_20160921_016c552b04b5a3cc8c83233d34c7fc80_20160921_037dfac14c35_710

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160921_016c552b04b5a3cc8c83233d34c7fc80.js, 20160921_037dfac14c3541d1a412418c64cad2f2.js, 20160921_073b3e31779f349650fc6977a0add94b.js, 20160921_10a3e0605b8ced0a0dee77069aa99014.js, 20160921_17bab7cc945fd06123e7b9b16dea263f.js, 20160921_17ed90b369ab37cb5f1e7dcf8f6bb253.js, 20160921_1af58d1231756b320d04226685b5a131.js, 20160921_27fb26e7e153703634890a2f9e37ef7b.js, 20160921_334dc22c3620386c4119de547e0c0f38.js, 20160921_3941d41b2f7cb84a9ce802558f71cf2e.js, 20160921_4ad5ed78dc05b02005f65ab785b9c74a.js, 20160921_54ac484c468ac2ca7fe6c7210ca717bb.js, 20160921_649e29a058d10c3bf9a5a5a06eb3b603.js, 20160921_68d4a1cff7c2dbc758cf0077184d0d52.js, 20160921_73b5a50d06622b8411077815f2717627.js, 20160921_8aaa596582e26eec62319f01660d922b.js, 20160921_994c4aa8813658fbb0b792d8aa221e53.js, 20160921_9a54c73297e1211ec78765c2c1c7c05b.js, 20160921_9d32b55f93b83e117524c4df15361eee.js, 20160921_a1cbb43a1e22a4b1fd63ee1a724173eb.js, 20160921_b8c98d7e4e5c69c2f4fa4fec37a59dfb.js, 20160921_cb7b906c44a337d403a375918e9db0c5.js, 20160921_cff7808833d9e819d4a4f10450848a81.js, 20160921_da7f7f057c35b886425ec822f654da90.js, 20160921_dd28b3b2e4fae279f1dc4ba30acafda9.js, 20160921_fd5fc067457571e92a95bd16158d41e6.js, 20160922_2c550b6efe6ec163893e1c555d256b4e.js, 20160922_7706788d60398ea7d883afb2532d218f.js, 20160922_b06824c3d57db547b98db8d6b10525d0.js, 20160922_c593174721c6fbd1b57bf98d8a85a6fd.js, 20160922_ddc158d1b0906f773c8ee4447daa25e5.js, 20160922_e83e21df386eef1a99bc7a65e7e6f6f4.js

rule _20160921_016c552b04b5a3cc8c83233d34c7fc80_20160921_037dfac14c35_710 {
  meta:
    description = "datamaliciousorder - from files 20160921_016c552b04b5a3cc8c83233d34c7fc80.js, 20160921_037dfac14c3541d1a412418c64cad2f2.js, 20160921_073b3e31779f349650fc6977a0add94b.js, 20160921_10a3e0605b8ced0a0dee77069aa99014.js, 20160921_17bab7cc945fd06123e7b9b16dea263f.js, 20160921_17ed90b369ab37cb5f1e7dcf8f6bb253.js, 20160921_1af58d1231756b320d04226685b5a131.js, 20160921_27fb26e7e153703634890a2f9e37ef7b.js, 20160921_334dc22c3620386c4119de547e0c0f38.js, 20160921_3941d41b2f7cb84a9ce802558f71cf2e.js, 20160921_4ad5ed78dc05b02005f65ab785b9c74a.js, 20160921_54ac484c468ac2ca7fe6c7210ca717bb.js, 20160921_649e29a058d10c3bf9a5a5a06eb3b603.js, 20160921_68d4a1cff7c2dbc758cf0077184d0d52.js, 20160921_73b5a50d06622b8411077815f2717627.js, 20160921_8aaa596582e26eec62319f01660d922b.js, 20160921_994c4aa8813658fbb0b792d8aa221e53.js, 20160921_9a54c73297e1211ec78765c2c1c7c05b.js, 20160921_9d32b55f93b83e117524c4df15361eee.js, 20160921_a1cbb43a1e22a4b1fd63ee1a724173eb.js, 20160921_b8c98d7e4e5c69c2f4fa4fec37a59dfb.js, 20160921_cb7b906c44a337d403a375918e9db0c5.js, 20160921_cff7808833d9e819d4a4f10450848a81.js, 20160921_da7f7f057c35b886425ec822f654da90.js, 20160921_dd28b3b2e4fae279f1dc4ba30acafda9.js, 20160921_fd5fc067457571e92a95bd16158d41e6.js, 20160922_2c550b6efe6ec163893e1c555d256b4e.js, 20160922_7706788d60398ea7d883afb2532d218f.js, 20160922_b06824c3d57db547b98db8d6b10525d0.js, 20160922_c593174721c6fbd1b57bf98d8a85a6fd.js, 20160922_ddc158d1b0906f773c8ee4447daa25e5.js, 20160922_e83e21df386eef1a99bc7a65e7e6f6f4.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a691692f0982e93fd21c441e8c6d39328f1ea5990ce24999b2df98ee3488f667"
    hash2       = "bdbf3b67df915739d64604188a4862042efa316e641ef50d228a41f9327767cc"
    hash3       = "60d01505d8ea4f2da2961c36fda33950e39ba720d54d967d434c0c5003ff7d2f"
    hash4       = "462b92b513dfa104fe3c095cbf98c34389b13ed004671baf4f95430e8487a108"
    hash5       = "a1dd80ed4e2509af999afcf84c8f78ecc409616f9d6e072d25cb980d8bf9e464"
    hash6       = "81de0ae14e0c288b697a0e3c7f3ced9b68b8377e75dff5322d654841e642a8a7"
    hash7       = "de59166ad132c3c5ad12a85d2d837c1aec192afb497be23c517c637a08d25171"
    hash8       = "867c0b561ad28bc562227169c7a21fbf367232ec2d2454d4bd819e1a42cc1b62"
    hash9       = "a69d8e08a2b4320b4183bfad7a1baa8fc49b7361116aeb9e3a542ae416cd93d5"
    hash10      = "af803579fff33b5e316911dc121155eb553434eec287816287bbd86b427b3f7f"
    hash11      = "7e5f9d362688f19111d3dbdf393d51e133fcc63eb7db27536cb31d1205ccc9e3"
    hash12      = "5b883334540a4216b3582d1f2fa0a27f21b9c64a87944c8e58d9fab0f609eef3"
    hash13      = "6565dca0eb9e0e467a96242f29a80c650cc40a8892572ce8c28bfd197ace7fd0"
    hash14      = "4d2799f014910856c25b225165971fbe59cf99c8eb1db930d774de46f64d76c2"
    hash15      = "ff8a171dec88d707916b1928e49d84c61474fe9b0faf2916e72eadb2b404d04b"
    hash16      = "345c67f8d573844507dfad7f05cf340f1a2bb19331e3e0d242c508445594aac6"
    hash17      = "b7087906f833cc4e256e80f75293dfea38a9cf9102994a76779be7198f94535b"
    hash18      = "3d2e8d0924bbdcf83eaa5ef9fde5baf8f4e12cf5c14d5f8ceb77a4c3e708abd3"
    hash19      = "3fe6572823305aa2316dd2ce562c85b9f6eb40f26ee354b5e0ff97b66cffd652"
    hash20      = "4154e4928eccd35fa0d42dbefe4a742700d77124216f8b5756b8ef63634071d3"
    hash21      = "f1ea05bc317ec861954db64b30bd293d8ee2f663106d48389d91cfb77247fb1e"
    hash22      = "2a06a7a374bfacf6c8c177295f8ab5c8e4e8db511406cc33fcef97866f72f9dc"
    hash23      = "542990d73514ef4ff7fb1540013f789833830036dc9c9c2ad8c49c1bdabb1f2a"
    hash24      = "b6935463e925cb13fc2413b3d7559cf8e9f5072c15dc73075977046a3e27e417"
    hash25      = "841abb0789337235f3a5367c6d4aa3806741a639f1faf0d54e41f125ecc1be02"
    hash26      = "e32ed831874bb280ae970e019573b598cf97788865b3fea13118546e435353f9"
    hash27      = "deabc297df80ed9899178f4a02c9538b2fe3ee2038528e07da89655f0d68b1a1"
    hash28      = "53ed2c9df290c888bf2af9ce5d017a8ed1c6b1bb1c82aa0376f1bc204aa27eb7"
    hash29      = "73bcfec2ac113640d73b2ea0f0c348d7bc7d672d6be74cb4398f8669b599694b"
    hash30      = "c85cab0d5b0c79fe38ee2b60c2ea7eca36bb7dbe9442cff0a497346184cecee8"
    hash31      = "da7f290c48869e8adc8a27e6344a762283ddaa55eae77000c5439a118d259a98"
    hash32      = "ff3bd7f3bb53e5b0bbfefd44c539b38a506a76e4dae03eaa91c64f99e34b846b"

  strings:
    $s1  = "Tn\";})(),(function f000(){return \"Qj\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})(),(functio" ascii
    $s2  = "0(){return \"RLk\";})(),(function f000(){return \"SGs\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj" ascii
    $s3  = "urn \"Tn\";})(),(function f000(){return \"RPt\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})(),(" ascii
    $s4  = "(),(function f000(){return \"GGn\";})(),(function f000(){return \"Qa\";})(),(function f000(){return \"Wb\";})(),(function f000()" ascii
    $s5  = "(function f000(){return \"ZGq\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})(),(function f000(){" ascii
    $s6  = ")(),(function f000(){return \"GGn\";})(),(function f000(){return \"Vj\";})(),(function f000(){return \"Yz\";})(),(function f000(" ascii
    $s7  = "return \"Wb\";})(),(function f000(){return \"Yi\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})()" ascii
    $s8  = "000(){return \"GGn\";})(),(function f000(){return \"Tb\";})(),(function f000(){return \"PTs\";})(),(function f000(){return \"NYh" ascii
    $s9  = "00(){return \"GGn\";})(),(function f000(){return \"KDh\";})(),(function f000(){return \"RLk\";})(),(function f000(){return \"BQb" ascii
    $s10 = "urn \"GGn\";})(),(function f000(){return \"Nv\";})(),(function f000(){return \"Yv\";})(),(function f000(){return \"Wb\";})(),(fu" ascii
    $s11 = "function f000(){return \"UEg\";})(),(function f000(){return \"Wy\";})(),(function f000(){return \"UEg\";})(),(function f000(){re" ascii
    $s12 = "on f000(){return \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Tb\";})(),(function f000(){return \"" ascii
    $s13 = "r\";})(),(function f000(){return \"Iq\";})(),(function f000(){return \"BQb\";})(),(function f000(){return \"Oe\";})(),(function " ascii
    $s14 = "n f000(){return \"Br\";})(),(function f000(){return \"MBb\";})(),(function f000(){return \"Rh\";})(),(function f000(){return \"T" ascii
    $s15 = " f000(){return \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Nv\";})(),(function f000(){return \"NB" ascii
    $s16 = "nction f000(){return \"PTs\";})(),(function f000(){return \"Qa\";})(),(function f000(){return \"DYx\";})(),(function f000(){retu" ascii
    $s17 = "n \"ZFe\";})(),(function f000(){return \"ZIi\";})(),(function f000(){return \"NBs\";})(),(function f000(){return \"GGn\";})(),(f" ascii
    $s18 = "),(function f000(){return \"GGn\";})(),(function f000(){return \"Qa\";})(),(function f000(){return \"SEo\";})(),(function f000()" ascii
    $s19 = "(){return \"GGn\";})(),(function f000(){return \"MMz\";})(),(function f000(){return \"Um\";})(),(function f000(){return \"Mt\";}" ascii
    $s20 = "){return \"Br\";})(),(function f000(){return \"NBs\";})(),(function f000(){return \"Wy\";})(),(function f000(){return \"Br\";})(" ascii

  condition:
    (uint16(0) == 0x2f0a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c87810a3-b41f-4a56-b0fc-025e12ac1d10

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion