_20160921_02b826231ece268e91633311d2c70554_20160921_033cb159a631_809

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160921_02b826231ece268e91633311d2c70554.js, 20160921_033cb159a63153428b22d38108b692e4.js, 20160921_13a6ecf7a8d1b8c1e6c88d1f386d0fdc.js, 20160921_1568884c6d02cf213af1fde1314e5834.js, 20160921_18f3e0383dae972ccd3326bfeb339081.js, 20160921_220036ca1d4152e6bd72a833a4b3f832.js, 20160921_2746dcb029094ed409681059b0bf7b68.js, 20160921_331df381948e6d95c6a9496aeda63d16.js, 20160921_346ce24842d4c67049d4ae8a4ef57f0b.js, 20160921_42c93aee0243f217ab1a00a402ced889.js, 20160921_4357cd536e8c7d04b6d87c9010da5db8.js, 20160921_46b3ab412369507850a916abad1e6bf0.js, 20160921_4c22609fd7310d7f415ca007620a244b.js, 20160921_4d4f88bcbe1d7c27849018b54d3401d0.js, 20160921_539bde925d7d117e6c387c1b32dd397b.js, 20160921_582a5b9e6263457a7095e1d0bf6ab96b.js, 20160921_63def3fff7f150b1f60fee716b458fd6.js, 20160921_6ca29d2ebdcaa2724b801c02414faf7f.js, 20160921_6ed03f6116d83dcb603f8d7a421669a9.js, 20160921_6f40563df6afd13be332d60057d492bb.js, 20160921_71668d4dffd1de11d5c597a2f98e2266.js, 20160921_72cf8bebbcf48b45894fe7d7b3327a58.js, 20160921_7a3c07ee9b5aeabadf2f6cce951819f0.js, 20160921_83a4b9dfccb435ab7121b53e70b2bb23.js, 20160921_8a6f0879f250e6c15d2c7fa51d20505b.js, 20160921_8b0f3892ae56f8c06d3baa62c262a12f.js, 20160921_8dac417cb4331fdefcd724e5c4563731.js, 20160921_95270bbacde4afcb3c799d7a0643809d.js, 20160921_970f1dd445269cda0ba5e6f9fd675983.js, 20160921_99d82d33214407e421e255b85f02daae.js, 20160921_9dad243650b7872772e7037b467b5a2e.js, 20160921_a31336f192353e1997fed06b582e1aef.js, 20160921_a3256642bcc1ce0dfec8677fe62bc590.js, 20160921_b15ce64784b080eff109e1bd1b00ebf6.js, 20160921_b2002e7f99c6e0351a90c5fe98b8b775.js, 20160921_b2c7637ff56cbf278f1a457ae1833df9.js, 20160921_bcf3911462135150c96c6b8eccf51628.js, 20160921_be882ab89423f06a9e76ba0cb72775fe.js, 20160921_c459056d51b1a4ea3176139800021b35.js, 20160921_c6163df7a6dda28826544197fc8ddc4f.js, 20160921_c9a772728edf4eeff48c1aea32c00a13.js, 20160921_ca70c2e5223139fb829c45d71c694e10.js, 20160921_cbfbdc544b309301bc71d300d7726545.js, 20160921_d47b4a8df4397da0f8d93fe0d9eeb14b.js, 20160921_d6dc24b88112bfdeca39a6062c7510f7.js, 20160921_d6eab67b6b3cec2e5f5426840b084b70.js, 20160921_da68ef3a64fe9761a5f4505bcaef8f82.js, 20160921_dc989bc33de845eef9826b241e933829.js, 20160921_dff46b67b973e99ec02248f10c2f55c2.js, 20160921_e08237183b6bb8840bdab8df29dc62ff.js, 20160921_f0a3d5a403f0d7386ada786b887a464d.js, 20160921_f11c35e3159325debfd0a307299c4087.js, 20160921_f3a36d70a83646fa6d4f183bc8e1b1c7.js, 20160921_fb6312e3d81966654b016b9b32d471ac.js, 20160921_ff1932b6e91481dd80ff6251296b57fe.js, 20160922_99c635a67f8963210ce99c7a8cf9cd6c.js, 20160922_b22dda4c9fbc74ba5e251fc3110ada5a.js, 20160922_edfdc00dbdbb7dfd43478925b51e4a4b.js

rule _20160921_02b826231ece268e91633311d2c70554_20160921_033cb159a631_809 {
  meta:
    description = "datamaliciousorder - from files 20160921_02b826231ece268e91633311d2c70554.js, 20160921_033cb159a63153428b22d38108b692e4.js, 20160921_13a6ecf7a8d1b8c1e6c88d1f386d0fdc.js, 20160921_1568884c6d02cf213af1fde1314e5834.js, 20160921_18f3e0383dae972ccd3326bfeb339081.js, 20160921_220036ca1d4152e6bd72a833a4b3f832.js, 20160921_2746dcb029094ed409681059b0bf7b68.js, 20160921_331df381948e6d95c6a9496aeda63d16.js, 20160921_346ce24842d4c67049d4ae8a4ef57f0b.js, 20160921_42c93aee0243f217ab1a00a402ced889.js, 20160921_4357cd536e8c7d04b6d87c9010da5db8.js, 20160921_46b3ab412369507850a916abad1e6bf0.js, 20160921_4c22609fd7310d7f415ca007620a244b.js, 20160921_4d4f88bcbe1d7c27849018b54d3401d0.js, 20160921_539bde925d7d117e6c387c1b32dd397b.js, 20160921_582a5b9e6263457a7095e1d0bf6ab96b.js, 20160921_63def3fff7f150b1f60fee716b458fd6.js, 20160921_6ca29d2ebdcaa2724b801c02414faf7f.js, 20160921_6ed03f6116d83dcb603f8d7a421669a9.js, 20160921_6f40563df6afd13be332d60057d492bb.js, 20160921_71668d4dffd1de11d5c597a2f98e2266.js, 20160921_72cf8bebbcf48b45894fe7d7b3327a58.js, 20160921_7a3c07ee9b5aeabadf2f6cce951819f0.js, 20160921_83a4b9dfccb435ab7121b53e70b2bb23.js, 20160921_8a6f0879f250e6c15d2c7fa51d20505b.js, 20160921_8b0f3892ae56f8c06d3baa62c262a12f.js, 20160921_8dac417cb4331fdefcd724e5c4563731.js, 20160921_95270bbacde4afcb3c799d7a0643809d.js, 20160921_970f1dd445269cda0ba5e6f9fd675983.js, 20160921_99d82d33214407e421e255b85f02daae.js, 20160921_9dad243650b7872772e7037b467b5a2e.js, 20160921_a31336f192353e1997fed06b582e1aef.js, 20160921_a3256642bcc1ce0dfec8677fe62bc590.js, 20160921_b15ce64784b080eff109e1bd1b00ebf6.js, 20160921_b2002e7f99c6e0351a90c5fe98b8b775.js, 20160921_b2c7637ff56cbf278f1a457ae1833df9.js, 20160921_bcf3911462135150c96c6b8eccf51628.js, 20160921_be882ab89423f06a9e76ba0cb72775fe.js, 20160921_c459056d51b1a4ea3176139800021b35.js, 20160921_c6163df7a6dda28826544197fc8ddc4f.js, 20160921_c9a772728edf4eeff48c1aea32c00a13.js, 20160921_ca70c2e5223139fb829c45d71c694e10.js, 20160921_cbfbdc544b309301bc71d300d7726545.js, 20160921_d47b4a8df4397da0f8d93fe0d9eeb14b.js, 20160921_d6dc24b88112bfdeca39a6062c7510f7.js, 20160921_d6eab67b6b3cec2e5f5426840b084b70.js, 20160921_da68ef3a64fe9761a5f4505bcaef8f82.js, 20160921_dc989bc33de845eef9826b241e933829.js, 20160921_dff46b67b973e99ec02248f10c2f55c2.js, 20160921_e08237183b6bb8840bdab8df29dc62ff.js, 20160921_f0a3d5a403f0d7386ada786b887a464d.js, 20160921_f11c35e3159325debfd0a307299c4087.js, 20160921_f3a36d70a83646fa6d4f183bc8e1b1c7.js, 20160921_fb6312e3d81966654b016b9b32d471ac.js, 20160921_ff1932b6e91481dd80ff6251296b57fe.js, 20160922_99c635a67f8963210ce99c7a8cf9cd6c.js, 20160922_b22dda4c9fbc74ba5e251fc3110ada5a.js, 20160922_edfdc00dbdbb7dfd43478925b51e4a4b.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "4131eddf30a37bcc8a29ac1639ae3a6b259a3ecfc92b73a08091b2907434cf79"
    hash2       = "d370303fc83ddc3470e00cb54841641f9f338c2f025096e84d40782778041a8b"
    hash3       = "a1db38abaeb5bf0ea6f5b5ff0f4a9eedd9ce90cd62e2966ce8936e8e8fbc2905"
    hash4       = "a403e048902def05111493a952d740537d8afbb402b2336c8de1d8a2d6c38940"
    hash5       = "350a94fd53479bde96c18236897fe9846647bd4d4471ff812cc45a165d90a9d0"
    hash6       = "54f3e02c5b6d4d5d2db9a8d86252256d2f355ce582a09c9d870f84a9047c47ff"
    hash7       = "9908788e148928c5f3ee88b22ad1ed33dbf69f1ffd103491ebd438b979bb77eb"
    hash8       = "74d3e5ca6efd3e26128cb4a5ab3009003c70f505b353304608d74dfd028df0d7"
    hash9       = "24cea6347b33f54d332a2f5000d3f2841a3a09a1270f4da0da530495cac7ac0e"
    hash10      = "740dfd31653bea8abfef6b3038aec0b854878d45a8de4bde67cdb9124c6bbea0"
    hash11      = "aa03b8f8bd18b6425bd0435f38ca6501c2932bd998eaa0c2be7420c50212affb"
    hash12      = "ff7968bb25038246a127bf97a5d4f0afb2c088f5ccd47c093b21d1aa27116fdd"
    hash13      = "2c98aee98a3263e75913535b49eb469916a931e86a23075b07289143bf0fa3f8"
    hash14      = "8c037da0756f2e03c3daf2ada4f7a359fd0381e67b8eccb57785222e669ac983"
    hash15      = "9ff498e6534ca553e55771f7eceb4682e639590da978950f1c8683f05f448427"
    hash16      = "ef65e5e7f2b9ad6a0714382fda8dc9fde658333c4a3ea2cdf04558bfe763c3b6"
    hash17      = "85e2ab59983c4c704998f4c7c577cd8211e7b590b3f200f88616fe64954c10ea"
    hash18      = "b810435d98ebab77ad9d2cd316e2a0c0211b0941d86cbfa6c0e753732c6d3b15"
    hash19      = "7f10930e3c0bd956023b78dabf743464a690cb292b06d107d010614acff421c1"
    hash20      = "f6d3d773ad865f7e3793e6540facc0b8f68d4f503990e93cebc41b933a338a40"
    hash21      = "d9bf036d8b4743496b663218b8ff488676bee9250e9706c1179536db46cbba61"
    hash22      = "004799df77a97e1e1816f6a4a1acf9bec5dfd13ae07613832796a6c9ef0cc578"
    hash23      = "f3f9ad4055c2ff243fcdf662544ac5eff6ef170765938a028b9c6e0029fcb2a7"
    hash24      = "ad277513de073e1dfeba70577234c4da10406e1298f5253b5cf48893971016ed"
    hash25      = "221e50c91cd5c3d541d89b6c9999d61bacb186433ba85ae94088851587c25391"
    hash26      = "96514db18a22f5e5bde10feb1f6b426e5772d0f7e76f227e8d49a7a00bfb01b7"
    hash27      = "4ab6c9959d63ff05f6b1074253866e4ba4ca6148b9d820313ac79da48c63d90e"
    hash28      = "6cab57b5e35c3714b482592a77f0edbdc9fedb8c6e508d57b8cf63dfd719f5db"
    hash29      = "eb33bb458042e91be0620012d2d05aaafd9742abb0880d1389b5c02b834e9290"
    hash30      = "9f95318ee468d352a07628edd848ed3cb97379fab3e416b20eeb631ea656c3a9"
    hash31      = "0d6dd5e22f8f66e5240683d3b57744793a88315a385138ff11409b0c03a9c448"
    hash32      = "762774d5263bffcad635355a63715b9cd26c09b53efe134be033e8dff5062b47"
    hash33      = "4af9ef65888b7e1a452f74c901f68872403712ef67ed9f79ac51c3bfb98c1f59"
    hash34      = "e78e24f62fb93be4551c02ce2a2a27421a39d4a9d5c77d37c7518adf9e53ce65"
    hash35      = "1e6376c7075a97cbb4e180ac5ea89ade4f5170dd182e1014b19fd2ed4aa33345"
    hash36      = "a19789bb6f28d27bc82c039f4db69fb5cc4c189a7a47cddfffcdc6eace37a408"
    hash37      = "b552c80ce6e203066590d8d065eb3336f999e3f3336ff06bb686520de3f326c5"
    hash38      = "fe4f2a5579ff9cbd713377a0d5f78bb0c6c30247b6f455ccdb4014a7c298c978"
    hash39      = "2caf9c958877250774bdc190d1120c23a5fe115635a6c2d285aa8d62d171db39"
    hash40      = "c0d0b12b3c6fc559a577159775ce104e897b9b5c0422b945c7c097dd53710fe8"
    hash41      = "76f52cefe2f1cf5954919532ecd1ec4c5c9072cb4edc435169d570baa9894ed9"
    hash42      = "06efdd8c0262a51372ea085744e30220d9e93e45b2bf9ef29d7e71b27174d2fc"
    hash43      = "135f44db2fcd47db2f5b9cd01f10f5c892ae119d904f5cb0ea4bbdaafba92963"
    hash44      = "78db1c7c22d3adc33c9ba580ac46df953d36c9c15f9c8b211dc68c16595dc18d"
    hash45      = "b22daaadbd25f5bd920609cbc37e7ea10c4cd99c069220697c4c5db594cffee2"
    hash46      = "0ae44892f78e5b5ddfc07e6a23fb55469f21e12c45e74661ad81e61b07893ece"
    hash47      = "cecd93896e2d90bed54f31f9e387b5dcec7c277d5e455e561112b07c63d26ed5"
    hash48      = "780c5e07d33732406de5b51436310fbaacb6d3c6fdcb8d9fa40733ae6e903508"
    hash49      = "2ea0ce06677c6aad57b6618a39beaa56b2c9060cb989c2213eb782aca5d747c2"
    hash50      = "8d131000a0c435e8674de7020c3a970768f0d66e5b0cf5f711017057a318c00f"
    hash51      = "77a7ef76313303139cf36ae2953c6c901152f97fe8ddc013a16c1d4b69e5357c"
    hash52      = "f18be6e3d6cc83db6a4204656661ec0e213eded871d58d50b9d2c8b212b94cbd"
    hash53      = "331653a2e8936f9d68b3db693057e89f7c2bcfbb22d7e5f8e7dd76dcf11e3ab4"
    hash54      = "e9183fcae238e67df02c94cc13c7f9ce436709e3bd1fdaee8caa1fb15e4c0f81"
    hash55      = "07e5271d8517f89575dc2737fae5e8da89c7f2f25cd40c68e183d826da6b2bf0"
    hash56      = "c5b5cdc3be24f457939814321b7f3397a8f4d2370b1e57cdae1f3f10537e562c"
    hash57      = "946b208e84c64dbffc7e1cb08a19f629639d795decea5bf8ddd08b34a59e5e59"
    hash58      = "8672bbf21d7f10931a3f6328634b8b4e6160470a85d97fb93d56cb5eedb10599"

  strings:
    $s1  = ")(),(function f000(){return \"DYx\";})(),(function f000(){return \"UEg\";})(),(function f000(){return \"Oe\";})(),(function f000" ascii
    $s2  = "Tn\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"RLk\";})(),(function f000(){return \"Vu\";})(),(functio" ascii
    $s3  = "ion f000(){return \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Rh\";})(),(function f000(){return " ascii
    $s4  = "ion f000(){return \"GGn\";})(),(function f000(){return \"HJm\";})(),(function f000(){return \"DYs\";})(),(function f000(){return" ascii
    $s5  = "eturn \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Km\";})(),(function f000(){return \"Yz\";})(),(" ascii
    $s6  = " f000(){return \"Lp\";})(),(function f000(){return \"ZIi\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"W" ascii
    $s7  = "return \"Tn\";})(),(function f000(){return \"DYx\";})(),(function f000(){return \"MJq\";})(),(function f000(){return \"DYs\";})(" ascii
    $s8  = " f000(){return \"Tn\";})(),(function f000(){return \"DYs\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"GG" ascii
    $s9  = " \"ZGq\";})(),(function f000(){return \"Vu\";})(),(function f000(){return \"ZIi\";})(),(function f000(){return \"GGn\";})(),(fun" ascii
    $s10 = "function f000(){return \"DYx\";})(),(function f000(){return \"Iq\";})(),(function f000(){return \"Br\";})(),(function f000(){ret" ascii
    $s11 = "000(){return \"Tn\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"DAp\";})(),(function f000(){return \"Oe" ascii
    $s12 = "ction f000(){return \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Oe\";})(),(function f000(){return" ascii
    $s13 = "0(){return \"Sj\";})(),(function f000(){return \"Nv\";})(),(function f000(){return \"Km\";})(),(function f000(){return \"Do\";})" ascii
    $s14 = "){return \"Km\";})(),(function f000(){return \"KXg\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";}" ascii
    $s15 = "000(){return \"DYx\";})(),(function f000(){return \"YTp\";})(),(function f000(){return \"Oe\";})(),(function f000(){return \"Br" ascii
    $s16 = "return \"Oh\";})(),(function f000(){return \"UEg\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})(" ascii
    $s17 = ")(),(function f000(){return \"Uo\";})(),(function f000(){return \"Uo\";})(),(function f000(){return \"Mc\";})(),(function f000()" ascii
    $s18 = "(function f000(){return \"GGn\";})(),(function f000(){return \"Vj\";})(),(function f000(){return \"SGs\";})(),(function f000(){r" ascii
    $s19 = "ction f000(){return \"MBb\";})(),(function f000(){return \"BQb\";})(),(function f000(){return \"GGn\";})(),(function f000(){retu" ascii

  condition:
    (uint16(0) == 0x2f0a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

74c086dc-ed0c-4e29-a4ee-69303f2c44af

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion