_20161220_134250b21b440657c9e9b5b0e454851b_20161220_165359c218fe_841

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20161220_134250b21b440657c9e9b5b0e454851b.js, 20161220_165359c218fe9beaf727aba731cf1113.js, 20161220_17b579948c9bb2ae935bfa325e1af887.js, 20161220_1cf1819b2ca1ac78a4917b853f1d5926.js, 20161220_2387e3832bf24f6d959d322811fadd5b.js, 20161220_23b5370177dead6e2f36684da2800c33.js, 20161220_3cbc673d417fd6bbec60dae3ac1620a1.js, 20161220_582dad102cf496112818d5387a7a0abc.js, 20161220_5f9af392da86ed06aca3e99436ed365f.js, 20161220_6359a82d141699bba29b92b7e6c1bc1d.js, 20161220_6da31c9e1c85d7d78c354e96c8d4559b.js, 20161220_6e54d119c124bebaaa3e28a8d6b902d1.js, 20161220_79561b1ca7ce682e5edad89630822a12.js, 20161220_819d06183b021cfbde5e7c31aab76166.js, 20161220_88520cd7cf94a7e9e291de32904a0382.js, 20161220_927f31187250df22271aa59aee13a86c.js, 20161220_96ff1bf7d349449c7245f52891864428.js, 20161220_9e91a9130235d63a3edf023bcb66f357.js, 20161220_a74021ff08204898fe10cf2f73137b41.js, 20161220_bdb1e9acdb0645524d6c14bfec47a8e3.js, 20161220_cb91a779cdbbacc9b49ffcb34e9fd184.js, 20161220_cbf2dbad0834a39c9d5b451854ed06b9.js, 20161220_cff019c55babd930a15979f0891830e9.js, 20161220_dcd26cb5ee88d6f17906c07874533ad1.js, 20161221_04a6c664dc7ebc01b6208d7f5778cc62.js, 20161221_07a9d89bdf7f070af0c3bf7ada497f03.js, 20161221_07c81e038a46048f6ccc63b75675441a.js, 20161221_0cbe8c5b280c344df47dba7d00ff4095.js, 20161221_0ffc8a66a64b631e9f1d03630b34e33e.js, 20161221_11d20c987164e014a95ed7c1b1442f42.js, 20161221_166b16b1a1dd8cd673a3e5a35072d6ea.js, 20161221_1756ae3cc0e726881be013d7f539ce04.js, 20161221_194dae4e5b6ac35b529f64b56018eb80.js, 20161221_1d8c01e19441432f42181a52b58095a9.js, 20161221_1ee6b570942e4eaa7590e8421200c1cc.js, 20161221_2075d56fb98c3360fb3f9453088f8d12.js, 20161221_2161d4b2ee573d0a506e86190d321ad6.js, 20161221_25ec215449d151fdc78b73e467569c55.js, 20161221_272f1e7dd4bf27a0f44eb265816ac16f.js, 20161221_377a203cb0bf5199a75515840eb03ad9.js, 20161221_3f35ae0a10d708ccc9c69a974719280e.js, 20161221_44598180066b9d144a383fec8bd9b066.js, 20161221_4e66d93da4383c6e8c0f3482b5e6d621.js, 20161221_541fff03c1ee8353944e00db7c9d3208.js, 20161221_5a68b631c4c02102eaab25fedba9eede.js, 20161221_5bd80c62efa30aeb533bba003fde83ec.js, 20161221_60b63650108d0a0035eb096a2eb80cbe.js, 20161221_61d3aa3db4428fe3e3112cdb5a76d004.js, 20161221_669c13ace7f00ca7c71700335871987a.js, 20161221_6bf13aa38a4acb9ad69f37909060f9c1.js, 20161221_7071a983e42e7e938f13f285d2fb73cc.js, 20161221_7b499dfb14482b4eded9f9012ca8aa28.js, 20161221_8237a08a8c3674d320bd3812de57f410.js, 20161221_84127dc77f61da228954a37cf2aec1c6.js, 20161221_8a25a9f10c92b404b73a30ef0c123a37.js, 20161221_96f8fa05079a46ebe7864a60a47796a8.js, 20161221_9c94ee506cee8f933e32be6559bd84a1.js, 20161221_9df0f3fa5de5a2d70f945f3fc775b685.js, 20161221_a0a0ab8cd2bfbd2f2320646d67d8b626.js, 20161221_a36c2cca872ed0e7e14644c9fa017bdf.js, 20161221_a3d0ea8d42fe1f5daca850b325e9cbcf.js, 20161221_a4cbb331ffcc62be50493e7736010802.js, 20161221_a9f1ebad67224fe418b85ab14c682982.js, 20161221_adcd42f75f259dcc147b7a0043ec3f01.js, 20161221_b20cfd12ecf2a55acb16412050749eb5.js, 20161221_bffa6cc15962bc7cc0ee3f089583dbc0.js, 20161221_c0ef3a51007ffe25b8720793794e9721.js, 20161221_d2de890c8970c31d3b3bf75c0f842411.js, 20161221_d8f72c94f5e0e0439098f78797bcfa87.js, 20161221_db2124f9175de1413a95df6286cf0bec.js, 20161221_e5eca7802b1579fc3f2ebf6ca3c2409a.js, 20161221_efc231a552dc8495619fe503ef935ba4.js, 20161221_f16f81fca21cefd590f30984dc7f3408.js, 20161221_f404089e6a33f878a133b5ae1baa14a9.js, 20161221_fdb4a19c3a6714ff944a69532bd15e20.js

rule _20161220_134250b21b440657c9e9b5b0e454851b_20161220_165359c218fe_841 {
  meta:
    description = "datamaliciousorder - from files 20161220_134250b21b440657c9e9b5b0e454851b.js, 20161220_165359c218fe9beaf727aba731cf1113.js, 20161220_17b579948c9bb2ae935bfa325e1af887.js, 20161220_1cf1819b2ca1ac78a4917b853f1d5926.js, 20161220_2387e3832bf24f6d959d322811fadd5b.js, 20161220_23b5370177dead6e2f36684da2800c33.js, 20161220_3cbc673d417fd6bbec60dae3ac1620a1.js, 20161220_582dad102cf496112818d5387a7a0abc.js, 20161220_5f9af392da86ed06aca3e99436ed365f.js, 20161220_6359a82d141699bba29b92b7e6c1bc1d.js, 20161220_6da31c9e1c85d7d78c354e96c8d4559b.js, 20161220_6e54d119c124bebaaa3e28a8d6b902d1.js, 20161220_79561b1ca7ce682e5edad89630822a12.js, 20161220_819d06183b021cfbde5e7c31aab76166.js, 20161220_88520cd7cf94a7e9e291de32904a0382.js, 20161220_927f31187250df22271aa59aee13a86c.js, 20161220_96ff1bf7d349449c7245f52891864428.js, 20161220_9e91a9130235d63a3edf023bcb66f357.js, 20161220_a74021ff08204898fe10cf2f73137b41.js, 20161220_bdb1e9acdb0645524d6c14bfec47a8e3.js, 20161220_cb91a779cdbbacc9b49ffcb34e9fd184.js, 20161220_cbf2dbad0834a39c9d5b451854ed06b9.js, 20161220_cff019c55babd930a15979f0891830e9.js, 20161220_dcd26cb5ee88d6f17906c07874533ad1.js, 20161221_04a6c664dc7ebc01b6208d7f5778cc62.js, 20161221_07a9d89bdf7f070af0c3bf7ada497f03.js, 20161221_07c81e038a46048f6ccc63b75675441a.js, 20161221_0cbe8c5b280c344df47dba7d00ff4095.js, 20161221_0ffc8a66a64b631e9f1d03630b34e33e.js, 20161221_11d20c987164e014a95ed7c1b1442f42.js, 20161221_166b16b1a1dd8cd673a3e5a35072d6ea.js, 20161221_1756ae3cc0e726881be013d7f539ce04.js, 20161221_194dae4e5b6ac35b529f64b56018eb80.js, 20161221_1d8c01e19441432f42181a52b58095a9.js, 20161221_1ee6b570942e4eaa7590e8421200c1cc.js, 20161221_2075d56fb98c3360fb3f9453088f8d12.js, 20161221_2161d4b2ee573d0a506e86190d321ad6.js, 20161221_25ec215449d151fdc78b73e467569c55.js, 20161221_272f1e7dd4bf27a0f44eb265816ac16f.js, 20161221_377a203cb0bf5199a75515840eb03ad9.js, 20161221_3f35ae0a10d708ccc9c69a974719280e.js, 20161221_44598180066b9d144a383fec8bd9b066.js, 20161221_4e66d93da4383c6e8c0f3482b5e6d621.js, 20161221_541fff03c1ee8353944e00db7c9d3208.js, 20161221_5a68b631c4c02102eaab25fedba9eede.js, 20161221_5bd80c62efa30aeb533bba003fde83ec.js, 20161221_60b63650108d0a0035eb096a2eb80cbe.js, 20161221_61d3aa3db4428fe3e3112cdb5a76d004.js, 20161221_669c13ace7f00ca7c71700335871987a.js, 20161221_6bf13aa38a4acb9ad69f37909060f9c1.js, 20161221_7071a983e42e7e938f13f285d2fb73cc.js, 20161221_7b499dfb14482b4eded9f9012ca8aa28.js, 20161221_8237a08a8c3674d320bd3812de57f410.js, 20161221_84127dc77f61da228954a37cf2aec1c6.js, 20161221_8a25a9f10c92b404b73a30ef0c123a37.js, 20161221_96f8fa05079a46ebe7864a60a47796a8.js, 20161221_9c94ee506cee8f933e32be6559bd84a1.js, 20161221_9df0f3fa5de5a2d70f945f3fc775b685.js, 20161221_a0a0ab8cd2bfbd2f2320646d67d8b626.js, 20161221_a36c2cca872ed0e7e14644c9fa017bdf.js, 20161221_a3d0ea8d42fe1f5daca850b325e9cbcf.js, 20161221_a4cbb331ffcc62be50493e7736010802.js, 20161221_a9f1ebad67224fe418b85ab14c682982.js, 20161221_adcd42f75f259dcc147b7a0043ec3f01.js, 20161221_b20cfd12ecf2a55acb16412050749eb5.js, 20161221_bffa6cc15962bc7cc0ee3f089583dbc0.js, 20161221_c0ef3a51007ffe25b8720793794e9721.js, 20161221_d2de890c8970c31d3b3bf75c0f842411.js, 20161221_d8f72c94f5e0e0439098f78797bcfa87.js, 20161221_db2124f9175de1413a95df6286cf0bec.js, 20161221_e5eca7802b1579fc3f2ebf6ca3c2409a.js, 20161221_efc231a552dc8495619fe503ef935ba4.js, 20161221_f16f81fca21cefd590f30984dc7f3408.js, 20161221_f404089e6a33f878a133b5ae1baa14a9.js, 20161221_fdb4a19c3a6714ff944a69532bd15e20.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "2ef3859e5d91df92b38747cf7dbf7c67a8faa201c54ca2a8f7bebb0a3c98899c"
    hash2       = "d15e20a94008d3eb239db8847752f8a20e0dd14406736a9d19ad67ac4d669565"
    hash3       = "f0053c930b6245f4987db0c5673a22173e45e1f80d9025ae8ebd98d71827f0a2"
    hash4       = "15f2f11f4a71705cc7bfb00beed350d1ff94f545fab04908913e1994b8b30684"
    hash5       = "f99ffd9ce2664a4537d5dc0ee3e3857e8bb566809bad834277df86bbbc8b8b6a"
    hash6       = "7ae84b276441379d840dd0a78742005ef284fd8db0c484ba736ddb3118da7e57"
    hash7       = "e35d61c2f249b1009677534c9167f6547b928360ca19a0ea5ef23af456582ead"
    hash8       = "07878df6b4f82b5c828a91f4880611090cf0f79d2638239f2b3cbf0afe3a0020"
    hash9       = "e3e091cd2eb5835c20631232760f5c3a607f668e0293810ae995d465493c99ce"
    hash10      = "19921a8ed770f425253f6f41750c4998c5184761cee6a2ea9eb9831958ed41a9"
    hash11      = "f380d26c2dc437b4778aefad5ec07924ecb8ef06af46dfe3748839abc6b86af1"
    hash12      = "44952a27aa5a0c4749cce667b452ae882b92a49f8a7073143edae7efa39335c0"
    hash13      = "965fa7282cf9068e6d840ada6b3e46a9d6f3292794f3a0a3fb4171b2ddac01eb"
    hash14      = "9c674258cdad47618b68c3dc015db8918f367fbcab99e581dd330fd60dfef915"
    hash15      = "ffa408105867002040867d98359649b17793c058b4b66e44a859ecbc099c1d26"
    hash16      = "ce37987f2fb9da98ca1211aba8305a2dce8049024549908c906982713b8953a1"
    hash17      = "e14b608e183ffccb46941c25b859e186513f78b02d10b419a8f871f1ac2d35d6"
    hash18      = "b01e27562d71c379d334d972fddfe593c1bdd6a1aeb3068e72c6175282dbe02c"
    hash19      = "0c0dc083ec7282c66842a95c049d63bfd1379c3c448f151f9839dfec64782795"
    hash20      = "5cf16baea4e85608c43b3bbf65144dc06f35d0c247f83789b0cedecda424c1cb"
    hash21      = "17306a75e8b924bbf8c87b9981539d7998953156123718dac59b5e5d0fe99f4b"
    hash22      = "b423b0a85f753b489f29bdb23ba5cf0ecb21114af599695601d968919ec7c1c5"
    hash23      = "382880405973de97c9fd14a095ad4f5728a51cdce7fd071e46915e721d24002f"
    hash24      = "2b0bbfb78a9bb3cc9212a617ccefba7b01282dd6fd5fb3d314680a7a6405523d"
    hash25      = "9f2c721af159333d8a0b83a6f43be9590a3357ff3b016ac1547acb3a69736307"
    hash26      = "52dc5bac015df3af4fa64e53443dc1e5074727dea070c29fc11f541ac4dc3048"
    hash27      = "ad86f2ed86610f53b2a68bf0e160a7b29dcbece7db8d9e91b5dfa2735a698d6e"
    hash28      = "b60e66b490d315f4a92715dd63c733cec9b2bdb8ca92c1310bf8de7741a35306"
    hash29      = "a055065d372d6ef3c516a6f8a9d65834d1ea8df9e51c3f4de13c34ee57868cc4"
    hash30      = "b1d96c216d2a5e5d4d2848c802ea40e1f243751261daa184aa4ad5cbdfc75675"
    hash31      = "24b3bb117ffd08df5afa27a54d3a8872faf2fbc13ec2f173563f7a5ef9ed566a"
    hash32      = "b08f99f8e471f097cdc418cfb94a7d8e37b793b82e5e4fda7b303b16ad8ac4ea"
    hash33      = "8993a9be4eabe23c7dc8c7d6ac484120d11068e086e7d62de4b0dfffc8c934a4"
    hash34      = "99d332f62d1ce2d4e9ba1617d5ce2c1c7360bd05e549eec2deb356c12936b9f3"
    hash35      = "d09df18b7accfc0ec1ef3363a4df530e54330eef111e84a23c91d69e63448ad4"
    hash36      = "693e88917a2303932b109d21b546c6b2400997289ab2ec975101f5df2759d838"
    hash37      = "8480d850da5cd522b5245c80f336a62e446db78cc0eb0fc7f4ba93d83d7f283f"
    hash38      = "6cefb2b520246e66374cff4b81effe1b424580b61d81c6e448780a90e9f582aa"
    hash39      = "7b6fc669e5c8556280f337780dfdf0a4a531fbb445c4f73a11b3cb6606cedf90"
    hash40      = "3e4e103309fb6cd09118ac20a069e2fdacbd7bce383fb76eb2158659fcd3da2d"
    hash41      = "7eda8b0c64760b5055dc77d0c7d8b4a6935ca4dc0331fdd4cbd80e4201265956"
    hash42      = "e5ef6989a50565963d3f792fa61e91f70f918bb8792d1158745d7eb3ebe824f2"
    hash43      = "5433817cc7bf707c19028b262e27dac2c027d49cf2b3f4ff74231b844bc29cc5"
    hash44      = "0ba90976b205995a9908ab5c97a0446c196f08278b2489fad0c41b964a54887b"
    hash45      = "acf7abf20c2d3be4b6bf9c6d08817f883b54778bd1ae619640278232ca07b4e1"
    hash46      = "0489b6a78d8b0a86db8a2c535390ba4ea2a8c3c39b44450e9a5697ec53d23ba5"
    hash47      = "401e33050df1b81f8d276700faf64e8e1ce83af1c921f34013cfe9d6b5cf0c62"
    hash48      = "16d4c56a7d78cc2c239b5c044c2ccb9d7410702fae673b4bd0308a22a0c03b5f"
    hash49      = "1cc2e64d88f7c8a6fd65ea99b4b58c3f243dcb2bb008f4a952b0ba83f7a63822"
    hash50      = "5f5df95f25544f141b8f8a4b01322cbb5b38ecacce9efc1c21043a861e652b2d"
    hash51      = "9694954f36a9799e1dbf2e1e7fc8087d02c79d3c72ca4ac6194129f1f5849169"
    hash52      = "57ea28319d15597d7ada53e5ba197954ef3f47a184250edc64484bd837216094"
    hash53      = "3c694f7e3df128e9f7ddb9f252ffd8680d9e1b44f665fbdb7d115ca661d3cedd"
    hash54      = "25d8ffec91264c80f1a4acf075ef903c1144ad1162f238956deb05360164cc09"
    hash55      = "53c375cea0f861218dcd21bee03e379688901543334ba6f331920ac81a83ec7a"
    hash56      = "9f38bf72da77cfcb3236544be4a8b752ee0491ec91273ef93bc7edffb0f3149e"
    hash57      = "8209ee69ef719af76c053a07400394a18503c1065e21a1bd231373c506fce2b6"
    hash58      = "eae0fc72f84dcdfe8b96a1ad1b301ef0a4a4e7da736e4b5a56370671664c474b"
    hash59      = "86f89ccf023c6e160190f2b3985ef65e969dbda47cccc4d56e063c1f1818c763"
    hash60      = "f37b5cc57027b1f141c537f63d09a2f819d521a28a102eba5f0151180cc9b340"
    hash61      = "071f8c1c9218521324e63c771e0960e645a7af2fac5000fbdd5fb9af01ecc2a3"
    hash62      = "5b0750bc628d115171c27e938afe6aa82aae79e6a497c1b4fcb80fc13186da61"
    hash63      = "4623174d5ab1492bcb3b0a04f857b503258992b750511bf184bd26bb1cc2e09e"
    hash64      = "3edb498a69109b9a113b1342a6b5594c25c2ff08bba5af92997bd70cae794c35"
    hash65      = "8769f4d35c2ca0e80c1c18017c44c8a7c525a3ac36e6560faa25099300e2a426"
    hash66      = "9c7a8aef2d4ddb5c1bc116cf5e5e837da4db6a6c3267d3757e8d49a139c6c35e"
    hash67      = "c45605e0fe409df3e98958f6fa5765059cec60a5a98a369f65d327a572a425c2"
    hash68      = "33749939e822bb0c2e1ba19b27e64021bd7a7d3bf37fde45476f01229527743f"
    hash69      = "0524e1813af6106475bbec5803b1b1298777d229d12108288cbfaf166549fbdf"
    hash70      = "ce8c3f0efe6c34264b923a35be53a9690491f6b259f351da7ed209c928fb6fd1"
    hash71      = "d51aea052b4d8ee0679feffdcb68d037c45a0aec30ba45444ece147b1119f2c2"
    hash72      = "c3d4db6d2f16b545f1dae76b697cc9e73c1a873081d26beb5a86f1d6de3ff8f0"
    hash73      = "6ee19e22947d60de1543ef1395159cc06a282e7e39f2997f05a65c6fbf0eb67c"
    hash74      = "e852dc0cb581d125147de46a27236edd4944be33ab9beb81bec64fdb4d09e684"
    hash75      = "033505097e552074715404514fa93a6346bd15ee85d72793fcb4f5dd45a16553"

  strings:
    $s1  = " var NewNameCreator = new Function(\"FROSTICK,FROSTICK\",\"topSecretLine = \"+   (\"bmV3IEZ1bmN0aW9uKCd2VlJFQkZGMycsJ3JldHVybiBc" ascii
    $s2  = " var NewNameCreator = new Function(\"FROSTICK,FROSTICK\",\"topSecretLine = \"+   (\"bmV3IEZ1bmN0aW9uKCd2VlJFQkZGMycsJ3JldHVybiBc" ascii
    $s3  = " var silaBitsa = new Function(\"FROSTICK,FROSTICK2\", \"FROSTICK[FROSTICK2]();\");" fullword ascii
    $s4  = " var TortPankakyFF = new Function(\"DAS\",\"TortPankaky = \"+\"bmV3IEZ1bmN0aW9uKCdSZWVib2tHYWxheHlGUk9Hdm9zdG9jaG5peScsIHZlbFZJV" ascii
    $s5  = " var Limbus2000=new Function(\"HORN\",' var GALAXY = \"chastity necessarily()\";var kelso = \"ADODB.Str32\"; return kelso.replac" ascii
    $s6  = " var Limbus2000=new Function(\"HORN\",' var GALAXY = \"chastity necessarily()\";var kelso = \"ADODB.Str32\"; return kelso.replac" ascii
    $s7  = " var levitron = new Array(7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,70,7,7,7,71,60,6" ascii
    $s8  = " var TortPankakyFF = new Function(\"DAS\",\"TortPankaky = \"+\"bmV3IEZ1bmN0aW9uKCdSZWVib2tHYWxheHlGUk9Hdm9zdG9jaG5peScsIHZlbFZJV" ascii
    $s9  = " var silaBitsa2 = new Function(\"FROSTICK,FROSTICK2\", \"FROSTICK.write(FROSTICK2);\");" fullword ascii
    $s10 = " var levitron = new Array(7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,70,7,7,7,71,60,6" ascii
    $s11 = "}catch(exception2){" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1de56d79-e7e4-476d-aebc-9f96296306d1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion