_20160921_14f99bec2c2ed0c000bf0acbf6c2260c_20160921_3e524aa8d0a1_803
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_14f99bec2c2ed0c000bf0acbf6c2260c.js, 20160921_3e524aa8d0a18c87370a789c7bba4fc5.js, 20160921_b5e2b5a2e8f104e719b3c6631c08f1f7.js, 20160921_e59567324a545ca23bf9e3ba990b6526.js
rule _20160921_14f99bec2c2ed0c000bf0acbf6c2260c_20160921_3e524aa8d0a1_803 {
meta:
description = "datamaliciousorder - from files 20160921_14f99bec2c2ed0c000bf0acbf6c2260c.js, 20160921_3e524aa8d0a18c87370a789c7bba4fc5.js, 20160921_b5e2b5a2e8f104e719b3c6631c08f1f7.js, 20160921_e59567324a545ca23bf9e3ba990b6526.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "224106b166fc0a998ec1d58e5d4a78c585bdeb76194d93210753d7d0f558c06b"
hash2 = "71a83b86275cb43222066a6d27dfb98cdd9fc8283b2b007f9262c38686262b9a"
hash3 = "8495e7e7fc77026b5e5681ac973eefb0561cb5cce78632996de59641ce00258e"
hash4 = "ce1d8f63fc8c7b91e97f36fa89b000d70fc284d08682ca3a91ee6c2a4e6e2c72"
strings:
$s1 = "n \"MKa\";})(),(function f000(){return \"Ot\";})(),(function f000(){return \"KZr\";})(),(function f000(){return \"Zj\";})(),(fun" ascii
$s2 = "(function f000(){return \"Sq\";})(),(function f000(){return \"WIj\";})(),(function f000(){return \"PTi\";})(),(function f000(){r" ascii
$s3 = "\"PTs\";})(),(function f000(){return \"TKp\";})(),(function f000(){return \"Lp\";})(),(function f000(){return \"Zj\";})(),(funct" ascii
$s4 = "\"PTi\";})(),(function f000(){return \"Lo\";})(),(function f000(){return \"OUx\";})(),(function f000(){return \"Uo\";})(),(funct" ascii
$s5 = "0(){return \"ZIi\";})(),(function f000(){return \"DAp\";})(),(function f000(){return \"Tn\";})(),(function f000(){return \"RPt\"" ascii
$s6 = "n \"Lp\";})(),(function f000(){return \"Qj\";})(),(function f000(){return \"Lp\";})(),(function f000(){return \"GGn\";})(),(func" ascii
$s7 = "0(){return \"Ot\";})(),(function f000(){return \"Ot\";})(),(function f000(){return \"Go\";})(),(function f000(){return \"ZIi\";}" ascii
$s8 = ";})(),(function f000(){return \"ZGq\";})(),(function f000(){return \"DYx\";})(),(function f000(){return \"TRc\";})(),(function f" ascii
$s9 = " \"Km\";})(),(function f000(){return \"Zj\";})(),(function f000(){return \"MMz\";})(),(function f000(){return \"MKa\";})(),(func" ascii
$s10 = "unction f000(){return \"Do\";})(),(function f000(){return \"TKl\";})(),(function f000(){return \"DIa\";})(),(function f000(){ret" ascii
$s11 = "n f000(){return \"MDb\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"MBb\";})(),(function f000(){return " ascii
$s12 = "\"KXg\";})(),(function f000(){return \"Lp\";})(),(function f000(){return \"DIa\";})(),(function f000(){return \"MMz\";})(),(func" ascii
$s13 = ",(function f000(){return \"GGn\";})(),(function f000(){return \"KDh\";})(),(function f000(){return \"Oh\";})(),(function f000(){" ascii
$s14 = "urn \"GGn\";})(),(function f000(){return \"ZIi\";})(),(function f000(){return \"DYs\";})(),(function f000(){return \"YTp\";})()," ascii
$s15 = "ion f000(){return \"Mu\";})(),(function f000(){return \"Lp\";})(),(function f000(){return \"OMd\";})(),(function f000(){return " ascii
$s16 = "(),(function f000(){return \"HJm\";})(),(function f000(){return \"YTp\";})(),(function f000(){return \"XTn\";})(),(function f000" ascii
$s17 = "unction f000(){return \"Tn\";})(),(function f000(){return \"TKp\";})(),(function f000(){return \"GGn\";})(),(function f000(){ret" ascii
$s18 = "ction f000(){return \"Iq\";})(),(function f000(){return \"Do\";})(),(function f000(){return \"OUx\";})(),(function f000(){return" ascii
$s19 = "ction f000(){return \"Wb\";})(),(function f000(){return \"DIa\";})(),(function f000(){return \"GGn\";})(),(function f000(){retur" ascii
$s20 = "{return \"Sj0\";})(),(function f000(){return \"WIj\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"RLk\";}" ascii
condition:
(uint16(0) == 0x2f0a and (8 of them)
) or (all of them)
}