_20160629_08be64b8f170385b4755908d05333115_20160629_08eecbb4d397_824

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160629_08be64b8f170385b4755908d05333115.js, 20160629_08eecbb4d397cbd2b555da8619b519bb.js, 20160629_114869672119badc90af6b85c5e1733c.js, 20160629_15f1a6f8c1f4c7ad6dd7dfc8845bc04f.js, 20160629_19313a4593df0b37ba5df1984f373405.js, 20160629_1a7576c33449268b2364dea50babeb44.js, 20160629_1beaba2fb8fe72ce9cf330e1ca8184a8.js, 20160629_1d151ac6c8bf35ecd0f071e4e09a09f0.js, 20160629_1ea310e3eee7cc0d6de6692b90aba6d4.js, 20160629_2055d37e90e99bcc62f0344b0e66ed03.js, 20160629_2aa771a8b8ffdcde5a4b3d3f9187f8c2.js, 20160629_2b4a140940057b31564da7365825ff5e.js, 20160629_34fd9b5ba600074c44b6e27791e01be6.js, 20160629_3be4eed8d5cc074dc97a8630c922a931.js, 20160629_3ee9ff9e49b32f7f3d9275a54f497c1f.js, 20160629_401c29141bf6c0f2b495fa58c7ae9bd8.js, 20160629_40cafc544dfb07cd9b88dc2e9cc8826b.js, 20160629_4df886f56d006ee7b6873e326aed434c.js, 20160629_4f83d97ae52cc55a0d53fdd7218013af.js, 20160629_57d2b6b2e2d81e112d8cce1a6dcbd71a.js, 20160629_59394e922f83cd71e458fd28e84572db.js, 20160629_644d56e7aebdc47c2ac6602e4ab1d44f.js, 20160629_6c7dd04708f1f572c233601b3e171778.js, 20160629_7aca6b86b9935ac3d51d566a3b01d948.js, 20160629_7f89de2b175fa1baafb424e213410abd.js, 20160629_86cb4331d6a49da65d425a7ea3de61d0.js, 20160629_89fb90fc74e2de4a58e1c6e6f0100ba7.js, 20160629_8d81f8c19010a041d7f517ab41ce6828.js, 20160629_9734aaa64392a138a111f1835be33506.js, 20160629_988bd2bfa4c16cd50defdb84e0b0fb1d.js, 20160629_99dfac566f3fe756139f07d9b7ff235a.js, 20160629_9a254bf8c9cfbd7605a8b2512faf869f.js, 20160629_9a61e276ec4ad7ea3d33ee41a31bd215.js, 20160629_9eafc46c47ddbd4862d5142bbb25efa8.js, 20160629_9fb186435edc115d0acfe80d7010b747.js, 20160629_ac239c2b1e9caef446f162a9eaeb36d7.js, 20160629_b1b99f47d0eb9a240166c21b559c1c9f.js, 20160629_b9d59d606950ddd30b1d492c36e768c9.js, 20160629_c21589f471c0b54db67e81c6836ad13e.js, 20160629_c5865d80dd4424075dfddd3f8bc85210.js, 20160629_ccef88c16f5172a64941a2cf5d5ec933.js, 20160629_d72b454e6db53d68b1a6bc0ece46b494.js, 20160629_d83df84b425ce9442cb2020f2bdf6c4b.js, 20160629_d8e88084fba9d0f38ddbe81466fda746.js, 20160629_da99a5ef165a79550f42f7d02e28bcbd.js, 20160629_e0282b8a8f71c0045dca05afce2d5359.js, 20160629_e0b39151f8c93b6797f6402f956c3dfe.js, 20160629_e884ce0201c5d28bdd656b0985625b9b.js, 20160629_e97b0d5343576da803c2e752b0f5a08a.js, 20160629_ef6f6a96d1421f06ab06f69e78c781d3.js, 20160629_f08c636f1554974f6d4503515459d6b8.js

rule _20160629_08be64b8f170385b4755908d05333115_20160629_08eecbb4d397_824 {
  meta:
    description = "datamaliciousorder - from files 20160629_08be64b8f170385b4755908d05333115.js, 20160629_08eecbb4d397cbd2b555da8619b519bb.js, 20160629_114869672119badc90af6b85c5e1733c.js, 20160629_15f1a6f8c1f4c7ad6dd7dfc8845bc04f.js, 20160629_19313a4593df0b37ba5df1984f373405.js, 20160629_1a7576c33449268b2364dea50babeb44.js, 20160629_1beaba2fb8fe72ce9cf330e1ca8184a8.js, 20160629_1d151ac6c8bf35ecd0f071e4e09a09f0.js, 20160629_1ea310e3eee7cc0d6de6692b90aba6d4.js, 20160629_2055d37e90e99bcc62f0344b0e66ed03.js, 20160629_2aa771a8b8ffdcde5a4b3d3f9187f8c2.js, 20160629_2b4a140940057b31564da7365825ff5e.js, 20160629_34fd9b5ba600074c44b6e27791e01be6.js, 20160629_3be4eed8d5cc074dc97a8630c922a931.js, 20160629_3ee9ff9e49b32f7f3d9275a54f497c1f.js, 20160629_401c29141bf6c0f2b495fa58c7ae9bd8.js, 20160629_40cafc544dfb07cd9b88dc2e9cc8826b.js, 20160629_4df886f56d006ee7b6873e326aed434c.js, 20160629_4f83d97ae52cc55a0d53fdd7218013af.js, 20160629_57d2b6b2e2d81e112d8cce1a6dcbd71a.js, 20160629_59394e922f83cd71e458fd28e84572db.js, 20160629_644d56e7aebdc47c2ac6602e4ab1d44f.js, 20160629_6c7dd04708f1f572c233601b3e171778.js, 20160629_7aca6b86b9935ac3d51d566a3b01d948.js, 20160629_7f89de2b175fa1baafb424e213410abd.js, 20160629_86cb4331d6a49da65d425a7ea3de61d0.js, 20160629_89fb90fc74e2de4a58e1c6e6f0100ba7.js, 20160629_8d81f8c19010a041d7f517ab41ce6828.js, 20160629_9734aaa64392a138a111f1835be33506.js, 20160629_988bd2bfa4c16cd50defdb84e0b0fb1d.js, 20160629_99dfac566f3fe756139f07d9b7ff235a.js, 20160629_9a254bf8c9cfbd7605a8b2512faf869f.js, 20160629_9a61e276ec4ad7ea3d33ee41a31bd215.js, 20160629_9eafc46c47ddbd4862d5142bbb25efa8.js, 20160629_9fb186435edc115d0acfe80d7010b747.js, 20160629_ac239c2b1e9caef446f162a9eaeb36d7.js, 20160629_b1b99f47d0eb9a240166c21b559c1c9f.js, 20160629_b9d59d606950ddd30b1d492c36e768c9.js, 20160629_c21589f471c0b54db67e81c6836ad13e.js, 20160629_c5865d80dd4424075dfddd3f8bc85210.js, 20160629_ccef88c16f5172a64941a2cf5d5ec933.js, 20160629_d72b454e6db53d68b1a6bc0ece46b494.js, 20160629_d83df84b425ce9442cb2020f2bdf6c4b.js, 20160629_d8e88084fba9d0f38ddbe81466fda746.js, 20160629_da99a5ef165a79550f42f7d02e28bcbd.js, 20160629_e0282b8a8f71c0045dca05afce2d5359.js, 20160629_e0b39151f8c93b6797f6402f956c3dfe.js, 20160629_e884ce0201c5d28bdd656b0985625b9b.js, 20160629_e97b0d5343576da803c2e752b0f5a08a.js, 20160629_ef6f6a96d1421f06ab06f69e78c781d3.js, 20160629_f08c636f1554974f6d4503515459d6b8.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "761674a745e2a57b31e49cd3e3839c6ab9082a099efcc4c9a130e3d488096609"
    hash2       = "777e7ef4d1a069da2c098cf7ab5b78e0ad7feb180be1394c011697d497985797"
    hash3       = "91a338f23dab591d96eff6d604ee12896bc165077af2ebfd20287e7ea3fce5e9"
    hash4       = "fbd68b908e281f8612d6b259cbbe093d4ace83d570efd6854f6e4ae1872f265b"
    hash5       = "45f337882239b9ba2db80063ded313fe834d3a30a311823b58ac648a7e6d537f"
    hash6       = "2cc858e64cfd7b439b6483de31a24f28a7cf8241c864da2503324139763dd14c"
    hash7       = "53ecd5a45f8e23b7853932dba75fc850517fa386521024631abf7b0ef967d24e"
    hash8       = "2e7ed5ec961964c467a4be229aec166b7a02a72bf2127db66f601c54958a5062"
    hash9       = "b2a2df638de92952f6762733a39610af18a8cf23679358f650b5fba68272175f"
    hash10      = "fbec22d0d98b4fb2013d445c450814c9a6773e163fe5c97d0ae9d72b7f65289f"
    hash11      = "43f3a61f214f42fc952af5cfa4a6b48bcf536f611efee1fd9c8350c94e48ac49"
    hash12      = "3d8b8c908f39b1705913fa7b3fa6be7c352413786c5edd44278725a60b8c159f"
    hash13      = "49ef528c0ed9756f6ab5aebdd5b68ecee9a1078d3027134a7ef1ee08f3a22194"
    hash14      = "6d9a3b41ec30d9d88fde84865f6f54d250ab09fd59abff4c9a5357e7f67c03ed"
    hash15      = "babb91e6115809807aef38441e19426b583c6fdb7d7d47fac60f44981f8aebb4"
    hash16      = "1c0e65a2d7bfc061751ec54de4ab53861eba52bd2b24493365953d8146c65e5d"
    hash17      = "e4dc4df37861cbc799525300afa68c7a48db4e21a3f5fe8da226fff0c59a7801"
    hash18      = "12d29dbbe562d6ea4f0799d32d19f691def7968af8769856b06a6eef4661a5f3"
    hash19      = "0dbf1322b1b079cc309e087f4dfdf005af258b83b099d9e067d6af341a9ebd1a"
    hash20      = "41ad67dbdea760ede896461f3091be6c17ba6a97e515e7ddf97a956e12774b80"
    hash21      = "62472eefeca9095327fcac2acfc2d5f0796cb2b564c2887ebf1f0dd02568568e"
    hash22      = "fa83b19ffe560d7dafc5dbdffe6b2ea603bdc631dc4792bb7c2325600498acae"
    hash23      = "0b6ae1e2c03668f52958554343903b41f34ce24023c7c25d1c9ce5fdbe02b59f"
    hash24      = "031c68eeba0d780f31a8d62c8f7f62672de55f14059bc9ae4684e264120829a4"
    hash25      = "99193ee3cdb57759f3d7b1c054ec664662c1810cc741c8ed940e0bfcaf59f371"
    hash26      = "4fd1cc49384cb5645f8415af63983617c4d37aa9eed3a5ee776fc3e3f8a83117"
    hash27      = "2d823961c42a79494f7da903f754510325c1dc2c53a425344c49593ec347116b"
    hash28      = "79509416d104a131828fbf5b55693a7219c8ec02f2f1572087927ed8f470ed30"
    hash29      = "7f89575fc2798a291a01a182eeb7f855b3b40afa0a61093be355768678c6061c"
    hash30      = "80e73ada959635a4f5f28977b0b5ae5aa672c471070857a914352833030c445b"
    hash31      = "4dc4080575da91baf583934e6f3cf08f148eb3de5f1c61f6eecab2f965235b22"
    hash32      = "b420b6ef1111db3f7aec7924aff1386d78a8586ddffc56c373bd5ab67b525e74"
    hash33      = "baa5d0697c4b1e72d688bbf940b18a4b4f97bf14f1d364ce3b55da9b0f98ff3e"
    hash34      = "df158d2921adf0f7f876a2464c3af113e24749f2390349db3ae7e1f92a59093a"
    hash35      = "8bc59bbfe8a51effa1e199484fb3943945c8ef9c38a65ee9474cc75f79cb7681"
    hash36      = "6b128203a421fb07ebc1e8ca38d3d4b313cf2fb0c1851aa0b7d93cc6bf1b2943"
    hash37      = "f18cfba4bad58badec104ff9b1b31037bd9b77e3bb2db7013ce6caf6f4198280"
    hash38      = "0a492dcf3cf193a0528ea0e45a1d8a7668df6b2fbf0f5e08cdeabda5885c1aa1"
    hash39      = "c5eb8401ccf25a1dae2abf764400da0dc33fe07d0409c43c2d9c8cd744aae8b6"
    hash40      = "36c6279b9108b26fa2c1ba2d95cfb7590bc3decfb13d6d8101fc0144360a50df"
    hash41      = "723cf51270f7a4da29794253d7f4247a0ba375cd137319bdac1380fc1749b88d"
    hash42      = "b129c7822c5ab66db4e02e437221351d0475aa191548bf47cc493f2d1a2170a6"
    hash43      = "269a1d4a51ca5a04aa36f9a1b5d7f327f2192b6652d2ecc7363fd87a9a1ec1cf"
    hash44      = "39f741c427f9bc381b8b86ce5e94e344481649bbe6dd7f6e90c853c52b5c0749"
    hash45      = "cfafa044670fe5c63d70743e4b9ac3ae42885f8048dc1235827bb60bb321c4e2"
    hash46      = "192b7b1aac58d2bea4c2c63b3a7c577dfdd61f3d8196e2a40c70d06357244b4a"
    hash47      = "1baffb6b6fc160c788d62a1bd2806dbccabac35671c0b8c0fc5bc172857e31fe"
    hash48      = "29798c7136a816fd52fca58dd9ee2209ae2286179650400686542c408523f10c"
    hash49      = "be9d12f08e3fabfdcbadb4799149cbabbd56c4998532f401cda5f82513181c6a"
    hash50      = "71a1569feffd4a625f594051921edcbc4d5ee297174eb77c5a783433e69f0661"
    hash51      = "5f2980c46f74fb45654c94b3af9d3d20f3351cedccb759b668187e2306a9ac5f"

  strings:
    $s1  = "var ranger =\"pornhubcompornhubcomJVpornhubcomRFTVpornhubcomAl\".dollarm4();" fullword ascii
    $s2  = "architectural = \"b3Blbpornhubcomg==\".dollarm4();" fullword ascii
    $s3  = "String.prototype.dollarm2 = function () {" fullword ascii
    $s4  = "String.prototype.dollarm4 = function() {" fullword ascii
    $s5  = "var ungodly = \"pornhubcompornhubcomQWpornhubcomN0aXZpornhubcomlWE9iapornhubcommVjdA=pornhubcom=\".dollarm4();" fullword ascii
    $s6  = "Point.create = function(){" fullword ascii
    $s7  = "var weasel = \"E\";" fullword ascii
    $s8  = "function achievment(bidttt){if(bidttt==1){return 2;}else{return 17;}" fullword ascii
    $s9  = "function Shtyler4(gutter, reverse) {" fullword ascii
    $s10 = "var rampart = new citroen(d2.split(\"}\")[1]);" fullword ascii
    $s11 = " function dollarm(rivulet) {" fullword ascii
    $s12 = "    pirkinst.puerto = pirkinst.pitiable[\"c3Vpornhubcomic3RypornhubcomaW5pornhubcomn\".dollarm4()](errant, chosen);" fullword ascii
    $s13 = "    ok(spyFunction1.calledWith(), \"Function called without arguments\");" fullword ascii
    $s14 = "    ok(spyFunction1.calledWith(\"test1\"), \"Function called with 'test1' argument\");" fullword ascii
    $s15 = "    ok(spyFunction1.calledWith([\"test1\", \"test2\"]), \"Function called with 'test1' and 'test2' arguments\");" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4e632ae1-e3d8-4364-9b77-dddb3ac0b166

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion