_20160421_555dbd3303aa5e17f8349bf880458828_20160421_7284a898b6f9_787

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160421_555dbd3303aa5e17f8349bf880458828.js, 20160421_7284a898b6f99c109507e2dd666cb1f6.js, 20160427_0c762ef1022bbb37318c3cabbfcf67c9.js, 20160427_1288cf45255fb8478fc29dcbf39b5d22.js, 20160427_16ec08b2dd250259eb204aa5a91f01d9.js, 20160427_17db2c12c8697a427fe29907d7015728.js, 20160427_1bd29011d363323bf007e919941afdb2.js, 20160427_2d9a814c5fe2e4b31efaec3ca761f4cf.js, 20160427_2ff0fa7e7de707dba3337aea229e252a.js, 20160427_310c6828bca855714cfc9a6d37c7c3f0.js, 20160427_37a1cdc70fd55bd8a1bcfbbf387c1db0.js, 20160427_380901857bfbc73f15cf8b208bd012b3.js, 20160427_3f4fda43f68b1cf0350e3e187e2f1d28.js, 20160427_413243b8b645883d4e33a725e2c8b734.js, 20160427_41c3e24957b0823447be6d420fda2259.js, 20160427_4410b2dd1ea1fc668877948352a34971.js, 20160427_459cedb7f37e0c2461010d6fb1389a44.js, 20160427_4944ae332825d6c2cc186856f6d8f442.js, 20160427_495f4c1e59d75ad73b29aa0b89038b46.js, 20160427_51321e27cb30cb41fb8d5744489ed3e7.js, 20160427_56a599b7058eb0dabb9b7b2a2d453cc1.js, 20160427_5edd4ed4754f6fc2cf3fdd36ba003467.js, 20160427_66cab1e1d80e802076594ccadef7a2fa.js, 20160427_70ccd08602ae383d546657b2dda92775.js, 20160427_70f30d42ff2692b7f4209ddc7d100227.js, 20160427_7210f8c9bf89704b9c71b0a6e3abe700.js, 20160427_74e31e28968697dc84baa7502eb1023b.js, 20160427_76113341ed28976630cc319b46d26c8d.js, 20160427_7667d2a5286d448068c2e6453d572d72.js, 20160427_7bc5b1aa7b71fd8eadf781b4c1bb7213.js, 20160427_7c8be1df2cc4bb21c9c88d669b3a5309.js, 20160427_7e2ca2d6aa82a7f88f74fb86239cee56.js, 20160427_8a7977b2ca395d39b59472d6b4b1871b.js, 20160427_8ba2bb43cf2c848d0ffae3885f30ba8d.js, 20160427_8c6aef15587b04d41f8d50a6ce807abd.js, 20160427_8d2fced5d619a8841e471055c1bfc2a8.js, 20160427_909bc6f42844d609bfc955a09e07a933.js, 20160427_919e6c8a5f846b2d378ee3d9b7903707.js, 20160427_921c499199fbd7f023506fedc5215849.js, 20160427_93d9c3ac57f1a2cde8609d88da193215.js, 20160427_94035dd261be3a69644b102f19258152.js, 20160427_986d9b2eba14260bd958b5681a3798d9.js, 20160427_9ccbcccf1bd757835c49e138aef823d6.js, 20160427_a344d562f9e881b08ab92ec35c2ac275.js, 20160427_a4a023d9b54ac8d9e35fd1f88d58bf45.js, 20160427_a6f51831a4ba52b6a925305ee2b20898.js, 20160427_a78b9099a0788bd0b12048e6e7e0d69a.js, 20160427_a9aa6f4c6ac792b8233f4bd16fd30e4f.js, 20160427_aa988bcf998c3dbafc4aba17427c20e1.js, 20160427_ab9e9007b69f46d5a68c3275bc88c9d6.js, 20160427_b00402dd273a137eb8dd964d7467c1fd.js, 20160427_c1f492cf9a0626f9de48f74a770b9cc4.js, 20160427_c4450419c7d633dcceb6bf2ad458c51c.js, 20160427_cb24b2a0ba8dc6f5f427424e027b3ece.js, 20160427_cc7c4cf72c06da70594747f4718245a2.js, 20160427_cc89d9673bac8fc760e09602323e23d9.js, 20160427_cd6504facb8e52efa217d2190983994f.js, 20160427_cffee675f87d07bf0e82bd650798e3f1.js, 20160427_d9295e200d2dc0b1d705d94b646af608.js, 20160427_da36e56e5073480f8ead5af72719a25a.js, 20160427_dd62329486b0b214edcf3d930f74f70a.js, 20160427_e6b5e17fb85099be38fed89d0de7624e.js, 20160427_e8bd9cdc8fe78f068a3825475ad5c1fb.js, 20160427_ea8722908c3481d64617890f36cd1275.js, 20160427_eb418028d572fafc18512d3f3b2ab7f5.js, 20160427_ebae6924e1eb82a7c19ea5acc4535d7a.js, 20160427_ef478f87f808bfe106b09b7702fbddff.js, 20160427_f3b58dbe5bc38192d1d44b9220dd0e0e.js, 20160427_f6ec89fce247c593242cb0872402762f.js, 20160427_f754a9920be3106f76fea45eb38d53c8.js, 20160427_fd6be84697f2a285c7c57bc7cac2ca8c.js, 20160427_fe784109e21f6456973a25575485563f.js, 20160427_ffb19a8165fc04e34b5edbf38d463c2f.js, 20160428_00cd550e80fb3bd454bf47f7c7e16392.js, 20160428_032b2274eaa6ffe6cf8777d338b07c4c.js, 20160428_0a6401511d723332fd1b0c7b61fa8b7c.js, 20160428_0b06bdd2cf581e4e26d46ec7a8546969.js, 20160428_0daa805e05c1b8fc28083441e077f3ab.js, 20160428_0df0fe638c1cdd7ef42205eed51a6d6a.js, 20160428_0fca56842036a99db4f38dff917caeb6.js, 20160428_11400d83760def4d8943c08c860e9364.js, 20160428_182868cad5bcb428e1b2fbdb5a440e2d.js, 20160428_1aca1e5fa1cb547f7714f6f2b129eeda.js, 20160428_1b50fdc1ae27452c5b6ff1c0fc19c1ef.js, 20160428_1e9b9d3a1d857866293b9f07a6d2fb16.js, 20160428_2480b3a7fea7b60cd0c571de0fc75e9c.js, 20160428_2d9f2940579cf90d595277a285454fdf.js, 20160428_30732d83206b3a46742e3ececfe3cf7e.js, 20160428_326c8a7fc04f011627d760cf359ead3e.js, 20160428_379a37be4b67e2146bb5dcdf84f4f8ca.js, 20160428_39f3407232c2af924be6f6725106c1b4.js, 20160428_3eb7c8a4428588c81f5f64cb73d73831.js, 20160428_40cfc063560974c916c508cadd65e592.js, 20160428_425de5e55401a736f81d5ce4358b56d8.js, 20160428_486b3cdcde7d14ed9f0f37c9ac60dd67.js, 20160428_4a3af9babc62b83ea795f454618a1c46.js, 20160428_4d826d44ddd2253487b473925d8bf245.js, 20160428_4e75cfa16b112346c66b9210e4f1ac11.js, 20160428_4ec46cc3eccbc3253e60d9ef31d49ce7.js, 20160428_552a61e9db580170f92bd08770a0350c.js, 20160428_579547429b6b9f6846bb1dddc71c2c5f.js, 20160428_5c8f766660b5441ad5682f98fb4a016c.js, 20160428_62fa0fb7538ddb6d39db29121ec2179a.js, 20160428_63794a7dc0a1ca5abf6f13077ab9745b.js, 20160428_63a45a96f506effa35b0af8432a66eaa.js, 20160428_681d188c19190c7df8090972f746158f.js, 20160428_701cdf5f1a9f8f2c7310d622f99477b9.js, 20160428_731eee074d05252f4a9b239e75721d5c.js, 20160428_758a9ae5554c8edd7cedbd4983bbb5dd.js, 20160428_7b01768c84622c209ce05f37ef5da790.js, 20160428_7cad62cb5fdbc9b54072c42ab09d4676.js, 20160428_7d90d6a20ead1b85d9a8636b5ccc969b.js, 20160428_7e1a7c40eae8439bd22b8ad98004c919.js, 20160428_85172380929a334e08e6203bf77e8818.js, 20160428_856c3480ae03248a7d5754924b773793.js, 20160428_8795ce0bb42cff12832c526ebae2a964.js, 20160428_8f1fa411d8c137294ef9ded51a985027.js, 20160428_909b4bda48a99d9f909b3696b813f15a.js, 20160428_90d7ac5c4cfae206f957c451c790b4db.js, 20160428_9a28fdbfba78f91de5701477a0fe0bad.js, 20160428_9d119cc38a065a6f9f48ffc53d3c42fc.js, 20160428_9eeb4c95007f908c5aad44d52d6f3204.js, 20160428_9f0635fb2b581d5e0f7d4bb964d693f0.js, 20160428_a00e6ae5aa5256ffc15fdb9207989e83.js, 20160428_a1b6312893fa75a0bf02ba0de2b3abc7.js, 20160428_a1c11b96e7d1a6ba69bc8bc29bdb30a4.js, 20160428_a8d3655f038f61e925a6403046535196.js, 20160428_aa086b0be78e22359a25c58ea416cc25.js, 20160428_aaae0a20c3a356a4f075153b6183f08c.js, 20160428_aec174e754a7ea5e655f58a487149e89.js, 20160428_b051c36b2915d9988908c991037309a7.js, 20160428_b38bb64deb4ebc37e373be108f0faf54.js, 20160428_bbe48bc299909583eae3bb758ab2070a.js, 20160428_c0c45192cf4fe5b38f0109291bccd859.js, 20160428_c24cba97f1a6039ea07fcbd20476d394.js, 20160428_c5f19a864a50c87c0c440a55b8c926c3.js, 20160428_cbfc22154e2a0df77d186b57a34aa052.js, 20160428_cc9ca27fc74d7e26b01cb75e29f3e5e4.js, 20160428_ccc08af5381e7f896409e8a83a5fc07d.js, 20160428_ccea1abd6e840a213d6fd5117f092f94.js, 20160428_cd00aec5d724f65f7fe5eb8b0cca620c.js, 20160428_d7e1bd335bd4e7888d050e29a40eb82e.js, 20160428_d99d639ba9051f97b7da1fd25a2da695.js, 20160428_e4f91080d2bf7fd4362c3666d7546d22.js, 20160428_ecc611e1b85ec08e4d8bd4ca4cd2a21c.js, 20160428_ef05ccb2bea29e2eb39cb147b72f9722.js, 20160428_ef12b00a0ea33372cbfb93b7c3986756.js, 20160428_f026622a65ff8f878bb4f025e7c78b07.js, 20160428_f1b7a238ff2eca640f2362118a2d7ac6.js, 20160428_f5d2a2c5ebf3c56701eff0a0afdb6356.js, 20160428_f67de5e854aa83cfcd6e2eed62b76859.js, 20160428_fd84c4a94df221f8c22120dbd2414a31.js, 20160428_fda418dbd713109c3c8f4df94836b839.js

rule _20160421_555dbd3303aa5e17f8349bf880458828_20160421_7284a898b6f9_787 {
  meta:
    description = "datamaliciousorder - from files 20160421_555dbd3303aa5e17f8349bf880458828.js, 20160421_7284a898b6f99c109507e2dd666cb1f6.js, 20160427_0c762ef1022bbb37318c3cabbfcf67c9.js, 20160427_1288cf45255fb8478fc29dcbf39b5d22.js, 20160427_16ec08b2dd250259eb204aa5a91f01d9.js, 20160427_17db2c12c8697a427fe29907d7015728.js, 20160427_1bd29011d363323bf007e919941afdb2.js, 20160427_2d9a814c5fe2e4b31efaec3ca761f4cf.js, 20160427_2ff0fa7e7de707dba3337aea229e252a.js, 20160427_310c6828bca855714cfc9a6d37c7c3f0.js, 20160427_37a1cdc70fd55bd8a1bcfbbf387c1db0.js, 20160427_380901857bfbc73f15cf8b208bd012b3.js, 20160427_3f4fda43f68b1cf0350e3e187e2f1d28.js, 20160427_413243b8b645883d4e33a725e2c8b734.js, 20160427_41c3e24957b0823447be6d420fda2259.js, 20160427_4410b2dd1ea1fc668877948352a34971.js, 20160427_459cedb7f37e0c2461010d6fb1389a44.js, 20160427_4944ae332825d6c2cc186856f6d8f442.js, 20160427_495f4c1e59d75ad73b29aa0b89038b46.js, 20160427_51321e27cb30cb41fb8d5744489ed3e7.js, 20160427_56a599b7058eb0dabb9b7b2a2d453cc1.js, 20160427_5edd4ed4754f6fc2cf3fdd36ba003467.js, 20160427_66cab1e1d80e802076594ccadef7a2fa.js, 20160427_70ccd08602ae383d546657b2dda92775.js, 20160427_70f30d42ff2692b7f4209ddc7d100227.js, 20160427_7210f8c9bf89704b9c71b0a6e3abe700.js, 20160427_74e31e28968697dc84baa7502eb1023b.js, 20160427_76113341ed28976630cc319b46d26c8d.js, 20160427_7667d2a5286d448068c2e6453d572d72.js, 20160427_7bc5b1aa7b71fd8eadf781b4c1bb7213.js, 20160427_7c8be1df2cc4bb21c9c88d669b3a5309.js, 20160427_7e2ca2d6aa82a7f88f74fb86239cee56.js, 20160427_8a7977b2ca395d39b59472d6b4b1871b.js, 20160427_8ba2bb43cf2c848d0ffae3885f30ba8d.js, 20160427_8c6aef15587b04d41f8d50a6ce807abd.js, 20160427_8d2fced5d619a8841e471055c1bfc2a8.js, 20160427_909bc6f42844d609bfc955a09e07a933.js, 20160427_919e6c8a5f846b2d378ee3d9b7903707.js, 20160427_921c499199fbd7f023506fedc5215849.js, 20160427_93d9c3ac57f1a2cde8609d88da193215.js, 20160427_94035dd261be3a69644b102f19258152.js, 20160427_986d9b2eba14260bd958b5681a3798d9.js, 20160427_9ccbcccf1bd757835c49e138aef823d6.js, 20160427_a344d562f9e881b08ab92ec35c2ac275.js, 20160427_a4a023d9b54ac8d9e35fd1f88d58bf45.js, 20160427_a6f51831a4ba52b6a925305ee2b20898.js, 20160427_a78b9099a0788bd0b12048e6e7e0d69a.js, 20160427_a9aa6f4c6ac792b8233f4bd16fd30e4f.js, 20160427_aa988bcf998c3dbafc4aba17427c20e1.js, 20160427_ab9e9007b69f46d5a68c3275bc88c9d6.js, 20160427_b00402dd273a137eb8dd964d7467c1fd.js, 20160427_c1f492cf9a0626f9de48f74a770b9cc4.js, 20160427_c4450419c7d633dcceb6bf2ad458c51c.js, 20160427_cb24b2a0ba8dc6f5f427424e027b3ece.js, 20160427_cc7c4cf72c06da70594747f4718245a2.js, 20160427_cc89d9673bac8fc760e09602323e23d9.js, 20160427_cd6504facb8e52efa217d2190983994f.js, 20160427_cffee675f87d07bf0e82bd650798e3f1.js, 20160427_d9295e200d2dc0b1d705d94b646af608.js, 20160427_da36e56e5073480f8ead5af72719a25a.js, 20160427_dd62329486b0b214edcf3d930f74f70a.js, 20160427_e6b5e17fb85099be38fed89d0de7624e.js, 20160427_e8bd9cdc8fe78f068a3825475ad5c1fb.js, 20160427_ea8722908c3481d64617890f36cd1275.js, 20160427_eb418028d572fafc18512d3f3b2ab7f5.js, 20160427_ebae6924e1eb82a7c19ea5acc4535d7a.js, 20160427_ef478f87f808bfe106b09b7702fbddff.js, 20160427_f3b58dbe5bc38192d1d44b9220dd0e0e.js, 20160427_f6ec89fce247c593242cb0872402762f.js, 20160427_f754a9920be3106f76fea45eb38d53c8.js, 20160427_fd6be84697f2a285c7c57bc7cac2ca8c.js, 20160427_fe784109e21f6456973a25575485563f.js, 20160427_ffb19a8165fc04e34b5edbf38d463c2f.js, 20160428_00cd550e80fb3bd454bf47f7c7e16392.js, 20160428_032b2274eaa6ffe6cf8777d338b07c4c.js, 20160428_0a6401511d723332fd1b0c7b61fa8b7c.js, 20160428_0b06bdd2cf581e4e26d46ec7a8546969.js, 20160428_0daa805e05c1b8fc28083441e077f3ab.js, 20160428_0df0fe638c1cdd7ef42205eed51a6d6a.js, 20160428_0fca56842036a99db4f38dff917caeb6.js, 20160428_11400d83760def4d8943c08c860e9364.js, 20160428_182868cad5bcb428e1b2fbdb5a440e2d.js, 20160428_1aca1e5fa1cb547f7714f6f2b129eeda.js, 20160428_1b50fdc1ae27452c5b6ff1c0fc19c1ef.js, 20160428_1e9b9d3a1d857866293b9f07a6d2fb16.js, 20160428_2480b3a7fea7b60cd0c571de0fc75e9c.js, 20160428_2d9f2940579cf90d595277a285454fdf.js, 20160428_30732d83206b3a46742e3ececfe3cf7e.js, 20160428_326c8a7fc04f011627d760cf359ead3e.js, 20160428_379a37be4b67e2146bb5dcdf84f4f8ca.js, 20160428_39f3407232c2af924be6f6725106c1b4.js, 20160428_3eb7c8a4428588c81f5f64cb73d73831.js, 20160428_40cfc063560974c916c508cadd65e592.js, 20160428_425de5e55401a736f81d5ce4358b56d8.js, 20160428_486b3cdcde7d14ed9f0f37c9ac60dd67.js, 20160428_4a3af9babc62b83ea795f454618a1c46.js, 20160428_4d826d44ddd2253487b473925d8bf245.js, 20160428_4e75cfa16b112346c66b9210e4f1ac11.js, 20160428_4ec46cc3eccbc3253e60d9ef31d49ce7.js, 20160428_552a61e9db580170f92bd08770a0350c.js, 20160428_579547429b6b9f6846bb1dddc71c2c5f.js, 20160428_5c8f766660b5441ad5682f98fb4a016c.js, 20160428_62fa0fb7538ddb6d39db29121ec2179a.js, 20160428_63794a7dc0a1ca5abf6f13077ab9745b.js, 20160428_63a45a96f506effa35b0af8432a66eaa.js, 20160428_681d188c19190c7df8090972f746158f.js, 20160428_701cdf5f1a9f8f2c7310d622f99477b9.js, 20160428_731eee074d05252f4a9b239e75721d5c.js, 20160428_758a9ae5554c8edd7cedbd4983bbb5dd.js, 20160428_7b01768c84622c209ce05f37ef5da790.js, 20160428_7cad62cb5fdbc9b54072c42ab09d4676.js, 20160428_7d90d6a20ead1b85d9a8636b5ccc969b.js, 20160428_7e1a7c40eae8439bd22b8ad98004c919.js, 20160428_85172380929a334e08e6203bf77e8818.js, 20160428_856c3480ae03248a7d5754924b773793.js, 20160428_8795ce0bb42cff12832c526ebae2a964.js, 20160428_8f1fa411d8c137294ef9ded51a985027.js, 20160428_909b4bda48a99d9f909b3696b813f15a.js, 20160428_90d7ac5c4cfae206f957c451c790b4db.js, 20160428_9a28fdbfba78f91de5701477a0fe0bad.js, 20160428_9d119cc38a065a6f9f48ffc53d3c42fc.js, 20160428_9eeb4c95007f908c5aad44d52d6f3204.js, 20160428_9f0635fb2b581d5e0f7d4bb964d693f0.js, 20160428_a00e6ae5aa5256ffc15fdb9207989e83.js, 20160428_a1b6312893fa75a0bf02ba0de2b3abc7.js, 20160428_a1c11b96e7d1a6ba69bc8bc29bdb30a4.js, 20160428_a8d3655f038f61e925a6403046535196.js, 20160428_aa086b0be78e22359a25c58ea416cc25.js, 20160428_aaae0a20c3a356a4f075153b6183f08c.js, 20160428_aec174e754a7ea5e655f58a487149e89.js, 20160428_b051c36b2915d9988908c991037309a7.js, 20160428_b38bb64deb4ebc37e373be108f0faf54.js, 20160428_bbe48bc299909583eae3bb758ab2070a.js, 20160428_c0c45192cf4fe5b38f0109291bccd859.js, 20160428_c24cba97f1a6039ea07fcbd20476d394.js, 20160428_c5f19a864a50c87c0c440a55b8c926c3.js, 20160428_cbfc22154e2a0df77d186b57a34aa052.js, 20160428_cc9ca27fc74d7e26b01cb75e29f3e5e4.js, 20160428_ccc08af5381e7f896409e8a83a5fc07d.js, 20160428_ccea1abd6e840a213d6fd5117f092f94.js, 20160428_cd00aec5d724f65f7fe5eb8b0cca620c.js, 20160428_d7e1bd335bd4e7888d050e29a40eb82e.js, 20160428_d99d639ba9051f97b7da1fd25a2da695.js, 20160428_e4f91080d2bf7fd4362c3666d7546d22.js, 20160428_ecc611e1b85ec08e4d8bd4ca4cd2a21c.js, 20160428_ef05ccb2bea29e2eb39cb147b72f9722.js, 20160428_ef12b00a0ea33372cbfb93b7c3986756.js, 20160428_f026622a65ff8f878bb4f025e7c78b07.js, 20160428_f1b7a238ff2eca640f2362118a2d7ac6.js, 20160428_f5d2a2c5ebf3c56701eff0a0afdb6356.js, 20160428_f67de5e854aa83cfcd6e2eed62b76859.js, 20160428_fd84c4a94df221f8c22120dbd2414a31.js, 20160428_fda418dbd713109c3c8f4df94836b839.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a3839eaae76072a9b0f8876581137ebfd4efa2d26e5018ddba03b103f829c882"
    hash2       = "5a6cad063d7563d3a4de388fc8ecc7fb9ad346d2d3485f94599e7798623e4c51"
    hash3       = "b079f62d4eddcfddf2fc77995a8b86a744cfe881ca7b9e272310573180d3d7dd"
    hash4       = "e49796b5541988fa66cdb30212bb80e27cec9c2c4edd1ebbb5aa6aba445566db"
    hash5       = "2ba40829401736a8b7a435ec3e0382005cbbdde9fabd428681deba829c572469"
    hash6       = "7fa1b647bcae3ee158692b39e691c2d07d2818497d18331af1cbe665eafd7f2d"
    hash7       = "5bf8520b55125c7d0c64224c00026144bfeee2cda29c0f29b5e42bbd7d9270d1"
    hash8       = "2a90230659501d7f72509bd3c37b12f8f48ed12db86d2d255c3b591302a33387"
    hash9       = "ea8a427d041402b9126534c201cb5de2541da13783e2f524c70c27d93ce4d5b6"
    hash10      = "85df7b46a53342a304499734166b8aaea975f578e521f92c54cf562d95ebec08"
    hash11      = "02389f9c8e45bf046044974fb34a14a8b34b239f219dee732c8bde5652d3b067"
    hash12      = "5106b67c8433ff2fd8526ec7945dd3bb05e0eaf69811fdd1b47bed1e497c550b"
    hash13      = "00bfd12c68b4426c59723b696b5c00607905db6407e8ed2923126b81a2a07694"
    hash14      = "b1cdfb1ac0c852ed831f98e3d6bc3b82d811b85c0e4d308cf5755ac0352b6e4d"
    hash15      = "48217cc6bb5276313d365406bda4654334d443c65ba28094352c364cad977d3f"
    hash16      = "24b10564425e9f581ef553b854c445f8e0b2b779060e9f1d83562c4c004824dc"
    hash17      = "df46a58280a7b28e3035e94b142820247fabc3a3659019059bc57e62eb11a622"
    hash18      = "2728054b09c687237fa63387d5446489e736cea5bff7bef874d7cae19c9b01b6"
    hash19      = "60eebc5899873996481e626da4e585a4e658689a60a358c339f9607a5496aaae"
    hash20      = "4d33dc121657aca06a648ca2ab86acb226761f75718cd68acf68e2d90b6dd514"
    hash21      = "538eaf5a3c7f725ace7312d9eed5cb95a816074c14e59ababd1d2508a6c8958b"
    hash22      = "3de04a82aa0660bdaaac6c208c4dda98b0d2c54d171bc264ddfaa25481eea5eb"
    hash23      = "cbfbdec662833f4930459708b65393ba461a47e07cd6546106c55f09c4a9a57f"
    hash24      = "12035e330130f557b6ee29f870e0de2d92beac1122e504945a65521b86a568c1"
    hash25      = "6f055d791c3974bbb068dd3180896870c0067abbdcef819ba07d1b4ee6f50aab"
    hash26      = "aace52f47e38c2e7d974412e40e3d1413ca0a54e5eadb56eaadae5159131df2f"
    hash27      = "0509ecd52ad6dffcf67ab1fc2ee6dcd23f190c1037a082eb94cb8e9b2dd17b8f"
    hash28      = "353dd5ef216696eab20ef0d673d4ce40f00e2de14c37e7a1a3682d3428362479"
    hash29      = "4f443a8e23f42a79b26f5ac1be4c104b76b48dd1ab6da0e27edc044933bb6943"
    hash30      = "2a436f3f67033d61dcb3dc6e16a2aec6bfe2b89e0babdb795736a7783b9647da"
    hash31      = "1977d5dc0001c11951365afae22be5c474b60dec367af2ea75e946d4f579bec0"
    hash32      = "ac60c0878cee1c57008ff6d6d9348b64024c7deadf4701bd08017f70ff7e65f8"
    hash33      = "1fd03f1368086030b855b0e7633ecd65b1256aab30fd7f49abab4707c7712d3c"
    hash34      = "3ee246f8e239bd7a761e2eafaebb0d59b48f02b927ccedfb382964291d53a3a7"
    hash35      = "1cf75bee348504e51f0f8b8ae3be139a86923c91c3ba7b946036d7bf48dba64f"
    hash36      = "242d814da352b1f341455ef4b823f8147f0e89280a20b1ada9333162b8bdca2d"
    hash37      = "84710dd58b9b3d2f3dbb4501e894943088d5eaeba0cb830588de06420fdd0f8b"
    hash38      = "233e127b56facbc31d8f71e7e34f643ffb50ae3902608c804d4cebf9c7ca4fbd"
    hash39      = "69a90701bbcae00e0e96c1863d8db07c9d3605f502d529bbd039f4047635570a"
    hash40      = "1f9a4a410e139b60c7ca51ac1a672068285921a7525d08c15129293b18a003f7"
    hash41      = "c042617b7e58611c9abdf9b51df71b4d8121bba68b2b14197e32745f5b83e9f1"
    hash42      = "bbe0e0f68f5f6184dadb09806b130604a8327a4c15ac4d84edff8308a65a0e26"
    hash43      = "f76e38c3ccc2a52db870883e44018e07d5a5be6eaa5fa93b5dc5df1bb7e4f848"
    hash44      = "7cf8755638209dda62abe66daec852befd8dc71f2fc2a90706f22770ac01b84e"
    hash45      = "f92fd3ad5f4476bb9aa01228d08324a78fcd83fa767358a6fb16070f1233fc42"
    hash46      = "f5d67d932b71c0a52ef5df65b14ca27e54b8bd4bfc20e83bc451d7998698b901"
    hash47      = "afd8b2818b27fac18bc42f691a0e3879fbba2edb7cd9c0db7abfced64da21631"
    hash48      = "6a899cc5873c4d69a244253f8be59c7610db3f90e5a4431c2202bee749eae808"
    hash49      = "085d926b88dbc7fd2c3b5b817197c54d96aa527941f836d38092f25dca1cdda4"
    hash50      = "f9c2ae5756d20d8a0900b0654b169e7fe05f7df7891c0b79f660672244353d92"
    hash51      = "c997cd0d17a574e21e0c77b043864f343c164195430561db3f47a4cff8776314"
    hash52      = "1f871086c140d5b80ab312844fcb7066b0ec8c171b72e665c6b4d2676a1971f7"
    hash53      = "95ed7805fd730e0bf2769d53009640b2f42740e8cbf5088fb4512c7e7b928831"
    hash54      = "51bcfa83c0724fdb167d2df607f72cbb1ef555e6dae702a0093ab94ed31fc775"
    hash55      = "f2c2e7e56e4e04346d6bc330ca23504ae542a29c4dab3cc3c8049cbe8bf407b3"
    hash56      = "ad180a3eda15994ef90c6965793cee11b26d0acc51215cc9cc6563606dd47fc4"
    hash57      = "f4adfbf55756f66cabca0eae1a4bb5996524a040b4eaa4dd3cf4415c3d205723"
    hash58      = "c25694fa91abd4cdf75857a1edec86cdb05dc147c26617a9cf682a0d69837958"
    hash59      = "241e358cfefe6fbf867b20da703564541b32d85845f5569cd6d2c4894d31ff6d"
    hash60      = "a952ee278df4a965b8f0958be62f70d5fe21e22de042be38b371c8b71618f545"
    hash61      = "00239b0959e61f9cdcfbb822eb06c9e625afd5199243f9b551e2bcc600bef7ec"
    hash62      = "1c4c8c79d2beec50ef849dd29be7a58776576d7d00a019a379439c2fa4761c42"
    hash63      = "2206fb5a3cd26a6edf3f58b4c4b9ffd7cd1ee52009726200ebe11e7f2c7fee73"
    hash64      = "af35e036e068d766f42630b28c07fbb31e1358937e822ac24d6bc523260e7283"
    hash65      = "f37192b4f7ed4da3f3ccb4d1dc54b876c10bef1456c0c32616589b78f8a04677"
    hash66      = "413e05508ccb891f3f190aaab542aed63184b2855e102f0054e76610298b4732"
    hash67      = "654a7d5c70d3b4469a1b43bdb71f383c621c165289ffbe28568350d3c7b1c05f"
    hash68      = "23a0e52dee578f1e89f3c41565899878de097802643d77a7b5ba0d0f529abdd4"
    hash69      = "720b999ca6d24811bb761a90c53086f20912743cbbbc1698cc1de27962472cef"
    hash70      = "3818c05aa168ddb555833c61f0599a1d51f5c06c66626a2496dd15b32cccccf1"
    hash71      = "16500862c129db2576187ac89d6ac78f9bc613891785958697a8156e531afe23"
    hash72      = "4f1218abdcd1d1293ae69d1a24551f96c9b4b43512d65f9facf0e63a9b18b29e"
    hash73      = "e4588181f607a81e6246f5fcb201bc9fd8fae0dcea82062b3ef338c23c43bf7b"
    hash74      = "fe9f366e9962f1434169020be3619983ddde9202dc71c33f6ebd4641f3e4a50d"
    hash75      = "8679a5796532035698b4be6a5f842ee5fb322754f1caac34d796d2364211e942"
    hash76      = "a7c8930951b1d060d8cca295e8f9c141c383a6d107e66cf913e0fd85d3b9d112"
    hash77      = "ad54190ed1367b8b5d7dfe0d58ab2fc0ddac69368e71a12b6eec56725ab2c95f"
    hash78      = "776e40c28bdbd075566f60b57a8fa6ce66684d9ebeaeca869e05d44ae371ff0d"
    hash79      = "2046cc154ab7af2bbffced254b29a5e7803069db457987863cdd548a58a7827d"
    hash80      = "79d2a237b6ad7823dff9453c5c0e9b952eb7f06652fe7df6aaccd6d39b5ac544"
    hash81      = "06dbe9884e5078ef55cde428476bccf4524f68863bb2f790e96d9d45f1150dad"
    hash82      = "025cbfd53a6b4f587ba88424bad36590d7bdd20647061fd2f8adf3aba5c6e839"
    hash83      = "1dd2e1e99e4f3d9073cae3631d339b58c6bb00d11ae84dce24919eaef700120e"
    hash84      = "e6d039a79b868790afe8a9dadaa10404a89de3cff04f28c239b6e5e120d4cb6e"
    hash85      = "5b1f14bcd9efaf019b813f99ee867a95f1e99d74dc027e4f619db015d0907869"
    hash86      = "3f4cc010fbc6f23fce02f1b43aab8969f70937c6a5318b0ffbe901dbbd429298"
    hash87      = "6df79e1aaaf6d0f696652f2b6a0990bf0773092a9d8c60d2e7bdab10b76fcdd7"
    hash88      = "3943cf0330f3f59ea32c0cfa982071d31e3c2d870a5e8175107305a5b94de869"
    hash89      = "041c1988ce7e47c0942c9d200a90914be84a8150523e8e308a586ae80209766a"
    hash90      = "30b7f273a360f94106e548f0716be14db895f5bc2d2f4609418c59b0752e4cdb"
    hash91      = "cbeb41d7be5a3992da00f16e9bccf7e6ec10d569de307f01bf7ca7e8add7601c"
    hash92      = "e364f1f0c43c851744d24765750e5735ae2ebc4aff97af948b8024c4b98f34db"
    hash93      = "a840d59c7ae84f440e8abfc1477f0ffd75900a9689820141d9dfe98e274e82ea"
    hash94      = "3ca0d4e46683a9f02d833eb760a2eb17612f938bc4baee23dcee39fd2c18b95a"
    hash95      = "e96a285ce2c62d1b9532e36501b128d1d11564a8cf8349bf4480db2a2bcd1c76"
    hash96      = "75fd4e42d443fbea1e6e0c173c6c8db8fdc5ba9b64fb4d01e9e49bbc8aa435a3"
    hash97      = "7fe379a09ac994927d9229a2fb873754871ba10fe6d578edf713b341f51b4b60"
    hash98      = "719250931bbf5adcab9560e91b6d05f533fabe3fc631f2a71f5f3f1387ee4256"
    hash99      = "984a7fce4294a11b1a3badbd80e4b5b099a2d87ae680cb21d10f282a0249f7dd"
    hash100     = "07520f799a385e0898b520c6ce43368332c20ce6cb7f96d5b375ef9b36df8bf4"
    hash101     = "10e623965b6ee1aee86658ab70b23e07ed91cc8204c72cdc43b90225933f3c22"
    hash102     = "1ea69405ad38cad8e091db4792cc75fe56b09f6b7f4f82ce5148911eca4fec21"
    hash103     = "376f6e955827ea199e210cb369a2569f3d99f5383e3f78fe9cb9e4b8ccda1441"
    hash104     = "2deb044e6862a15fdcdca66fea0a65b9f47c15be8787a6afc8afe5fe2668ea98"
    hash105     = "717cc2366019e4ec7cc44b66432ba6424e85955c589dd297ba2c5636845d80a0"
    hash106     = "12679eda90f0a0211e1c96fcc2a0fc86ac130df6a36485e197dcf7044df76a72"
    hash107     = "67c63249ad720d16a5f26a18ab5a909dcbcf6811afcadd72c55485bc09300718"
    hash108     = "43eb58f799f06ca6715cb684c0ac18f2db14273b4eab793978a8eb4629bd06aa"
    hash109     = "4f04e0b39616a1505cac58cc2c89fa99d61ec2e34eb7f662fa906a5d87c885ec"
    hash110     = "bd3eee8d16601da6300fc09640e07831069c7e983f6d416d95e9fcc66a9b2157"
    hash111     = "4f89bd32a15753ed8c3527ac6bd32844fbc9c6e599a3fc2974efeff3174ac173"
    hash112     = "a9a1bdec8e8410ef6cf9813c685f099ada35c7ba7e2e2385e785ea73063dfa8c"
    hash113     = "441f8fb795ff48e8ca05f092c27376aa9b60fbc980e23d7f73023cac435d3fd5"
    hash114     = "c34bee1a8a9349274400390b9266696eca1a338bb5368464f0dfda73ffd3cb4b"
    hash115     = "ed43f2bcce6f57730223fdbadde00ed4e23955d1cbd2ea115f19f08e2bdfc81e"
    hash116     = "4838996362cbf6bd53b574b0bf7e192a2f76160d618a70208ad85fc91aa82df9"
    hash117     = "2635c678f58bc0d25c1f68f58d74f075b6079961bde5e71da0d1352cb376af63"
    hash118     = "8cd21235cf4427489fc1be788033a74fb4872a522adc0bf6ecf0a34a1f8c72bd"
    hash119     = "656acbcc7c0c9d1301bff339a33bf94d6f2719770fb4b71ef400ea7822914452"
    hash120     = "30913cfadf629705afca03247b6741ad07b64d4ae02b10def08bfcf6947f5235"
    hash121     = "79df3c810abdff91a4a9efae4d14efa6ca1bb8b639b4620749ed431cb02059ca"
    hash122     = "9e088a541cb368524ae76de8b4fba8c672bde115a940fdbae8323033dafc4d38"
    hash123     = "dfc7ca3b45be101d2bcee3d4f46f70ea41878258e2e75f69083683c46f0372dd"
    hash124     = "066c7c85a6e6d64807e991071593463184263991aa86acc880fd788a510eb72d"
    hash125     = "1207a69359bc35ea5fcec7620162c0cfe901c780f61754a06c1f122f88fe2e07"
    hash126     = "2cf021a93dfe867c4255e9c2cadcd97d74f438f89624dc88835545a1b070402b"
    hash127     = "5929c905977b10115ea7bf59095c91d7f29fda8bbacf1b2446a7d64753adc014"
    hash128     = "27f0b64d822edc39adf9ce3b69fbc7d5cff1eb8a19f7b6084d5fc19df38c188f"
    hash129     = "de8f8f936d98bc0d0b4d3fd3174b55c8d6f232f927d751ff2f9cf60d855ae232"
    hash130     = "dfebdd225f3c0204f07212cabf3621dc1d7bce42e8911a0ebdedc9e6b54577a7"
    hash131     = "287dbfd89200683dd1a55d8cb50821447f38d90bdc759aca654a6aca23e97584"
    hash132     = "a87facc99a7fce2203e0f860b6e2ad9f8304d1af09e49fc621649cda0dd18965"
    hash133     = "d56fbb3ec839b4962ddb584d189e3eee81bef1176d60d566d15a238756329495"
    hash134     = "f997f5ebcf8e8e39568e80f72b70f5c10e9d891a742630dc82630ba8630a16ff"
    hash135     = "5c7632864b8f7dad69d99f37258da66cd9f48acb46d85e1abc03a7c87a5edaaf"
    hash136     = "0083abf8df60a15dc99b0b67d9a90429c60a26e8f6b3ae78362d027b194f8f52"
    hash137     = "8b06f3c544a9b2257a81b99068fe2f2df81fefbfc5269e31a246826565ee5b4b"
    hash138     = "80d16d3d47ef1c904b34d6aa063b3e7ea67c36f94637d91d9dd7e66d20647177"
    hash139     = "e2b3f3ff2f3c1cffb0cd0cce0feebeb66ad0e8ca9fb9280db3ef1c4084ee94c3"
    hash140     = "268caed7177b286964a6abcbd38eab3326d03934fc3e342cbc8acf86aded9375"
    hash141     = "6bb92b37bf2ac9ce042891d4a150c528cff7b5626864bc15bc170d7de94445ee"
    hash142     = "a077a08c7f158824936e6eff83dce0e9996b2c7ede6db0fb8f158b7165008357"
    hash143     = "9ec97c04652dee8bdf971924c265a7bfe92294661a4bb46d942ed9177f9980b9"
    hash144     = "420cc90fff574f7c1c7382c98fbbd4f804a13065a411c42075ca757c8358afd5"
    hash145     = "24389d67c60887fbc0cb9f86c6c0ff2c8e8768a92ad578a338fed73049bdf517"
    hash146     = "ce1fec8dcf685decd7048cc22055d0e2100e0026badf1e583b439e269abb3df4"
    hash147     = "3ab658d70cc329cfee15dc3d207eb9a8a7ed2451655b46ee534a50476ae7e306"
    hash148     = "6b575e972099593241e5394756a9bda9b2dc60f90c504411b8a6960f96bfbaae"
    hash149     = "eda654a47310c3971c5025a7f63602cdd0523431076687237e3d340fd399dd8f"
    hash150     = "b43919c050f00ca8ee610c9f3270f502cabc19d892c8ba0e3c253b2c264f6af4"
    hash151     = "ed2d37ccbde43b9582163df9a9abe703048007bf26b4e1d52ad560a1604aaaf7"
    hash152     = "d40c5e9e6e49205e1f07c05921004dea68c810936a5ed84f277eea76c423b93c"
    hash153     = "274877393abbda5927f45a035ff5b9f6d453f74733f9279fcf59a790611d6292"

  strings:
    $s1  = "        vwfUqxPgROU = \"} Manually add leading whitespace removed by IE if ( !support.leadingWhitespace && rleadingWhitespace.te" ascii
    $s2  = "OdFlSAi = \" Deserialize a standard representation tag = ( rtagName.exec( elem ) || [ \\\"\\\", \\\"\\\" ] )[ 1 ].toLowerCase();" ascii
    $s3  = "OdFlSAi = \" Deserialize a standard representation tag = ( rtagName.exec( elem ) || [ \\\"\\\", \\\"\\\" ] )[ 1 ].toLowerCase();" ascii
    $s4  = "        qOlbRvvl = \" String was a bare <thead> or <tfoot> wrap[ 1 ] === \\\"<table>\\\" && !rtbody.test( elem ) ? tmp : 0;\";" fullword ascii
    $s5  = "eliFWuDIYcN = \" Convert html into DOM nodes } else { tmp = tmp || safe.appendChild( context.createElement( \\\"div\\\" ) );\";" fullword ascii
    $s6  = "        vwfUqxPgROU = \"} Manually add leading whitespace removed by IE if ( !support.leadingWhitespace && rleadingWhitespace.te" ascii
    $s7  = "var hydrocodone = furthermore[exclusion](commiseration.shift());" fullword ascii
    $s8  = "var overlaid = giuseppe.pop().split(\"" fullword ascii
    $s9  = "var exclusion = commiseration.shift();" fullword ascii
    $s10 = "var furnished = new proportionate(overlaid[0]);" fullword ascii
    $s11 = "        PvVKiw = \" j = elem && elem.childNodes.length; while ( j-- ) { if ( jQuery.nodeName( ( tbody = elem.childNodes[ j ] ), " ascii
    $s12 = "        PvVKiw = \" j = elem && elem.childNodes.length; while ( j-- ) { if ( jQuery.nodeName( ( tbody = elem.childNodes[ j ] ), " ascii
    $s13 = "        var continuity = hydrocodone + \"/\" + jason + commiseration.shift();" fullword ascii
    $s14 = "holding = \"b\";" fullword ascii
    $s15 = "var slothful = 0;" fullword ascii
    $s16 = "        dfwAan = \"} Remove IE\\\"s autoinserted <tbody> from table fragments if ( !support.tbody ) {\";" fullword ascii
    $s17 = "    AqqiwAoypAm = \"} Remember the top-level container for proper cleanup tmp = safe.lastChild; } } \";" fullword ascii
    $s18 = "   cvqiFiqxJ = \"} Fix #11356: Clear elements from fragment if ( tmp ) { safe.removeChild( tmp ); \";" fullword ascii
    $s19 = "    WnAGqyQ = \"} Remove IE\\\"s autoinserted <tbody> from table fragments if ( !support.tbody ) {\";" fullword ascii
    $s20 = "var escapade = (cards).reverse().join(\"\");" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6a70b408-decc-4ae3-8f3d-bcdd2e95c4d7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion