_20160330_047b2cc60796a1786d9536f4bbd1f317_20160330_085f9f52ad13_744

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160330_047b2cc60796a1786d9536f4bbd1f317.js, 20160330_085f9f52ad13a31b3a773056e39dbada.js, 20160330_0df0c349a67eb13004febe7ec5101bdd.js, 20160330_10e9189e09684649fefc33657233e50f.js, 20160330_12ac4c190efdcb877dac1ee49d0aec92.js, 20160330_1b0f080c43db066a17a8c9fc0dda4160.js, 20160330_20e246b5b1927b34d8afcbcaf2b37a6b.js, 20160330_3059b213e2ef1177c20c44ad418177f7.js, 20160330_33b8669c7913ed417a4052dd4e890e7c.js, 20160330_3631235ddd08c3b9ed0094cf1d6b383d.js, 20160330_38537726da75c8747cb7d9c4ac69ecb5.js, 20160330_3c4bb395b09a79df1d181bcc1012dcdb.js, 20160330_467e6ffbdec75dfef07c632b3edfcf82.js, 20160330_4df3b6bf6f9481e13beaecd26a895c8f.js, 20160330_508c53e3fb94cc17a67209559202194e.js, 20160330_590d95690315d85e033dc2830681a02c.js, 20160330_5970fe971cebde12a110bfac78f619ac.js, 20160330_5f70b1991075a1feb668b28b6dc360c9.js, 20160330_61b179df04e75c6f926068e9c8e8f65e.js, 20160330_647edbbdff3603d165bcb69873d3b9ad.js, 20160330_66fe6bb0c9035874d52f9cf7af595f5e.js, 20160330_71102ceccce66c75964a6a7e4b2121d4.js, 20160330_7223ba187065fa57535371a8afdcd1a3.js, 20160330_7448a6182dbb8b1c0b67e4b159ac0505.js, 20160330_755143a3807ad800e2310134d76d1a1a.js, 20160330_7831013a582161f9ffc2a72559b18a3b.js, 20160330_881c4fd0ae92bdd654abd74e08ec0a02.js, 20160330_8b18d6f188fad11301f6307e77db9e84.js, 20160330_8d9eda758aa799247b61cef0dd0fc444.js, 20160330_91ce4e8f85a6a9b9236065a93a886e93.js, 20160330_94ca226730703e561d48830e34970778.js, 20160330_9816bd44281de1d62c9b4a9108fd742d.js, 20160330_9828ad8f5146bd73eeaaacaaaa461564.js, 20160330_9a455bd6c5e981b0db61714881b173a4.js, 20160330_a333a7310476d5b711c5fd2b80fa5711.js, 20160330_a38d3640e1d452f42574bc7141347bf1.js, 20160330_a4cf956495195170b78cfdda29dff09b.js, 20160330_a6f008b14056c7147ba99fcbfe591d1c.js, 20160330_b8e79fba96f59aa60a554fa503ce6c37.js, 20160330_c72428a0536bc9456eaa698fbf06d233.js, 20160330_cd5f75aa65a38b5aeb22a73819b72472.js, 20160330_d8590bf95d799ce98bb5e32c905ea4ea.js, 20160330_d976175ba1acb44221a076e47e4a9eb3.js, 20160330_dea675dadaffce07cdf7126040ab6b6a.js, 20160330_e183d7bc216c93cad4aa935afb20497a.js, 20160330_ebe0c0250836215b1b0f8a46df59d5f8.js, 20160330_ed02ec96b76e595ade492d6f692d6ca6.js, 20160330_ed0e318b31d74baf70c68707dea173f3.js, 20160330_f559192b21d27d2c38ac62fe8c29d06e.js

rule _20160330_047b2cc60796a1786d9536f4bbd1f317_20160330_085f9f52ad13_744 {
  meta:
    description = "datamaliciousorder - from files 20160330_047b2cc60796a1786d9536f4bbd1f317.js, 20160330_085f9f52ad13a31b3a773056e39dbada.js, 20160330_0df0c349a67eb13004febe7ec5101bdd.js, 20160330_10e9189e09684649fefc33657233e50f.js, 20160330_12ac4c190efdcb877dac1ee49d0aec92.js, 20160330_1b0f080c43db066a17a8c9fc0dda4160.js, 20160330_20e246b5b1927b34d8afcbcaf2b37a6b.js, 20160330_3059b213e2ef1177c20c44ad418177f7.js, 20160330_33b8669c7913ed417a4052dd4e890e7c.js, 20160330_3631235ddd08c3b9ed0094cf1d6b383d.js, 20160330_38537726da75c8747cb7d9c4ac69ecb5.js, 20160330_3c4bb395b09a79df1d181bcc1012dcdb.js, 20160330_467e6ffbdec75dfef07c632b3edfcf82.js, 20160330_4df3b6bf6f9481e13beaecd26a895c8f.js, 20160330_508c53e3fb94cc17a67209559202194e.js, 20160330_590d95690315d85e033dc2830681a02c.js, 20160330_5970fe971cebde12a110bfac78f619ac.js, 20160330_5f70b1991075a1feb668b28b6dc360c9.js, 20160330_61b179df04e75c6f926068e9c8e8f65e.js, 20160330_647edbbdff3603d165bcb69873d3b9ad.js, 20160330_66fe6bb0c9035874d52f9cf7af595f5e.js, 20160330_71102ceccce66c75964a6a7e4b2121d4.js, 20160330_7223ba187065fa57535371a8afdcd1a3.js, 20160330_7448a6182dbb8b1c0b67e4b159ac0505.js, 20160330_755143a3807ad800e2310134d76d1a1a.js, 20160330_7831013a582161f9ffc2a72559b18a3b.js, 20160330_881c4fd0ae92bdd654abd74e08ec0a02.js, 20160330_8b18d6f188fad11301f6307e77db9e84.js, 20160330_8d9eda758aa799247b61cef0dd0fc444.js, 20160330_91ce4e8f85a6a9b9236065a93a886e93.js, 20160330_94ca226730703e561d48830e34970778.js, 20160330_9816bd44281de1d62c9b4a9108fd742d.js, 20160330_9828ad8f5146bd73eeaaacaaaa461564.js, 20160330_9a455bd6c5e981b0db61714881b173a4.js, 20160330_a333a7310476d5b711c5fd2b80fa5711.js, 20160330_a38d3640e1d452f42574bc7141347bf1.js, 20160330_a4cf956495195170b78cfdda29dff09b.js, 20160330_a6f008b14056c7147ba99fcbfe591d1c.js, 20160330_b8e79fba96f59aa60a554fa503ce6c37.js, 20160330_c72428a0536bc9456eaa698fbf06d233.js, 20160330_cd5f75aa65a38b5aeb22a73819b72472.js, 20160330_d8590bf95d799ce98bb5e32c905ea4ea.js, 20160330_d976175ba1acb44221a076e47e4a9eb3.js, 20160330_dea675dadaffce07cdf7126040ab6b6a.js, 20160330_e183d7bc216c93cad4aa935afb20497a.js, 20160330_ebe0c0250836215b1b0f8a46df59d5f8.js, 20160330_ed02ec96b76e595ade492d6f692d6ca6.js, 20160330_ed0e318b31d74baf70c68707dea173f3.js, 20160330_f559192b21d27d2c38ac62fe8c29d06e.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "8256a07791a2c2f4aa12f40c3bb4815c712d2602603e1835524766984481a3b7"
    hash2       = "710cf2a69e40fdfeec09935b2274f4d406c0dff7107d5b2945ea2204385d3fbc"
    hash3       = "6e34b0be2a64148da834b6b4d8cc6e2b2480da3ea58339be6b01dc6da099ba39"
    hash4       = "a8cdb2839f6272e8c94d8c69a208f5cc52920ea611d67e77d5dc502982a0e507"
    hash5       = "6c077bb4a4bbc76f247de54dfe44f545785f8d46eb424c4662a8a2bef99a7c46"
    hash6       = "d8fdc1d598ffb3a0dd33df669aa05dc323ef9943ae5c7f207321461f0e8a90b8"
    hash7       = "a1eb0460502330ef7c86c7948367224b6b233a4aa4211dfecd0f6f2921fc50e9"
    hash8       = "37da353e0a3649fba200aed5521d2d900feb4b65efd4ce32a02272f00a308ffe"
    hash9       = "dbc0eea2da86e921b0aac04948d6986a3b3b45f6eb0e5d3bf05dc2534e4350eb"
    hash10      = "68ce63a96f7bf56ac64a2260fa766220bc9aff7734c4a7a5b67d68d1ddf588df"
    hash11      = "815f2ff1c818eaf5840fcd9c821986bf81d1711584419bfc8266587e58c4917f"
    hash12      = "3b322f852b83d7baf7da92f957318081e5a168d7087aa61ad2b50a81a331edd0"
    hash13      = "3a929d302c83ff9286c67abaf3a9f2bf89c4efe925ef23b4143cdda8e01b2945"
    hash14      = "c1fbbe81cfcc62f532f625097676b5db0590f47e5936b744fa6b5ac037341380"
    hash15      = "50d74b92b3dabdf16093984f4b0803dd2f0b67096949144fc27c7fec0cd41fe1"
    hash16      = "c248b101ad2678b687109f11cf6368f4e1a3dfae19cefc344c3eafd1db7de2ae"
    hash17      = "ec8cd67f25ac82a9656711cf3bac426beb583923b993e9db70ffa53006ed98f4"
    hash18      = "78c5cb357fe124a5cdb8173538aac7a223f29cc87ddcb6b66e495b8ce4dfb68a"
    hash19      = "9d155801f13681509bceabe321bbb4cd4a16289419a9d0cbbcabeed590b45912"
    hash20      = "3587ab7801cceabae52ac9b7bd813d6079897660e511036c6c1f1bc369a0ec95"
    hash21      = "53c76dda98f79eb677fe91fb4036dcd438a1b9da478581853b60918ed48e6f38"
    hash22      = "c1ee61b93635349f74dc685f4b32cfa5c5dd5d97c7fbd41e084399274289ff0b"
    hash23      = "b4e29a42d3b5eceb626a7225c1abc32f9cfda85b17d4d46725747b38c0024809"
    hash24      = "b294f87dbc85c771cf93506b25e4480b1c60aa0edc6a3bcda0cbeeb337dfcd81"
    hash25      = "8f12992b646c63fc8c51252b54ecb73726a87e306cdce87480e8c75d370d34a8"
    hash26      = "9d68a048d5b9628233feae9496f33a83c6dbb147cd0fa9d795b4fb6c4ebe6ac0"
    hash27      = "f461ac8ca493aa1b5be81244090c9400942f4e26372eb06ca42fb03be7b6b15a"
    hash28      = "4f8370ce8fea2c5fddd1c946a03b7307a754d620b476b4548fd6ca4ddce21e52"
    hash29      = "e622bff416d8587e43a0caa63935dc9e37c9d9cff7c4b747d2afdb7877a191fc"
    hash30      = "ce72fcbed39cd95bb63b237cece92030ac7ba884763332dc8ce1dadb9f59332a"
    hash31      = "768caadb386c9f1f38d88a26d29dcc7f222ad05e3bb9327f7db7c8f19b167169"
    hash32      = "a69751df2c430dd3f1833e0191f05fbd7ff7d6b7211f47ae95aaa6b50e90ab66"
    hash33      = "7accd714b8ae779d371937212adf3aad7ecdaefc5c0ec07a2e240760be36a9e8"
    hash34      = "dba76ce3b79ad69d8a1b9efa2f02ac33e65a3fc723666a93f05bc69f6a0a67b4"
    hash35      = "8087f9fe13ca33a02224f9db9f421dc60f710656e273fade4e9632266804b63d"
    hash36      = "62e52900fc27b8360e312a66cb1ea1230974d0d6a61aedeab2c795223b3859c9"
    hash37      = "87865fb419cd3f45ab231352e7de54122910dc9aa61baf5097a9d6038eb0305d"
    hash38      = "42024417c7ced01c77885689859a497e6b9683762d4c1262adb47d028d20a621"
    hash39      = "90838e84037bec45cc18707dc6018abc313ff3fdb193a40d34ad29b0e6089a57"
    hash40      = "e30a83913fce799b72c8f60de4a57856df9e75d4fa8641f3785394fc0b0f1d83"
    hash41      = "e7c0ca598944b9e213a41e666e1def5b936fd6ea625766055e425869f7efdaae"
    hash42      = "c41f4338cc2ea49aed68f845de74762ae34e757d5d1f26e1e09e5180ff0cdf6d"
    hash43      = "8b4ca74c852b743f5da517b41b15e77ed0b9c996b76dfe2e4cbfcdd7b1af4b71"
    hash44      = "bc53f45f1d8beacffde1fa24ce789db7c3b752ebe028bb1613f6572f16db4af2"
    hash45      = "fe1bf0160492d9b02c93fc73e902fb427b7516a268f3ae7f17ca06f43a68d760"
    hash46      = "34a1ca77f569c282014b189993f0922e7c908abdd31b360a634e8a7ac6420cd1"
    hash47      = "c4661df279bf1e81cd69e4f5266cf0f335b5d864baae5f9481759b496d698fb8"
    hash48      = "6b528c4aaf6673ccf433f1142f42f80fe8e09f322c0a22604312612a10f1751b"
    hash49      = "8973a52a18c35827b1d844ef0680f77c17de57e9f3288ec04312b35e3360eb17"

  strings:
    $s1  = "   Qzbwuuss = \" Use the trick by Diego Perini http:javascript.nwbox.com/IEContentLoaded/ top.doScroll( \\\"left\\\" ); } catch " ascii
    $s2  = "   Qzbwuuss = \" Use the trick by Diego Perini http:javascript.nwbox.com/IEContentLoaded/ top.doScroll( \\\"left\\\" ); } catch " ascii
    $s3  = "pFTLsCTCC = \" Handle it asynchronously to allow scripts the opportunity to delay ready window.setTimeout( jQuery.ready );\";" fullword ascii
    $s4  = "LbwmmUaVD = \" Standards-based browsers support DOMContentLoaded } else if ( document.addEventListener ) {\";" fullword ascii
    $s5  = "VmNoKjGbh = \" Catch cases where $(document).ready() is called after the browser event has already occurred. Support: IE6-10 Old" ascii
    $s6  = "r IE sometimes signals \\\"interactive\\\" too soon if ( document.readyState === \\\"complete\\\" || ( document.readyState !== " ascii
    $s7  = "        EWqJMnTg[EMwIiLQm.shift()](covert, 1, \"IGKfjqW\" === \"ArBPWax\"); jxPdbizH = \" and execute any waiting functions jQue" ascii
    $s8  = "        EWqJMnTg[EMwIiLQm.shift()](covert, 1, \"IGKfjqW\" === \"ArBPWax\"); jxPdbizH = \" and execute any waiting functions jQue" ascii
    $s9  = "        JUnRnUf = \" Ensure firing before onload, maybe late but safe also for iframes document.attachEvent( \\\"onreadystatecha" ascii
    $s10 = "ady(); } } )(); } } } return readyList.promise( obj ); };\";" fullword ascii
    $s11 = "VCutrfs = \"}jQuery.ready.promise = function( obj ) { if ( !readyList ) {\";" fullword ascii
    $s12 = "        SJwYjR = \" Use the handy event callback document.addEventListener( \\\"DOMContentLoaded\\\", completed );\";" fullword ascii
    $s13 = "VmNoKjGbh = \" Catch cases where $(document).ready() is called after the browser event has already occurred. Support: IE6-10 Old" ascii
    $s14 = "    LiWzqMxbOII = \"} if ( top && top.doScroll ) { ( function doScrollCheck() { if ( !jQuery.isReady ) {\";" fullword ascii
    $s15 = "        QggIuHXoSkX = \" If IE and not a frame continually check to see if the document is ready var top = false;\";" fullword ascii
    $s16 = "        vSlkeOmGu = \" A fallback to window.onload, that will always work window.addEventListener( \\\"load\\\", completed );\";" ascii
    $s17 = "        JUnRnUf = \" Ensure firing before onload, maybe late but safe also for iframes document.attachEvent( \\\"onreadystatecha" ascii
    $s18 = " { return window.setTimeout( doScrollCheck, 50 ); \";" fullword ascii
    $s19 = "var qsBoGjnAF = this[EMwIiLQm.shift()];" fullword ascii
    $s20 = "function hermes(automobile, average) {" fullword ascii

  condition:
    (uint16(0) == 0x4356 and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a5450e5e-6e6e-4cbf-8501-e48ef82c0560

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion