_20160916_00721e8cbbd639833a93ceaadd14b3b7_20160916_01407f91d032_760

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160916_00721e8cbbd639833a93ceaadd14b3b7.js, 20160916_01407f91d032e59f40969ffed914983f.js, 20160916_01dca5811e42f99c60fa87ea5b5d6202.js, 20160916_096031258b8adbc02933507056b512b7.js, 20160916_0b6dc0ac143d4c031d1f42d1412ba94f.js, 20160916_0ef8e510aefbcbf5a9cf46e24d5db77f.js, 20160916_1275dc82a6dc4b2b1c675b40e534bc78.js, 20160916_21a1da57d87d84384491661de2b24b8c.js, 20160916_2379736c294967461ac872c992198a77.js, 20160916_2436d6cc9bea8b755e605d776a468b55.js, 20160916_266a3d97d66d229b85f4151eb64179a8.js, 20160916_291f53a1535ad463b844d1e53d7d22f3.js, 20160916_29332d35682de03d2aee9e287d0b03b1.js, 20160916_334173b17fb525667309f71910d83702.js, 20160916_35ad47b96edc7e313e7cfa66786ac7bc.js, 20160916_3615195ffdf9cc92767641ce6aabbc35.js, 20160916_3e173ab05263e72b908e70ba40211d44.js, 20160916_3e6964f22ed21cd402d8dffcb853b13d.js, 20160916_3fba18aa094a5cc1d88ea286ec04da83.js, 20160916_429245313a3d9a3a9df6be1bb4c8951e.js, 20160916_46f319af85269a7a804886fb9138dc0d.js, 20160916_47411e8f44fab43643cfa3ee2b945da0.js, 20160916_4aaf7a16919a8085ece48b513a00cde1.js, 20160916_50f8733fd58bb3377c41aa8135420569.js, 20160916_57484bcc3943be4d3be258795c6a681c.js, 20160916_5bc207c10fd521d24f9c2316f5085995.js, 20160916_7a544569d06dab4560709bac3145f450.js, 20160916_832e4c45751f1ad50d543a2f1079f3c5.js, 20160916_89cc571d942bbd8e363e14c50063e70b.js, 20160916_8bb6b581fa9815f9bb6970cb08295728.js, 20160916_8dd3fde7fb035b51da1147aa1f451488.js, 20160916_8f3ed3a4eababc796a38ef65c6ba42fb.js, 20160916_904ee8f803a98e134bae66f68aa4478d.js, 20160916_91533517076dc31c151c897adf5e663b.js, 20160916_96aff0e273e8ecac5a4ecdec39c5e400.js, 20160916_a2fdad5cc3d1018d45471c64c36b1452.js, 20160916_b30553fa84e8c53913b26de4cea7d060.js, 20160916_c12cf0b2ce31abf6da87b6bf3adb0b99.js, 20160916_c7ba0ed3b4d69af5d821bf167620354b.js, 20160916_ce45b230c84dca35125a5fcda2db0d5e.js, 20160916_cfce11bc17f019da445c5d9e4ff84bbe.js, 20160916_e0e2d3ef8b46b5d513b8413ddecd1d15.js, 20160916_e18b068f2ad7d2cba9c53a7bdd6edb15.js, 20160916_e19f56456293ac53b981f0eec88db951.js, 20160916_ea51714e2939515e0f3be177e1b7c6aa.js, 20160916_eb28d78f50bff23175a93562d67f752e.js, 20160916_edf37b41000ad69a746e0b6d92b69cf1.js, 20160916_f55df9bd4e84cdc112b8a0def67b947c.js, 20160916_f922c84ebdef3164fff9196954487280.js, 20160916_fcd8b69c3002111c03814ce404d648b4.js

rule _20160916_00721e8cbbd639833a93ceaadd14b3b7_20160916_01407f91d032_760 {
  meta:
    description = "datamaliciousorder - from files 20160916_00721e8cbbd639833a93ceaadd14b3b7.js, 20160916_01407f91d032e59f40969ffed914983f.js, 20160916_01dca5811e42f99c60fa87ea5b5d6202.js, 20160916_096031258b8adbc02933507056b512b7.js, 20160916_0b6dc0ac143d4c031d1f42d1412ba94f.js, 20160916_0ef8e510aefbcbf5a9cf46e24d5db77f.js, 20160916_1275dc82a6dc4b2b1c675b40e534bc78.js, 20160916_21a1da57d87d84384491661de2b24b8c.js, 20160916_2379736c294967461ac872c992198a77.js, 20160916_2436d6cc9bea8b755e605d776a468b55.js, 20160916_266a3d97d66d229b85f4151eb64179a8.js, 20160916_291f53a1535ad463b844d1e53d7d22f3.js, 20160916_29332d35682de03d2aee9e287d0b03b1.js, 20160916_334173b17fb525667309f71910d83702.js, 20160916_35ad47b96edc7e313e7cfa66786ac7bc.js, 20160916_3615195ffdf9cc92767641ce6aabbc35.js, 20160916_3e173ab05263e72b908e70ba40211d44.js, 20160916_3e6964f22ed21cd402d8dffcb853b13d.js, 20160916_3fba18aa094a5cc1d88ea286ec04da83.js, 20160916_429245313a3d9a3a9df6be1bb4c8951e.js, 20160916_46f319af85269a7a804886fb9138dc0d.js, 20160916_47411e8f44fab43643cfa3ee2b945da0.js, 20160916_4aaf7a16919a8085ece48b513a00cde1.js, 20160916_50f8733fd58bb3377c41aa8135420569.js, 20160916_57484bcc3943be4d3be258795c6a681c.js, 20160916_5bc207c10fd521d24f9c2316f5085995.js, 20160916_7a544569d06dab4560709bac3145f450.js, 20160916_832e4c45751f1ad50d543a2f1079f3c5.js, 20160916_89cc571d942bbd8e363e14c50063e70b.js, 20160916_8bb6b581fa9815f9bb6970cb08295728.js, 20160916_8dd3fde7fb035b51da1147aa1f451488.js, 20160916_8f3ed3a4eababc796a38ef65c6ba42fb.js, 20160916_904ee8f803a98e134bae66f68aa4478d.js, 20160916_91533517076dc31c151c897adf5e663b.js, 20160916_96aff0e273e8ecac5a4ecdec39c5e400.js, 20160916_a2fdad5cc3d1018d45471c64c36b1452.js, 20160916_b30553fa84e8c53913b26de4cea7d060.js, 20160916_c12cf0b2ce31abf6da87b6bf3adb0b99.js, 20160916_c7ba0ed3b4d69af5d821bf167620354b.js, 20160916_ce45b230c84dca35125a5fcda2db0d5e.js, 20160916_cfce11bc17f019da445c5d9e4ff84bbe.js, 20160916_e0e2d3ef8b46b5d513b8413ddecd1d15.js, 20160916_e18b068f2ad7d2cba9c53a7bdd6edb15.js, 20160916_e19f56456293ac53b981f0eec88db951.js, 20160916_ea51714e2939515e0f3be177e1b7c6aa.js, 20160916_eb28d78f50bff23175a93562d67f752e.js, 20160916_edf37b41000ad69a746e0b6d92b69cf1.js, 20160916_f55df9bd4e84cdc112b8a0def67b947c.js, 20160916_f922c84ebdef3164fff9196954487280.js, 20160916_fcd8b69c3002111c03814ce404d648b4.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "0b3963039f15f2d68b7e4a365c3ea3963b3cb4f56967893130fb0ea61edd585d"
    hash2       = "56bb5456d5ce47f94f214102585f499b25cfebb7dfa17124f88be9b2bd83d15b"
    hash3       = "361e379fcaa9a3e9c29076ea4339ba1f839269f15a92f80e730f43ed58816b14"
    hash4       = "16d565e1d0f1acde8c12aaaa7d2f79386b5b6efe17335c1eca7188282cd3076e"
    hash5       = "7878ab9a0c39429e96d42f1e205f7e96943a4553ea3cec081e01d071820df3ef"
    hash6       = "c4c2e249588474b467117892316086a6ea3c7e01a3b074e0dd8575256a0877dd"
    hash7       = "d819ad33077fc0c221ade0a7eed0c6677c0d8cfc488ca76a62ce863e1a99a9bb"
    hash8       = "8ab531e64b7c945f12d1612ba3c98e9db75bb2e403a53411322f5a66a6b55414"
    hash9       = "69c69f238a1d7df1d66604959d79df56022db32b4eae50717120c1783decdb9b"
    hash10      = "9ee7ea7e23bd6dc87809516ab26d9719ca26699ca24bb970667212be2d85fcf3"
    hash11      = "113a127482f6f6907a12932e10dc8770433e91688ef2cc3b992c09cb40060b9a"
    hash12      = "2f8346be8aadd68511a9b6443c7425db5e1477c5bfbce655fc97c26f2de6ff98"
    hash13      = "ade01c81d94f88e7dddf1ee816df89be0fafac09fdcf8a429bd8fc4aa85bd99a"
    hash14      = "fd8cc4137601b03d52cea6f776e02fa6b86f114d4a8bf860db1583e05d2cdd6f"
    hash15      = "a2e3d4944e9b3294fbe4f73bc3725c5cf49b9f8edcd54ca9bbe9a72d48e0bfb6"
    hash16      = "ffc99022b774721e9ad14ed855906f1ab02c3ddd37ad2c2aab64418cc5e81dfc"
    hash17      = "520331e38cca40c62f75a98c216ae4255d6f6a1a505c4e4ed29cdf1b6c99eac2"
    hash18      = "02043d491443899884bf51e377710216491b16764d73977809cbf4adda42109c"
    hash19      = "3a770508d51d7c4aa219abd546d8bc2527b2f2fe9b919fa32ff06ec35a135101"
    hash20      = "3d8ff049a2cce6512abbb714966a56a071242c087be12b0a8002de4b49eeece0"
    hash21      = "5b68125c74296cbd692272fef92db601e36705d0a55100a4384a27b6b45fc9b7"
    hash22      = "19f6ec338d2ebbeea4faf364ee386c2cd53ba2bb626934939e9eaa2f92538ef7"
    hash23      = "69022aac84e502302f00409d36f169f57dde14357b5f413270e9c05da24fa7e1"
    hash24      = "959ff4ddb666e054f7a6841936a3d012f70cdb8af121e6147234edb0748513f5"
    hash25      = "297649c66ac08ad932838f0678b8cdb29bb0c0b2e861b73d83ead9f5935a791d"
    hash26      = "d9d6f539176e1512250c58ca255ce08562019491d82e9921270aeef4328e7436"
    hash27      = "955555f4685255175e9f65dd91b329061253e120b8970a17cd46a9aa7bf6268a"
    hash28      = "03f4bc46d1c4d3e828f23d2c5084529a39e63161153e13b03372f284ea26ca7e"
    hash29      = "e52cbccd3ea66c64ad9505a2bdbc9e400dc30132ce82e95fbf9690ff72509d55"
    hash30      = "4c092828aa38bfcccbd5bf492a1c4b6b0fcc1b33b418077765e4405b2dac6ca3"
    hash31      = "9ef7251034c4889203f725e535abb8210101dada73115a537d855c7609a4e318"
    hash32      = "0fa95a0319e8f9f33602b7954618590a96b15d00f6848c40927669b10cb16d53"
    hash33      = "c7cfee0c5df0a4f57ee231570757dc6ce0b23a1a5c3c4effb5ff8bd28252d59e"
    hash34      = "d7ef49a2fafe7465cfd4b023326d5f92e4b9118b8a50a8f4b126df966f20eed0"
    hash35      = "c65c23975f6f6482f196f85ecb35e0bfe7f50eb86a9e2007efeeedc15c7e448c"
    hash36      = "4084e3d5cfb32f7ca4e17560f37632ab761fdee49479ee02c36e8ca5c63bfb1a"
    hash37      = "787de81f1f9b3cc22c8a37ef1ea7864df976c3154c0e7b9a7d0952ac0ba2e909"
    hash38      = "c080ff74fb5cbfa2540ec050bc99000e4e9f656039aeb4bd1a346de8c3a0900c"
    hash39      = "f66eb5c4ef65a824aeb7fb9233683ef27776d1e73f350b2440fb20472a21f0fb"
    hash40      = "0f59966b4d36cd4e8127143d8022e48e1e858bdcb3ae7147d22c772a60b6ffc4"
    hash41      = "aa35763897de6bd84df63b95b717bed948f1a86cea84aca8c65630b312561e58"
    hash42      = "ad43ff7c50cd5873e8f0eee4a4aa53909e3e2a79285407598c254a1c3ac5168b"
    hash43      = "eec6bf898905992abda46493e151419d8cebdc5ae80bcf21dbe701f2898f5211"
    hash44      = "8e01ff14e60af73621f61a74c9ebaf82c8cea79a5ab130c64d0a5fa3a765c8f6"
    hash45      = "d77d73e699d35334b3ab80dfe32d1448757c1b1b3b188d69b59d6df37c9e749b"
    hash46      = "66b3c8dd82790cde5dc6f5db31c28583997fdef6abbb3396fe9f87d1e169362a"
    hash47      = "f512d4e282bc093552d0ae39ad34c91005b099f8740d31fdc1fe36a8b4a67ffa"
    hash48      = "c837f53ac21d41d36d90230dee13c57e833a9fe3da804712f096edc25e5e4d72"
    hash49      = "5ba58dbebfad46ee802dbccae30aff75fc5e118adcc7a31548caa0d1e4d3ffef"
    hash50      = "072800f8c393cc64fd45d5e681064c6b2df9bdbc7210ea94add3cc5b4646b4c3"

  strings:
    $s1  = "], \"NIj\": [3, (function f(){return \"\\x0d\";})()], \"JDt\": [3, (function f(){return \"\\x09\";})()], \"DYm\": [3, (function " ascii
    $s2  = " \"\\x40\";})()], \"VXh\": [3, (function f(){return \"\\x41\";})()], \"Xk\": [3, (function f(){return \"\\x42\";})()], \"Kp\": [" ascii
    $s3  = "){return \"\\x43\";})()], \"Ne\": [3, (function f(){return \"\\x48\";})()], \"Pc\": [3, (function f(){return \"\\x49\";})()], \"" ascii
    $s4  = "\"Kx\": [3, (function f(){return \"\\x51\";})()], \"Yi\": [3, (function f(){return \"\\x50\";})()], \"Pg\": [3, (function f(){re" ascii
    $s5  = "tion f(){return \"\\x57\";})()], \"Ad\": [3, (function f(){return \"\\x56\";})()], \"Mg\": [3, (function f(){return \"\\x55\";})" ascii
    $s6  = "\"ZLu\": [3, (function f(){return \"0\";})()], \"Fy\": [3, (function f(){return \"4\";})()], \"KJq\": [3, (function f(){return " ascii
    $s7  = ", (function f(){return \"\\x54\";})()], \"OAq\": [3, (function f(){return \"\\x53\";})()], \"Fq\": [3, (function f(){return \"" ascii
    $s8  = ")()], \"DAa\": [3, (function f(){return \"\\x46\";})()], \"Ee\": [3, (function f(){return \"\\x47\";})()], \"HBp\": [3, (functio" ascii
    $s9  = "var WZf = {\"FMt\": [3, (function f(){return \"\\x6b\";})()], \"CVy\": [3, (function f(){return \"\\x79\";})()], \"Ci\": [3, (fu" ascii
    $s10 = "\";})()], \"Aq\": [3, (function f(){return \"\\x29\";})()], \"BWb\": [3, (function f(){return \"\\x4d\";})()], \"Ht\": [3, (func" ascii

  condition:
    (uint16(0) == 0x0a0a and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d586a6b3-7815-40b5-8029-036eb6bfc468

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion