_20160511_00b031e892fa0b9e43bf24acc3d55839_20160511_00c418181dab_622

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160511_00b031e892fa0b9e43bf24acc3d55839.js, 20160511_00c418181dabc1b893cc15991e6aeba9.js, 20160511_0484c4f2a314cb9deea7bc9c2b710476.js, 20160511_054e1414dd24cc8a23fd0ff7a7ee354a.js, 20160511_06e208e52a63719cffdbc4580c237cfe.js, 20160511_07133531c1e9b138685daa4b2fa9c59d.js, 20160511_0a0665c78cf93e36f2ee06c499faae3d.js, 20160511_0a845e96a9c9f34213cc7ced1cdffbf2.js, 20160511_0b032987101b48c1acfe83361eb793b0.js, 20160511_0b9be56086a61becdebfc7743568513a.js, 20160511_0c3a55265e27bd42b057a10f9e41e2b0.js, 20160511_0ca5af902e91f602ae982e5adab4844b.js, 20160511_0e6e787bf0c9c919ae7517f16d3a992d.js, 20160511_12139c5ee67b2afb54fc25772fbf371e.js, 20160511_1216016855edb7590468aaefca4adf9e.js, 20160511_149e8c6620f2867a59f9d430818ff869.js, 20160511_15828f01baab7c7bf55fd723db0baa97.js, 20160511_1635a98ecd8b7fd315afba2da83db6e7.js, 20160511_18690cd6f0bbe40808a4f79a04046f45.js, 20160511_18c67e60930724093921d570ec2f8bc9.js, 20160511_1d4d8888ed030f6659e0a8fd45c76b91.js, 20160511_1ee7073badcc163a1628cd6516a2c2cb.js, 20160511_2009c40bb0d1ac8e3f31b6d91b145903.js, 20160511_211e026d71c82f7c90fa4b94fdca386d.js, 20160511_21fb7e694a42eba421280d86510c31d8.js, 20160511_26a0b80541652bc6893e59a5b643b2b6.js, 20160511_278857f76c60d95650ea2098d0eee806.js, 20160511_294c6c8c010e370f611a4dc20fce8e33.js, 20160511_298452beb7728540a47d54a8904851d0.js, 20160511_299ba35907be6fc25584b70de557498f.js, 20160511_2d852e82865001f68ea9ca7728df163a.js, 20160511_2e4b9ae46a24bea39e3d4b20019f63ea.js, 20160511_2e6fdaa680104dabcae00d11014343c1.js, 20160511_34a508e0ca22d917cc0a7e9e3d264a67.js, 20160511_372004116bd83fc7adda890dbd552011.js, 20160511_380d29f29ed87586f0f86cdf2c534f6d.js, 20160511_386db2daaf18ba8758eb59c61d62056f.js, 20160511_3a512414ffe7f44ff0d28fa58b044b96.js, 20160511_3a7fc5b25ae374eed7e97e2f3330a98b.js, 20160511_3af466198ae8ce576538d4d31f6ed9c9.js, 20160511_3da179023b12713280fcff38b5c56954.js, 20160511_3ed9b07268e50db72c97e1e3d39ed540.js, 20160511_40c930ae24b9584a9cd072eb54125182.js, 20160511_40d7cab04e3e51e8694afb27c1e687ba.js, 20160511_41c605a2348793e268d87c0ef51c061d.js, 20160511_42bc9f06f23f202f44084aaddad90e3c.js, 20160511_435a0e2da3408609d9be149cf6cd09ba.js, 20160511_464331ef40343118a44c3f15a7f32bb3.js, 20160511_4980bc042783983f58f44b5dbc5a20e1.js, 20160511_49971c732fb90b2f4210e0dd5c964b7a.js, 20160511_4b74c3fbed4d0f552d63be7a86c57541.js, 20160511_4c85534bce4caebb4ec4497a5c468449.js, 20160511_4d0b7d162130f9b3c5c72cdde8710d0b.js, 20160511_4db784eb623b68b9e17a93647f0b33c0.js, 20160511_4e4ca66976e86e4f56eb13dfbd08fc72.js, 20160511_4f193d8c61de1a136f26bacf80e14e18.js, 20160511_4f1a27dd61835bcbada555ad5d9974a6.js, 20160511_4f95bda67cd788b632d84b9ee6b97d6d.js, 20160511_500b833cd7c1644ae7b696c3a707bd9a.js, 20160511_50867905e5d64d0e6641006043576be5.js, 20160511_535d6890772fb749e0105eb391191e58.js, 20160511_539eb07c36cb8dedca3fb41b313e50fb.js, 20160511_5430f32e94ab7c518050393a96ef39b5.js, 20160511_55c015fd8262647258a2439403ad585b.js, 20160511_5661adae0f6e288d378174f1be655c89.js, 20160511_5833b5e1e7b774cf0eea0b48381a447e.js, 20160511_5aa9f8c1425a3310abe0dfeb0657def8.js, 20160511_5b5c74a1212dfce1981a7055a7d2074c.js, 20160511_601e834e136ee102403be8071298019f.js, 20160511_60953ef4af3d7206692a0c6b084293b0.js, 20160511_61cc37b527b062f9ccd152c614eed0da.js, 20160511_620febcef70fae92483352e91cec15a1.js, 20160511_642d35bd7791f03e4818adf2cff3d0d8.js, 20160511_647f9d0c412e80ade8be904287fe0c82.js, 20160511_64a2a0a4cbaa962bdd79d1ab3c220cab.js, 20160511_667eb26bcbc0a7862faa90e0ad6b9f36.js, 20160511_6a79530d6f1844d1ed1291be3a602f4f.js, 20160511_6bc6daa64d407806c7fd6e06c9e3adbf.js, 20160511_6c17d7dc5da75cc48b7b069969a3a75a.js, 20160511_6cc4ba537e536b30253727de630c2a59.js, 20160511_6cd97f1f6268aa995a353e1665690998.js, 20160511_6e57b9f374f378250653ff2ac4a56e04.js, 20160511_7008d68481177ea19af824507b14a53b.js, 20160511_7129dbeeb4e408062a6778691a2ca251.js, 20160511_75af846b06cde109b1ef081f5823b338.js, 20160511_76ac92f28eb5ad1a8be5e5790a7b1be0.js, 20160511_77f5fbd257be1cc87185b3f9a4f3aaf8.js, 20160511_7b633dd5f0333e2c2e7b2598474403b4.js, 20160511_7b75be05d99822aeda2f1d4e6ee3fb6c.js, 20160511_7f51bd36e42150f33e8205b29af6e9b8.js, 20160511_7fb3eef53ce1d1fe1d1763c0e67ff46c.js, 20160511_817f72a6306c668a6e69059f04700a7b.js, 20160511_82d93f8a5a7e9e1ec43e0867daf01f07.js, 20160511_85cbecd7850e716261aff46d5e75beb4.js, 20160511_85f589ae974b583de7aa531d46f2c63f.js, 20160511_86638876c22bb62dbace018c4c6c7262.js, 20160511_874e1b2eea709df4d6143a5b4dbdaf30.js, 20160511_87a7ddaaf49c457d886d301ed0edcaea.js, 20160511_89c63d1f84a800a8ccd8099d9fba5ea7.js, 20160511_8a1e85726034c413836bf1c98513fecc.js, 20160511_8a8d1af9aa7c743de4146c198c97b455.js, 20160511_8f285f977663c33621cd20b5ac1cea83.js, 20160511_8f742f27826991c1392fb9261dc0d420.js, 20160511_922d544a43e6625892ff96cbdf8a8b94.js, 20160511_94539fc2a8c0cf87b15cda6cf278f375.js, 20160511_95627eba4a2d8bedf946936bbd6309b6.js, 20160511_968a062fcdbb9700775ba45b76469ba3.js, 20160511_974b248c2d68327419c364ef0fb090fc.js, 20160511_97fe99c2cdb602ef6d16092ed7c0c0b7.js, 20160511_99a81c59b944b36ca1852a4b93855771.js, 20160511_9a1f052139701232ed55d05f432ccc28.js, 20160511_9b4625467a96f7b66bbffe9083a8e794.js, 20160511_9e2a23a39b6d666fed4e5fcc132baa6f.js, 20160511_9e6d1c27813e9db063962bb2bf96aa1c.js, 20160511_9f30bcffd7b65a400714f975b77ec10f.js, 20160511_a080d903ac48b73f3ad8a959c1c0f73e.js, 20160511_a5c17d9274e6b113254a774261c314b2.js, 20160511_a6d6e6a42fed67e3a601fcdd352adc4f.js, 20160511_a91dc8d73ae0b18ea53a84985691adb8.js, 20160511_aaa30ce0d0521eca02a85b50435392ca.js, 20160511_ab0a4e290e600ae2ce9cccfe3b08b84d.js, 20160511_ab2a7ada98e95f3170191d06cac36c1c.js, 20160511_ab571a66b941ea4b6e0cd591f96c016d.js, 20160511_ab697bce7c5dc8049f119691981bcdf5.js, 20160511_ad124927c932f076274265684876ed88.js, 20160511_b077be5756b087ea0b103c50097f7895.js, 20160511_b141b7d88637ca8d3c6c85365ff18e9d.js, 20160511_b3fb9faf408a1aa9b7578df1168ec65f.js, 20160511_b539d9c0f7c2867cfaf465efc1b0c324.js, 20160511_b5894993de015cfc5b3bcde113d97e96.js, 20160511_b5a952472bef23ed1ea83b0c9bc397f0.js, 20160511_b85088502c59556bf9ce386207dbecba.js, 20160511_b8fd9ba0bab8f554b6da0ad4822a5042.js, 20160511_ba007ba744c432ff3baf3d898ee4dc53.js, 20160511_ba69f1a2e250c9c0e66a3b015b519d26.js, 20160511_bc5a9b7e902b629b2efaf8f263fe5bd6.js, 20160511_bd5d393915df9bcee63b566ce51b7452.js, 20160511_bd5dfaa90e0ca094020f597d65e01e1b.js, 20160511_c0e875d030d4df7746bc49eb6cb2303d.js, 20160511_c16fd56346308ed30269c7e19137ee21.js, 20160511_c19d0fc6570f3ad2176382e360ae3534.js, 20160511_c2ae0f2a20238ee9070d8ca381662bc0.js, 20160511_c301b1c706308726828567d1503566d0.js, 20160511_c3ee03a4aca1b16ab4d3b97738d99d4e.js, 20160511_c450251aa74c6784daae229812a8cefe.js, 20160511_c47f7850f02e3827022591d49387b761.js, 20160511_c5b7fc7eb32809da07c6ba2112aaa36a.js, 20160511_c63b1c847a564f770293e5dd39505c16.js, 20160511_c675dd2486ae2a5e95d3ff40a9332f67.js, 20160511_c6f2179c2f1728147e768a82e767b7e6.js, 20160511_c9dbaa675fe471837c904bce7a3e856d.js, 20160511_cac8741abf882dfab95e6c713c7eaaa6.js, 20160511_cc6971c99ece1169f5660d1905a3b1bf.js, 20160511_ccf050e017407b992c9227849465c7b4.js, 20160511_cd33c2401de3a13fe68c17d8a599201e.js,...

rule _20160511_00b031e892fa0b9e43bf24acc3d55839_20160511_00c418181dab_622 {
  meta:
    description = "datamaliciousorder - from files 20160511_00b031e892fa0b9e43bf24acc3d55839.js, 20160511_00c418181dabc1b893cc15991e6aeba9.js, 20160511_0484c4f2a314cb9deea7bc9c2b710476.js, 20160511_054e1414dd24cc8a23fd0ff7a7ee354a.js, 20160511_06e208e52a63719cffdbc4580c237cfe.js, 20160511_07133531c1e9b138685daa4b2fa9c59d.js, 20160511_0a0665c78cf93e36f2ee06c499faae3d.js, 20160511_0a845e96a9c9f34213cc7ced1cdffbf2.js, 20160511_0b032987101b48c1acfe83361eb793b0.js, 20160511_0b9be56086a61becdebfc7743568513a.js, 20160511_0c3a55265e27bd42b057a10f9e41e2b0.js, 20160511_0ca5af902e91f602ae982e5adab4844b.js, 20160511_0e6e787bf0c9c919ae7517f16d3a992d.js, 20160511_12139c5ee67b2afb54fc25772fbf371e.js, 20160511_1216016855edb7590468aaefca4adf9e.js, 20160511_149e8c6620f2867a59f9d430818ff869.js, 20160511_15828f01baab7c7bf55fd723db0baa97.js, 20160511_1635a98ecd8b7fd315afba2da83db6e7.js, 20160511_18690cd6f0bbe40808a4f79a04046f45.js, 20160511_18c67e60930724093921d570ec2f8bc9.js, 20160511_1d4d8888ed030f6659e0a8fd45c76b91.js, 20160511_1ee7073badcc163a1628cd6516a2c2cb.js, 20160511_2009c40bb0d1ac8e3f31b6d91b145903.js, 20160511_211e026d71c82f7c90fa4b94fdca386d.js, 20160511_21fb7e694a42eba421280d86510c31d8.js, 20160511_26a0b80541652bc6893e59a5b643b2b6.js, 20160511_278857f76c60d95650ea2098d0eee806.js, 20160511_294c6c8c010e370f611a4dc20fce8e33.js, 20160511_298452beb7728540a47d54a8904851d0.js, 20160511_299ba35907be6fc25584b70de557498f.js, 20160511_2d852e82865001f68ea9ca7728df163a.js, 20160511_2e4b9ae46a24bea39e3d4b20019f63ea.js, 20160511_2e6fdaa680104dabcae00d11014343c1.js, 20160511_34a508e0ca22d917cc0a7e9e3d264a67.js, 20160511_372004116bd83fc7adda890dbd552011.js, 20160511_380d29f29ed87586f0f86cdf2c534f6d.js, 20160511_386db2daaf18ba8758eb59c61d62056f.js, 20160511_3a512414ffe7f44ff0d28fa58b044b96.js, 20160511_3a7fc5b25ae374eed7e97e2f3330a98b.js, 20160511_3af466198ae8ce576538d4d31f6ed9c9.js, 20160511_3da179023b12713280fcff38b5c56954.js, 20160511_3ed9b07268e50db72c97e1e3d39ed540.js, 20160511_40c930ae24b9584a9cd072eb54125182.js, 20160511_40d7cab04e3e51e8694afb27c1e687ba.js, 20160511_41c605a2348793e268d87c0ef51c061d.js, 20160511_42bc9f06f23f202f44084aaddad90e3c.js, 20160511_435a0e2da3408609d9be149cf6cd09ba.js, 20160511_464331ef40343118a44c3f15a7f32bb3.js, 20160511_4980bc042783983f58f44b5dbc5a20e1.js, 20160511_49971c732fb90b2f4210e0dd5c964b7a.js, 20160511_4b74c3fbed4d0f552d63be7a86c57541.js, 20160511_4c85534bce4caebb4ec4497a5c468449.js, 20160511_4d0b7d162130f9b3c5c72cdde8710d0b.js, 20160511_4db784eb623b68b9e17a93647f0b33c0.js, 20160511_4e4ca66976e86e4f56eb13dfbd08fc72.js, 20160511_4f193d8c61de1a136f26bacf80e14e18.js, 20160511_4f1a27dd61835bcbada555ad5d9974a6.js, 20160511_4f95bda67cd788b632d84b9ee6b97d6d.js, 20160511_500b833cd7c1644ae7b696c3a707bd9a.js, 20160511_50867905e5d64d0e6641006043576be5.js, 20160511_535d6890772fb749e0105eb391191e58.js, 20160511_539eb07c36cb8dedca3fb41b313e50fb.js, 20160511_5430f32e94ab7c518050393a96ef39b5.js, 20160511_55c015fd8262647258a2439403ad585b.js, 20160511_5661adae0f6e288d378174f1be655c89.js, 20160511_5833b5e1e7b774cf0eea0b48381a447e.js, 20160511_5aa9f8c1425a3310abe0dfeb0657def8.js, 20160511_5b5c74a1212dfce1981a7055a7d2074c.js, 20160511_601e834e136ee102403be8071298019f.js, 20160511_60953ef4af3d7206692a0c6b084293b0.js, 20160511_61cc37b527b062f9ccd152c614eed0da.js, 20160511_620febcef70fae92483352e91cec15a1.js, 20160511_642d35bd7791f03e4818adf2cff3d0d8.js, 20160511_647f9d0c412e80ade8be904287fe0c82.js, 20160511_64a2a0a4cbaa962bdd79d1ab3c220cab.js, 20160511_667eb26bcbc0a7862faa90e0ad6b9f36.js, 20160511_6a79530d6f1844d1ed1291be3a602f4f.js, 20160511_6bc6daa64d407806c7fd6e06c9e3adbf.js, 20160511_6c17d7dc5da75cc48b7b069969a3a75a.js, 20160511_6cc4ba537e536b30253727de630c2a59.js, 20160511_6cd97f1f6268aa995a353e1665690998.js, 20160511_6e57b9f374f378250653ff2ac4a56e04.js, 20160511_7008d68481177ea19af824507b14a53b.js, 20160511_7129dbeeb4e408062a6778691a2ca251.js, 20160511_75af846b06cde109b1ef081f5823b338.js, 20160511_76ac92f28eb5ad1a8be5e5790a7b1be0.js, 20160511_77f5fbd257be1cc87185b3f9a4f3aaf8.js, 20160511_7b633dd5f0333e2c2e7b2598474403b4.js, 20160511_7b75be05d99822aeda2f1d4e6ee3fb6c.js, 20160511_7f51bd36e42150f33e8205b29af6e9b8.js, 20160511_7fb3eef53ce1d1fe1d1763c0e67ff46c.js, 20160511_817f72a6306c668a6e69059f04700a7b.js, 20160511_82d93f8a5a7e9e1ec43e0867daf01f07.js, 20160511_85cbecd7850e716261aff46d5e75beb4.js, 20160511_85f589ae974b583de7aa531d46f2c63f.js, 20160511_86638876c22bb62dbace018c4c6c7262.js, 20160511_874e1b2eea709df4d6143a5b4dbdaf30.js, 20160511_87a7ddaaf49c457d886d301ed0edcaea.js, 20160511_89c63d1f84a800a8ccd8099d9fba5ea7.js, 20160511_8a1e85726034c413836bf1c98513fecc.js, 20160511_8a8d1af9aa7c743de4146c198c97b455.js, 20160511_8f285f977663c33621cd20b5ac1cea83.js, 20160511_8f742f27826991c1392fb9261dc0d420.js, 20160511_922d544a43e6625892ff96cbdf8a8b94.js, 20160511_94539fc2a8c0cf87b15cda6cf278f375.js, 20160511_95627eba4a2d8bedf946936bbd6309b6.js, 20160511_968a062fcdbb9700775ba45b76469ba3.js, 20160511_974b248c2d68327419c364ef0fb090fc.js, 20160511_97fe99c2cdb602ef6d16092ed7c0c0b7.js, 20160511_99a81c59b944b36ca1852a4b93855771.js, 20160511_9a1f052139701232ed55d05f432ccc28.js, 20160511_9b4625467a96f7b66bbffe9083a8e794.js, 20160511_9e2a23a39b6d666fed4e5fcc132baa6f.js, 20160511_9e6d1c27813e9db063962bb2bf96aa1c.js, 20160511_9f30bcffd7b65a400714f975b77ec10f.js, 20160511_a080d903ac48b73f3ad8a959c1c0f73e.js, 20160511_a5c17d9274e6b113254a774261c314b2.js, 20160511_a6d6e6a42fed67e3a601fcdd352adc4f.js, 20160511_a91dc8d73ae0b18ea53a84985691adb8.js, 20160511_aaa30ce0d0521eca02a85b50435392ca.js, 20160511_ab0a4e290e600ae2ce9cccfe3b08b84d.js, 20160511_ab2a7ada98e95f3170191d06cac36c1c.js, 20160511_ab571a66b941ea4b6e0cd591f96c016d.js, 20160511_ab697bce7c5dc8049f119691981bcdf5.js, 20160511_ad124927c932f076274265684876ed88.js, 20160511_b077be5756b087ea0b103c50097f7895.js, 20160511_b141b7d88637ca8d3c6c85365ff18e9d.js, 20160511_b3fb9faf408a1aa9b7578df1168ec65f.js, 20160511_b539d9c0f7c2867cfaf465efc1b0c324.js, 20160511_b5894993de015cfc5b3bcde113d97e96.js, 20160511_b5a952472bef23ed1ea83b0c9bc397f0.js, 20160511_b85088502c59556bf9ce386207dbecba.js, 20160511_b8fd9ba0bab8f554b6da0ad4822a5042.js, 20160511_ba007ba744c432ff3baf3d898ee4dc53.js, 20160511_ba69f1a2e250c9c0e66a3b015b519d26.js, 20160511_bc5a9b7e902b629b2efaf8f263fe5bd6.js, 20160511_bd5d393915df9bcee63b566ce51b7452.js, 20160511_bd5dfaa90e0ca094020f597d65e01e1b.js, 20160511_c0e875d030d4df7746bc49eb6cb2303d.js, 20160511_c16fd56346308ed30269c7e19137ee21.js, 20160511_c19d0fc6570f3ad2176382e360ae3534.js, 20160511_c2ae0f2a20238ee9070d8ca381662bc0.js, 20160511_c301b1c706308726828567d1503566d0.js, 20160511_c3ee03a4aca1b16ab4d3b97738d99d4e.js, 20160511_c450251aa74c6784daae229812a8cefe.js, 20160511_c47f7850f02e3827022591d49387b761.js, 20160511_c5b7fc7eb32809da07c6ba2112aaa36a.js, 20160511_c63b1c847a564f770293e5dd39505c16.js, 20160511_c675dd2486ae2a5e95d3ff40a9332f67.js, 20160511_c6f2179c2f1728147e768a82e767b7e6.js, 20160511_c9dbaa675fe471837c904bce7a3e856d.js, 20160511_cac8741abf882dfab95e6c713c7eaaa6.js, 20160511_cc6971c99ece1169f5660d1905a3b1bf.js, 20160511_ccf050e017407b992c9227849465c7b4.js, 20160511_cd33c2401de3a13fe68c17d8a599201e.js,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "987f9e03b62a0d8b626cc6bac9324fe746ecbfea22d92c21d309044b8a7ee2cf"
    hash2       = "2f4fbe9503b6b513825e18ba5003029fa223ff8686bc6656ed75181e56295a2c"
    hash3       = "8fab4ef28aab625446210e1e2ba86fec4961f5ada9797962406c767a2caeb744"
    hash4       = "09af2f7e8429442377e7e882ee0b85dddcb4f510e6377d66137954d02a2225c0"
    hash5       = "0d4fc78f486a8389ccad248a35e981c7b7290ff823378f066cb349969d4e6435"
    hash6       = "5bc1897f36cd746133de378a04799d69a085684aa276827e619b76ae831fecc3"
    hash7       = "a7ae9db91e316d0de68c510d42bd15ce9588ad583324147c6f8f8a4b83c35b49"
    hash8       = "d374ed74f5231023af7b226a5924687ef06a501ce561c88212ed094f8c75ebea"
    hash9       = "346e2006eba183cca90bb414fe56c42e272c14312822ed0c0dbee50465e269b1"
    hash10      = "e8c4d26480c0b7b2589435a5c768f01b88297d6d0172151d62ba3efee9630cc5"
    hash11      = "5d81ab1eaa668e00acb8337d9c5df5747dcee1b53215e3c64e22d296d8c495e1"
    hash12      = "0bb7758fa07cf2c3ba05f0b7ca25cc5766d09ce579680a9858daad7cbaaa93f4"
    hash13      = "b7032311e3d880963d62b614d74e0664cf02d65e750b9cf7d0e0bb483a3924bb"
    hash14      = "aed28031da450112c2e4aec4c86695cc96387dbe717f0a761dc31bdc6ca1b841"
    hash15      = "3cd37ce67fcf2cb3c1733e878b88fc75bedeb0e0c618fb52e73cf11fed6c9772"
    hash16      = "3e02b1116eaa4dfe1033de348983ca770038c590394189421e803cc8172b3816"
    hash17      = "b71f0f5519cca3a79a5bce404d2d9e924435a51a88fc3b0a88eda5dbd007874d"
    hash18      = "9ee2ca9d285fdb03905a45c65542ff4c15c682051a0669c5bd6132fe8fc464d0"
    hash19      = "fe78cddcb72c163cd6484e4b743d7df50f3b3dafd9553b54f32e25f2b48984c6"
    hash20      = "0def8f3d98b84a9d2939d13e54e1b56d08487cc5cef693f8ab24d84bd0a15618"
    hash21      = "059f1230efcfc6d89645fa8a66d8fe6901ed1d5dc16fb683da573375ce0d64cd"
    hash22      = "15f4331a17d7dbd82bee090174feb95cd861e8217678a9dc44aef6b1ea58cb68"
    hash23      = "e02dd0439dbe424f17419a6abc81bf967a36cf394a881c0465398bc6e89a118d"
    hash24      = "2f0a44ea7fcf1090cfcecf2443bd4cb7e8ff4682a6a1d6e861e38c645e56c866"
    hash25      = "7bad0532f4c2df0a6b0a48e2ccb706342900134a72657f837f72130d5a4b05c4"
    hash26      = "eb58e4326857c95003dc7adffa93d0aa7d644d2a36a7a25517134af24c7835f0"
    hash27      = "9abab3fe20a9ee792e9f28a86ccd84ec524188c47c01cb6270513eaa34fd4a03"
    hash28      = "5494ff0addd95cd09e6cfa35333a0ef595c75e0ba446b1db44af0ff851dbd2af"
    hash29      = "50e323d4ff0942f0e4e31d554a31a14d44e67c204bf91bef970a3c076d864255"
    hash30      = "01a40b93ab4c1f3e7f4e044296d38b849d64db5934448e67b6fcf9cc0cce12a9"
    hash31      = "b69d2ffdd693184649cbeb09db3c3a71dc32a390ade8debcf5923eba4e1484ad"
    hash32      = "085b1aed68a73962fe14e1c5cd8ede5ee611b6cf3af6455b9ab0128a6b3d6ed2"
    hash33      = "b9684895b2ae798119163552f0da54de817f01cb1aa975c5f57f048a2354215f"
    hash34      = "25ffc6ae898452b5f8e69cfb0c25be9e30e3bd5ed7bb2ceae7bea9a7184333af"
    hash35      = "08ec78de5a56e38c10fc06a6bad9aef3b0a88c6cb6b91abe5bb2c0f89821e82b"
    hash36      = "8f0b6362e7dac2b012f33e9289c970f1918a49cb3cb92340862fa7c4a3103e76"
    hash37      = "acc302697640b45676b5672708fc029bb3740d031b084e80519963083ad79956"
    hash38      = "176e45f967fa6cee09ac2b5a94b8533b7fadc9e9ed9b1d6c5cda1c1b89a542c8"
    hash39      = "c4edab01d8009efc068afecdbc066294efd8e129cea994d6022a88278f76e95b"
    hash40      = "406303ffd8652c82ef6649858838b3aa2278c15c69425b3c646a341164541228"
    hash41      = "5b883d496fc8c7e82f75564d270f624ee0ea2a7d310b64a9b623e297efbd5890"
    hash42      = "406fea12377679378f943152033be24103b267c46d22a9114bf1624975fe3fbc"
    hash43      = "21ffd513b8eee58a60acd32035d7b504255e77f7eee9954a26f41037c7a99776"
    hash44      = "7e101b51d7d512ed631d574ed2adb7a42a7cd49154edb9580468681af0bac240"
    hash45      = "8990f7cc324d90ab6545aa050d44b071c42a8fa98f9a83baf41119ceea294e4e"
    hash46      = "220a24f6c218303ff95e2f399bef15b68839d559349b788dcb83b166e004d133"
    hash47      = "d1bff0c8310a4d77cba323682dcdc51740d147eba58f048e075918588c1e244b"
    hash48      = "9ab958d0137fd0cc82471377505998fbd3741ef277d484ccfd1a3c99fb7d826f"
    hash49      = "bd1fbaea2260b63e7d7e7a337774a2014bd117ca6b8388b8c43058dca105cf55"
    hash50      = "ae0948fc71895483c60e9cae08cc9962aed9caa6c0f5ac03ac0cb69916321311"
    hash51      = "98980d757f9c32c207c8d39e0860cea68d76228424d8d571c9c6e43514899009"
    hash52      = "c5a40c350ff88b4968e7821d055707eb3c0c87fbe02d6e05b6f539e8c0f6bd40"
    hash53      = "d4e768eaeea7cd890b1a4d920b968e64574c79f2188a2bd4614c6747030e78f2"
    hash54      = "b1277505e52f0196c6657abfb04e64ac236bec4683ac7c8237ed3a85bdd51200"
    hash55      = "9a17bfeeb5ac8c82f9c1945a7e2392baa899dc6bfcdef91aea079d25b7579c8f"
    hash56      = "7dc16b9810ef6724eb056a5584a907e224bd20f27df0f3320b9fad0c142f0165"
    hash57      = "4a8958ecc3befc67fd071f7a0b3c2f8a72b7a13143a9b46dfa05bce82c46812d"
    hash58      = "94afe664eb05f1eb0e0a437b3c3db89e4803dee3451b6f8f4c3984ebf671c0a8"
    hash59      = "01aedaf9cd3cad8ee96ca0d34b84ff0d9c3c9ae534efe540f6c65fffbf8c1a29"
    hash60      = "2823343b99ae84d6ae1ecdf8225df939361b34a7e42115997cd0b0e564c2897b"
    hash61      = "8707d0ccf74e2bdb470e5772980fbe082ad502218325d18fb312534886a62a31"
    hash62      = "61bdf092ed55b34dac4ecc34909b31ef8eef7b73f18b644570222cb6995d21b3"
    hash63      = "adbf37b8c8a1776eae26b832960b49cfd79d63a62c6604a615f93c9313fcfda8"
    hash64      = "34d1372581a239b18101436251b9bdaceeb1ca77026376a70210b25519e3db9c"
    hash65      = "9da5836c6fd415d778a2a68a67c97fbb7f80a547721beb207febb09d397365b7"
    hash66      = "0a2b1c3524cb7cbdf483e35f6feb032e630678caed5de97aa077a934b35fbd91"
    hash67      = "b54a09a03f03e4c008876fe25ec78b86857d1465539a15ff774cd829446a4250"
    hash68      = "03b2498218f1a8436ec7d78c66ab8b476b8ffd9522ead92b82200a7a1966c8d8"
    hash69      = "b32faf1fd28eb3ecd339ff08573528beddc6b49646e5d309491f57664d0b731e"
    hash70      = "f3f2157a1f0e35ad5ee6a8b3ff84ff0e6584483653f5f96cdeb394205a2c1743"
    hash71      = "95f2f04c4fdaef9c089c2a43b38056fc69385a16628c1593c22a83eddaf0c501"
    hash72      = "8929a9a9aa89a905c7e4ae91abf1fb1f4ea971c5b866a9f44649366d8b3afc3a"
    hash73      = "016d7a975c956c4ca2a37da9df464169add232f895321d85099568bca028350b"
    hash74      = "369f3a08cecb7c3ffed49836fa6cbc728a75e1a9b5518076f389686a4c4e0f3b"
    hash75      = "32746fd0e739a1b392bad5c8e498fa1082e1d93121238650cf5d90ff6a60c144"
    hash76      = "c742770e97284fb97264ba3c03c3bf903333b6808e920a854860073a74de06a1"
    hash77      = "09cd7da3e92e0cf5c78bf32204ae19a13844dfe8563042d8a56d1c709ea18669"
    hash78      = "8cf9fcf6ecca2fc03832215e623125bc5423ca0cd3b3646434c2b382c694a829"
    hash79      = "90a553d70a5813a7296290c3b176f3a86611bcf44a1caa569347026a0b97e147"
    hash80      = "bd8b7b9dd37db51e893bab578887fa3f971f69503eb8f954cdd3a4295912b130"
    hash81      = "8c5f6d465fc06959720f00cdbe99e6d27f03e08e3707b36925207224d2aa4197"
    hash82      = "fab94f54f200a184e20355387843acf4c8f30eaa2992e6a08c25221db7bef19c"
    hash83      = "89d57400ea8b27ed47ee31c855685ebc1af8f2a44583df0eca5135b3400c3daa"
    hash84      = "1b2f73406ae2cd35330fe918aa860ae5c323d1cd3ac0657c430dd986d09a7c16"
    hash85      = "d9d3d520776001cf48fd06fa4a6006254da67bac5f11c0e649fdf53c9f3e4550"
    hash86      = "784ad1b3f57a6129518adcef40e165f27800c8e8c8ad7ad78891400515cd517e"
    hash87      = "e83564e0fbecbbb90f1c1f143fed6a9126d039b549db45be7a86b7411639eb01"
    hash88      = "7d600247ff7e67c11bfa2307309c4debc7ea8b0b1ae31ed790688481491f93e8"
    hash89      = "412da48619c4454f37bf60f7586e00906f0838f52b01f8a93389b4b51b3d91d2"
    hash90      = "91595528972669ae8c979e0644c41c52b41b7a57710faf5bf2048e84feab2d0e"
    hash91      = "7228773edca81fe594d1360929fde3bbd552d2b520e77061c73c98723b27c3cb"
    hash92      = "0806ba41e5ec3d939aeafe3445f8b1f3285c2b45ed14aea700fd4f3994d5df71"
    hash93      = "f6bea60414919c86a173cada01ed0790859daf75d96b29559945863633222170"
    hash94      = "b4115fbfbd9102418a046c2af7c5c31fe273fe4570c63747fd671b94ba82799f"
    hash95      = "6f40d757c4c332fc9b792ad09f459b04b94e1d5ab43e734fd51153a352d67a0e"
    hash96      = "bab28fe92da6ee05c08d76690678292081fc55ff5b0133c064552c375b027602"
    hash97      = "5922a5f726e5ccd141d2b9a27fb7e7b40ecc2dab592bfe7b138e06c82e01973e"
    hash98      = "61b382a759e6696bf0fd38f29510ea928a381055e96a39da1abc6f550f2ffaa1"
    hash99      = "22fff4bb5e2431bc3f14b6bf4ec5fc79ebdcf53a5ceedbd4e3282bf18c98a5d1"
    hash100     = "b9ccaab52fd8b3956e483377699a745f4fc19a787a7e916103be7daf65a14bcf"
    hash101     = "e1a76819a47246f70f179b03bfdcb1235fff571a76df777127051bdde8df395f"
    hash102     = "5d492bd6a3bfeb8c535563f6c8abf61eb2cfeaabe23475c224516809df09ea21"
    hash103     = "4469c5dc14597abbb6a80b4ef4c1db6b1562c1f26d0526678a83b9c93fd7e76c"
    hash104     = "505bbb461ce945e63389c30fa1471988c86217e5ced2ad1d26838a7631ba3398"
    hash105     = "13301cb29896931e3eb3843ea1d5a52593bcf6f97287b3678a64ff4d5bd1526c"
    hash106     = "430540943c9ba6b38211a813720ffbcd6762f494738b72e2f8cec20ad74b6e0e"
    hash107     = "288ed9e63a05adcf4441b882ea93dbc78d9e7f0b9e0188a3b9f81bc25b756001"
    hash108     = "922c8239ae43cd73f26ce148b0ecada0e85ea0be31423a4f2c4b58bf6cf844ca"
    hash109     = "bcda3577d26003d3b39411a02a79663d14cb2468dac8f41e5c1183151df471d8"
    hash110     = "eae424b34e8eb81025edc8d024d3fbc074ceba0b18a834d8b463aee92beae0f6"
    hash111     = "37d572d8f22ddcccc78e88e1cebe1be2147a81a72186c93ed2c4e1d73fefca86"
    hash112     = "0db04ed4ad539989110e9b13f0936337377598e7eaea450ee38bc42748cd705b"
    hash113     = "90b00f415f856e31e009c8a435df08ca629d3c68bf1ff3b2851e5a0d001d0e10"
    hash114     = "223016c9162358e3054c6c94c7a393e0347f072722cc0b16b6faaf4c0cb56b2a"
    hash115     = "fb8bf0b019707b4a6e5050e279dd3d2cdd77768bd216b97916ed858a8d2529c7"
    hash116     = "c03c3b156f709a9c8553f4b62db9db8bb211224a5be13b0eadc68318fd9c79c1"
    hash117     = "0e784f1a065e5fa9906a9ed1aaaf7bf945d586dc64f0add0a530ba4d36635c21"
    hash118     = "e74243d2b669c1b463d3188947b02577f09652a45e2357ef2a8300717ab37e13"
    hash119     = "413fdc65b550755886363a526fcabf9e6344e252fa4439fcba0ec8cb6ab8d39c"
    hash120     = "e75501e91f1ff5af4499f499f5ac1ee35f1ad6596536188d8bff9dcffc40b955"
    hash121     = "e5d4e253cacfe105bfc139a8f1a531c4b9e0ba0a58cf16c85c315f44fbdc09cc"
    hash122     = "1cb1f67bcd06b392460b5267f2a56a100d78cef2f8b3fa334c4e61993c68d5f1"
    hash123     = "0d3c82aef21a0b6fe1fe37f8ceb79bdbcc9831275a62ba41925d07867b0b3e37"
    hash124     = "f7fb2e10eb3944cb895cd1b8c56cc4f2a97c41697eaada9d7c5be891ae47672f"
    hash125     = "512df15ddfdd8cf798d83d30d0164a5c7e0e3d9f7b1c26b12f86ac8e78d4aacc"
    hash126     = "f54c0b941347588ca0cc7e1e567202a4c68ca981a4e195558949c1be25c08b9a"
    hash127     = "d19e9014f84f6b9ffb8e57df399e5fbd5845f86291599dc0a0225858dac2f087"
    hash128     = "21cbd2cf0f611ae86a47bd4a64cc8b0ee20180da200c14a5387ecadad69df0c6"
    hash129     = "41a9d3c8313299cc7a26787b27d34c6c3d54775018c474930ba03b662a92a1a5"
    hash130     = "92717812307be70bbfff1ea38ee23110a571a29cdc1064485d07e62c858815ea"
    hash131     = "8ad77703b0e7c90cb9f5ef4c28158a48bc17e2ce6902f72116d2f50fdbb1411e"
    hash132     = "7c6c1c2af3202c118581a0d42df681c0c94ae34a9496eafe4a6e4d3e3773b39a"
    hash133     = "249043743265837a99bb326b2be965f61d3a69085a91ccabce61118bec51dcdc"
    hash134     = "491b57d5e01f8d1dcdd66309a556fc392bd10747bb61e105159caf53b1b526ee"
    hash135     = "e44ebab7333ccaa6b5691483abe066627170be16fd49866e1c6d5453b374795f"
    hash136     = "c8b7273067e3f4c89c4040c60e695193e047f2cb6affcac02ed01d17e8154d67"
    hash137     = "e4224868622353a1c23cac243d309f3b5d4abf70c873958ddfb8dfd1c3a3709d"
    hash138     = "9b4462f0033aaea041578525661ad006beaa4bb345d6bed73f69c99996f9dad6"
    hash139     = "fe5694b4daa67a4a0ba7482ee904e1eaa2358bc048802bd569e6e7248963d1a8"
    hash140     = "5696ac5a8def4a36f0cdbdf79e85abc02d0847f1071fcfc81b5653f65dcc7bbb"
    hash141     = "c38a6a642bc3f84f203d2636051e406a7be20cb4b6112b819786eb07adb62200"
    hash142     = "cdc2132cce6060f39fef938585efe2cc9af90435768f1ad72b4913c790e121ea"
    hash143     = "7bff5f124f4951343748f172a5b1515d26594d6524b61cae030d98e61fe9a647"
    hash144     = "c75d0ba432d25e75bc3b22ca4c8a45ecd47fc836c1beedd67e4d2eccc60f9c1d"
    hash145     = "bba3b745b9dd92585baa198a8f8d8d61f1477981c4df03a7c166e66e838babfd"
    hash146     = "8080d2284d0dcd43f32f861e6dd2ccef193e79074d0e39f3f2839f7a4fafd896"
    hash147     = "25cd4593b58aae27463f320a60b45f2694601a11d81596cc1526c14240a4b0b2"
    hash148     = "1c20d65a4b77101be1c1d64010b21f22aaeea96dbeec8e60fac2b01d3fd3ebf4"
    hash149     = "b046d01f6393b2cc1b454812785cbff4c859ed5d04b7914072f355929688f407"
    hash150     = "aaef9bcc5bd35c69ad40668612468c1ab48b2c4ddf033b8434e401571adcf641"
    hash151     = "bc845eec4d221aec41d3a63b6762f2de3af71889ca114cfcb66d57c41a8758c9"
    hash152     = "95c3373d76845edcbc18bbf7da052859dc16f592cee22dafa6d4e9a59c73c637"
    hash153     = "8cacf9bab10c8421649178a9f95edde30e9abb688f8ad4e559f0cc449ce26953"
    hash154     = "0450dedbb3b6af41c80205258c000a6bb73744ef86ca9e2a3a67ac773bb836fb"
    hash155     = "b7a8cc0883bca90d287e2273b25fe5d404f16fe401723fa0b47522a3984ce5d4"
    hash156     = "314afc4b3ee860de3a3f3b2f5e363af747133762af7db17b53bb418f55980bc0"
    hash157     = "5b7b87d30e17e588be7dc65ec272baf41cae4a471a9c4c72b8d9ab6a9b2cca95"
    hash158     = "55638c2c067f53354273bde4867d71a5ad20f81141313dba4baaec1d6049cace"
    hash159     = "4b70efb12b0eba6e76155de0d32887eb7da65e0206b0fcf354c85a626f68af44"
    hash160     = "2523f37904b9683bb1fdcdc31a7de8802e9b1ea83a59cdfdfab34949e64126b5"
    hash161     = "8522f62785dc8298073a1361eee4d8b1b8bf5d96712ccba96a703539b983292f"
    hash162     = "7941b77c25af5b945fd91a0ec8ba23479b9c0cb9540becb43c4653013af3e970"
    hash163     = "37680a366f770f72cee938120c573066816f1dfdb1710b0b72c7cd32eb03ef50"
    hash164     = "8107cad2d9b17bb6153c74a19067bd8165b150a7eb579247198fb2ae5d3306a7"
    hash165     = "75c2b8b726db78571673ee3e180699cf2fb353342bb907cf03387d09265e52a7"
    hash166     = "629997fc81379ab6f4b9f1784eb99593bde7c9e911557f75ad0d66e0338aa16c"
    hash167     = "e3f2a2ae8fc36b5c4e5fbb79d641d13ae0ddc60b811ad889e55f2dd7705f4e64"
    hash168     = "7f6a5ab33b5621f1a7dd1837b169248db13dfab27614c8720bf5c5ff847a2c1e"
    hash169     = "627620e69ae853f1d5cd4698ca98217b5f069e646fd989562ef11fe277bd6862"
    hash170     = "9282159d10e81f9471aaa37dccc973ca28f6e02bd56b4562d2c2d7cefa319521"
    hash171     = "506267c392f23c446e02beb44fc990f4f404eb16ead32664cc57c4462271be1e"
    hash172     = "5039a709c2eddbf5b16c3534be24f7f533ac3a6013c7ffafa91cae371152b7f8"
    hash173     = "bec7dbcdbca59483b128a562229e5d93c94618ce1faabafaedfc08df65bdbbe6"
    hash174     = "1af7f333328e52322043ba91a1bf1516f2c6a52c5fddcec707e41eabfa5b8f65"
    hash175     = "89f0bb96640e0aaf969a3ab07c2ca62e8413686b965d62d917b69c0e7b181d6c"
    hash176     = "f19bc6e1b67411c35ef8750439c6daf465c5b02d3ecb6e670ed8cb0161f0afeb"
    hash177     = "9ceed3e84dcba44693c8f134096ce889565c667ff7402a85c3a1f4aa291a11f8"
    hash178     = "51e285ef7d95c14c09e4126bab96f9afa39b2d329f047d6a6436a30ed9bb1554"
    hash179     = "d0c02fc066539e5f1aa66e993d0a0bd5e01e0eef76551057aa04a8f1bc92393b"
    hash180     = "8644e9552cfda19d37694fc3c26a5234be0c1181758990ef0bf54ef159138088"
    hash181     = "75face8ecfcca8b935f862fe33c6c40216654d0479909fb88b7bcc6c073f5164"
    hash182     = "29ae77fcf51abbe52d22ee7c1613e8ad48c280ff95c223008de0d1819661f9e8"
    hash183     = "db925e495891bf7f8e5106822cd1559c8ec5a5bc5ab4252ae4d82e433e904c34"
    hash184     = "0c7acffadab312e2a2d9377c8dd9ee30305336002920b207d21556c355143a24"
    hash185     = "67b09ec4b4c4c13a0de9f88f71a129fb21bab5b427ce001086310def12ac2891"
    hash186     = "6ad376378389ce13f0f796143358206544a70c04fae8732ee1bcaeb77ad19c82"
    hash187     = "d47eae90dd3cfdaf08ee4719971efabc16b617bb12525e587ee5659aafaae3ed"
    hash188     = "7494ce34f1022ceff4a4f4c370611b4043fe5804c048581bfaeabda9a713155c"
    hash189     = "830041567e134e0d3f09b2b8df897a4f7c999feb68131a491879ba61e783049a"
    hash190     = "6ec99765aaf0c7f392e21378ac94dd5ac8a6f020f4182f72d821e31778b89f71"
    hash191     = "9c23ed0b6cb50225d5078559e3949ec86f0c917aca8703d142375db0ed945d8f"
    hash192     = "92425bf75d31b712dce13075c7d9f04b288d225f8ba9656a98e5f61ac415d5d4"
    hash193     = "0386b0f065c0161b63317ab6232f9fbef1700cfd73bbe14098e53a9915280883"
    hash194     = "b8de980fb616045b09d0d9f32fcc10b34632eaa5a1391cbeea108290fb15e587"
    hash195     = "d6261e8f87cfb51646775a6a397abb5e120e94741ee9d44adb8f9a62e36e60e1"
    hash196     = "095eb518316a9f8ee67f99ae17289ae259b047e8688978698d1e6cac6eb5ece6"
    hash197     = "cea7f22d2225af9f6f952e3f1fcfa1644c564882acc062e4f9738f2fb08baa73"
    hash198     = "c7f86169d16c46eb9e2951a1180079a5a8447faac34c33525b3ba3aebd37e4f5"
    hash199     = "1db73e8f73df706f6f87fc840c7d8d33cd8aee2354b8d650d10182befea5b0fe"

  strings:
    $s1  = "function add1b(SOFTWARE0){bordercolorlight0[(\"Ifasd \", \"Gef.H.\", \"R\")+ \"u\" + (\"fudfk\", \"n\")](SOFTWARE0, JavaScript, " ascii
    $s2  = "function add1b(SOFTWARE0){bordercolorlight0[(\"Ifasd \", \"Gef.H.\", \"R\")+ \"u\" + (\"fudfk\", \"n\")](SOFTWARE0, JavaScript, " ascii
    $s3  = "var bordercolorlight0 = function colorInteger() {return lime[deter]((\"Trafdscks\", \"WScript\")+\".Shell\");}(), followed0 = 11" ascii
    $s4  = "colorInteger1[dy](JavaScript0, starfish, (true, false));" fullword ascii
    $s5  = "function ducts(Table) {var A13no0 = (29 * 4 + 7, Table); return A13no0;};" fullword ascii
    $s6  = "if (colorInteger1[\"r\"+\"eadystate\"] < (1 * 2) * 2) continue;" fullword ascii
    $s7  = "var deter = \"C\" + \"r\"+\"e\"+\"ateObject\";" fullword ascii
    $s8  = "lime[ducts0](120); " fullword ascii
    $s9  = "Table0 = \"start \"+A11F4+\"\\r\\nexit\"" fullword ascii
    $s10 = "}while (bordercolorlight);" fullword ascii
    $s11 = "function c(){return deter;};" fullword ascii
    $s12 = "var KZT0 = false;" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

999cdc2e-42a3-489e-8383-7da89efb3c05

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion