_20160921_05de6ed1bba9a99cad4c92bf9ce97005_20160921_06311313c2c9_711
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_05de6ed1bba9a99cad4c92bf9ce97005.js, 20160921_06311313c2c91f30b188be9b0f27e37d.js, 20160921_13c992e435ed245b1977cea0df2db815.js, 20160921_13e37e5857b4357c4b5f40a021143101.js, 20160921_18cdf3dec8ac4b7697e775bc56ddeba9.js, 20160921_1c5a439961f0eccee5312fdbb892fb0e.js, 20160921_22785a85892e6eb0dbe789a8a528129f.js, 20160921_29976a5f68bbdfe415494e838aef0c3a.js, 20160921_2a4c1d98d0b8022ca5527a8e6d96e6e7.js, 20160921_37b7533d4596284ad0b05a77fca64e04.js, 20160921_3a185c9392a67b927e245520858a0afc.js, 20160921_3b3df29e27c35ab2e50a3446fa67bf66.js, 20160921_3ca43590701fad2cb827b5edf3989d00.js, 20160921_4319d62667a3ba06f88c6ba9123c871b.js, 20160921_4a2d69f96df0dd4c57fda9e63c804950.js, 20160921_4b801afbcd9818be02d65ee0ac30ad19.js, 20160921_527d7c3756974f804734da343b6b6f0e.js, 20160921_53ea150fd63a4ef657412c858a71a13e.js, 20160921_5541f4e80ad2d4f163ebcd0e8c899e59.js, 20160921_5775da34d70f97a2d7aa3296f909af35.js, 20160921_5d475fd55c4e461509ccd87876cf56f7.js, 20160921_619a314e9bcca286c046dff250b54b6b.js, 20160921_68596411289b2d10a74a19f9fce4a325.js, 20160921_6ad2178e7d047e60c71f9fe1ca457b74.js, 20160921_77c9e00128c9a883c23909fbb2c12569.js, 20160921_7ffe38e0972c323071684bfa98cafbdf.js, 20160921_802181e3d75c3e2d045cebba97849683.js, 20160921_80e6ac924bf190eef40e43ba5d57f11b.js, 20160921_814eb57aeffc75442964829345cc9f96.js, 20160921_87f13d652177c2ccba1196dd341efb6d.js, 20160921_89a260f4d6da4d97f251f843cf5e94b0.js, 20160921_8c33029db61426a234eddfae1623641b.js, 20160921_939d60f07d4171a5bae4c0b4ca33f3d9.js, 20160921_93e612a2f44e1198dfe3c296cb4f7b79.js, 20160921_97fcc16be1aae58b311e71df667be641.js, 20160921_98f234a378a6dd4e51c1730a4a700647.js, 20160921_9aa040f4b657816cc001fcf9a33be586.js, 20160921_acebc8ac4559526a5a8de801968bd19f.js, 20160921_b86272ed73cef9077c204056df823014.js, 20160921_ba8a9f239804499b5d1d2a06a862c1ca.js, 20160921_cab66b13ccb843c90a2a068a082cd4ec.js, 20160921_cb6c4de61b30cd204129d0942321058c.js, 20160921_cf2bd9606d396ba99f8174f1946c8590.js, 20160921_d4a195112732d8d5ebb1bdc900a52d50.js, 20160921_d53637406b068b7f313912a4769e371e.js, 20160921_d7492227e681b1689bfc5442a91a169e.js, 20160921_d74d6a32efd0c1fd568c81769c75b5f0.js, 20160921_e0f34764de4fcb908eef371ab4011f31.js, 20160921_ee1327bdf201e62d1f7ae5482cabbd90.js, 20160922_2bdee31da941689170d6b7da303eeff6.js, 20160922_51694f0251fa3f1d7267b3d7973d4097.js, 20160922_92c62e47426236a3598469915ee3dcfe.js, 20160922_9d6af27348126e594fbe29c3cf568591.js, 20160922_abb8cfe456777bb23f3253a5921340d2.js
rule _20160921_05de6ed1bba9a99cad4c92bf9ce97005_20160921_06311313c2c9_711 {
meta:
description = "datamaliciousorder - from files 20160921_05de6ed1bba9a99cad4c92bf9ce97005.js, 20160921_06311313c2c91f30b188be9b0f27e37d.js, 20160921_13c992e435ed245b1977cea0df2db815.js, 20160921_13e37e5857b4357c4b5f40a021143101.js, 20160921_18cdf3dec8ac4b7697e775bc56ddeba9.js, 20160921_1c5a439961f0eccee5312fdbb892fb0e.js, 20160921_22785a85892e6eb0dbe789a8a528129f.js, 20160921_29976a5f68bbdfe415494e838aef0c3a.js, 20160921_2a4c1d98d0b8022ca5527a8e6d96e6e7.js, 20160921_37b7533d4596284ad0b05a77fca64e04.js, 20160921_3a185c9392a67b927e245520858a0afc.js, 20160921_3b3df29e27c35ab2e50a3446fa67bf66.js, 20160921_3ca43590701fad2cb827b5edf3989d00.js, 20160921_4319d62667a3ba06f88c6ba9123c871b.js, 20160921_4a2d69f96df0dd4c57fda9e63c804950.js, 20160921_4b801afbcd9818be02d65ee0ac30ad19.js, 20160921_527d7c3756974f804734da343b6b6f0e.js, 20160921_53ea150fd63a4ef657412c858a71a13e.js, 20160921_5541f4e80ad2d4f163ebcd0e8c899e59.js, 20160921_5775da34d70f97a2d7aa3296f909af35.js, 20160921_5d475fd55c4e461509ccd87876cf56f7.js, 20160921_619a314e9bcca286c046dff250b54b6b.js, 20160921_68596411289b2d10a74a19f9fce4a325.js, 20160921_6ad2178e7d047e60c71f9fe1ca457b74.js, 20160921_77c9e00128c9a883c23909fbb2c12569.js, 20160921_7ffe38e0972c323071684bfa98cafbdf.js, 20160921_802181e3d75c3e2d045cebba97849683.js, 20160921_80e6ac924bf190eef40e43ba5d57f11b.js, 20160921_814eb57aeffc75442964829345cc9f96.js, 20160921_87f13d652177c2ccba1196dd341efb6d.js, 20160921_89a260f4d6da4d97f251f843cf5e94b0.js, 20160921_8c33029db61426a234eddfae1623641b.js, 20160921_939d60f07d4171a5bae4c0b4ca33f3d9.js, 20160921_93e612a2f44e1198dfe3c296cb4f7b79.js, 20160921_97fcc16be1aae58b311e71df667be641.js, 20160921_98f234a378a6dd4e51c1730a4a700647.js, 20160921_9aa040f4b657816cc001fcf9a33be586.js, 20160921_acebc8ac4559526a5a8de801968bd19f.js, 20160921_b86272ed73cef9077c204056df823014.js, 20160921_ba8a9f239804499b5d1d2a06a862c1ca.js, 20160921_cab66b13ccb843c90a2a068a082cd4ec.js, 20160921_cb6c4de61b30cd204129d0942321058c.js, 20160921_cf2bd9606d396ba99f8174f1946c8590.js, 20160921_d4a195112732d8d5ebb1bdc900a52d50.js, 20160921_d53637406b068b7f313912a4769e371e.js, 20160921_d7492227e681b1689bfc5442a91a169e.js, 20160921_d74d6a32efd0c1fd568c81769c75b5f0.js, 20160921_e0f34764de4fcb908eef371ab4011f31.js, 20160921_ee1327bdf201e62d1f7ae5482cabbd90.js, 20160922_2bdee31da941689170d6b7da303eeff6.js, 20160922_51694f0251fa3f1d7267b3d7973d4097.js, 20160922_92c62e47426236a3598469915ee3dcfe.js, 20160922_9d6af27348126e594fbe29c3cf568591.js, 20160922_abb8cfe456777bb23f3253a5921340d2.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "cc9a1bb338cbe502eae2d8092d1b4369f9be8a107f4db340bf51a1640991e960"
hash2 = "2e8ad2d8de7bc2cc77c2b00b8eeb4fd7976cd68790eeb4b6bfd14ad188696ed0"
hash3 = "289da9cff140ea3b4e35a1aa721314733c057d085ff9e8b5fc3ed7e10f75341b"
hash4 = "bd94ae3a0c3b8dadcaba65cdd5f58ebd19d616ac5679af1b7891e5bf26889265"
hash5 = "1a1aa090c906360f52952b29d512b8c450c7e8c8cff28bc6fded6af15377b37c"
hash6 = "3fbb744f5c370c0fc7398db52f2d758d4ee9e8aaf91430daa5c6bada9598710f"
hash7 = "3bd9f1cc39c45e7b6963f5eca04b26ef2eaf9c8005e5a0d5f12e868261ae58ca"
hash8 = "218bc62c15296caf93128e0a5e06fde374e19fd4150b6c9b1def4d962554ef39"
hash9 = "65be7c1c5efef8255d7094d95251c12de72303024061cff2152d54a244a049f0"
hash10 = "61b41be208c77057ce2b56a866ae0e936c6372d0c3a92f126a1cf5090fe0a5e7"
hash11 = "a5201f237db515e70a3934feb4ff64c4cccf728f340d6e9e46fbe4217f988165"
hash12 = "dd15d322a8169ff9edb922ead245c93109f14c5fa4f31811eb58601888323ad2"
hash13 = "ef7c5701a8646e7803463e9a01e4f2e45cd535f2ed7174e97abde991a779b665"
hash14 = "33e5babd254cb93078c026ebb6beb245e487651597122eb576cf5b870dfbf8ee"
hash15 = "786d4a5233f100c1ba7f5e820c46309247158a45ed43bd58795f05152dbaecf6"
hash16 = "f85dba2504097034fa23d87391ecdaf7fe5f29824616a8d91d353284964bfac1"
hash17 = "7d2dd725d314277b3b7cf1c94ae8894dce1d36430ff22819c2fecb47f14c3f43"
hash18 = "16ac7affa46e10764a6e40de21c545ac275939c77c4acf142df8e3f848362242"
hash19 = "615edf37483855ab2b78dd87e38795245913e5fc6efc9bc47d9e698132792739"
hash20 = "270e1d840937d10ac3eb1fdd04f0fbbbfd31a88a2f316c94c5167a23a2940644"
hash21 = "dc4e4001f0f2e1f28098f6ad190b918a7ffe075d590fb142a508fdad546d9816"
hash22 = "9f370548310908c52102d40d56781574ad404eafca7ac832d5e52d48f722bff5"
hash23 = "52b104c52d9f1461833687ee9fc5da1913610266114cbc0018bf345ee135d662"
hash24 = "2e126f3a35c3e15739f44a3b15bf991678bc6c232e213be738a2521187bf8173"
hash25 = "95544bd07dbc8b2550e3a6bb328d49a808c8749bb3ced90cbb8f5f90782625a1"
hash26 = "4bc751383d4c72f88b3f59d9fde1f38f09a81b77ee4df0498bec1df7cd088bc7"
hash27 = "ab42f16384f05ce6299f1ffd60f980af6ecf1fa2d23befc951797d1d52915400"
hash28 = "e240b858e2fac9be9a3fc0f8611c4c05e6f217dd1e13ac43649aa6d7597ee450"
hash29 = "2736df4d651a33824aba7abffa7c08414414ffed9f5f27b4b2d81101cfeb7117"
hash30 = "52cce778f06a6477b6f4a6a9f48328a81d874164235533c2925fdd358b6279c3"
hash31 = "700f6c802eb024896efe2b22255973b53752a8f129213c9bba2c4f2ebdc53988"
hash32 = "8a7c2a5271a5dc64c200145fa7252ff19d736174b3556eb436f9ac8941daec71"
hash33 = "c23bfef986de7a073bbcd781aa45ad15287fb2c448d110b92a01e652f22ff335"
hash34 = "e88aa94cf06df033312260c4a58f453654133758e66e1d2df4f11f9de9bfec7c"
hash35 = "2459214bba37a40478bc984d75c7b1ababcbf0d17eeabe32578555058bdac21f"
hash36 = "67d0e50d586bb8bcc6b12ccab848f1a72b3a329ddaa0c7f45ea3661082887c8d"
hash37 = "06edaae6cd03c231dca115449fcaf6955b5f70df34983f02383296a412f73538"
hash38 = "79fe55ec3d2d6dbd854df9676c4565b6a8410e1d94298c2ff2f112036fcfac73"
hash39 = "c639defcc03ef60ba09f66ea7a3067f4493b67650049d4d5576fb24d05a2ec25"
hash40 = "4ab28724a794acc5764f2e51f93d2b91ef9513b43e4cb9b0d10bad2710c2e6d7"
hash41 = "ce3b033b39aaca0b7c9abd0fc5eeb09d24d7096d0a399cebd99f7bd8d574f0d1"
hash42 = "db98233c2508e4a2167ee46a334ce9052faa726615e89838f4fdb36b74fc5353"
hash43 = "c5afd84ebe18fa55c764dd8e7349bc7b9cd8b10ab8d94500cbf7f62bd741c00d"
hash44 = "679537ccc73765d47769657cc000499c86fa227678df5b0d4690ca0e2cf6325c"
hash45 = "cafcf490b9e4364e16ee46f82e53896038b46a0b37f3fd7a33a363316965b400"
hash46 = "63aa129680edf69c72e8f077be5e8562f041fa0b0c7e63a8a9b219c23749b135"
hash47 = "eeb2c0427dff61d2dceedf890b96f76da6a37634fefa03079a481c476d7a3547"
hash48 = "de457f8d789ffcd672900ad06037697526230f620a01d113732fa3683b1604b1"
hash49 = "91500ac726f9d2548dffc99162aeece9863dc7b928106d27a769e6bbf9439f81"
hash50 = "70ee088e40fb9f7bd2cc1514b94af7f28ef9fd68444cdbd3859858840ae0e498"
hash51 = "c424926fb99cca3faf3dda68a4860b770a7f0467803b01fbdf54011c52f56a99"
hash52 = "d6b6eb713cecae41143fb04e090a4809564a1837f49e53a84e27f0d3b0885df7"
hash53 = "3634189c93f3a76e0a4df72e631f0715b4b71427c157ca5fe116252ca00f1d9b"
hash54 = "658f6872a894eb9bcb193b7bf73260e92d4627036eede588553b81333dcf0c30"
strings:
$s1 = "eturn \"Oe\";})(),(function f000(){return \"Yz\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"GGn\";})(),(" ascii
$s2 = "n \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Qa\";})(),(function f000(){return \"Br\";})(),(func" ascii
$s3 = " \"Tn\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Yv\";})(),(function f000(){return \"Yv\";})(),(funct" ascii
$s4 = "turn \"SEo\";})(),(function f000(){return \"Ml\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"GGn\";})(),(" ascii
$s5 = "ion f000(){return \"Tn\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Tb\";})(),(function f000(){return " ascii
$s6 = "eturn \"DYx\";})(),(function f000(){return \"UEg\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"GGn\";})()" ascii
$s7 = " f000(){return \"KDh\";})(),(function f000(){return \"Nx\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"W" ascii
$s8 = "on f000(){return \"GGn\";})(),(function f000(){return \"MBb\";})(),(function f000(){return \"Wy\";})(),(function f000(){return " ascii
$s9 = "})(),(function f000(){return \"Yv\";})(),(function f000(){return \"Qj\";})(),(function f000(){return \"Vj\";})(),(function f000(" ascii
$s10 = "\"MJq\";})(),(function f000(){return \"Vj\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})(),(func" ascii
$s11 = "})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"PTi\";})(),(function f00" ascii
$s12 = "\"Wb\";})(),(function f000(){return \"RLk\";})(),(function f000(){return \"Mc\";})(),(function f000(){return \"GGn\";})(),(funct" ascii
$s13 = "0(){return \"Qa\";})(),(function f000(){return \"RLk\";})(),(function f000(){return \"Tn\";})(),(function f000(){return \"TKl\";" ascii
$s14 = ",(function f000(){return \"IPu\";})(),(function f000(){return \"Wy\";})(),(function f000(){return \"Km\";})(),(function f000(){r" ascii
$s15 = "r\";})(),(function f000(){return \"Oe\";})(),(function f000(){return \"NBs\";})(),(function f000(){return \"Wy\";})(),(function " ascii
$s16 = "n \"YTp\";})(),(function f000(){return \"Oe\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"GGn\";})(),(fun" ascii
$s17 = ",(function f000(){return \"Km\";})(),(function f000(){return \"Yz\";})(),(function f000(){return \"Tn\";})(),(function f000(){re" ascii
$s18 = ")(),(function f000(){return \"GGn\";})(),(function f000(){return \"IAa\";})(),(function f000(){return \"Go\";})(),(function f000" ascii
$s19 = "{return \"Tn\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"HJm\";})(),(function f000(){return \"SGs\";})" ascii
$s20 = "rn \"Um\";})(),(function f000(){return \"SGs\";})(),(function f000(){return \"TKl\";})(),(function f000(){return \"GGn\";})(),(f" ascii
condition:
(uint16(0) == 0x2f0a and (8 of them)
) or (all of them)
}