_20160915_1640a9e8ea85b02afd0189ad6b2629fe_20160915_16d1b5ce0ad6_735

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160915_1640a9e8ea85b02afd0189ad6b2629fe.js, 20160915_16d1b5ce0ad6a61c76ff1c167b18f3a2.js, 20160915_1aeca8bcf04139f2c80b16ac963db9ee.js, 20160915_1ee058aa65dc0b7a29b9c23730001f89.js, 20160915_24e9980fafa2f9f63b54be0c8dcafc6e.js, 20160915_3fd880313f1ad3d4d8a3dab675f2c2d4.js, 20160915_4f81db1262c66f30c8827188c2a63a19.js, 20160915_511b76f3e522ed482cbc040a4e3bca2b.js, 20160915_5c960858e4d9540501248a4e602cbebe.js, 20160915_5de3e0d56fa4a3516ea7c688371cba8e.js, 20160915_5dfcfaf9f5b1d1d5b39af20bfe14c970.js, 20160915_6abd34e5eacc786cc43b112509566024.js, 20160915_7173c02578e447f66ddb6bb17b290727.js, 20160915_7297cf6d156fe5fb27751728321fd754.js, 20160915_75f2a03026d1bdafad16805bd266f416.js, 20160915_818a7e096e67eacac8728d0801ea2f79.js, 20160915_8b802a81b0d18dbb83012206ddfbcf9d.js, 20160915_8be1242814b504d7c79d04d6f5c39545.js, 20160915_941a51bfe9e2aba2f05477ce586a5528.js, 20160915_a6595f8b2a62db13593259005748c824.js, 20160915_a825098d3a72684b4ed7ebc43f147666.js, 20160915_b4404abe2cb80ba9fdc696d90b1305ec.js, 20160915_c3d9f649a3c6f42b1f11640ded64f5d9.js, 20160915_c8edfc98a9788ed23b16c73b0555d9a1.js, 20160915_cd4bff55df334e024f7988e85bcdb40f.js, 20160915_cf3e732e0854474ad62723876029ba26.js, 20160915_d2ddef6ed24a8d23e583e73c7347dcfc.js, 20160915_de6c2ddecc2ffceb2dff384cae5c6ea4.js, 20160915_df90c68f78ddf3afbd1e3c5d586f9efc.js, 20160915_e23c257f9c879b1c69268d5dbf1df5a1.js, 20160915_e3cf1cbc4aebcd942ede11e876da2fdc.js, 20160915_ea504c55ac9640954392d1f60116e62c.js, 20160915_eb0023dbd27ec090547f877b6d719a3f.js, 20160915_ec5c379b7ab65a8cf7e0f61f032a2e12.js, 20160915_ed2e7cfb7d10e6f6d684830b081c2465.js, 20160915_f040582df27e63acf9861d3802d7c233.js, 20160915_f97f8c26488178907e4b93636310adba.js, 20160915_fb57f0e74fce3be9e1380cfaf47d51ac.js

rule _20160915_1640a9e8ea85b02afd0189ad6b2629fe_20160915_16d1b5ce0ad6_735 {
  meta:
    description = "datamaliciousorder - from files 20160915_1640a9e8ea85b02afd0189ad6b2629fe.js, 20160915_16d1b5ce0ad6a61c76ff1c167b18f3a2.js, 20160915_1aeca8bcf04139f2c80b16ac963db9ee.js, 20160915_1ee058aa65dc0b7a29b9c23730001f89.js, 20160915_24e9980fafa2f9f63b54be0c8dcafc6e.js, 20160915_3fd880313f1ad3d4d8a3dab675f2c2d4.js, 20160915_4f81db1262c66f30c8827188c2a63a19.js, 20160915_511b76f3e522ed482cbc040a4e3bca2b.js, 20160915_5c960858e4d9540501248a4e602cbebe.js, 20160915_5de3e0d56fa4a3516ea7c688371cba8e.js, 20160915_5dfcfaf9f5b1d1d5b39af20bfe14c970.js, 20160915_6abd34e5eacc786cc43b112509566024.js, 20160915_7173c02578e447f66ddb6bb17b290727.js, 20160915_7297cf6d156fe5fb27751728321fd754.js, 20160915_75f2a03026d1bdafad16805bd266f416.js, 20160915_818a7e096e67eacac8728d0801ea2f79.js, 20160915_8b802a81b0d18dbb83012206ddfbcf9d.js, 20160915_8be1242814b504d7c79d04d6f5c39545.js, 20160915_941a51bfe9e2aba2f05477ce586a5528.js, 20160915_a6595f8b2a62db13593259005748c824.js, 20160915_a825098d3a72684b4ed7ebc43f147666.js, 20160915_b4404abe2cb80ba9fdc696d90b1305ec.js, 20160915_c3d9f649a3c6f42b1f11640ded64f5d9.js, 20160915_c8edfc98a9788ed23b16c73b0555d9a1.js, 20160915_cd4bff55df334e024f7988e85bcdb40f.js, 20160915_cf3e732e0854474ad62723876029ba26.js, 20160915_d2ddef6ed24a8d23e583e73c7347dcfc.js, 20160915_de6c2ddecc2ffceb2dff384cae5c6ea4.js, 20160915_df90c68f78ddf3afbd1e3c5d586f9efc.js, 20160915_e23c257f9c879b1c69268d5dbf1df5a1.js, 20160915_e3cf1cbc4aebcd942ede11e876da2fdc.js, 20160915_ea504c55ac9640954392d1f60116e62c.js, 20160915_eb0023dbd27ec090547f877b6d719a3f.js, 20160915_ec5c379b7ab65a8cf7e0f61f032a2e12.js, 20160915_ed2e7cfb7d10e6f6d684830b081c2465.js, 20160915_f040582df27e63acf9861d3802d7c233.js, 20160915_f97f8c26488178907e4b93636310adba.js, 20160915_fb57f0e74fce3be9e1380cfaf47d51ac.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a6b5ab24accd9ee0fe9214a7b698669dbac012e3bc41e5330872f7b2f9ef5623"
    hash2       = "353bf62e80e64a329723c0a8dcb6ed7b96253a3248a3325d7f40eb10d3276bd0"
    hash3       = "479b0a21bf9f233b918718dcf9f1aecbdfffa239e8a19d9384f21a9c91f656e2"
    hash4       = "ef3c85742a6b90a82a6ffa845211cf2b09bc463fd58bdc71b8964b3be2cf1694"
    hash5       = "37421130dff9426751405b3f8a2e7d51453cfbf5e54510c1e175275588212ac3"
    hash6       = "008c06e73581539919cce00864b69504c18874da28d8f77190b224559d845a0d"
    hash7       = "0bfef308ecae358b884d42df3e4df774bef094715f98848ca8c9ad0735a720bf"
    hash8       = "2672949b9ba808f46697fdfc201d891551eee41575f86375e9a31c8044af0882"
    hash9       = "093a96a4689877c2141f9ebb0b1377a31d7b56bb1b645ab8426c969aa7fd5ff4"
    hash10      = "b9992f8011018081dbc7e53de162870f69fa517934c9ead9afe67f4fa8a49468"
    hash11      = "9a35e4b41a1c6e93ceae0a768ae6618486162dbbd4212ed0459c4bbd78c9126c"
    hash12      = "186cbc42ec52c22826978afcc60128741776c7dd8c9f5e0f51ea0fe821905e1d"
    hash13      = "e4a3a3aafe9254a37488ac71e67f8768721283df24b0bc5dcb4cba2a8d93c52e"
    hash14      = "1d3af1c2b9e26d7d955cca340b7d909381c05873233903ec5198e2b63da9d355"
    hash15      = "5f81f644b61d89713f92fbc9686fb609935dcba080f3a6a6f08ede9fbca03dc3"
    hash16      = "06eeaa29e47de0cd15279e26b338b0b18def0b633f38422fe8c84d7b8b193b24"
    hash17      = "34f7510d9d19d0d7a2e5dd4944632787b0f5367003a72c2719e7c07bdf30a2ca"
    hash18      = "f4d2433d1032f29615c4ae62f5bd1b3ea460edf1bd4c1fc6936cbc0cd0d75cef"
    hash19      = "912ae3b611746b49266b779e22fec4eefb2281126733d475cc8045d871565026"
    hash20      = "be2ca3f96e318892c396da6b8b5e262d090a3640710ce72a6febbdfc9a30edd5"
    hash21      = "8813db8967c6aeaf8d14cd8cdd01fbdcfe0ac4e90b53c2aadad488a8e8ab7c9b"
    hash22      = "7db4fda6b70e6845a6aa3604d06a48da68dc3f86a7125aba7edce5ec2ed3655e"
    hash23      = "41b2d8a28e96d8921f986d6f7e52ebbadbcabb309ce07796282167653379eb01"
    hash24      = "7a891acc8f398fa8d241fc57d316c27ed075e83f9de72063d86638703c54705d"
    hash25      = "fb14c17f5274794af11850dad53abd03358ad34b3e2ac62245091f8329ba0465"
    hash26      = "e3a7a72a0e71cd4cb0668e291e630903c9ffefd9e8146df5171e3d50a0d29586"
    hash27      = "8e7dc3f2467861350aaf243f362ba81c0478c9689ee3cb60f8d25ec537164ed3"
    hash28      = "ac892efea28cc479c5d03e77b2883abc110aecc4c71995623498d557ef3a8ed3"
    hash29      = "9437b404f1a6e0bcc9fb18106a08075ac2d2f1e4bfcae9c456432982d2f63eed"
    hash30      = "1951e01d95546f0150e4cde2d721f45812168349e4e3e718a3f251b12383b452"
    hash31      = "2019dfab0208a5ec78d329285d6aa0d005bafd7ff7f3746c4dc25119a184c982"
    hash32      = "6f5163587ae9ea0a7bd1ad2d38dcc2fa6f8542fa05a34f4e2a58b72ea3576d6c"
    hash33      = "b4a9d988d81381191022fcddc84f65f354c0b4f298208ecab8fe74a14c455b9e"
    hash34      = "10bfcf84277d34002ec24523dad5622ad1e163aee6d1ccb9c6ccd0652582d35c"
    hash35      = "3a9203c50bc765742f3a316eb9040b733df052d89f1a6667330502e5863ed5fb"
    hash36      = "b685b30efdafa5813ddc215337d51fdf8a38497375177e0aa1fc5957138c99dd"
    hash37      = "fa3bd4511e7d232f507adf11f6548d18aa02dca535518d147c601e8803f1c41d"
    hash38      = "bb55a9530d2915ad71632f68077bc62ca74bbde3c20420bf200e5b590c80c9f6"

  strings:
    $s1  = "{return \"\\x6d\";})()], \"KHz\": [3, (function f(){return \"\\x6e\";})()], \"QQd\": [3, (function f(){return \"9\";})()], \"IPa" ascii
    $s2  = "n f(){return \"\\x57\";})()], \"MGt\": [3, (function f(){return \"\\x56\";})()], \"Jp0\": [3, (function f(){return \"\\x55\";})(" ascii
    $s3  = "\"PBq\": [3, (function f(){return \"\\x46\";})()], \"EEn\": [3, (function f(){return \"\\x47\";})()], \"PXx\": [3, (function f()" ascii
    $s4  = "turn \"\\x4a\";})()], \"Dn\": [3, (function f(){return \"\\x4b\";})()], \"Nc0\": [3, (function f(){return \"\\x4c\";})()], \"Cz" ascii
    $s5  = ", \"Wf\": [3, (function f(){return \"\\x0d\";})()], \"Df\": [3, (function f(){return \"\\x09\";})()], \"DEp\": [3, (function f()" ascii
    $s6  = "var COt = {\"Hn\": [3, (function f(){return \"\\x6b\";})()], \"FTe\": [3, (function f(){return \"\\x79\";})()], \"Hh\": [3, (fun" ascii
    $s7  = ": [3, (function f(){return \"8\";})()], \"Ao\": [3, (function f(){return \"\\x44\";})()], \"Zy\": [3, (function f(){return \"\\x" ascii
    $s8  = "turn \"\\x78\";})()], \"Tb\": [3, (function f(){return \"\\x75\";})()], \"PBp\": [3, (function f(){return \"\\x74\";})()], \"IVs" ascii
    $s9  = "})()], \"NXi\": [3, (function f(){return \"\\x58\";})()], \"DBk\": [3, (function f(){return \"1\";})()], \"Pe\": [3, (function f" ascii
    $s10 = "on f(){return \"\\x77\";})()], \"BNg\": [3, (function f(){return \"\\x76\";})()], \"Vx\": [3, (function f(){return \"\\x71\";})(" ascii
    $s11 = "()], \"EKn\": [3, (function f(){return \"\\x29\";})()], \"VYh\": [3, (function f(){return \"\\x4d\";})()], \"Vl\": [3, (function" ascii
    $s12 = "\"\\x4e\";})()], \"Jp\": [3, (function f(){return \"\\x4f\";})()], \"Ha\": [3, (function f(){return \"2\";})()], \"VMm\": [3, (f" ascii
    $s13 = "\"Jl\": [3, (function f(){return \"0\";})()], \"GXa\": [3, (function f(){return \"4\";})()], \"Fa\": [3, (function f(){return \"" ascii
    $s14 = "0\";})()], \"Of\": [3, (function f(){return \"\\x41\";})()], \"WLj\": [3, (function f(){return \"\\x42\";})()], \"SHk\": [3, (fu" ascii
    $s15 = "LFv\": [3, (function f(){return \"\\x51\";})()], \"Du\": [3, (function f(){return \"\\x50\";})()], \"Qq\": [3, (function f(){ret" ascii
    $s16 = "d\";})()], \"MLz\": [3, (function f(){return \"\\x7a\";})()], \"St\": [3, (function f(){return \"\\x7c\";})()], \"Kr\": [3, (fun" ascii
    $s17 = "turn \"\\x43\";})()], \"Hr\": [3, (function f(){return \"\\x48\";})()], \"By\": [3, (function f(){return \"\\x49\";})()], \"CEb" ascii
    $s18 = "var COt = {\"Hn\": [3, (function f(){return \"\\x6b\";})()], \"FTe\": [3, (function f(){return \"\\x79\";})()], \"Hh\": [3, (fun" ascii

  condition:
    (uint16(0) == 0x0a0a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

490c74a5-84f2-41ad-aa09-9b7402715e30

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion