_20160520_01e209a53d965d94e74f15910bf7b4b6_20160520_037f3d84340b_623

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160520_01e209a53d965d94e74f15910bf7b4b6.js, 20160520_037f3d84340b70d6af3f6adc877f4778.js, 20160520_04d497983294ad33dfb3cf870512d389.js, 20160520_0572c7677f45e6bc9e252dd558ab5b3a.js, 20160520_07cf62435013494ba6e88c38ba85fd81.js, 20160520_081928753544faaa5c8efddf4bbf334d.js, 20160520_099dbc249635fc965b6a0d18d5d71886.js, 20160520_0c74e07a608f8dd781d4f05faaa548d5.js, 20160520_0f24f48dc5a7fc5b66055f4937ee4ebb.js, 20160520_105b9fb3ab16bcba1e9c343473ec4de0.js, 20160520_118e98f36611a7032c3214d6d39dac96.js, 20160520_14229ca8c66853354a499ea70f6e83ab.js, 20160520_14582f75208c5925ccf7a9fb9e9b934e.js, 20160520_1515339c0381a520645cd798daef4408.js, 20160520_1565e7870400ab8151f9e4a407783ae6.js, 20160520_15ab5684189f548fe3f0a130ad8b8f5f.js, 20160520_15eee5127a48f95f1f421a538db0aef8.js, 20160520_1630960d30ea02ecf1e6901284e136bb.js, 20160520_1730fe2db48462731f95477443f0ffe8.js, 20160520_182ed4c77a32830b8b409882ace6e47a.js, 20160520_19b4f262b1b0714d12c00d91e67f0eec.js, 20160520_1a345fe52a0db23490c0a5ac394bf33b.js, 20160520_1c90e8c4ac34d710f082e95c0e3f907e.js, 20160520_1cba1e645e4060046aa92e806a285f63.js, 20160520_1d4e741b458eabf35df6be58166effe3.js, 20160520_1ec765452bf4c8f343b7480f6febc43e.js, 20160520_1f276fcebb017d16df2bccb26f0bacbe.js, 20160520_201277e2e9252c9573e62394c1de4be8.js, 20160520_2195fb2c221f524a4e9d929d475e6991.js, 20160520_22c984c0884c6c917dd7b4ad2858d26e.js, 20160520_22f58a2714e10c1beec4ece7b46b09b9.js, 20160520_268c998e356b37ab1595117c481875a8.js, 20160520_26e8b6fa33406a28ed3213129d059f50.js, 20160520_299e376bab98ceb94070e56b4a7cd771.js, 20160520_2a32614c7a41d4e6c56dea28a7bcb29c.js, 20160520_2a88fd3ec867dcf6726790dcf205b083.js, 20160520_2ed10806f478b466e92db3d286a1abaa.js, 20160520_30c974de6fa21e91b7c169536a05f18e.js, 20160520_3142589b52ee953142887684adac1d3e.js, 20160520_36f009a9efe50d227f05d6b3241a216d.js, 20160520_37b2c6e392b1efb98e6def1f9fa73be2.js, 20160520_37bb92354fb98ad69b2c4ec298a54b52.js, 20160520_395e370e99d8657f34ff5ae2d7268b4b.js, 20160520_39c2529e442fe6a0a2c588a3b1ae4384.js, 20160520_3e36e03ed5e864a485677b772e208c2b.js, 20160520_3e97a8ae9fd24f877d0947b28ac5864f.js, 20160520_405b4046cbb0f7718196dd9d4b38b189.js, 20160520_43ebfbec9fbf6939f5dba6d8262aec08.js, 20160520_43f9264cbf0d90e6abd3292de588e41e.js, 20160520_457e58e030d5735c9e4b0ffe1b0e4896.js, 20160520_46ca76884653cd66ed8fc8e6ecd3883e.js, 20160520_48c0f42fede1ea907f9ec6aa4df5c61e.js, 20160520_4e7613ccfc308734d719f91b35a438f8.js, 20160520_5025aa8e954f7c3db9463fd622ff1bd4.js, 20160520_506508f0572fb4bae8c2eee70cd19dd2.js, 20160520_50cecf2e7c47d6321cd777437bbb1200.js, 20160520_51bab0310cc4e4836d81f4dc9113d515.js, 20160520_55a132a51348275dbbe951ebc3f29859.js, 20160520_591039d6d45ce56b876a4f6cd340cda6.js, 20160520_5b77d4062213c8eda1d6e6752a970cdb.js, 20160520_5c86fb4c8fe2270c9cdfe1c1fbde4f69.js, 20160520_5cd71a31d73c65da0ef4c32ff414c082.js, 20160520_5fbd48f50c47cd7ef794d94ad0fb14bc.js, 20160520_60391f4fa095ed03b9242bdc523c374a.js, 20160520_60ef974c752d99a5a0b9856dec54b396.js, 20160520_6562e7bc26a3f85aa9346e261bdac0b2.js, 20160520_65cb7e80a4ad58a0bb570e64a01a4435.js, 20160520_675b37e40b3824b1ce9d25ae29824b45.js, 20160520_6931f1be2a1ffcf8d532dee0f7b87441.js, 20160520_6a59544ba4ecf707111633c96df291cf.js, 20160520_6a9c45f031ec334db49763cdba577215.js, 20160520_6d49389da886314f291bc010502feb04.js, 20160520_6ed457f228118c3a3ddd46fa78275e3a.js, 20160520_726c71122b6b6f1b6d79891ea557fb72.js, 20160520_74ca59755c9e4ef8761038fa60967ff6.js, 20160520_7505a4e0e0182ed2a41f91abebab72e6.js, 20160520_7555ac07f3235108b4158880158383bb.js, 20160520_7980013268a15921a4b8c752de817ff5.js, 20160520_7c940f4f7beae599c685ebc887d63b07.js, 20160520_7ef66e51be03534ec4f0305721bd5daf.js, 20160520_80f29b282697cd66797a64f4abce6311.js, 20160520_86014b18c040c606fce975e4147f3d2c.js, 20160520_86ad5ef4bda7bba2ea42995c6c6d941a.js, 20160520_86ea5948dbb9e9c6875b6e426981caf6.js, 20160520_878351f045df9b393ae66092a17c124a.js, 20160520_879b03b4e4063e70078b1f1b873b8f59.js, 20160520_889489f8b1228df6d15791d50c2378b8.js, 20160520_8fa3e5eed65732eee45850fda1a47958.js, 20160520_94072db8c82a7c77b6a16d6cdead47a9.js, 20160520_94c9263117c09e5abcbeb01e78b95030.js, 20160520_95faf5cebe0f5d1423f00ebb8da76b53.js, 20160520_96bf59c1370301b9b93187d8cba5a663.js, 20160520_96e3534730d6fad8ed748b4b9da4f47a.js, 20160520_980e410c92ca37aa595bd867b8f0dc02.js, 20160520_988efe487ab6786ba4959091b41fa54e.js, 20160520_9ce3822e3b8ca9b62e65543b91d87dcd.js, 20160520_9dde39eae0a831e749c22e99013f4bb6.js, 20160520_9eb95389a141fcead1042c5f5babebaa.js, 20160520_9ef85c746c17fc6eaa879b38193c923e.js, 20160520_a277e936810f770ba9ad4ea9cef42072.js, 20160520_a2e9845103349e51566a0070ae3f027c.js, 20160520_a50fb4a65ed5b5877fd9a4db38db2a6d.js, 20160520_a912185056ab9dddfe237dc4921ea680.js, 20160520_ac089f1b93a9e4d827d9a04f94405f4b.js, 20160520_ac129a8821c86b2d5fb2e5094c33a927.js, 20160520_ac24036a003c8978c391d06f51f926e5.js, 20160520_ae0a52b4aaa3eb05f12b23f96009f41a.js, 20160520_b1659f96b0867a9ffbf022c567720537.js, 20160520_b3c708e787687e57a1ff31285c77362b.js, 20160520_b50e417f8680b533fd2c519358e9f400.js, 20160520_b9fa5dc4bf1371f769a5068782d4cf66.js, 20160520_ba0920d1092caff47ef874d8a0d63e1f.js, 20160520_badce333ed392c0f839b87c0a57c37d2.js, 20160520_bcd3dff59fe3ed7edbd1bd6e59ddc434.js, 20160520_bcfcdfad9dab565b288a5a26a4fb142b.js, 20160520_c0182ab7844c443a2b139d609b578a90.js, 20160520_c4c63fd5a384a2f7baa3050dbe34e671.js, 20160520_c543012d574414eb27113ae58bd92bb8.js, 20160520_c5d1f7e7c47930ac9c3b92f9968a0e88.js, 20160520_c5f876ce3032b67e9d659e771f3ab215.js, 20160520_c7ee70e9a8825155f3cbdba1358ad6da.js, 20160520_ca99894be9a1359738c6e58e1c124cb7.js, 20160520_cde4479c6d1b0179f55a4a70bbc265ef.js, 20160520_ce8308162e65128c081a4f3ac705a22d.js, 20160520_d15fa6088a5b49e38aac2358af7b9a27.js, 20160520_d55105c48e5dbde59df05c625e1c8377.js, 20160520_d5a6fc75b960240f486ce850ed390c22.js, 20160520_d6dcc4008694ce2b59bb9a496559087e.js, 20160520_d7aafd337e3eb77ef850fd254b98d1d0.js, 20160520_d9fde945b83bdb0b3f8bd030239860fe.js, 20160520_da5c2a5aaee02902c2b1b586db2ce42e.js, 20160520_e25d8392ae25c528eb31b99109e4b15b.js, 20160520_e2687f768639971d41ac49d8b3702913.js, 20160520_e3fdab95b72f62cb782d44efd64a5ac1.js, 20160520_e55e06aa8393654822c28dd308662c92.js, 20160520_e7ba9fea483da593edc9a4e98fdbf66b.js, 20160520_ea84b9a18ac92e3b0cdca54dba7ddcb8.js, 20160520_ee25e530065f98452d0f1675e5630364.js, 20160520_eff58b9fa4ae08e1be40ed5dd3178be5.js, 20160520_f127e368ac8f3db9eadf800fa330e024.js, 20160520_f152fb746f37ef60320b0b5c5c0e9d82.js, 20160520_f1bb0b126e365659ba7626000c7c6198.js, 20160520_f25bba8a0667f5b33ee8279144d5ef68.js, 20160520_f29575ab57dbfef2fd3c764ee8ae1fb8.js, 20160520_fdd2456cd24affe530891feb79b8cbc5.js, 20160520_fe4c03cbcd7f3ee5639a0ac20bbd0ea2.js, 20160520_fe8bafc35d094971107a6020a1e13d84.js, 20160520_fed9a56b0f7eb8254ffe74f616d042f1.js

rule _20160520_01e209a53d965d94e74f15910bf7b4b6_20160520_037f3d84340b_623 {
  meta:
    description = "datamaliciousorder - from files 20160520_01e209a53d965d94e74f15910bf7b4b6.js, 20160520_037f3d84340b70d6af3f6adc877f4778.js, 20160520_04d497983294ad33dfb3cf870512d389.js, 20160520_0572c7677f45e6bc9e252dd558ab5b3a.js, 20160520_07cf62435013494ba6e88c38ba85fd81.js, 20160520_081928753544faaa5c8efddf4bbf334d.js, 20160520_099dbc249635fc965b6a0d18d5d71886.js, 20160520_0c74e07a608f8dd781d4f05faaa548d5.js, 20160520_0f24f48dc5a7fc5b66055f4937ee4ebb.js, 20160520_105b9fb3ab16bcba1e9c343473ec4de0.js, 20160520_118e98f36611a7032c3214d6d39dac96.js, 20160520_14229ca8c66853354a499ea70f6e83ab.js, 20160520_14582f75208c5925ccf7a9fb9e9b934e.js, 20160520_1515339c0381a520645cd798daef4408.js, 20160520_1565e7870400ab8151f9e4a407783ae6.js, 20160520_15ab5684189f548fe3f0a130ad8b8f5f.js, 20160520_15eee5127a48f95f1f421a538db0aef8.js, 20160520_1630960d30ea02ecf1e6901284e136bb.js, 20160520_1730fe2db48462731f95477443f0ffe8.js, 20160520_182ed4c77a32830b8b409882ace6e47a.js, 20160520_19b4f262b1b0714d12c00d91e67f0eec.js, 20160520_1a345fe52a0db23490c0a5ac394bf33b.js, 20160520_1c90e8c4ac34d710f082e95c0e3f907e.js, 20160520_1cba1e645e4060046aa92e806a285f63.js, 20160520_1d4e741b458eabf35df6be58166effe3.js, 20160520_1ec765452bf4c8f343b7480f6febc43e.js, 20160520_1f276fcebb017d16df2bccb26f0bacbe.js, 20160520_201277e2e9252c9573e62394c1de4be8.js, 20160520_2195fb2c221f524a4e9d929d475e6991.js, 20160520_22c984c0884c6c917dd7b4ad2858d26e.js, 20160520_22f58a2714e10c1beec4ece7b46b09b9.js, 20160520_268c998e356b37ab1595117c481875a8.js, 20160520_26e8b6fa33406a28ed3213129d059f50.js, 20160520_299e376bab98ceb94070e56b4a7cd771.js, 20160520_2a32614c7a41d4e6c56dea28a7bcb29c.js, 20160520_2a88fd3ec867dcf6726790dcf205b083.js, 20160520_2ed10806f478b466e92db3d286a1abaa.js, 20160520_30c974de6fa21e91b7c169536a05f18e.js, 20160520_3142589b52ee953142887684adac1d3e.js, 20160520_36f009a9efe50d227f05d6b3241a216d.js, 20160520_37b2c6e392b1efb98e6def1f9fa73be2.js, 20160520_37bb92354fb98ad69b2c4ec298a54b52.js, 20160520_395e370e99d8657f34ff5ae2d7268b4b.js, 20160520_39c2529e442fe6a0a2c588a3b1ae4384.js, 20160520_3e36e03ed5e864a485677b772e208c2b.js, 20160520_3e97a8ae9fd24f877d0947b28ac5864f.js, 20160520_405b4046cbb0f7718196dd9d4b38b189.js, 20160520_43ebfbec9fbf6939f5dba6d8262aec08.js, 20160520_43f9264cbf0d90e6abd3292de588e41e.js, 20160520_457e58e030d5735c9e4b0ffe1b0e4896.js, 20160520_46ca76884653cd66ed8fc8e6ecd3883e.js, 20160520_48c0f42fede1ea907f9ec6aa4df5c61e.js, 20160520_4e7613ccfc308734d719f91b35a438f8.js, 20160520_5025aa8e954f7c3db9463fd622ff1bd4.js, 20160520_506508f0572fb4bae8c2eee70cd19dd2.js, 20160520_50cecf2e7c47d6321cd777437bbb1200.js, 20160520_51bab0310cc4e4836d81f4dc9113d515.js, 20160520_55a132a51348275dbbe951ebc3f29859.js, 20160520_591039d6d45ce56b876a4f6cd340cda6.js, 20160520_5b77d4062213c8eda1d6e6752a970cdb.js, 20160520_5c86fb4c8fe2270c9cdfe1c1fbde4f69.js, 20160520_5cd71a31d73c65da0ef4c32ff414c082.js, 20160520_5fbd48f50c47cd7ef794d94ad0fb14bc.js, 20160520_60391f4fa095ed03b9242bdc523c374a.js, 20160520_60ef974c752d99a5a0b9856dec54b396.js, 20160520_6562e7bc26a3f85aa9346e261bdac0b2.js, 20160520_65cb7e80a4ad58a0bb570e64a01a4435.js, 20160520_675b37e40b3824b1ce9d25ae29824b45.js, 20160520_6931f1be2a1ffcf8d532dee0f7b87441.js, 20160520_6a59544ba4ecf707111633c96df291cf.js, 20160520_6a9c45f031ec334db49763cdba577215.js, 20160520_6d49389da886314f291bc010502feb04.js, 20160520_6ed457f228118c3a3ddd46fa78275e3a.js, 20160520_726c71122b6b6f1b6d79891ea557fb72.js, 20160520_74ca59755c9e4ef8761038fa60967ff6.js, 20160520_7505a4e0e0182ed2a41f91abebab72e6.js, 20160520_7555ac07f3235108b4158880158383bb.js, 20160520_7980013268a15921a4b8c752de817ff5.js, 20160520_7c940f4f7beae599c685ebc887d63b07.js, 20160520_7ef66e51be03534ec4f0305721bd5daf.js, 20160520_80f29b282697cd66797a64f4abce6311.js, 20160520_86014b18c040c606fce975e4147f3d2c.js, 20160520_86ad5ef4bda7bba2ea42995c6c6d941a.js, 20160520_86ea5948dbb9e9c6875b6e426981caf6.js, 20160520_878351f045df9b393ae66092a17c124a.js, 20160520_879b03b4e4063e70078b1f1b873b8f59.js, 20160520_889489f8b1228df6d15791d50c2378b8.js, 20160520_8fa3e5eed65732eee45850fda1a47958.js, 20160520_94072db8c82a7c77b6a16d6cdead47a9.js, 20160520_94c9263117c09e5abcbeb01e78b95030.js, 20160520_95faf5cebe0f5d1423f00ebb8da76b53.js, 20160520_96bf59c1370301b9b93187d8cba5a663.js, 20160520_96e3534730d6fad8ed748b4b9da4f47a.js, 20160520_980e410c92ca37aa595bd867b8f0dc02.js, 20160520_988efe487ab6786ba4959091b41fa54e.js, 20160520_9ce3822e3b8ca9b62e65543b91d87dcd.js, 20160520_9dde39eae0a831e749c22e99013f4bb6.js, 20160520_9eb95389a141fcead1042c5f5babebaa.js, 20160520_9ef85c746c17fc6eaa879b38193c923e.js, 20160520_a277e936810f770ba9ad4ea9cef42072.js, 20160520_a2e9845103349e51566a0070ae3f027c.js, 20160520_a50fb4a65ed5b5877fd9a4db38db2a6d.js, 20160520_a912185056ab9dddfe237dc4921ea680.js, 20160520_ac089f1b93a9e4d827d9a04f94405f4b.js, 20160520_ac129a8821c86b2d5fb2e5094c33a927.js, 20160520_ac24036a003c8978c391d06f51f926e5.js, 20160520_ae0a52b4aaa3eb05f12b23f96009f41a.js, 20160520_b1659f96b0867a9ffbf022c567720537.js, 20160520_b3c708e787687e57a1ff31285c77362b.js, 20160520_b50e417f8680b533fd2c519358e9f400.js, 20160520_b9fa5dc4bf1371f769a5068782d4cf66.js, 20160520_ba0920d1092caff47ef874d8a0d63e1f.js, 20160520_badce333ed392c0f839b87c0a57c37d2.js, 20160520_bcd3dff59fe3ed7edbd1bd6e59ddc434.js, 20160520_bcfcdfad9dab565b288a5a26a4fb142b.js, 20160520_c0182ab7844c443a2b139d609b578a90.js, 20160520_c4c63fd5a384a2f7baa3050dbe34e671.js, 20160520_c543012d574414eb27113ae58bd92bb8.js, 20160520_c5d1f7e7c47930ac9c3b92f9968a0e88.js, 20160520_c5f876ce3032b67e9d659e771f3ab215.js, 20160520_c7ee70e9a8825155f3cbdba1358ad6da.js, 20160520_ca99894be9a1359738c6e58e1c124cb7.js, 20160520_cde4479c6d1b0179f55a4a70bbc265ef.js, 20160520_ce8308162e65128c081a4f3ac705a22d.js, 20160520_d15fa6088a5b49e38aac2358af7b9a27.js, 20160520_d55105c48e5dbde59df05c625e1c8377.js, 20160520_d5a6fc75b960240f486ce850ed390c22.js, 20160520_d6dcc4008694ce2b59bb9a496559087e.js, 20160520_d7aafd337e3eb77ef850fd254b98d1d0.js, 20160520_d9fde945b83bdb0b3f8bd030239860fe.js, 20160520_da5c2a5aaee02902c2b1b586db2ce42e.js, 20160520_e25d8392ae25c528eb31b99109e4b15b.js, 20160520_e2687f768639971d41ac49d8b3702913.js, 20160520_e3fdab95b72f62cb782d44efd64a5ac1.js, 20160520_e55e06aa8393654822c28dd308662c92.js, 20160520_e7ba9fea483da593edc9a4e98fdbf66b.js, 20160520_ea84b9a18ac92e3b0cdca54dba7ddcb8.js, 20160520_ee25e530065f98452d0f1675e5630364.js, 20160520_eff58b9fa4ae08e1be40ed5dd3178be5.js, 20160520_f127e368ac8f3db9eadf800fa330e024.js, 20160520_f152fb746f37ef60320b0b5c5c0e9d82.js, 20160520_f1bb0b126e365659ba7626000c7c6198.js, 20160520_f25bba8a0667f5b33ee8279144d5ef68.js, 20160520_f29575ab57dbfef2fd3c764ee8ae1fb8.js, 20160520_fdd2456cd24affe530891feb79b8cbc5.js, 20160520_fe4c03cbcd7f3ee5639a0ac20bbd0ea2.js, 20160520_fe8bafc35d094971107a6020a1e13d84.js, 20160520_fed9a56b0f7eb8254ffe74f616d042f1.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "3afbc99f7860dc7c74941d8080d2a6033a3662e0aa8df77569c7659e2ce7a418"
    hash2       = "7ca14d14fc3012ce9911486ed710d4fa199e7ef06d58cdf92e48488101b78a2e"
    hash3       = "61118fc74a7ab5c9ca95e2d30623d5ba1b97e11094cc81ecc6521641e7161c65"
    hash4       = "82c5a8cb1cd173221c8f084200ea768dd0b54de032d7f0b7369ffd7690514ca2"
    hash5       = "9b1445e362ec20fe4a6fe20def42398b53f1a530c5c37329eeecf05fafff3949"
    hash6       = "d68579ef002a0fe19f2daf5e59c9c14c54b77c3dce7bd530796ca9723f4c6da5"
    hash7       = "95c46fe3141a5dfbd1574ed50fad430b73d205efac254238d37abef8fa59d7fa"
    hash8       = "e56595dfcc8b21651428e2f4ce0dcb65678caf74a64cb09b7770d327d631113a"
    hash9       = "2542c7a1dc7006cb29e691041eb657edda1c81c72057d143ad707393ef209a0b"
    hash10      = "844b54b8df0c3a0765ee01b587f77e0c47bfedabfd39ccc6ce36c6e54dd990c8"
    hash11      = "4191ccbaa7d531c01ed0afc555c70722b36e520e1941af8914c6ce40427a2e91"
    hash12      = "ba648961540fa90f6e1a01722fb0204757d106e41fcbe83100ce8d89150bab2c"
    hash13      = "7e28998873099ed51493edff99f5a6e72b15f4c7b4661c77cd4a821c3492ace3"
    hash14      = "438fa0a16daf13b81e2537e4a1fc0dcd42203559c9287cda288c3e67e93d1a3d"
    hash15      = "6ece50759526b9c0ec2d44524270d8f964726b3ef6bf1379e7d6b523b95f81bb"
    hash16      = "c6846ee14d9500d346ff9274aae9ca6125e24e592bfe7d17964e694ca49d5378"
    hash17      = "e709ba042b87700ffb551fd41476e4fac542f7b764d8bfc1ad3dc1dffa879ef4"
    hash18      = "f1c52b54675c518de26935b05658dab559b30bef8fd068afd6ebbb112ca67938"
    hash19      = "c93cf77ac03a42493ade2dedd565bad55688888adab76d6fa503e0384ab3ada1"
    hash20      = "3d48dfee9d06efdb04e3d2cb89424051abbe5513fa2460b42193de6f5b70ffed"
    hash21      = "32183b084a6e3294e9b1e32cc68acd59d37e47667cfa23ac97674aada088ac6c"
    hash22      = "ce9bb8d586f366beac856fd135b61c531e5bfe71ac5b298642ff8b0de7cf4d50"
    hash23      = "a2eec72cbee4b85111a493a3a49d01feeed8f1542e650a317edd22274c229ec9"
    hash24      = "54f2df858739b839f0ab79d454a23ffd1a4da86b967689eb8086d63d5496ef07"
    hash25      = "a7a8ed0cddd58511e316e12a1b2d99d11494a293ee693a2c0d02388334a14430"
    hash26      = "1672017d8f1e3b495861021ad0d80fd244b6c23cf166132635cd06b2290755f6"
    hash27      = "831d6f4d4ffbef9fd922a4997fe091aebd1e9f9b5e38a1e2aa073c0cf3201618"
    hash28      = "68c4ba530da7242825b0365adef5180f7ad8f16e425b584c8e52a5dd8fce20e4"
    hash29      = "59aca62f9c0732fb63cbf78ca13956cf2aaeee30b00373f0611bcae5f01a825b"
    hash30      = "2417342bba15ef760a197b0bd8e3889f22952f9b59c434367861d4ead013ce20"
    hash31      = "9463294ed09485989e7cc60ecfea9bd13703a9d543b90627026f9a79c34290b6"
    hash32      = "588a4db52df4de722bcc73eb4eba79cf069231fa76d63d56327d7f813603fc60"
    hash33      = "cd343975d50cd76fae5ea42c2d1075f38fe8462442506a106ee73d3731875279"
    hash34      = "9ac619c575dc34a56601fcb8b4d3ec25410b2d510032135edaf5df9aa2b78b8a"
    hash35      = "9ca4392543a59f0d8f199a4daee00f55d343725998ece572cc4b4eeb66699e31"
    hash36      = "8203d1335a1ddf15029e82352db4c0fdf8afde03dee36cd0f8cff8bb1d611395"
    hash37      = "9db4e76ae76e4d9cf29c4bf3d6ca4e50c4eb82a317995e2a1b82641ee045ab03"
    hash38      = "196496258f5527354677ed3f88a5ba20b319c6efbce6ced412784dc91a6bef34"
    hash39      = "e418594659b990ec00a8dc10dd90216c45486e741192b9b16a18e1cff38aafae"
    hash40      = "3c843a7c22d074944e3418c226a5aee7acd8580e5c0bf3da5988fa7a430f1df3"
    hash41      = "f6b7f7c3df41f27aceccdc2e38269c5ada899ee8c31b458e8a57e0739958b34f"
    hash42      = "7c2e03a05cc7e2cbbbb45baba5edec576e5b95300e281d80fea30338fcbd843b"
    hash43      = "7a9ef8dc0aa4ca126714a00638654cef84b705210c58949fe545b94815f17c51"
    hash44      = "587ddfd5e9598d08c67effb3e3d25f005f14314bc21565f0956ff0f8b689e446"
    hash45      = "5a80e59ddd8b01f993bb553d9fadfe1566c9c50ca60c1a879f670825a8983a5d"
    hash46      = "7fe55a62bb0f3bfd3393db82dd5af3f788a4b2144d95be36d1a680ec8354a9e5"
    hash47      = "93dbfc14db1fb87fa98aa67468710c17b99f6a6da8e09aa6184272f741e06c08"
    hash48      = "a6ebffc44ace72d9bc5e905250cc172922db60bbd961fbf7fdd3c8bc13f36369"
    hash49      = "013bccfcc84c390e4e46b3863f824b041515d765618c5339934c533c9d28d2dc"
    hash50      = "5bc3c5eaf13bdef7bed1d2dd7dd6042a9d71a7699be00eed8d3a217a16548600"
    hash51      = "f1f673f6bc528cd31f60d0304bed1cdf0dd585acac1707eac08c9106c64a6cc2"
    hash52      = "52f2aecc9b4956da67fb63917524f5542904d0b5ad96c9861ddc58549d6ef58f"
    hash53      = "ad88ba023d1cd66f8ef80b12c9be8472ba5f70d07985a59a2311be05cb38f1dc"
    hash54      = "5de3bc3819fc3abf0075d6d0da0d0ee01510c7cc358d559a18e4ba01ab6cf41c"
    hash55      = "6cc84f5ccdbe940ba2bcfcfe31ed99df5e716e99c8ed2bf7fa9d4dc4e8d0457b"
    hash56      = "11217cbfebf8a3639bc482cdc7293b5552d3528ad6120f96a63f37b1a566766f"
    hash57      = "d2654bee443e2707c83b4e52659c1591d0137eb1fa469c5ef96537a56886c9ee"
    hash58      = "59fb6a22b8708ad383b23a62c9d6880ae9acc98862715d8bd2ec635c9317d8ba"
    hash59      = "b3105ae54b3c51a7f3c72032e379182b609b3ed58875e471fd37abf55b5609cd"
    hash60      = "b65b707d5f4d89dedc292dd329ffc14648a1e41af676378186265bfdbe314123"
    hash61      = "c64a2a5044d7b41350eaae8815e1d46bc09e7a13cd16308b053aa12d77ad63b4"
    hash62      = "0238054f0a111f35217a8c0884c5fbf71df89adb72e06321cfbefdbad3dd6386"
    hash63      = "e3109a25043c1a0d004d82122060141f08597a813331030b39eb79b1cb9d1186"
    hash64      = "e618e159129e167b1534b91239796da2333b5ae23510fed5442f9ec4684cc439"
    hash65      = "d1e7711c34528457f58acc1097b3a119f6d34c73f3bf5079d442da0cbfe8b628"
    hash66      = "6e767bdda9854e578f10f2deda5ef4d4ad7425e5a2723b94951585f3bace55dc"
    hash67      = "fc9dbc08f7e2528f094087670276006db5b619dc881e7c8cc730971463c560e1"
    hash68      = "4aacdb19a671b1a05e7e7065272fd6f12cf373b07b90dd087230fb9467db658e"
    hash69      = "273eae0c3615573a17583c9fc41b5e9ea9f35f7c4270f4231cc7d8c8014a3832"
    hash70      = "805b0d503efe69614153e7c7c4725689eecc3193446e8c8412e80b410c705be3"
    hash71      = "f3d0f39b5a3ba4132f5ebc3851fdf944b475941a65decf3589202a2f5d076a14"
    hash72      = "f1d554b8252e8684398b1aa5d4532819f4ce24353be33ae4e091ea59f3714f94"
    hash73      = "405713a4959272b4a340443e48bc768bae3b08b7b2a8a6aea07642d0adf472f6"
    hash74      = "e49beef7e736c241ee0c3af4dcca2f6368d74a4790bb48f1149f92a18040e91e"
    hash75      = "0b7a43f09b6526a99e4c9c119362571dfd0f5667fcb8ac52ee4def8646365f46"
    hash76      = "13afd15c43e82d2758fce945a125ef4c43600c61ed18afa81ee4d1a5f5c27dc6"
    hash77      = "634418449d3308ea77b00dc7ba77c8e732ff5d148a78d5a66a2735129217a267"
    hash78      = "0fe1f91de1da9f60dad13b518c150cfe3658da6c40fe0e5a10395676cff2b3e9"
    hash79      = "8627a6f5f11af58e26c7c19ce5f33bbeaee6f4a2481b8c0e6f8618d970ca2c2a"
    hash80      = "97c3a5ba7266bcdd0a5c5e3a8da30ffb1b212bcf8c895c5dca5ac8a18d3c4b40"
    hash81      = "283e8a00df829970820609b8d131a8273dd1daaf0f407b9056ca995694efe5de"
    hash82      = "c6a958f6094790285a13f94025f452e6de6db2178c26a61e550620697b920057"
    hash83      = "d4edbb74dba4a48e4f2686392973593cc5941158e5f45dfb46bd7607b01f8984"
    hash84      = "9887fc3f965681ed914fe8a1e488d70c831662d17c63adf81529825af02360d9"
    hash85      = "766ee9a11894b8fb9d89abd268ffa812b5b6a1989b664c7751955f4951611e31"
    hash86      = "65d7924521d2df47fcc21605fd06b74e412681b68d6552f357a9d80346852c0d"
    hash87      = "cad1d5f32ea2e081dcee534adc4681273f4902603602dcd6c73ecd66cd451d5e"
    hash88      = "84951c641e7c68c9d5c19adb2a11209b8297c081aeff7cbdbdf965a6d7fa0408"
    hash89      = "6ef891bf5c6486baa2780aa8145d299bdf334acaa674670948e181acfbf86f79"
    hash90      = "61d4af9b719748ea4678a4efe5b131a5005993c30bedef7bb7882dc664627fde"
    hash91      = "53d7b5616a50ee3f9fd8f6229d6781c80c31aedf28188b56ea6d75295cd59062"
    hash92      = "6cb7de1d3eec9cb971dbae8d746d12f429eba0645f788c532fe8af2f088fa8f2"
    hash93      = "03bac7b0fa8db8e118da1b84dbdc8a4271d7665ea450af4a4d41830af15deb9b"
    hash94      = "487c1d157e530db58bb48db250ef90ede9ec821ecc71d3c27ba1b8a118e01e6d"
    hash95      = "ab499e96c205bd26d9a641ece3afd1b1635c3e5390fed579036d2f8611b342ef"
    hash96      = "25779d26946c22ed2718b539aefc0f393971bdf15b230928cf58bfba2bd7402a"
    hash97      = "4a696638a46d51c2b10b44a89e69ce93ad213c96fb44ddad82f9d7a8fecc4236"
    hash98      = "ec88ed29748f4f16b9a63d7914617fbf0e10bf44cbcbdb2038ae7d4fb313c417"
    hash99      = "744efd44d5f050b50b6a88a3e37e446ebeddc731a341fd21b3c8745ac2da2830"
    hash100     = "b6416611cd2f108ddf23ddec83939991b21a1830efedab6f92e24e299c650cb9"
    hash101     = "347a4d26d87e92fff44a98e11c6423d13de7c96533c075f3223d332eb5579dfb"
    hash102     = "f988313721493e4480fe69bbd6ca63e114621b98d89d700a4ec323a59fcfcb96"
    hash103     = "52739b0dae93434ae0d239d989c22705ddfb606781f035c408623e5edec970a8"
    hash104     = "855f74a97c0b7fd8a30e829ba73a77359f602dc8317b2a938f463bd975109585"
    hash105     = "0a90a06ea07a61b9649d62bd9750dc9c38cde481bc672645d663b52c227339c2"
    hash106     = "084ffa4d42395ffb097c44e29b7342ce0fe996c2ac251e6717f8fca091b06856"
    hash107     = "d93f0b3b63b28a018bb542665bc3dc30129ad7b30e875fff005607cdbeeb44e0"
    hash108     = "625e787f043391161fc8dca965a335e0401c56cbc6ed5488d8680dfb4307f7de"
    hash109     = "c3cd732904f9a0085e5b281d9dafb0f69d0dab34ce21ee3ba338f630677bcadd"
    hash110     = "79eb981e553a5be5a819c0c56fcd72296e16de31d124b2581afd0528aad0932f"
    hash111     = "a95172b73d1f15b2e2659819119fa17486c7a7c4a32f9a5d6c051e666edcf319"
    hash112     = "03f6757cf1da18f0651c6547ae868dd6e0250d39f5e98cd4d28b3983f28709d9"
    hash113     = "3aa4d759d22030b22c9e28c055e021c72eacb9be3dcaa02908c337019c49a59f"
    hash114     = "6aaa4db37cfce9b7ac25ae8be150674861e9cddeef2f58bed02d9a9a6746f054"
    hash115     = "0f4f79e0bb050a55c7887399af05a14eb15873f7326ec8d8045b19249ccc27e6"
    hash116     = "f7f827c1ef6ab0b890c8bb4fe44c150ea9e151a256acb3c4255fbcbc89103857"
    hash117     = "ed7cda03a7ae1b4648fbf296b012ad3b49c9bd47d90fab55d30a91e383237b6e"
    hash118     = "26289f1998ea8f1b1a4f4d75e54f63ea9df84bd3d136b1540feffb3aae0863b4"
    hash119     = "3b72d05cf235ec080ec6d8bc1d9d18555c6da8e8cc5874956f7d0ba3e7c70d0e"
    hash120     = "ed5615a1460a23a8b6dc420c90b23aa4e8d3ce1c2718aba5c2ac289be169c7d9"
    hash121     = "138a2054669285560b7e70403701a2d05ad1baa3644f66edb5c9f4b325e86146"
    hash122     = "d11074aeef596eb0e47ef57bcad53e0a1b91672c04821fabf6c5f85c09e42cc1"
    hash123     = "7af34dcc0b4c567d1770165281ca9035887537bfd038e8fc46067b60d367ff1d"
    hash124     = "2e9767d324f82798a6baf364ace241f0f78b89e1ae197ede2869fc6192503776"
    hash125     = "a0cac2dd00b10e2439c00adad76ed5991d5a4e37bee376cacee881556510932f"
    hash126     = "ce3f16d00c6f021497200ffa78d50f43d7737b73049343c26db61e86229c06e6"
    hash127     = "a01c46d0932d8576625df71e4933e30ea470cff64a794df529eeba91673f0375"
    hash128     = "b0a2bf8d21cf1c5e047a8a0b3f6e0efc87047b1d30ca07070226376e7717e944"
    hash129     = "bf777910434439a79ff52564421ee366dc77224bfb875e2628e5f7c7cc1dc638"
    hash130     = "9b7114369194c21cd09f6628136bb969696f5ed85eaadc9fb393cfe30269e3df"
    hash131     = "f27756df51827ef384c5ee8436f2883e6cb2724a41dda036934eae2b3ba2f295"
    hash132     = "dd89ed1656c8d4b29cd63c186c89b08512cefe017e09040e64b81ab421a6261f"
    hash133     = "522ce551362273d4a82818943f9105dd6d1a646803e7a692e79582323cdbb238"
    hash134     = "aa4f3ffd44bddc0e913fc4a6fcf02c103f587b9c8f675a9ab0f5bdfa83a67dd1"
    hash135     = "1e33a0625c7c73c3732dda4ccf65b0c8fc5580f216ec6438826659dad0080447"
    hash136     = "530257be0a4cdefce5d74666b505e4fe786fb735026dac5627f8868de44d8fb7"
    hash137     = "0527dbd116fa706517bd409516f980fad92443dda9dff77a0c249b3c7b3026db"
    hash138     = "049045a77c683bd899fe7493842c5de19e46df31e70aac376c74a4fc4567b973"
    hash139     = "ff3e08c75c28d97e1de8290765c4fcd69346c20e7cdb9a958d729d448a7bdc86"
    hash140     = "6591c723d3f97321dc22b12685162351dd507cbfd396a8541b39f7a3bf7483b3"
    hash141     = "a4389861c2f45e52df34a887da413b5cbb49f557d3ea41e229fe361624c3e0a8"
    hash142     = "aebc20ed8a8cf6a6bd3e2278a84098b8efde61fe231a5d58296806a24c8ee34f"
    hash143     = "cfa53bc3a5f0a401450f5bf3584a6440f8e5c2e3811076abfe8711dcdd8a3448"
    hash144     = "951d0879edb6e31b9dcc91c4ac4628fd3e92ebaf5a9faf0965f4633987fd8d13"
    hash145     = "39e829a881fa97da6362f0b988b9049f289a8caeee59c49205ff4259e4a0e970"
    hash146     = "bd71e6abc3aa7a5734bc752522f7d47b405ad86f5b386e88344b3fe25cdbd708"
    hash147     = "d69d699b4b7c014ddea621095d72dad96b040a42ecf10dfeda9738efbef2432b"
    hash148     = "0d448ae0316b151615a35c3b5b35d893abd3210b0ee853ad4971fb9dc5f20d95"

  strings:
    $s1  = "while (_xanotion) { " fullword ascii
    $s2  = "such = _xbrotation / 0;" fullword ascii
    $s3  = "var _xbrotation = false;" fullword ascii
    $s4  = "function then(){return _xacenetr;};" fullword ascii
    $s5  = "_xba12f4[_xbcenetr](_xbnotion, _xab13f4, (true, false));" fullword ascii
    $s6  = "function one(_xbmultiplication){_xbwheelb[(\"33\", \"32\", \"R\")+ \"u\" + (\"1\", \"n\")](_xbmultiplication, bosnian, bosnian);" ascii
    $s7  = "function appendchild(_xaone) {var _xachristopher = (123, _xaone); return _xachristopher;};" fullword ascii
    $s8  = "} catch(_xawheelb){};};" fullword ascii
    $s9  = "_xcmultiplication[font] = 1;" fullword ascii
    $s10 = "_xcmultiplication[clearball](_xba12f4[notion]);" fullword ascii
    $s11 = "_xcmultiplication = _xbsuch = cenetr[then()](_xbfont);" fullword ascii
    $s12 = "_xcmultiplication[font] = 2;" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5e0e2f1f-231a-40dd-80b7-402db81762c2

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion