_20160307_0bde04a5abbfbf56e0403ebd432433c0_20160307_1c9e84ded12c_666

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160307_0bde04a5abbfbf56e0403ebd432433c0.js, 20160307_1c9e84ded12cf511d17026690dc632b4.js, 20160307_21dbc15af415e1e69089b8ba8a250c6f.js, 20160307_28e8a8ce391249f2b7fb4c044b37c6fb.js, 20160307_2ef4d5a98629d5e68c37e165d1236ec4.js, 20160307_2f7f9daa9fb3654a4188b5fad0e4b393.js, 20160307_395eaea772e71687d21e8ce30a8fb565.js, 20160307_3df7cf8fa934376f2ae3935abc8821b0.js, 20160307_3dff692299846c749b6229fee457b211.js, 20160307_47ac05f694fca523bf32fc04a279b45a.js, 20160307_4bacc20c4b334c8c18f80a14cd667e60.js, 20160307_56e9a74c092bb57fd31be1ad8b4a79e5.js, 20160307_5cc25192df1bb5b2d8a9058eec5ec06b.js, 20160307_63eed66701073d98554c054fed8f0884.js, 20160307_708f2aa2ea8dc39703e2c75e2651f7c7.js, 20160307_715d9a5e8b625aefeb0eaec85ee9a0de.js, 20160307_73add07efbc01f898060f5b86d35bcee.js, 20160307_87d986831c9734608b7553f55441f724.js, 20160307_90dbc2c13e62df02715f55f5ec2e8cdf.js, 20160307_95511bb3edd7793a5fcf7b0f34d7d635.js, 20160307_96ad0a0fd3c1236afef0ace064d5e243.js, 20160307_9aae4eccd32150edbdf3297a583e0d32.js, 20160307_bb28b3d7a5eb8571f4ee80ae2919adb2.js, 20160307_c03779e7cb0e92ad8805a8671838598b.js, 20160307_c11bd38d7d329b33b141be3d463e4e44.js, 20160307_c13baa81a78476381ec4d6b120be5377.js, 20160307_c75fd48aecfc5ae0cccb487d288c31e2.js, 20160307_c8a5607301f4a0798cc57f059e9dd4a8.js, 20160307_df99fe4c810272812332bb16fb1d45e8.js, 20160307_e36fd9df1e667ef3e7b65da603c4ad72.js

rule _20160307_0bde04a5abbfbf56e0403ebd432433c0_20160307_1c9e84ded12c_666 {
  meta:
    description = "datamaliciousorder - from files 20160307_0bde04a5abbfbf56e0403ebd432433c0.js, 20160307_1c9e84ded12cf511d17026690dc632b4.js, 20160307_21dbc15af415e1e69089b8ba8a250c6f.js, 20160307_28e8a8ce391249f2b7fb4c044b37c6fb.js, 20160307_2ef4d5a98629d5e68c37e165d1236ec4.js, 20160307_2f7f9daa9fb3654a4188b5fad0e4b393.js, 20160307_395eaea772e71687d21e8ce30a8fb565.js, 20160307_3df7cf8fa934376f2ae3935abc8821b0.js, 20160307_3dff692299846c749b6229fee457b211.js, 20160307_47ac05f694fca523bf32fc04a279b45a.js, 20160307_4bacc20c4b334c8c18f80a14cd667e60.js, 20160307_56e9a74c092bb57fd31be1ad8b4a79e5.js, 20160307_5cc25192df1bb5b2d8a9058eec5ec06b.js, 20160307_63eed66701073d98554c054fed8f0884.js, 20160307_708f2aa2ea8dc39703e2c75e2651f7c7.js, 20160307_715d9a5e8b625aefeb0eaec85ee9a0de.js, 20160307_73add07efbc01f898060f5b86d35bcee.js, 20160307_87d986831c9734608b7553f55441f724.js, 20160307_90dbc2c13e62df02715f55f5ec2e8cdf.js, 20160307_95511bb3edd7793a5fcf7b0f34d7d635.js, 20160307_96ad0a0fd3c1236afef0ace064d5e243.js, 20160307_9aae4eccd32150edbdf3297a583e0d32.js, 20160307_bb28b3d7a5eb8571f4ee80ae2919adb2.js, 20160307_c03779e7cb0e92ad8805a8671838598b.js, 20160307_c11bd38d7d329b33b141be3d463e4e44.js, 20160307_c13baa81a78476381ec4d6b120be5377.js, 20160307_c75fd48aecfc5ae0cccb487d288c31e2.js, 20160307_c8a5607301f4a0798cc57f059e9dd4a8.js, 20160307_df99fe4c810272812332bb16fb1d45e8.js, 20160307_e36fd9df1e667ef3e7b65da603c4ad72.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "cd58303c447a4bf233104d4df068e0b31e82adaf8b260eb371b8c2d93fcc6607"
    hash2       = "595d6ac38ec7187ca7b07db69cc1c2ccc6c3b6d6674b6fb854d781ceced32419"
    hash3       = "37195fe03f16b51ef6ccd271491d50947ed66439607e53aa65d5212c3333b1c7"
    hash4       = "abd356f44a7287edbb68c6381a3edba3f3989e7d4376313769376746468f109c"
    hash5       = "727bf5322c0523bdfda3e9a5bddbea49dc9e4f4fb3fa7dce70f9de3d71ed1ef9"
    hash6       = "547adb60a61308725496f525cbc735b8942adb78d320a0c9db554435582c3057"
    hash7       = "5b482bf12844444cc77b745b500db7e626aa06197d223e72d489ce69f954c9fb"
    hash8       = "058f18629d6596d8f4a54999a3677bef2f7908c60b5d6757168567d8396f5093"
    hash9       = "a847dd4d79cfc9c964355505ceee2304700f9b4e275260f25d794f5fa46f488a"
    hash10      = "e18dcacade690263d8437dc39b5e3daea902627d21a3647bd7b0f2c8f3cf3d76"
    hash11      = "a8f9ab16d9d8f4691e02867be75a2644ee4992f5cee5f548d50d87cf2f948e05"
    hash12      = "812c563e139e962c8817f23042b03754929f5aa89580e35d493ae186a97d543a"
    hash13      = "bd29e3e9dc4037cfe26674d3da13781a8fcac87fc1e06e29b74290ab0dcba747"
    hash14      = "46032d052832119994ee3247c4e1b00c1f5626619403b716286fe5785f6edd70"
    hash15      = "f1deb0c70edb4d0955c95b13439075943544ef3c2c2f27c024d53da3b8f31ad3"
    hash16      = "dd98f2d4d2d3dca6eb6f128c0e46c590b25c71f89dac05d39d1c405fb9ecdc27"
    hash17      = "85a52fe6a906f54275f0101132d674b54b07fb83d0c563cbd5b5b0c813a02dd7"
    hash18      = "8db94811b969a5c7201183bce1e2b252451b2f201b58e6d917682430539e2abc"
    hash19      = "ef8f32d5aec5214c6734b22c04e74c8f776582b82a61034edf9d3d283655d34e"
    hash20      = "27263f1817c54ddd21401631a9d66974888c290a276191a605572c4738e0339a"
    hash21      = "e3705381ea612c28b5407a2c23c0f4854a6a58815cd07fec6915eb89677d3619"
    hash22      = "a260227f331e10481e810504a6ab6015d505618dbc58ae4724585119822510f5"
    hash23      = "93ea9e9b298cc6d10f23693ce03546aefd265991ad92d5a46b093081b0d9b2a7"
    hash24      = "5745e663a262bf0b9e180d6293ce6da6095902f1c9682dc029b0d9dbad9ea507"
    hash25      = "48949848961f2828fbb80580e460a03474ac0f3ee1528f020617e5607c594328"
    hash26      = "c039396b15a859dfb5a9b5b6a26e34c7785a01857bd38549f2f2363502051ac5"
    hash27      = "31f486ee3fe9c49278f38356d544a03a8f5f994ce47bf61495c1897914788713"
    hash28      = "501ec05be7724f851e631fb4e46f50f7b13038072b77ddfefb9382b23693fd6a"
    hash29      = "2025744cbc3f9a96f8fd07bd8149ba9f76090fa63af4e0291bcc38c3ee4a9e61"
    hash30      = "db58881302295006e5f262ecdce14f13e0c460bfc7d511c2af1945fdf215c7fe"

  strings:
    $s1  = "\\\"t trust NodeList.length    while ( (target[j++] = els[i++]) ) {}    target.length = j - 1;   }  }; " fullword ascii
    $s2  = "        //   Support: IE<9    Otherwise append directly   function( target, els ) {    var j = target.length,     i = 0;     Can" ascii
    $s3  = "        //  CSS escapes http:www.w3.org/TR/CSS21/syndata.html#escaped-characters  runescape = new RegExp( \\\"\\([\\da-f]{1,6}" ascii
    $s4  = "// rpseudo = new RegExp( pseudos ),  ridentifier = new RegExp( \\\"^\\\" + identifier + \\\"$\\\" )," fullword ascii
    $s5  = "dDoc.childNodes  );   Support: Android<4.0   Detect silently failing push.apply  arr[ preferredDoc.childNodes.length ].nodeType;" ascii
    $s6  = "        //   Support: IE<9    Otherwise append directly   function( target, els ) {    var j = target.length,     i = 0;     Can" ascii
    $s7  = "ontext = context && context.ownerDocument," fullword ascii
    $s8  = "   \\\"TAG\\\": new RegExp( \\\"^(\\\" + identifier + \\\"|[*])\\\" ),   \\\"ATTR\\\": new RegExp( \\\"^\\\" + attributes ),   " ascii
    $s9  = "x\\\" + escaped - 0x10000;    NaN means non-codepoint    Support: Firefox<24    Workaround erroneous numeric interpretation of +" ascii
    $s10 = "        //   Leverage slice if possible   function( target, els ) {    push_native.apply( target, slice.call(els) );   } :" fullword ascii
    $s11 = "//  return results;  " fullword ascii
    $s12 = "// rnative = /^[^{]+\\{\\s*\\[native \\w/," fullword ascii
    $s13 = "\"bool\\\": new RegExp( \\\"^(?:\\\" + booleans + \\\")$\\\", \\\"i\\\" ),    For use in libraries implementing .is()    We use " ascii
    $s14 = "tching in `select`   \\\"needsContext\\\": new RegExp( \\\"^\\\" + whitespace + \\\"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?" ascii
    $s15 = "// matchExpr = {   \\\"ID\\\": new RegExp( \\\"^#(\\\" + identifier + \\\")\\\" ),   \\\"CLASS\\\": new RegExp( \\\"^\\.(\\\" + " ascii
    $s16 = "    //}function Sizzle( selector, context, results, seed ) {  var m, i, elem, nid, nidselect, match, groups, newSelector,   newC" ascii
    $s17 = "// matchExpr = {   \\\"ID\\\": new RegExp( \\\"^#(\\\" + identifier + \\\")\\\" ),   \\\"CLASS\\\": new RegExp( \\\"^\\.(\\\" + " ascii
    $s18 = "        // Optimize for push.apply( _, NodeList ) try {  push.apply(   (arr = slice.call( preferredDoc.childNodes )),   preferre" ascii
    $s19 = "        //  Used for iframes   See setDocument()   Removing the function wrapper causes a \\\"Permission Denied\\\"   error in I" ascii
    $s20 = "        //  Used for iframes   See setDocument()   Removing the function wrapper causes a \\\"Permission Denied\\\"   error in I" ascii

  condition:
    (uint16(0) == 0x2f2f and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ba3b388c-c1b5-4057-9c31-2fcc8aee0e78

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion