_20160919_057232377f42e6e167d197013eebf706_20160919_08da5c3f02c2_720

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160919_057232377f42e6e167d197013eebf706.js, 20160919_08da5c3f02c211aec73ba0c6550a2c72.js, 20160919_1022ebb2685a682cd0d2aa92e67c9157.js, 20160919_1361742f56de46e27928f34168876f49.js, 20160919_1801d05ea9bcc0cbb8095a281170d0dc.js, 20160919_1c398fa43d8e209834ef3f40c8353a38.js, 20160919_1e12599949555cc74ad5a8b12bfb528f.js, 20160919_23fc1dd90a615180b363e53bb6568c34.js, 20160919_242b6320da119ce3fa9eeae1e7d821ff.js, 20160919_2d222dd307f0569e6e5ac6f51152f81a.js, 20160919_3ac87cc6ab6df6e1dd2cbf1179f7db59.js, 20160919_3d47f3bfbdabe2c053cdc9d1a105d739.js, 20160919_4126da1c7382bc6c25bfd1ba73d0fc53.js, 20160919_429db6c8fe5253cfd5107009f0795c69.js, 20160919_44471b0fe34fd99bfd93a2e2dd6a07b7.js, 20160919_461872674d35df70c7a8b4bf902215d3.js, 20160919_4d381bf0fe7f385d7c76ae000edb6b80.js, 20160919_4d767b0c30f73c81af0da55d2f9f80eb.js, 20160919_4f9510c7aba6fb2ffb6eec1ee7663456.js, 20160919_5e5d563da255975086a816a47d657caa.js, 20160919_6944c112d7fd4661bd19db71139e654e.js, 20160919_77865ef9c039be96227fcae2b1dea4a3.js, 20160919_7fe15291ca6d75c2bfaf3ed337a77853.js, 20160919_8633293b763bc98ce3d1d90c1a5c9957.js, 20160919_873c90f6785e7a310a17a10a348625a6.js, 20160919_87e749fa1e51632d69df0a2da981d2bb.js, 20160919_8de3212cab7b9109321152a1a01ff1fb.js, 20160919_8e19038581ccf1588b705a2f4f91d696.js, 20160919_90cb46d46ac3198dae128f363ce89a70.js, 20160919_93b80c294fb64bac1e2a2d64e4dab410.js, 20160919_9542146e845392a007037066b6a57451.js, 20160919_97c5d07a254bc20b5e70700b911a766b.js, 20160919_995368ab4d4e55d1f6150e5deb633879.js, 20160919_a3c393451a2ddb026a76c999e1ea35e3.js, 20160919_a47b9fc59996500989d4622f3f67d39f.js, 20160919_a60d0e15001d3e9d9de009139e6208bd.js, 20160919_ac4eaf6498451b618ff95a91c6e6a780.js, 20160919_ad0c8e3ae86b61cc425bd3181244f5d8.js, 20160919_b0ae99402cc5ba52e7b2d45eac41e5d0.js, 20160919_b93cab14b2d27ccc19e96c48434dad21.js, 20160919_bb19d20c8fa3c5348af32169d43bf7ed.js, 20160919_bdb0ef4924c7f54cf0a4f6b3a555a55b.js, 20160919_bdfc31bc0619cd0e266112758684c79e.js, 20160919_bf5fd630039b52e37636030cc16baf56.js, 20160919_c3c0ea257445c7802a2bf92534b8518a.js, 20160919_c9f6c28aa7daed8753582e0013c15249.js, 20160919_d043edd6ea52a8fdfadc469c1ac1c2f7.js, 20160919_d1fd4897c2ad5d4eca6a633838a7d616.js, 20160919_d2f23e9f709a3aa357cad830de21d0d0.js, 20160919_d3bcc0a71284e003d2810555f658b9fe.js, 20160919_d5c2c5139c5ae6cecef264726a56ed9e.js, 20160919_d894583fb6190e7e1ba569fcfcc36591.js, 20160919_e0bcde6a5e8d40fe327241c87ac7f5af.js, 20160919_e6c7ca89a75a519b6fc84f1f9db80979.js, 20160919_ed1bc5f58cfe90f11fa00a2b88a0f817.js, 20160919_fccf35cfa4f2896b1622ee53f368fe31.js

rule _20160919_057232377f42e6e167d197013eebf706_20160919_08da5c3f02c2_720 {
  meta:
    description = "datamaliciousorder - from files 20160919_057232377f42e6e167d197013eebf706.js, 20160919_08da5c3f02c211aec73ba0c6550a2c72.js, 20160919_1022ebb2685a682cd0d2aa92e67c9157.js, 20160919_1361742f56de46e27928f34168876f49.js, 20160919_1801d05ea9bcc0cbb8095a281170d0dc.js, 20160919_1c398fa43d8e209834ef3f40c8353a38.js, 20160919_1e12599949555cc74ad5a8b12bfb528f.js, 20160919_23fc1dd90a615180b363e53bb6568c34.js, 20160919_242b6320da119ce3fa9eeae1e7d821ff.js, 20160919_2d222dd307f0569e6e5ac6f51152f81a.js, 20160919_3ac87cc6ab6df6e1dd2cbf1179f7db59.js, 20160919_3d47f3bfbdabe2c053cdc9d1a105d739.js, 20160919_4126da1c7382bc6c25bfd1ba73d0fc53.js, 20160919_429db6c8fe5253cfd5107009f0795c69.js, 20160919_44471b0fe34fd99bfd93a2e2dd6a07b7.js, 20160919_461872674d35df70c7a8b4bf902215d3.js, 20160919_4d381bf0fe7f385d7c76ae000edb6b80.js, 20160919_4d767b0c30f73c81af0da55d2f9f80eb.js, 20160919_4f9510c7aba6fb2ffb6eec1ee7663456.js, 20160919_5e5d563da255975086a816a47d657caa.js, 20160919_6944c112d7fd4661bd19db71139e654e.js, 20160919_77865ef9c039be96227fcae2b1dea4a3.js, 20160919_7fe15291ca6d75c2bfaf3ed337a77853.js, 20160919_8633293b763bc98ce3d1d90c1a5c9957.js, 20160919_873c90f6785e7a310a17a10a348625a6.js, 20160919_87e749fa1e51632d69df0a2da981d2bb.js, 20160919_8de3212cab7b9109321152a1a01ff1fb.js, 20160919_8e19038581ccf1588b705a2f4f91d696.js, 20160919_90cb46d46ac3198dae128f363ce89a70.js, 20160919_93b80c294fb64bac1e2a2d64e4dab410.js, 20160919_9542146e845392a007037066b6a57451.js, 20160919_97c5d07a254bc20b5e70700b911a766b.js, 20160919_995368ab4d4e55d1f6150e5deb633879.js, 20160919_a3c393451a2ddb026a76c999e1ea35e3.js, 20160919_a47b9fc59996500989d4622f3f67d39f.js, 20160919_a60d0e15001d3e9d9de009139e6208bd.js, 20160919_ac4eaf6498451b618ff95a91c6e6a780.js, 20160919_ad0c8e3ae86b61cc425bd3181244f5d8.js, 20160919_b0ae99402cc5ba52e7b2d45eac41e5d0.js, 20160919_b93cab14b2d27ccc19e96c48434dad21.js, 20160919_bb19d20c8fa3c5348af32169d43bf7ed.js, 20160919_bdb0ef4924c7f54cf0a4f6b3a555a55b.js, 20160919_bdfc31bc0619cd0e266112758684c79e.js, 20160919_bf5fd630039b52e37636030cc16baf56.js, 20160919_c3c0ea257445c7802a2bf92534b8518a.js, 20160919_c9f6c28aa7daed8753582e0013c15249.js, 20160919_d043edd6ea52a8fdfadc469c1ac1c2f7.js, 20160919_d1fd4897c2ad5d4eca6a633838a7d616.js, 20160919_d2f23e9f709a3aa357cad830de21d0d0.js, 20160919_d3bcc0a71284e003d2810555f658b9fe.js, 20160919_d5c2c5139c5ae6cecef264726a56ed9e.js, 20160919_d894583fb6190e7e1ba569fcfcc36591.js, 20160919_e0bcde6a5e8d40fe327241c87ac7f5af.js, 20160919_e6c7ca89a75a519b6fc84f1f9db80979.js, 20160919_ed1bc5f58cfe90f11fa00a2b88a0f817.js, 20160919_fccf35cfa4f2896b1622ee53f368fe31.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "342063f3bff5be6bfdd4fd4472a30f53336cc59405f343882b33f92cdddbdd9f"
    hash2       = "6186b245c2fd248686001d19917456ac29e19b296258b2654ad159d07baf1aba"
    hash3       = "ab6a6416df941dc29695876ac0d88510c4701e1989c338aba5ba2cdb03e1089c"
    hash4       = "bfb501a6ff384ee4bf1774362f7ddc4b121d152a47dd79298be75d06d38c8a9a"
    hash5       = "889873de56384aa35c8ab4618bf921076d09d6fdbc5cab049515fd5e9d464340"
    hash6       = "394ad27de43ca95b273198fb9eb1a716582d2c6d1cddbe7d8913c3e16b71d4a6"
    hash7       = "bd224de2f2ae89b5a4a09537337a088f3505790cc05f77bed8007e9cc8bebf03"
    hash8       = "9cdc37fac3d75740d2025e87bc22f56db646b602880c1de178b9e01094db8888"
    hash9       = "bc8d480de9c11545768d86486731161ed430e947e1ff097222d31acd5543e625"
    hash10      = "2cd1a7843084a9b7cf9bf134c0d4d336dc37440f364cb29939b065a0717f7386"
    hash11      = "fb795bf562b7c699914d8a2e9b5e58ee68dcb01a44d08c771c7ae25f0d32a875"
    hash12      = "eb6ff032a27e0dfe1bcb49ace1ec05c491cef65453ec1d45cb6a8c3dafccdc5a"
    hash13      = "53b3245dba8078c7a7214f8f1a876eb365e91d772aa49d6dcddae860e16a3ebb"
    hash14      = "3e55fac079aa2c9ffcb98f1c76e4ba8bb15b49a18324ae56743a861dcb37f9b5"
    hash15      = "f0763cff32551940570e103990c28edcb5c368921fa0a6b48678b9f34af9bdc2"
    hash16      = "c76b26558e3ca87ba5e8085034a960ba41fc0e26d2f00fb143dfe0ef1782a3cc"
    hash17      = "7aa91b3071ac866908b0c15123b07a8b8a2e6a1168780730f13a5023bc5ef747"
    hash18      = "463c8d973bd086a9f6153a08790883dde03666dae2d5008af1972a78dc5b0e3e"
    hash19      = "8645aae14874c6300d3f88ea55d49e12deb76a1e00c5dfa7202b0e58e913471e"
    hash20      = "9baedb2ec11f4d5ace069995d76eb7b56a378c9a102b0fbb1cbe8cc1b2076493"
    hash21      = "96aa2e4aba7fa9378b0ed602e5d961466298f82bb699bd7b9090812af0d28d3f"
    hash22      = "5dd0edcf3a96078de74855a3a691763a4abb13cfe856c4220c9e29a1098728dc"
    hash23      = "72fa4aa010d4ae95210d0a6c5834b924d6d345c0e7fcc4bed85ae38b1b01ce2d"
    hash24      = "93ab92a9979f8aee439dff3a95a1cbdbd6d1ce0dea617ce47ca50454401794f2"
    hash25      = "0683604365a9354ff3ce262d27ab6aca830ba4a4a98bbdea5558be4dd62d4ae7"
    hash26      = "43b5046c03c85067797304fd0509bbc532880bf0b361292bf9de2c77acb12090"
    hash27      = "2f4b1ee654b7c0ad2eadb17d6dd135a7435e26eb54045781a0d422406e257d48"
    hash28      = "583f4243b90da236942b96aa378eb4be2c8564d50696c973e001f6a543110e10"
    hash29      = "570820896da7aeb4a61547fdb0683463689e162e5e98c6c7876211b7abbd8c8f"
    hash30      = "c068337d64257ead73fe292c5e84c10597dfb40006351f5900069e70c1e78627"
    hash31      = "5e3542d3bd5f9b10da7b84c8e114602716897ee091dcd7c38e865cc162698fae"
    hash32      = "a3bf0f71a5937d74a2a1159419e249aae6c99bea427946fbadb8506239ab4858"
    hash33      = "48c119e4f842f71cc77d104d052b187a0800535ce2b4925b9c4f9421ad687a9c"
    hash34      = "255b81f67b8f79a1c1522731a5e6de6ba4b78297b1998e124b9c2a3b23080a8b"
    hash35      = "c01248b4061c89224351637ebfb5b2339d58ecb0eaf0908b5354650b4b55c0f4"
    hash36      = "ffdb4ce722c92b055012beb79138a6b22fbabb5d52f9b2689cc74ff855663b66"
    hash37      = "14542eee19f3c74d14d588db7ffa83c2b5bc18e8c36ff1dccbaad3d335bb0a88"
    hash38      = "6fc3d2fa95786ed69714c83614defb36453ab4118b459f00dda4ad0a48aaedb4"
    hash39      = "3dc383282615b426b49e0ea0c3094102238cceb9e81b425dbb0748c04c8cefad"
    hash40      = "a9dfae867eb74a22b30f6433bd5e220627ea835321ea6dda5af7450e27f646df"
    hash41      = "541a30f174188877b5d4d780c365fd9b2a0288eaec2b58f0075b5c3b77758751"
    hash42      = "a2188ade7fbdb5c48940efc4bdeaab271a96830d93fa96ead72946a25f4ae382"
    hash43      = "a67fb76c27994cb1a16b679887453b3a3775d82453a33e0f2c243207fead7087"
    hash44      = "819f681f5206008fae6f7e2b8554dcb5553d76e09d419ae249f00f2af67272f2"
    hash45      = "2fed4674b3c3c0068a900bec01ef58a8c01ce208517d0a737ce8e623ce16fdaf"
    hash46      = "2cbede935e4201adb70ce0aa564edc5f072ca336b6638e1efc3555cf558224cd"
    hash47      = "ad467cac28b725687f40b92d5a9b24be3693639512d0c42fb9e7b42e06ffbff2"
    hash48      = "261f403fc6a7d820ea4adaa1cc4e03fb673bf2719a8f8e3a8aa140e1620b78ac"
    hash49      = "b960e074abc289cc6b67186ce63c352063928de86c94f9ddf316225adb0573f3"
    hash50      = "01faf56eccb8025c4027c4349699014d4800e6970f3d441cda9f75c19b7dc920"
    hash51      = "2366a8a07ffab0ee9c823f8a527fda7aa2483461f3a58405e05afbb7ce01188c"
    hash52      = "784b19edb42a843ce2e2c39e367a326ecc079781138d056e2ee635e5755bf614"
    hash53      = "886681e11912a6d0977f068be8817e4a94b353e2a6a4ca3ee96b7307160a4ae7"
    hash54      = "2bebe9880fcfa875fdbff02cfbaffd1b3f042a4b0019106c1aae7858d04486cf"
    hash55      = "3a1ef513764e7b6b615c3f2a2c02136402c0ff915bf313f56c13225c7a4affe9"
    hash56      = "f1e5829fe0e2883a32e833886863a75e04a658638bc66e46b46ead945695e85f"

  strings:
    $s1  = " [3, [4, (function avast(){return \"\\x4b\";})()]], \"Ru\": [3, [4, (function avast(){return \"\\x4c\";})()]], \"Yn\": [3, [4, (" ascii
    $s2  = "eturn \"\\x44\";})()]], \"XZg\": [3, [4, (function avast(){return \"\\x45\";})()]], \"Ff\": [3, [4, (function avast(){return \"" ascii
    $s3  = "return \"\\x5b\";})()]], \"RAp\": [3, [4, (function avast(){return \"\\x5a\";})()]]};" fullword ascii
    $s4  = "ast(){return \"\\x74\";})()]], \"Eb\": [3, [4, (function avast(){return \"\\x77\";})()]], \"BZq\": [3, [4, (function avast(){ret" ascii
    $s5  = "unction avast(){return \"\\x41\";})()]], \"GBs\": [3, [4, (function avast(){return \"\\x42\";})()]], \"CRm\": [3, [4, (function " ascii
    $s6  = "var QDu = {\"QEh\": [3, [4, (function avast(){return \"\\x6b\";})()]], \"Dp\": [3, [4, (function avast(){return \"\\x79\";})()]]" ascii
    $s7  = "n \"\\x53\";})()]], \"Mt\": [3, [4, (function avast(){return \"\\x52\";})()]], \"Vp\": [3, [4, (function avast(){return \"\\x51" ascii
    $s8  = "ction avast(){return \"\\x55\";})()]], \"Yh\": [3, [4, (function avast(){return \"\\x54\";})()]], \"YUn\": [3, [4, (function ava" ascii
    $s9  = " [4, (function avast(){return \"6\";})()]], \"SIk\": [3, [4, (function avast(){return \"8\";})()]], \"PNu\": [3, [4, (function a" ascii
    $s10 = "t(){return \"0\";})()]], \"Fy\": [3, [4, (function avast(){return \"4\";})()]], \"FGm\": [3, [4, (function avast(){return \"\\x0" ascii
    $s11 = "ction avast(){return \"\\x4d\";})()]], \"Dp0\": [3, [4, (function avast(){return \"\\x4e\";})()]], \"Lz\": [3, [4, (function ava" ascii
    $s12 = "\";})()]], \"Pc\": [3, [4, (function avast(){return \"\\x3e\";})()]], \"Uj\": [3, [4, (function avast(){return \"\\x3d\";})()]]," ascii
    $s13 = " \"DLy\": [3, [4, (function avast(){return \"\\x0d\";})()]], \"Jb\": [3, [4, (function avast(){return \"\\x09\";})()]], \"Ih\": " ascii
    $s14 = "vast(){return \"\\x3a\";})()]], \"Ph\": [3, [4, (function avast(){return \"\\x3c\";})()]], \"JKw\": [3, [4, (function avast(){re" ascii
    $s15 = "turn \"\\x43\";})()]], \"Xh\": [3, [4, (function avast(){return \"\\x48\";})()]], \"VIs\": [3, [4, (function avast(){return \"" ascii
    $s16 = "n \"\\x4f\";})()]], \"Lp\": [3, [4, (function avast(){return \"2\";})()]], \"FDr\": [3, [4, (function avast(){return \"\\x4a\";}" ascii
    $s17 = ", \"Jz\": [3, [4, (function avast(){return \"\\x47\";})()]], \"JWk\": [3, [4, (function avast(){return \"\\x40\";})()]], \"WTd\"" ascii
    $s18 = " [3, [4, (function avast(){return \"\\x6d\";})()]], \"QFk\": [3, [4, (function avast(){return \"\\x6e\";})()]], \"ITe\": [3, [4," ascii
    $s19 = " \"Hn\": [3, [4, (function avast(){return \"\\x57\";})()]], \"NPd\": [3, [4, (function avast(){return \"\\x56\";})()]], \"Zp\": " ascii
    $s20 = "var QDu = {\"QEh\": [3, [4, (function avast(){return \"\\x6b\";})()]], \"Dp\": [3, [4, (function avast(){return \"\\x79\";})()]]" ascii

  condition:
    (uint16(0) == 0x0a0a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

75a50b16-b39a-4e61-b4f8-74324c373e5e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion