_20160505_008f71e50bc263d18313c46b83fbffd3_20160505_00c69f30785f_699

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160505_008f71e50bc263d18313c46b83fbffd3.js, 20160505_00c69f30785f8432a6a3696b2cb01351.js, 20160505_0100c19638273a62ffedf2cbb28ae794.js, 20160505_011b629a51a15c8d580b473261a7f9f3.js, 20160505_0181deb057aed25cf5988bf3c130cc2c.js, 20160505_02d7d874f710a101f502bdd932648c28.js, 20160505_03ab9a17916c747aa45a4e9fb8eb1926.js, 20160505_043ff2abb2a5f213f19bd0aa0301ca68.js, 20160505_047d6774be9a49d925598e2bff520747.js, 20160505_04911dc9aabc5bd24e12a8a3ee423917.js, 20160505_06d0952fbb4210d42d4a70ece5ff28bb.js, 20160505_06d969232d2a7c94de1f37f25d1cf868.js, 20160505_06e27323fc73c666b2e2ab4b6d63f1c5.js, 20160505_06fd47fb74ff5d2271bd6ae30d383084.js, 20160505_07aad0de30813980d03cd79c3abda35b.js, 20160505_07f50a66a3982289549cf2162974fdec.js, 20160505_0a606dcf08067241ea82a56e23fdcfe5.js, 20160505_0d105bd40f86a1a837b410ada7b6a469.js, 20160505_0e11e30971a0facf0fc9167f8ec0f823.js, 20160505_0eefd6ddf7128fe8ae875f32a58df3af.js, 20160505_10dfcbadbcab5bd06e5696699d73ee3b.js, 20160505_1221f0fc53ffb983468869b3ca2cd08a.js, 20160505_12879907383165399e972f5f0e7cbf90.js, 20160505_14b73411cd8cc5947c950f47f8140ae6.js, 20160505_170881768895fbcc0458588e82b8de65.js, 20160505_1d1551309dceead4518549802afc2106.js, 20160505_1dcd894c2c098dd3b91654e8401eb94d.js, 20160505_1e5776950068ad2a434b1814cd1e4b1d.js, 20160505_22faf4d36afbaeb096791fb093f3b82c.js, 20160505_23b9a017e485efd292333d967169fecd.js, 20160505_240307cc5405e6264679ca8d30faec26.js, 20160505_2415e574fc918ce977628d9522f6ebb7.js, 20160505_26ab200ecb880a6e2a06f56a9de0b0ad.js, 20160505_2821cf45692935cf05838dea43db36ff.js, 20160505_28854a5ccf753437ca5315d3d15d35cc.js, 20160505_2945801fe45b9118b40345638e82f10f.js, 20160505_2961e2c6e074859355cb291191653703.js, 20160505_2b212a346ce17f016bce91a442789bd2.js, 20160505_2dbd7ad29bcf60d2992c984a5bc7c7c6.js, 20160505_30f246971ec953b20940fa63fac5ad0a.js, 20160505_325359ff8d464db2669a407b5f7e496b.js, 20160505_3255f6468236a6e9e1b64e53233fdbd3.js, 20160505_32cc8fe2fd4cc4750547b01c485337e8.js, 20160505_3451f2dc7c81d494fd86f5f26fda55b6.js, 20160505_37d71fcb1502db8c04b21f52456a3aa9.js, 20160505_381436211e12e1ab91a172bc923b804e.js, 20160505_3855c0e1404ce23d06e9800f1afe79f3.js, 20160505_38a5fdf26d74697555dc5a355d61d7e2.js, 20160505_3903d156be81812139abd991ec2eac67.js, 20160505_3a3cae3ae994109cd45beb0773fac9a4.js, 20160505_3a6437fb6f4cb9f83d1ecae085ad7069.js, 20160505_3a86bb6bc8ce14f31ebdb0b1ef549dd0.js, 20160505_3b1ca4f02511cf94d5b340d43606ca1c.js, 20160505_3ef020a080feda3916ad7154a878f52f.js, 20160505_41c93c65a03bec231323e2d5e8fcdb24.js, 20160505_45360d39e0c32015ffd632a8f27fa0cc.js, 20160505_456f3ff592c3b8de981773a82bdf7ae9.js, 20160505_46e524b4a9248b0afbd0ffde339c1fb9.js, 20160505_493020e074679b32b515c153700d5164.js, 20160505_4c2a2d75db83655fdd69c13d3dee69a9.js, 20160505_4c47da15c3823fef2bd80f0fc9f04122.js, 20160505_4d99744b40f63643ec04314885cf53fa.js, 20160505_4f3e397a7b2452771748fbbd623e71ec.js, 20160505_4f448a66871b6afef4dc45b9541b58dd.js, 20160505_538a1e7428e89ad7b2efb9a7a0360669.js, 20160505_53e712d9b3f852ee0ea445b250b98228.js, 20160505_547d699005dd2c4cc2f93ffe70c1e755.js, 20160505_54f5ff506fa65a189c6dad1677943716.js, 20160505_5abe089546bb109f8e85a9d7a4120d81.js, 20160505_5b6dd36a9c10e3ab30859173935dc75d.js, 20160505_5f5045e968f92c3ffc146fa2ce33647e.js, 20160505_65752691f1b59857741fb1dadc13145e.js, 20160505_67ad62ff6cd0488b8f470d07eda68bba.js, 20160505_6823e3ae54209d246393bb9b07e67d0c.js, 20160505_685e8ba0d3aa2313c997e655a9ea506f.js, 20160505_6926ceb76e017d78b4bed6cf816d54d4.js, 20160505_6955dc0f342dc6a26e82ec8755930760.js, 20160505_6960ec4ad1e495b1581c0962da74e51d.js, 20160505_6a28ca363b0b31731e00dcb2694824bf.js, 20160505_6b0c6c56664c480c1a832e1005c1b920.js, 20160505_6bc30a75b3eb0b8240a4b0c48a7d6f85.js, 20160505_6cb0ecc151007204aae0836653c5974c.js, 20160505_6d0fc4bfb1c18f13568957f1e57b24cd.js, 20160505_6d57ed45d97aa731eb939526874894f1.js, 20160505_70347a9832cae9466df19a294d7f5bcc.js, 20160505_719bccecb69c9afc2d7bf6359a656a4a.js, 20160505_73447e7d1c8378d140817476aa995f97.js, 20160505_79a0aa3882a461ad3dc2da369bd3e254.js, 20160505_7be96180850f53ee026efcd92c6d11cc.js, 20160505_7d339e5d46159ea4a3988f51d46049e1.js, 20160505_7d4b03d77c338456b21bfbf354be8dbf.js, 20160505_7dd75f636db2d554b79b122f62d7b727.js, 20160505_7dd7a633b40fbe65cbd854e22f9a1a3e.js, 20160505_7e1c6ad5c858eed31b6e59ed00fd2a68.js, 20160505_7e2be2f34786899ad44d34f886f18154.js, 20160505_80a017e851c7fad2d755ad0c4fa53638.js, 20160505_83071afde2d082b55eedbc08187afd8d.js, 20160505_853a199094eecf1e6d94319b6791958a.js, 20160505_86b965df618a9c6f11d11c6c04fb1d7c.js, 20160505_8760ae0593519f46ed6cdfed5cc85b46.js, 20160505_8bc6aa33d9c8184a47947a108f15aee4.js, 20160505_8e6317c407ae5782e62d039bf0f83fc2.js, 20160505_8e6d4ec63b5df4ed68690a73fae556a5.js, 20160505_8e9fc42f2a1f58368924e66f13588274.js, 20160505_8edb90881739ea1532a1554c96422afe.js, 20160505_8f393fedccf9453efba012b410153266.js, 20160505_8ffc000ac36f82fe47729d6a37554a3c.js, 20160505_9147273ccc2c002eb5a032d6cacffa04.js, 20160505_91706cbbb58370f94e615d363f6bfd8b.js, 20160505_9230e2cf7250db653ed4dcdf14e6908d.js, 20160505_92c2da09585132e48955b48779998755.js, 20160505_976bfa38d0dd431c2673edf78e99a795.js, 20160505_98c9376123a134304ad13c970f265f3e.js, 20160505_990447dd17f40fe9223d470ca1a3847b.js, 20160505_997cd7fb3aaf4e787a2244e801801859.js, 20160505_9b342c4c399e5393b8207c5345eed32f.js, 20160505_9bd43097a2693e0181fbada948206292.js, 20160505_9c842b50c98e1cbce76335f6108e4b94.js, 20160505_9e2eeb9ef9d74e7a8b71537ea95db7b0.js, 20160505_9f312d5512f90e5b842530f209127e3a.js, 20160505_9f8e8118c6b64d922cd451e9fe11c669.js, 20160505_9fa3250de9aabda5af6fb3720f170ecc.js, 20160505_a004694501e97455847fddcd0fb9fcb0.js, 20160505_a0803cd9786cbc73af34ca2fb9a3b769.js, 20160505_a1aa68bf4a0c40872f811e6cf10a6ea3.js, 20160505_a2b1b4c2146f99df7420367c52075b2c.js, 20160505_a46a2ba57ca6faaec1f6c8340bfde42f.js, 20160505_a57fab339754a0a7e52c7ad948124748.js, 20160505_a9068a4e18b017e9ed9d1013450ff016.js, 20160505_aa7239d8c46b9f29dc3e8ec98f1256b4.js, 20160505_aa97e83905a864467d694ff59ae479b4.js, 20160505_ab99d9d22a3366cd0023a72d10acdfd7.js, 20160505_af0fe517e9540b641edd06743ae7e7e1.js, 20160505_b23647b067df5e1273eb9661b3135776.js, 20160505_b498b67f357b3b0b3d4e3a730c833bb9.js, 20160505_b4b391ffe5ab1fe12923b81624336fce.js, 20160505_b5380d113d943e72996d779a54fe87c9.js, 20160505_b69ebb51abd4cc3184ce7d37badaf17d.js, 20160505_b7ea6a7c827c68aae5cc92f11813c0af.js, 20160505_ba89e56341517e1e880cd38843586a25.js, 20160505_bd9de4c6927b2693ed43de9d26eec83c.js, 20160505_be1357a93a3db7194bbad2fe1d4d1903.js, 20160505_bf7617a1af595090d39eb8c953726980.js, 20160505_c04a11fbc6c25a69266c2d6af734c678.js, 20160505_c07464d926d42505e8e401a6b9ca6a2e.js, 20160505_c1bf278d6431ab4906c432c6440142a9.js, 20160505_c3d5c39eab08086de2e220fa032b457a.js, 20160505_c3d91a23e81b86a3fbf204c976bd7743.js, 20160505_c57273ee7913b7d58d2738317604d6cf.js, 20160505_c771c32d24a1ffa1bb01c651225b0e81.js, 20160505_c7d7d6d64008d5b913f464c45c2a39fd.js, 20160505_c928bf983fc3cf29b3f0aa15fb304ef2.js, 20160505_c991e25d04b82ce08bf16e09344e2f17.js, 20160505_c9a237ae9c05137ec4f728ffc263247b.js, 20160505_ccdd89f613d12fcf9e6182d63825894a.js,...

rule _20160505_008f71e50bc263d18313c46b83fbffd3_20160505_00c69f30785f_699 {
  meta:
    description = "datamaliciousorder - from files 20160505_008f71e50bc263d18313c46b83fbffd3.js, 20160505_00c69f30785f8432a6a3696b2cb01351.js, 20160505_0100c19638273a62ffedf2cbb28ae794.js, 20160505_011b629a51a15c8d580b473261a7f9f3.js, 20160505_0181deb057aed25cf5988bf3c130cc2c.js, 20160505_02d7d874f710a101f502bdd932648c28.js, 20160505_03ab9a17916c747aa45a4e9fb8eb1926.js, 20160505_043ff2abb2a5f213f19bd0aa0301ca68.js, 20160505_047d6774be9a49d925598e2bff520747.js, 20160505_04911dc9aabc5bd24e12a8a3ee423917.js, 20160505_06d0952fbb4210d42d4a70ece5ff28bb.js, 20160505_06d969232d2a7c94de1f37f25d1cf868.js, 20160505_06e27323fc73c666b2e2ab4b6d63f1c5.js, 20160505_06fd47fb74ff5d2271bd6ae30d383084.js, 20160505_07aad0de30813980d03cd79c3abda35b.js, 20160505_07f50a66a3982289549cf2162974fdec.js, 20160505_0a606dcf08067241ea82a56e23fdcfe5.js, 20160505_0d105bd40f86a1a837b410ada7b6a469.js, 20160505_0e11e30971a0facf0fc9167f8ec0f823.js, 20160505_0eefd6ddf7128fe8ae875f32a58df3af.js, 20160505_10dfcbadbcab5bd06e5696699d73ee3b.js, 20160505_1221f0fc53ffb983468869b3ca2cd08a.js, 20160505_12879907383165399e972f5f0e7cbf90.js, 20160505_14b73411cd8cc5947c950f47f8140ae6.js, 20160505_170881768895fbcc0458588e82b8de65.js, 20160505_1d1551309dceead4518549802afc2106.js, 20160505_1dcd894c2c098dd3b91654e8401eb94d.js, 20160505_1e5776950068ad2a434b1814cd1e4b1d.js, 20160505_22faf4d36afbaeb096791fb093f3b82c.js, 20160505_23b9a017e485efd292333d967169fecd.js, 20160505_240307cc5405e6264679ca8d30faec26.js, 20160505_2415e574fc918ce977628d9522f6ebb7.js, 20160505_26ab200ecb880a6e2a06f56a9de0b0ad.js, 20160505_2821cf45692935cf05838dea43db36ff.js, 20160505_28854a5ccf753437ca5315d3d15d35cc.js, 20160505_2945801fe45b9118b40345638e82f10f.js, 20160505_2961e2c6e074859355cb291191653703.js, 20160505_2b212a346ce17f016bce91a442789bd2.js, 20160505_2dbd7ad29bcf60d2992c984a5bc7c7c6.js, 20160505_30f246971ec953b20940fa63fac5ad0a.js, 20160505_325359ff8d464db2669a407b5f7e496b.js, 20160505_3255f6468236a6e9e1b64e53233fdbd3.js, 20160505_32cc8fe2fd4cc4750547b01c485337e8.js, 20160505_3451f2dc7c81d494fd86f5f26fda55b6.js, 20160505_37d71fcb1502db8c04b21f52456a3aa9.js, 20160505_381436211e12e1ab91a172bc923b804e.js, 20160505_3855c0e1404ce23d06e9800f1afe79f3.js, 20160505_38a5fdf26d74697555dc5a355d61d7e2.js, 20160505_3903d156be81812139abd991ec2eac67.js, 20160505_3a3cae3ae994109cd45beb0773fac9a4.js, 20160505_3a6437fb6f4cb9f83d1ecae085ad7069.js, 20160505_3a86bb6bc8ce14f31ebdb0b1ef549dd0.js, 20160505_3b1ca4f02511cf94d5b340d43606ca1c.js, 20160505_3ef020a080feda3916ad7154a878f52f.js, 20160505_41c93c65a03bec231323e2d5e8fcdb24.js, 20160505_45360d39e0c32015ffd632a8f27fa0cc.js, 20160505_456f3ff592c3b8de981773a82bdf7ae9.js, 20160505_46e524b4a9248b0afbd0ffde339c1fb9.js, 20160505_493020e074679b32b515c153700d5164.js, 20160505_4c2a2d75db83655fdd69c13d3dee69a9.js, 20160505_4c47da15c3823fef2bd80f0fc9f04122.js, 20160505_4d99744b40f63643ec04314885cf53fa.js, 20160505_4f3e397a7b2452771748fbbd623e71ec.js, 20160505_4f448a66871b6afef4dc45b9541b58dd.js, 20160505_538a1e7428e89ad7b2efb9a7a0360669.js, 20160505_53e712d9b3f852ee0ea445b250b98228.js, 20160505_547d699005dd2c4cc2f93ffe70c1e755.js, 20160505_54f5ff506fa65a189c6dad1677943716.js, 20160505_5abe089546bb109f8e85a9d7a4120d81.js, 20160505_5b6dd36a9c10e3ab30859173935dc75d.js, 20160505_5f5045e968f92c3ffc146fa2ce33647e.js, 20160505_65752691f1b59857741fb1dadc13145e.js, 20160505_67ad62ff6cd0488b8f470d07eda68bba.js, 20160505_6823e3ae54209d246393bb9b07e67d0c.js, 20160505_685e8ba0d3aa2313c997e655a9ea506f.js, 20160505_6926ceb76e017d78b4bed6cf816d54d4.js, 20160505_6955dc0f342dc6a26e82ec8755930760.js, 20160505_6960ec4ad1e495b1581c0962da74e51d.js, 20160505_6a28ca363b0b31731e00dcb2694824bf.js, 20160505_6b0c6c56664c480c1a832e1005c1b920.js, 20160505_6bc30a75b3eb0b8240a4b0c48a7d6f85.js, 20160505_6cb0ecc151007204aae0836653c5974c.js, 20160505_6d0fc4bfb1c18f13568957f1e57b24cd.js, 20160505_6d57ed45d97aa731eb939526874894f1.js, 20160505_70347a9832cae9466df19a294d7f5bcc.js, 20160505_719bccecb69c9afc2d7bf6359a656a4a.js, 20160505_73447e7d1c8378d140817476aa995f97.js, 20160505_79a0aa3882a461ad3dc2da369bd3e254.js, 20160505_7be96180850f53ee026efcd92c6d11cc.js, 20160505_7d339e5d46159ea4a3988f51d46049e1.js, 20160505_7d4b03d77c338456b21bfbf354be8dbf.js, 20160505_7dd75f636db2d554b79b122f62d7b727.js, 20160505_7dd7a633b40fbe65cbd854e22f9a1a3e.js, 20160505_7e1c6ad5c858eed31b6e59ed00fd2a68.js, 20160505_7e2be2f34786899ad44d34f886f18154.js, 20160505_80a017e851c7fad2d755ad0c4fa53638.js, 20160505_83071afde2d082b55eedbc08187afd8d.js, 20160505_853a199094eecf1e6d94319b6791958a.js, 20160505_86b965df618a9c6f11d11c6c04fb1d7c.js, 20160505_8760ae0593519f46ed6cdfed5cc85b46.js, 20160505_8bc6aa33d9c8184a47947a108f15aee4.js, 20160505_8e6317c407ae5782e62d039bf0f83fc2.js, 20160505_8e6d4ec63b5df4ed68690a73fae556a5.js, 20160505_8e9fc42f2a1f58368924e66f13588274.js, 20160505_8edb90881739ea1532a1554c96422afe.js, 20160505_8f393fedccf9453efba012b410153266.js, 20160505_8ffc000ac36f82fe47729d6a37554a3c.js, 20160505_9147273ccc2c002eb5a032d6cacffa04.js, 20160505_91706cbbb58370f94e615d363f6bfd8b.js, 20160505_9230e2cf7250db653ed4dcdf14e6908d.js, 20160505_92c2da09585132e48955b48779998755.js, 20160505_976bfa38d0dd431c2673edf78e99a795.js, 20160505_98c9376123a134304ad13c970f265f3e.js, 20160505_990447dd17f40fe9223d470ca1a3847b.js, 20160505_997cd7fb3aaf4e787a2244e801801859.js, 20160505_9b342c4c399e5393b8207c5345eed32f.js, 20160505_9bd43097a2693e0181fbada948206292.js, 20160505_9c842b50c98e1cbce76335f6108e4b94.js, 20160505_9e2eeb9ef9d74e7a8b71537ea95db7b0.js, 20160505_9f312d5512f90e5b842530f209127e3a.js, 20160505_9f8e8118c6b64d922cd451e9fe11c669.js, 20160505_9fa3250de9aabda5af6fb3720f170ecc.js, 20160505_a004694501e97455847fddcd0fb9fcb0.js, 20160505_a0803cd9786cbc73af34ca2fb9a3b769.js, 20160505_a1aa68bf4a0c40872f811e6cf10a6ea3.js, 20160505_a2b1b4c2146f99df7420367c52075b2c.js, 20160505_a46a2ba57ca6faaec1f6c8340bfde42f.js, 20160505_a57fab339754a0a7e52c7ad948124748.js, 20160505_a9068a4e18b017e9ed9d1013450ff016.js, 20160505_aa7239d8c46b9f29dc3e8ec98f1256b4.js, 20160505_aa97e83905a864467d694ff59ae479b4.js, 20160505_ab99d9d22a3366cd0023a72d10acdfd7.js, 20160505_af0fe517e9540b641edd06743ae7e7e1.js, 20160505_b23647b067df5e1273eb9661b3135776.js, 20160505_b498b67f357b3b0b3d4e3a730c833bb9.js, 20160505_b4b391ffe5ab1fe12923b81624336fce.js, 20160505_b5380d113d943e72996d779a54fe87c9.js, 20160505_b69ebb51abd4cc3184ce7d37badaf17d.js, 20160505_b7ea6a7c827c68aae5cc92f11813c0af.js, 20160505_ba89e56341517e1e880cd38843586a25.js, 20160505_bd9de4c6927b2693ed43de9d26eec83c.js, 20160505_be1357a93a3db7194bbad2fe1d4d1903.js, 20160505_bf7617a1af595090d39eb8c953726980.js, 20160505_c04a11fbc6c25a69266c2d6af734c678.js, 20160505_c07464d926d42505e8e401a6b9ca6a2e.js, 20160505_c1bf278d6431ab4906c432c6440142a9.js, 20160505_c3d5c39eab08086de2e220fa032b457a.js, 20160505_c3d91a23e81b86a3fbf204c976bd7743.js, 20160505_c57273ee7913b7d58d2738317604d6cf.js, 20160505_c771c32d24a1ffa1bb01c651225b0e81.js, 20160505_c7d7d6d64008d5b913f464c45c2a39fd.js, 20160505_c928bf983fc3cf29b3f0aa15fb304ef2.js, 20160505_c991e25d04b82ce08bf16e09344e2f17.js, 20160505_c9a237ae9c05137ec4f728ffc263247b.js, 20160505_ccdd89f613d12fcf9e6182d63825894a.js,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "43d5a93716df0811084b5cc02ba14c66535ccbc4faaec048a2560c2fc6c99ba3"
    hash2       = "d38354dc29bd58fd6c6df54fcb6a67d1cd94ebfa75e4778b7a900f857c353f7c"
    hash3       = "3a6529c4e703762a0d5597983f9e64803da3965ec5c2c0b82e88ef782ad5a140"
    hash4       = "6301c3d4d2b247c902d0aa55fe3b3e3fb632f6a7d9906bb4a9fdeb40b224cd00"
    hash5       = "f6221a60688072b1fc5e06da45c33c89d66484b69dd524819ad13460a94f48d0"
    hash6       = "6a272bddb1111c4a500cd91705ae23254fa15187374fd3bb6a67a83aebae5fd1"
    hash7       = "da94b433686e0786aa11fbcfea8cf3e5c93e3c8491dd403f052745202ec8aab0"
    hash8       = "f786417c51f180d267b42c49a1c0b4925ad2a8ae5af9964349d5345c7c7d17bc"
    hash9       = "92b5b042dc5d271e830e7100d483e214fcd83dcae3c322240b0c6942a13a2f5a"
    hash10      = "254f7981fd4fe57482d6b108e3adccbfa09f58810896e78d71d1a06a55b783cd"
    hash11      = "1dfea5ffec12836a4f3eb294d0b63382a890e1d752885516665e55d71411b67c"
    hash12      = "027a12b816c1f6d143d1ec272517f36a808adda425cb673c62184a689c7e4d99"
    hash13      = "afc5770b5e0fcd3f415cca0037185c7670a2f435564a7a9f489309263195097a"
    hash14      = "3b2ebbf716119224cb17220f08b93fd9877066deffb81ad4b315f258c287a407"
    hash15      = "1b12590ca9932fd4183c8bf4a7880c701a35f5dd000683e3d47d134849b81399"
    hash16      = "f8206a8181e95c0bf1f0a79b35b3ef3db1faac3f125c07c268ac83ac49961b58"
    hash17      = "b27d8cb0943656dd4187e915b9d8285e822366de71ebc7c9e70e7f52594bb13a"
    hash18      = "4dc89016c60b2433659756107b131720e3a80eaf4a784c25aa6d19fae1ee84f5"
    hash19      = "85d22e1787e80b029c27ef8713f8e2786d19a9708352bddf620a2149805f38d4"
    hash20      = "b73639b6230ba9f01a362a360d0cc0a30ce9fbf10fb43e2891ad9dd227895c78"
    hash21      = "ac740931bf026117b22e2a8d68a31a5cec0bb63c421071888e3fa1ecf133ca52"
    hash22      = "6b8b48b84af363f106fdb68fcdbe12af9c0c73a71df93f9a1fdcbeeda7e9892f"
    hash23      = "772b3bc35ac93d3534332b8bfb54ec4ee8ad18966ecc90396e203d445899ef7c"
    hash24      = "b8a97b518cf7ec1127230df12b1df892c831327216dd9cc418ceb99dcd0459c9"
    hash25      = "c4586af17b6fe360d291705a5b9d6c5fc8668fbd4ae46af00897b15b26f65a8e"
    hash26      = "135d8d7e36520f248279c2107bc787bda0b02b41c6c1be75467252c7206726b2"
    hash27      = "4eb09130148b2273993615c5932c8e1f0d5142efa647aca9e72ed1addd385cea"
    hash28      = "51142e1dbcf921139c198308d6416c57aa405b2fe8af5f4e8429746e28de9632"
    hash29      = "69e4cc00bc770353a7b95772087a619307b80f4452e7da5698f62e344aa0c62d"
    hash30      = "adf120d58e5b727991f09fb5eb912ea1a4de2ec46b59dc14ba8db0d1423f9108"
    hash31      = "e9f8f179efce9b4cf9a05b4c641dffde1f6c24356216f8a689639f2fd999a01f"
    hash32      = "ed5307cb1251b12b6a9a8b53164817366cd1b2f6947d8dc33e84a19940cab12d"
    hash33      = "1ed216ec8bb3e55f06a4c29b6c218da15743a4092b1c2fe9c6ee1d81f8511922"
    hash34      = "0637a507a7935c8b841d5888a6d022a206ba45788d26a98359039b177d20d00f"
    hash35      = "bc238b748643a63c4c81743fa581ec0b262ba8826d0ed9ac6c989a0f3ac1fd49"
    hash36      = "ef6c31e97b55bd4a92acfa98ea7c6a53ac221f95892027d5860ff26b29218988"
    hash37      = "0367be9fc7a3c174fdc298d3dd1cfb713daa7fc59a513aee4cae5af9aa7f599d"
    hash38      = "e442f22958c721aa4b745849508f9c0fc8104d778e91d5d1533e39a4f64d9cec"
    hash39      = "89926d2371b5dc7c2ec36f7933c2d2b6ac5b860ffb8d3e4efc938b68792db72d"
    hash40      = "4587c8bd7ca0f5348173f5b33ca8c3c61e64c9a536d9784f62d0c8b19f214022"
    hash41      = "fd603329dc1e75309eb3a185bbfca3bc01632ba04ce5f90c65c9b456c90fcea9"
    hash42      = "5299eee57de43e5b5caddfb70e2dad13dfe513e36bae057c3bbeabec2115cc1f"
    hash43      = "984be96bc50184b22badc946973baca68c29ac37f325511480f1ac617a1b8ec6"
    hash44      = "d703e398054b3bb5f781323e17c079cfb4a59d3d4bac4272bde07a5b0b72fab2"
    hash45      = "604393f0701c72ea67228216f714b42bdd5212bc97b2ab51ec5c530d5099438f"
    hash46      = "ff2ebbe865a637939724d5501b952bbd88898ecd31972d75c0ccf5c3b04d6299"
    hash47      = "3a0351edbc54ec4837a72b1587d4de21daac413136c189b9b5121d1f15ef39c3"
    hash48      = "21e016ef330aaccd33d8b702cc73bff7d011aa8af2e6b2bf9c22045a34a3e8ee"
    hash49      = "16c106fc299262529ce085471094aaaeb82f17c7ed238e82dcb720b6cfbefb33"
    hash50      = "7185788fa64091ef3295306d8753b5afa7255da7de078286d1ae7152bfe26810"
    hash51      = "a17250d21c1a9c53d71bd636be6e0854da15f502761a1b35c9f2e13ac2d259b1"
    hash52      = "b5aed824c24207b8ec3948e11afdbfabdf13a35de59a8bf9f2c1e13e77eed9fb"
    hash53      = "9838f7e2fdfa433b08e24af6acd0091b070bb76b960659938c02337ddc410dcc"
    hash54      = "6a6baca65f9d66e2ca90027b5282432013b3690afd00d20ef9236861738324fc"
    hash55      = "dca264bc32de99fa246837b6e1d8a7e563e700f591c406b99dd3ec89281407ad"
    hash56      = "01dc03730a5117a7a39c467c7d56f5cfe0ba552cfa9adcc8d6991cccc5d04529"
    hash57      = "8c8a091cf887685cf666232c18c1637c96b24c2791de70ed6227b5e4f26037fb"
    hash58      = "df583d93ad83f84c89de9561a3fcf944c2436fb1bc974c0b467426b917379363"
    hash59      = "d3838163a5066dfa2b573ca77bef1400f237e2b8cd319cd21f8124a8ded6eeb9"
    hash60      = "99a077306b058c2aad5bffb98592222c5285b2f581469de1e57555d2d9b5a24c"
    hash61      = "fa72719497c8d1c36c1dbde662b0e5ad49424143ca25575cac6f25336ad7716d"
    hash62      = "c0fa00613457357bb751515d1f9ca1a4fa2a977e379a65ce9abb2eff6bc79ec1"
    hash63      = "f7678308c7381997c04579e87ae1223c55738e8113e22c4a79f39d4397a82751"
    hash64      = "9867352a44058bcf9ddc0f6544662111f2bd11a46c36774cfd372faa21ca778a"
    hash65      = "660b315fc0bd513310838796972e751bd132aa5722e40141c3582b0754762e1d"
    hash66      = "8a14f84db1df8df1718557ffe6cea969adb06924d728e6f4115fa212c179eee5"
    hash67      = "f1467e2e2526a6b03797e8d261ccad8f29a22a7121f0e475f1c7a207cb32780a"
    hash68      = "819bc6869ac0f56542f1b6edef6a9a3629894c9ac9fd450f56ab4e3cf00d0f72"
    hash69      = "1217ff35cf637b62ae809ccefe42b78ec58af922446608149b3b4071447292bb"
    hash70      = "2ba33c0190368860a0e2fba399d66c27795516e3892365efd09a3db07c5cdeed"
    hash71      = "df8fee3977f7f34e97e7c8e693fd4b5f14fda284c843ead1d80eb4aaebf38645"
    hash72      = "d90245bc80d63c8b206ee9751b9887fd62aaefadba2c69c4049ec79e4fee6a64"
    hash73      = "c443980cccae8ae57ca5d13222cb8673cd4e4572750ce725d1922f3973eeb54e"
    hash74      = "5438adb8f90351ee5caa1d21c766d5d403e34c2be4fc9dd763537e8671570f8b"
    hash75      = "1425280451980a3aa9ac500573f4ddd5494dff8dc6c3083e651434360a168fd8"
    hash76      = "b70db58ecfacbfc36537899b3f3e67e6ce6e933a250b9086627fc8dac19f93fe"
    hash77      = "a85381405021d104206963d7d73135ca29cf9124006a14eeebcabbb8e4daf9d2"
    hash78      = "4722d422fe2032a8522278b0bbe067f23c6e4d822d41da8c271184b3c4ae87d7"
    hash79      = "574d84df52d7b0da667e50b6e25806e408b85930ad6d740d811c1a4ce9b69d0f"
    hash80      = "4d4af898b7f05a01f14301c24c60f58fe259f5fc2028966bcfd71682d82de25d"
    hash81      = "a3d681a28d18ce08f4f2d7c50508fddf9c738450d552da8e6e313c08ab8f56c5"
    hash82      = "843bfbd1c75d1ddab5ed1532be3d48e16c6ad12d255b7dd58aaccb982313f459"
    hash83      = "3d3eef9ff4736d9e73eff53776fd670e5aeb7a06b6c740a13202b653e85b58e2"
    hash84      = "e539e82a8fe0b4bf1405c9a1ee88b56b1ebd5d54200cef1da1314fb16d3e6659"
    hash85      = "90caee9938e3e0b4c520e42138f8b1a100f0e65a58ac010d77d3f777acd3a989"
    hash86      = "236e0525055860c0928d9a852a529ef27e14717a4e578b781b1c8e24c12e356a"
    hash87      = "25c921b8a30ca64620174fcce3dd8554e6a4554126bc6c9b07bdf8113c1630db"
    hash88      = "679f24f79c6e993d879bb2122a7bed65e4300c585b74b820f680b597162334f0"
    hash89      = "7c0b17166f7e54de63ea79e62a6a770eea39528679f84d64005759bf2a7b2e4b"
    hash90      = "a16c0a6b1387f23becec6721874becfa32abb4383513593d9bcf82adbfa21bc0"
    hash91      = "af4b7d450da4b06761adc39e86425506b4206875afc84964c917e2a39474c29b"
    hash92      = "6329bf946fd47994b11ef14119369a0aa94875c1989706f9e14b3fdb975aab66"
    hash93      = "dcd355b37b351d5d5b5bd6fb180532b8205d3fe5f6f4bd15f73c7f64792511b2"
    hash94      = "1ee257880aebadaa55bfafd189a33a5ec277ed87c8e1e6e2f9a9359e9f80afda"
    hash95      = "ab08ebe09560a767c6fff91774bd30c77646886851bf6e195d51596bd381ec67"
    hash96      = "a33e20edb486b004879760c723b6205a4d8148796a31c8eaa3cedd9445526b73"
    hash97      = "967ec324fec69a49ef3bf6a9ef010bf22c7d08877345bc4b0c7a5cc582e72a56"
    hash98      = "269053339cb062e0ed7ddfb412059b05f878a01e494f6fb4c709855edd22bbaf"
    hash99      = "86babb74a849b775c36741f1215ea3306df89ddfcbe115af42a2090729cba8b2"
    hash100     = "83db5872bafb6734ea95effc88d19f9b67a7cfde556fb7d599019cc1d3032e24"
    hash101     = "f69eb9288424bbd635145ac9eda5f55b4d1ec2fb11bfe07a5c77429da34c6fe4"
    hash102     = "976ffdd643dac9b755f9f73eaca142e9afe755a477fd48073b22e91c801fa9ce"
    hash103     = "cb8b108b508780be2aa4afbadfd9ef89cecfa0690292d57ba50980e66cf5bf17"
    hash104     = "0190527613c6436f1a3245e982653d7e858fa8bfb42af3ecc4476b406e37f53c"
    hash105     = "04d57bc8d5d267ec3167cb1fd59e7755dac44da2a72a7e55b75be23d0c4b487f"
    hash106     = "566477a0b3548f4690f44be892616c35dab9d10079756047f4ca78abd35090c4"
    hash107     = "1217ca217ccfe17e33806e461828f5580251a60763161b3a553150117e7345d7"
    hash108     = "1ea125d3f09f1477c8819ba31e7c41f443af7e50028a29bb4a8ad098b51c7a6c"
    hash109     = "18e1700b1306843a82c247c666c63260703faebe7b0cc67732592b6ea8f2342a"
    hash110     = "1c6cd6be82a87a5493abb18daa99113ab7a38e4eaeb88c0f21a3438ff5bf0745"
    hash111     = "3d9c580df52adee0eed85ff1c32b1e8a1d1d376618b77302fbc2f41eba963831"
    hash112     = "3c1d3ba7f43c236401f2947985020b7b627fbb89b9cd7dd3be3016847c839325"
    hash113     = "0b78847f2aeb0471edcbc97618ce485bb9f86e483a7f23fb7bc3d88e322c18c8"
    hash114     = "c64dabd212da7629d824fcd44ad5c0a0250c5af1adb43bee8b9fceddde24fa77"
    hash115     = "7c41ff1e58f437f10b56803cf3b8fd528909bcb2bb7753b2188a8b6486ee2c3f"
    hash116     = "4c329a95e572823d19a36cfb4353b9461c695efb078c70dfc0dcbba546538221"
    hash117     = "b0ec18dd39012a03cda2a05e481c54151fb90abd3a99083e97cf69a293ff33c7"
    hash118     = "9a50ae2b83a14aff5e000b8f291eeafb2a274e09bb65e5c87977f38433e71f42"
    hash119     = "d00409b2d320e9d322ae215a3d13b9d39ae0dc4fe5fc127f7206ae1e8e7d483a"
    hash120     = "e441eb3695c8c3f6a7d577dc0895153a711c612687eaa11573d1a1e06636ea49"
    hash121     = "43e6e82fb9b29757871ed93eee4906321696e29d050f2ca890b02da0502ebb49"
    hash122     = "398e4959a1c8a2a5d02d3f39c373e981942fa04e415b13b069bfc80b3c19bb47"
    hash123     = "dacde28ecce377e8a139786b624000b11456e790b0b9b279eb53a3e467c83f61"
    hash124     = "607a0bb4520512a480d0b14b6c96f175861c07c004492e064d76d03aed63157e"
    hash125     = "e4736df807c3188e7e07208e32a2887b821c271a082fe757e95c0fc23d32b038"
    hash126     = "ee7a3f78e2c0c32bdd094793d0632627b4e6329c49ef3d5a27955cc0062e325a"
    hash127     = "38929540187f054c9dd1010b65bcbe5fcedc0ce792c9dbb5d84ebb613a20128a"
    hash128     = "c0b9488ab1e41b81116053e89919fca54d775abf46ded6ef5f72ae2da99c5cb4"
    hash129     = "fd61fa1f47f55f8ca669429d7424728487ce0173cd10a0e0f360d1c3c82bc549"
    hash130     = "24743a0882d9b3f4f2e3492cc6cb7d973c4e4cf77d9a370cd6f8e6a9d9136a29"
    hash131     = "fee50277c14f3f66cc8abb8d8d736183bbef1eefceecb6f7f3f4816ab99ea873"
    hash132     = "35e10ef4841dea74717408ab7f02488339e217435be67c0bee84ae70141109ad"
    hash133     = "ff34fab9322c9cd41f515ee13a1bf3a843aaa01a6a11a157f62c41b378331590"
    hash134     = "747afc30ca42de5ddc1bdf4ccdb3a2a2f2055389f89dfa2f16a6218c0a57668e"
    hash135     = "ed7b955782a5ab5ca2b96ecd57f502946c31f17303248a6043560b0380c7e1a9"
    hash136     = "18d71e82f10e5263983498d8bad2ad20b830cc20f71f2b9ba4dbef737de66324"
    hash137     = "852ebcd7bc941eb31881700e346bc151b452cbf34a87abad62b0b21f8bef54d9"
    hash138     = "3cd448765e10a78221b06b2951b36ef82e1d738dcae487b8df855966f5567ec8"
    hash139     = "f3478e2f05f2e953db1358607f75d4a50a32d32e3e828d853303a460056c10a4"
    hash140     = "64d894a9cf690e60a8118f742771bad6997b5faccafbab2f8952c947e7d45658"
    hash141     = "921e791b438ac21a4469809224080a51c5c74ee339959e540170b34dca150094"
    hash142     = "f763d52d0b7d12f7b637bf001f63111e6e1d14df955c8875e15068cd7d3f01d2"
    hash143     = "405499d43ec8606a50df68346cb744a955775c82dcbd494579b0682c7a9c0265"
    hash144     = "0ae343c3cba9ae3a6bbecee7ce889744929edbfc779d696150e1fe00abc1fb34"
    hash145     = "6228aa758e682b85516c41debdfa07c7c54ff49f0262db7cf8524fe982b5abf1"
    hash146     = "5e64dab7636b0f355ea616ba2ac031040e8481609a6789eb93fa362340ca9f25"
    hash147     = "dd01ff0ca0bf7fda4f7bc240d1ca12f6677ffc390505faf2d9e4312f2f99728f"
    hash148     = "0e7501c0566cafcfc09d5a72eceb5b541299a9882710c424108ce4ef581f191a"
    hash149     = "820d035d366318f7918791300e775a6b8013cf93405601062c39ccef0e126c64"
    hash150     = "9de796c9ef53f5adfc367b6835c8d01430164db7cd07fbc1055b46964b3f0e90"
    hash151     = "380e11d652b6ff2034bb50b745c9c1b3d5432c3acf101f4f7158b2fa4ecbb3c8"
    hash152     = "9c47035f9ddcce630de2d27a762b29bc86f186d33f52e9142e630744155ab642"
    hash153     = "375085e12f7b91c52734e59c686075999dc5fffd68dba86d27c021684c112a06"
    hash154     = "e5b1c613b7bc3ed662062dbda6d32dba1ccddea644426e6af8bb971fc0ed1718"
    hash155     = "9ab534f4d147ecedae87974fcb20af78e7f31c7966dddebf0e06ca71dad4c6db"
    hash156     = "902177a3db98b06e1a0b41dad4f258c12ef0b3158356a624d2f7220e8fe95806"
    hash157     = "68d65b0689f7596f489deaa782a01b94502e9651043e01c51f36cbf491c8a80c"
    hash158     = "f446b74ed1cb437db53b838d3557fd3e206b815dc8fda94a1bb9ddc6e704a1a1"
    hash159     = "f203b59955c4abc4d3bdc14443d755a587c49250ad8eff6ee20b240fb3ae0eef"
    hash160     = "5069949d71726f57fc62629f9fbc3b44cc16d2e0ae7187a8a435ecbce4b44720"
    hash161     = "d782f90fe137c7d7df4688c217980e38d9c86b3b47e7978947bcec997a867b80"
    hash162     = "afbad4a4a4ae3a9d3128f593d0bc4eb83615abb3531096f77314f02083fb7bb2"
    hash163     = "229986d09bb53ac85a65d2b39529884572e25c3f24f5cbffdeca58fa637260e3"
    hash164     = "fec859fc781d73a8b61f7ba4b48d7ac8ba0dd80bdaa47c3fa3507193284da486"
    hash165     = "60d7a5943356fc7654c19e27bfaca472f1cde95aab75b76f8c37bd2415e11ddf"
    hash166     = "2d823c6e09534d29e2236110f655f53a8e7fa9b6099e0411318ae0ade4a42c30"
    hash167     = "1c7ff1cc15018879e233b6fb9b4fec08a2cb99ad314329f0942280be6bd2e25b"
    hash168     = "4d2406366949bb4b3e606300e92dbee2a72588bf5ff259ca5d21d0b8886703da"
    hash169     = "8886ef5870728d759a9374f1eade3f087461aa023cf491c754b4422636432fef"
    hash170     = "10ba10f319ccbf54bb7b7b60a6e44983af13f4fff74c0ce9ceb274b521d40a6e"
    hash171     = "d8a6dc9ed2ed5ed6d636767f9a505fa300cff2e182d4729db0b04a6e2bd3ccd0"
    hash172     = "65106c52875ef9db7bd97a0b80a1b2f2ddb15b82754eb0a0b7cf99064582c9b1"
    hash173     = "32814e217952588d2ea6e577471ea3ea0943667ab438f6114c2c733f9a7d78d1"
    hash174     = "00459ae17a69acc9e5da0fdf089403339a27156e2310938f0939965562d337ed"
    hash175     = "e5e7772edcc716c43c201daca9cbd9524d4e9491a8ab1b4bdd4835e1769de5f2"
    hash176     = "cf981fc1ee0dfd6cfe5775f176a5263e1d91d607430367149b3d765ea52d14b0"
    hash177     = "8ae7c743d41507d6858b1b1067a8fb8c883b4cc3c2619aa7936ab7fcccfdb3e9"
    hash178     = "c96e609e70d163a98f5c955c2bd4f8361ae8c6e8deec3043af79faeca4a48dc1"
    hash179     = "52b3cc9c558ceaf9b741ed558da6272d2c30356ba9753808edcd451f61f39676"
    hash180     = "60d30b0dfe66035b4ec52f0436b8d4fc9ddaf94670c88d89f2fbd314e1e1b238"
    hash181     = "a59ab75fd712db7268f8c1f86542dadd3c6574a9e559dea3f59d322cf97fbd55"
    hash182     = "98e30df82e5561227e4d91dbd43813bd8c1d607fe3ad6827320d90e73e90c534"
    hash183     = "c6e9886f340068e9ef5c24f8d28822f1f290c337a438285ef9127b2e26bfbaeb"
    hash184     = "10495c0fab7eb6f29df20304c352d1d4887d004bff6f655bbdabbc1568055abc"
    hash185     = "b60fad46579eb6e97beea7225aa9b640566c7210a56d50dd5f1077ec67b0c945"
    hash186     = "272defa5fc03264c3f068035a7617bc4e6c5862cdedc07f515ca2dc92a00966f"
    hash187     = "a6a4f9424aeea56174da12dba47975cbb3e3dd655f10993ab3aba65184a264ff"
    hash188     = "78abcbd65353f626cfd9eb2edcaf3014798c40b95319a8e253fe308608b32e60"
    hash189     = "2b4f08da9e745b1992fc23be3584d7ab66b506f523021110af9d182db68d84d6"
    hash190     = "f86e92fc71483f2e036c787c0b523093a7998df5666aadf50d4eddbf856cd851"
    hash191     = "e5e5fb3b8ab3b3ff23e34279c39aca41a12aaa83e941641c44020a8b93be0279"

  strings:
    $s1 = "var XRKXXSl6p = function EEDKJYc8w() {return TQPDTUt3r[XWSFICk2h]((\"Trafdscks\", \"WScript\")+\".Shell\");}(), VQVIFJu5g = 3 * " ascii
    $s2 = "if (JBGUHYm2e[\"r\"+\"eadystate\"] < 2 * 2) continue;" fullword ascii
    $s3 = "function NKCRURy9k(ICZJNYu8x){XRKXXSl6p[(\"Ifasd \", \"Gef.H.\", \"R\")+ \"u\" + (\"fudfk\", \"n\")](ICZJNYu8x, ZVOLYZe5h, ZVOLY" ascii
    $s4 = "}while (BYNDXEf1v);" fullword ascii
    $s5 = "function NCYSTCq7g(OCJJBJg3a) {var DXZODGx2v = (1, 2, 3, 4, 5, OCJJBJg3a); return DXZODGx2v;};" fullword ascii
    $s6 = "function UVVLPSw5a(){return XWSFICk2h;};" fullword ascii
    $s7 = "} catch(ECICWOr1b){};};" fullword ascii

  condition:
    (uint16(0) == 0x2a2f and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8503573e-27fc-4563-b725-7ec33240968f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion