    hash174     = "350193b4a24aabdd6ae7c6dc7f94a0f1491b5836a53b9ae7a1c181954043f576"
    hash175     = "e242e6c0ef360be00cd94f9bef2a3110481cea72bcad64bfbf232e1e9e9f8415"
    hash176     = "bc15a69507c2dffb69c4e97ade420020ebd4a910a4bb1b795360f4e5c4333546"
    hash177     = "cc495ce25b9a41452f730db0be56a922521dab9493970314526ce440a8b82dee"
    hash178     = "203929867148d7df6d35d7ce03eb8acef62c416899196f672e0cad4872e4bdd5"
    hash179     = "ef79fe24ecb4b0aae15291a4fdca27f7a3368812cac20bd9a1527744bfa2971e"
    hash180     = "ce3ce5a48b2936aea1fee4541afec2ff2adb5154b13c7f294a276b987c803497"
    hash181     = "f5ba0da86581b32d9e9abd2a60cedd79fe9b39607d2ef828e272e81c7e069d17"
    hash182     = "ea573698412c9e49bb0d5bbd61128f218a7a2c5701d2d643c57a431bd302eab3"
    hash183     = "cf08b0322ce364a62deb11ae08e15e1f7c43dfe21eb6882feecd3b045ae31792"
    hash184     = "52d06c22a4ab55732870cb1a11ad5213ee2f91b30c94b84241c93d9fdb154820"
    hash185     = "7f9fbc4e277623b73720d6d0daf14f7bf6f67102ed69bd600849dff68af31799"
    hash186     = "b991e4e32cdd94826fd755c055dd08488df2e718d60d3b51d979c7801d130c88"
    hash187     = "ae01d6d26d490dcca4d78e4eac6c1d03dd1799af19a60aa27009dc8bf75f3920"
    hash188     = "ba8b9a28a0543e8472ff7a71e39774c04888f227bb61efa71f2d2166f4ba7616"
    hash189     = "5baa38dd6087f69c8abcb029402da4220dcd023d3b65c99326ed51a12dbdce15"
    hash190     = "72fd432d687aaa273e32c8b930d90a03ac186e2cb5b9aa6bb80fb1b6b1a4341b"
    hash191     = "132489f40cf884e75ddd004347768fa4f7ccc90d726d2ad74ed1ba619ae6770a"
    hash192     = "6f7bce17f171ac6579a768987d2934c284a7d7faca54b2061b5b3fa5bf6aaf19"
    hash193     = "d4f0d1328060a87606ca6379182538690914ea1c94e0227455e79d3e631d8c0f"
    hash194     = "9fb35998ec7524e5e456ca259fba6d8f7b90a9dc14858bab8d261282797efeba"
    hash195     = "b8b0508c2402c0fe2b827139767f66b1a0eccf07e1ff7c3c449158805047d826"

  strings:
    $s1 = "dopas0 = \"%TEMP%/\";" fullword ascii
    $s2 = "function newtonsCradle(getAttribute) {var sDiv20 = (123, getAttribute); return sDiv20;};" fullword ascii
    $s3 = "picker = doled1[\"E\"+\"xpandEnvir\"+\"o\"+\"nmentStrings\"](dopas0) + Lek1;" fullword ascii
    $s4 = "solid = dot1 / 0;" fullword ascii
    $s5 = "var doled1 = function playGame() {return Lek[newtonsCradle0]((\"fdasfadsfaszxvc\", dog)+\".Shel\"+\"l\");}(), picker0 = 11;" fullword ascii
    $s6 = "while (playGame0) { " fullword ascii
    $s7 = "var dot1 = false;" fullword ascii
    $s8 = "} catch(borderStyle0){};};" fullword ascii

  condition:
    (uint16(0) == 0x6176 and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b133dc7a-54bf-472f-9501-bf3a362a09f3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion