_20160519_007a1c637239805dacd17edbd670f6d0_20160519_031fce0975c9_842

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160519_007a1c637239805dacd17edbd670f6d0.js, 20160519_031fce0975c9f7038ea43d7b148c7a41.js, 20160519_053337170cc2be18d211851171104acd.js, 20160519_07bad3af6024d6ace2694241a321eff3.js, 20160519_08f15b2957dd87713923ec4b50459b14.js, 20160519_0a88a97ab452bdf2b217cea15a41689f.js, 20160519_0f0ece7545f77430b392ef8f90ee2ece.js, 20160519_0f1aa49f7c8652d87b8f8393260a0ac5.js, 20160519_1519493c2ae377596c5a4e0369fdc7de.js, 20160519_1640c227f049e88d02765d1cfe002449.js, 20160519_179d4008da9a5c9e1ae790273f487629.js, 20160519_185adc58539ae2d7fc960233a971a4bc.js, 20160519_1aafeb1982c72dbb03ee4282edad26c1.js, 20160519_23159b39c2dd678945c364aac7630b86.js, 20160519_2488452df26e2fe06e0a6925a1df3c93.js, 20160519_25604bb9769e5154e619201ae2171d2c.js, 20160519_2622dd36af2098d4194d18895527a2d3.js, 20160519_275174cb1281981d5f9a403f96addcdc.js, 20160519_27b407a198fdde8fb3942e34afde3911.js, 20160519_2a985ebe1c2706fd4922e124dd8ae446.js, 20160519_2e2e6f4ebd6624f8b02c850616d29da5.js, 20160519_2e5421bc3da7320c30812c743779412f.js, 20160519_2e781e9faa17c327779f82060b838dda.js, 20160519_2f12774a717975caac2b8d39ce0c75df.js, 20160519_31a33a3b0ad65953885fad8f34260b91.js, 20160519_33643e54826d9c68a96a15d08acbd12d.js, 20160519_3697e156b35644bf496bcaf777f573f0.js, 20160519_36e9b0892fdf843cde0a5df1ffcae4b2.js, 20160519_3a9eba4aadfb6149edb0b9251793517b.js, 20160519_3d352e66129963915c6ebe5e6a0a879f.js, 20160519_3d5b6c72001f9518bcacea75df58e0c8.js, 20160519_3de1fa6cf3b4509040f382d9932d1211.js, 20160519_3edaa44484dfc68cbbfe023dcbf414c6.js, 20160519_431ea7921529cf8a9649bd820f5e16d3.js, 20160519_43fd19a88cb9825804491aacb3094422.js, 20160519_4816b02e6674aa8cf124397f17bd7194.js, 20160519_492cd8f56ff9b4c759985b1f9528ba57.js, 20160519_4a5badb211a86b39fe24180cc1f73f67.js, 20160519_4b734276fd7ff3f5ee68d38db803caa4.js, 20160519_4c365948083cef62f29cbf919fa49325.js, 20160519_4d20c66b23926e0b14a2a320896b1806.js, 20160519_4d929a0bb69de6e87021822f10b19336.js, 20160519_52b370a1155766ee49e87bef5f043d0a.js, 20160519_570a2ecb8b9c79bac612cab75f02f5ad.js, 20160519_5d90732a654d88fb8d1dbb528692b845.js, 20160519_5ed654722931f9c0558a993f26fddd27.js, 20160519_6273ac7f32ce0657a5d3f770ef4ece14.js, 20160519_6414245a391e51a34267b1b07ec2e787.js, 20160519_64996f00ea5e563d71c7a715dd96c0d0.js, 20160519_6579f05c084e81c5ec9cb9d2c8514e1b.js, 20160519_6ba793a1d4f9eea3e4b57eb1adb6472b.js, 20160519_6d251b9f22044cf6dfacce77a46f7eec.js, 20160519_6fe4cd3328eee3f99adc73dd121f900a.js, 20160519_720dc4a08977ef220fd47b9bb2cec4f3.js, 20160519_74d21351a32241453704ee125a23bb42.js, 20160519_74dd2a9ad131536506a348f2996531a9.js, 20160519_75449346bb27bff314eea5ae0b704ddb.js, 20160519_76b9400595e522e5e91b6b97063048c8.js, 20160519_7a1d1e8dd20acf1c8ec714713eba868d.js, 20160519_7b36ad39f49a7ba834d8e70697666a7e.js, 20160519_7dcd0f3936df04ca690e5f25b7bc3ce6.js, 20160519_7e1a84db626ff78e499a20dc53330116.js, 20160519_80491e2559d633ac4f0476af02cf9fa4.js, 20160519_811c14a9072032c6c856537a290108e1.js, 20160519_83dcacd962648dca9ed9415cc6487435.js, 20160519_845e2a96a4becca154a1128da380b013.js, 20160519_8846c8d7ca8deedc3650042ea0a61b1c.js, 20160519_884820c0914f938b9e08175f31dd4ed8.js, 20160519_8d1720e185b08eda5539cda62fa622fa.js, 20160519_8d4ebf7f5436391544b458697c218e41.js, 20160519_8f752912a63bbd79dcd5d6c1cc1eb625.js, 20160519_91170524efa4883f48048c8ef2ddd76a.js, 20160519_91c759e92a93d14eadcf1cde58ff9275.js, 20160519_923b060c2bcb208fc725305da6abd036.js, 20160519_9444cb9a7ea48f9db24a710d7086c383.js, 20160519_976360ae27842a889c6117765ce76f31.js, 20160519_9bbea12ae393aedc217760203b0755db.js, 20160519_9bdb728f3025a58e4b07b6b102fca4d9.js, 20160519_9feb8edbafb64b09e9fa937d87af9368.js, 20160519_a053ff581d3a6acb2c5401e766241047.js, 20160519_a0949ec011b637499fac7d3140a69ea6.js, 20160519_a17aa07a5af71feb9fa7989f7c8ff4b9.js, 20160519_ab70a9f64819f8253a3bbb4a24f427c4.js, 20160519_abbabe383e9bf4a8cedcf1514e745075.js, 20160519_ad36801f6b041633390fcb191f8a5d4c.js, 20160519_ad8b06b436e3936bd13347783f86fadb.js, 20160519_adf2433f85e9a1da5daf2c4775779d9c.js, 20160519_afb0c0803dfa5d710ef600cf560f8c9a.js, 20160519_b04303d831a7927cf6f9cfa21723d157.js, 20160519_b33fa1f881806cd93bfc271d0755c4f9.js, 20160519_b4e3f7bfef7eb0b70531128b8c28f2bf.js, 20160519_b57305a599dae0598f9d9a5c7ea60d3d.js, 20160519_b5d146c514a01e364d5769ed10dbf58c.js, 20160519_b73b1fc19377686ae00b3b0d9354d267.js, 20160519_b8e89b7bae272afbd387cbffb0c5fadf.js, 20160519_bcd5b5d61b536e49ce9f32c7dc7e5525.js, 20160519_bd23ee5632fd12995117dc908119629e.js, 20160519_c0670090df38bf13987567eb16f6287a.js, 20160519_c0e502d6e63566148115ccb3f9b5f04c.js, 20160519_c298ea933087a09e9c3e951e74b19659.js, 20160519_c33d6365752aada81edad44eefae3d22.js, 20160519_c621d5fe4656fe7c5a2dc6643d2a85fe.js, 20160519_c6c035dd28c5fc3046fe67a1724ca0e0.js, 20160519_c8a35cad34c3fabacc5660be45914095.js, 20160519_c9bbaa5922689dc5062853d8c44bad6d.js, 20160519_cca1029af76f3e6de8c1d48ed5d71a26.js, 20160519_cd4ac48de37d15e092a94609868b1116.js, 20160519_d07b3508175cfce9b5b2376cd8fcca73.js, 20160519_d0cda8270c9f1d3a772d0cdefd5adf3d.js, 20160519_d3d252f82a8feb7cb6de056ed1fa1f05.js, 20160519_d41d0e74dae7b39dac715b2a4497c2f6.js, 20160519_d54846b50b9c5900743de6cf9f3a15ff.js, 20160519_d840cf26a9c9a8c645987c5576d05b78.js, 20160519_db50ce8fecf804ee46ad95ac70912424.js, 20160519_e1495759a4e995613aeeca518e9a708b.js, 20160519_e228ce0168b81bdba4607e1323272f5e.js, 20160519_e340161b34ddcadb0f529042e796cabe.js, 20160519_e3e030e9f563192567bd868524e32790.js, 20160519_e4257556a604070f6f3c50e5be436242.js, 20160519_e509004bbda9842b71eb2d747bfcc764.js, 20160519_e73b4a74a01f596de64b45158770a10b.js, 20160519_e943d74c5ffd8e8a56e6c275b1fe22c3.js, 20160519_ea0e96e32de11322a7aa9bad562a605e.js, 20160519_ece4a207e0b22359451a18837e358078.js, 20160519_edbd896762c2f174c3ffe95d316791a9.js, 20160519_ee2966ddcf5d5fd85ea56ad0c2e2dc72.js, 20160519_ee31fc37c44ad3a7703565195b2f606f.js, 20160519_ef7590eb2a2ec53850d497ad18459f16.js, 20160519_ef95cdb6842fda7a6ed367b49eae4e4b.js, 20160519_f24e85121de1b2adceb16b64b76b428e.js, 20160519_f28e8bd21b109773fa244bb481441a42.js, 20160519_f2ae18dfd1d8ee2f24d1700bb975b46c.js, 20160519_f34d6495e5dacdc675bab23cf1563553.js, 20160519_f4214daa2448bcaf0a53f070fe516938.js, 20160519_f47eb45efcefb02dcc0b5a58dec84da4.js, 20160519_f7f3cf74e52cfaca066c6a1601eef0f3.js, 20160519_f94622a992939241f846a6c5d16a2992.js, 20160519_fc78643f5616c1506af7947ffc05a164.js, 20160519_fc90b763a942817a9253692283c11bab.js, 20160519_fd9cf58e0d745ecdaeeb4213a5b23d63.js, 20160519_fe21a5e2d7a093929f4b1372dd15d6f6.js, 20160519_fe6879540433cdb056042199b9dd552f.js, 20160519_ffe7703ab1523ee4e32591b1fa1645b8.js

rule _20160519_007a1c637239805dacd17edbd670f6d0_20160519_031fce0975c9_842 {
  meta:
    description = "datamaliciousorder - from files 20160519_007a1c637239805dacd17edbd670f6d0.js, 20160519_031fce0975c9f7038ea43d7b148c7a41.js, 20160519_053337170cc2be18d211851171104acd.js, 20160519_07bad3af6024d6ace2694241a321eff3.js, 20160519_08f15b2957dd87713923ec4b50459b14.js, 20160519_0a88a97ab452bdf2b217cea15a41689f.js, 20160519_0f0ece7545f77430b392ef8f90ee2ece.js, 20160519_0f1aa49f7c8652d87b8f8393260a0ac5.js, 20160519_1519493c2ae377596c5a4e0369fdc7de.js, 20160519_1640c227f049e88d02765d1cfe002449.js, 20160519_179d4008da9a5c9e1ae790273f487629.js, 20160519_185adc58539ae2d7fc960233a971a4bc.js, 20160519_1aafeb1982c72dbb03ee4282edad26c1.js, 20160519_23159b39c2dd678945c364aac7630b86.js, 20160519_2488452df26e2fe06e0a6925a1df3c93.js, 20160519_25604bb9769e5154e619201ae2171d2c.js, 20160519_2622dd36af2098d4194d18895527a2d3.js, 20160519_275174cb1281981d5f9a403f96addcdc.js, 20160519_27b407a198fdde8fb3942e34afde3911.js, 20160519_2a985ebe1c2706fd4922e124dd8ae446.js, 20160519_2e2e6f4ebd6624f8b02c850616d29da5.js, 20160519_2e5421bc3da7320c30812c743779412f.js, 20160519_2e781e9faa17c327779f82060b838dda.js, 20160519_2f12774a717975caac2b8d39ce0c75df.js, 20160519_31a33a3b0ad65953885fad8f34260b91.js, 20160519_33643e54826d9c68a96a15d08acbd12d.js, 20160519_3697e156b35644bf496bcaf777f573f0.js, 20160519_36e9b0892fdf843cde0a5df1ffcae4b2.js, 20160519_3a9eba4aadfb6149edb0b9251793517b.js, 20160519_3d352e66129963915c6ebe5e6a0a879f.js, 20160519_3d5b6c72001f9518bcacea75df58e0c8.js, 20160519_3de1fa6cf3b4509040f382d9932d1211.js, 20160519_3edaa44484dfc68cbbfe023dcbf414c6.js, 20160519_431ea7921529cf8a9649bd820f5e16d3.js, 20160519_43fd19a88cb9825804491aacb3094422.js, 20160519_4816b02e6674aa8cf124397f17bd7194.js, 20160519_492cd8f56ff9b4c759985b1f9528ba57.js, 20160519_4a5badb211a86b39fe24180cc1f73f67.js, 20160519_4b734276fd7ff3f5ee68d38db803caa4.js, 20160519_4c365948083cef62f29cbf919fa49325.js, 20160519_4d20c66b23926e0b14a2a320896b1806.js, 20160519_4d929a0bb69de6e87021822f10b19336.js, 20160519_52b370a1155766ee49e87bef5f043d0a.js, 20160519_570a2ecb8b9c79bac612cab75f02f5ad.js, 20160519_5d90732a654d88fb8d1dbb528692b845.js, 20160519_5ed654722931f9c0558a993f26fddd27.js, 20160519_6273ac7f32ce0657a5d3f770ef4ece14.js, 20160519_6414245a391e51a34267b1b07ec2e787.js, 20160519_64996f00ea5e563d71c7a715dd96c0d0.js, 20160519_6579f05c084e81c5ec9cb9d2c8514e1b.js, 20160519_6ba793a1d4f9eea3e4b57eb1adb6472b.js, 20160519_6d251b9f22044cf6dfacce77a46f7eec.js, 20160519_6fe4cd3328eee3f99adc73dd121f900a.js, 20160519_720dc4a08977ef220fd47b9bb2cec4f3.js, 20160519_74d21351a32241453704ee125a23bb42.js, 20160519_74dd2a9ad131536506a348f2996531a9.js, 20160519_75449346bb27bff314eea5ae0b704ddb.js, 20160519_76b9400595e522e5e91b6b97063048c8.js, 20160519_7a1d1e8dd20acf1c8ec714713eba868d.js, 20160519_7b36ad39f49a7ba834d8e70697666a7e.js, 20160519_7dcd0f3936df04ca690e5f25b7bc3ce6.js, 20160519_7e1a84db626ff78e499a20dc53330116.js, 20160519_80491e2559d633ac4f0476af02cf9fa4.js, 20160519_811c14a9072032c6c856537a290108e1.js, 20160519_83dcacd962648dca9ed9415cc6487435.js, 20160519_845e2a96a4becca154a1128da380b013.js, 20160519_8846c8d7ca8deedc3650042ea0a61b1c.js, 20160519_884820c0914f938b9e08175f31dd4ed8.js, 20160519_8d1720e185b08eda5539cda62fa622fa.js, 20160519_8d4ebf7f5436391544b458697c218e41.js, 20160519_8f752912a63bbd79dcd5d6c1cc1eb625.js, 20160519_91170524efa4883f48048c8ef2ddd76a.js, 20160519_91c759e92a93d14eadcf1cde58ff9275.js, 20160519_923b060c2bcb208fc725305da6abd036.js, 20160519_9444cb9a7ea48f9db24a710d7086c383.js, 20160519_976360ae27842a889c6117765ce76f31.js, 20160519_9bbea12ae393aedc217760203b0755db.js, 20160519_9bdb728f3025a58e4b07b6b102fca4d9.js, 20160519_9feb8edbafb64b09e9fa937d87af9368.js, 20160519_a053ff581d3a6acb2c5401e766241047.js, 20160519_a0949ec011b637499fac7d3140a69ea6.js, 20160519_a17aa07a5af71feb9fa7989f7c8ff4b9.js, 20160519_ab70a9f64819f8253a3bbb4a24f427c4.js, 20160519_abbabe383e9bf4a8cedcf1514e745075.js, 20160519_ad36801f6b041633390fcb191f8a5d4c.js, 20160519_ad8b06b436e3936bd13347783f86fadb.js, 20160519_adf2433f85e9a1da5daf2c4775779d9c.js, 20160519_afb0c0803dfa5d710ef600cf560f8c9a.js, 20160519_b04303d831a7927cf6f9cfa21723d157.js, 20160519_b33fa1f881806cd93bfc271d0755c4f9.js, 20160519_b4e3f7bfef7eb0b70531128b8c28f2bf.js, 20160519_b57305a599dae0598f9d9a5c7ea60d3d.js, 20160519_b5d146c514a01e364d5769ed10dbf58c.js, 20160519_b73b1fc19377686ae00b3b0d9354d267.js, 20160519_b8e89b7bae272afbd387cbffb0c5fadf.js, 20160519_bcd5b5d61b536e49ce9f32c7dc7e5525.js, 20160519_bd23ee5632fd12995117dc908119629e.js, 20160519_c0670090df38bf13987567eb16f6287a.js, 20160519_c0e502d6e63566148115ccb3f9b5f04c.js, 20160519_c298ea933087a09e9c3e951e74b19659.js, 20160519_c33d6365752aada81edad44eefae3d22.js, 20160519_c621d5fe4656fe7c5a2dc6643d2a85fe.js, 20160519_c6c035dd28c5fc3046fe67a1724ca0e0.js, 20160519_c8a35cad34c3fabacc5660be45914095.js, 20160519_c9bbaa5922689dc5062853d8c44bad6d.js, 20160519_cca1029af76f3e6de8c1d48ed5d71a26.js, 20160519_cd4ac48de37d15e092a94609868b1116.js, 20160519_d07b3508175cfce9b5b2376cd8fcca73.js, 20160519_d0cda8270c9f1d3a772d0cdefd5adf3d.js, 20160519_d3d252f82a8feb7cb6de056ed1fa1f05.js, 20160519_d41d0e74dae7b39dac715b2a4497c2f6.js, 20160519_d54846b50b9c5900743de6cf9f3a15ff.js, 20160519_d840cf26a9c9a8c645987c5576d05b78.js, 20160519_db50ce8fecf804ee46ad95ac70912424.js, 20160519_e1495759a4e995613aeeca518e9a708b.js, 20160519_e228ce0168b81bdba4607e1323272f5e.js, 20160519_e340161b34ddcadb0f529042e796cabe.js, 20160519_e3e030e9f563192567bd868524e32790.js, 20160519_e4257556a604070f6f3c50e5be436242.js, 20160519_e509004bbda9842b71eb2d747bfcc764.js, 20160519_e73b4a74a01f596de64b45158770a10b.js, 20160519_e943d74c5ffd8e8a56e6c275b1fe22c3.js, 20160519_ea0e96e32de11322a7aa9bad562a605e.js, 20160519_ece4a207e0b22359451a18837e358078.js, 20160519_edbd896762c2f174c3ffe95d316791a9.js, 20160519_ee2966ddcf5d5fd85ea56ad0c2e2dc72.js, 20160519_ee31fc37c44ad3a7703565195b2f606f.js, 20160519_ef7590eb2a2ec53850d497ad18459f16.js, 20160519_ef95cdb6842fda7a6ed367b49eae4e4b.js, 20160519_f24e85121de1b2adceb16b64b76b428e.js, 20160519_f28e8bd21b109773fa244bb481441a42.js, 20160519_f2ae18dfd1d8ee2f24d1700bb975b46c.js, 20160519_f34d6495e5dacdc675bab23cf1563553.js, 20160519_f4214daa2448bcaf0a53f070fe516938.js, 20160519_f47eb45efcefb02dcc0b5a58dec84da4.js, 20160519_f7f3cf74e52cfaca066c6a1601eef0f3.js, 20160519_f94622a992939241f846a6c5d16a2992.js, 20160519_fc78643f5616c1506af7947ffc05a164.js, 20160519_fc90b763a942817a9253692283c11bab.js, 20160519_fd9cf58e0d745ecdaeeb4213a5b23d63.js, 20160519_fe21a5e2d7a093929f4b1372dd15d6f6.js, 20160519_fe6879540433cdb056042199b9dd552f.js, 20160519_ffe7703ab1523ee4e32591b1fa1645b8.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "8cede0e509ae4cd98a8469ca4189ee2bbae8708f3eae0ce6df61f685a6488d07"
    hash2       = "cfbd2d42aeb02aa0801e29808d0f4f6e9597bc750b22da0a6f736f8644ffc216"
    hash3       = "d463761f975b6053b0d0acd31408b262594d16bbd30ed6fb2cf176bf98137abe"
    hash4       = "04dc9f3f8535bdf73a63939aea31b1171002e3e04a34bc4056dc4f8b31600f02"
    hash5       = "234058ba3a9cfb77ea7e373adc4ea8903ac540467718f384dda47950d28664de"
    hash6       = "dbb7205108277685cc83c100cbd2ddd529243f8b3812010019e4ec1b49ba4b3b"
    hash7       = "fabc7592f366b8e7eae2f050f615f3eb323acad1ca1ff243cdaef1182ed9d837"
    hash8       = "ff14ef37aa5bdd776b71b9051c6625d87b2db937e1405f09fbae606a9fa22e3c"
    hash9       = "8562f87a7715132c052490022416c74e484c16cf91d9db7a9284cfe7573e2696"
    hash10      = "535ba170aedd14864a08bd477bf38d2efffde5b90e0447c8d856dd12ee9a5ad6"
    hash11      = "c50c0e2df4d76996a406a19c9415a0ade5f275796ab8a8e093f40a3cabc62fe7"
    hash12      = "bfcc5ceec70dfeaac4e9f5dd312d697c62b4db6b84673b58ec577299611d0dda"
    hash13      = "cc86b0436eb6ed102360d8a4b04ddc66108da576349f224af3e5ddb4b88771dd"
    hash14      = "fa09cd4c9b326f6bd019d7829313fed6e63595ceb777446ed8d276ff3824e267"
    hash15      = "b5513bdac28ce438bfb57ec4b85d7be99bfef196207d77360058369930c239fc"
    hash16      = "7f1831b6f3edeedf8316572d49717f71eebe57bb2013ca206cd1c3e508801c15"
    hash17      = "469fc5e85835aa3997182631f8c658f5bba75609349567942088b760e9a4ebb5"
    hash18      = "f3976ffdf17e3b3c531d496b61f74b38593a8802daddfd44cb14edcb713fc78c"
    hash19      = "26d6f28cce50a782ad73e062c1c06984692b37453e00b56c5cb64b925ae2242f"
    hash20      = "a7759abe5a4d7933124c60a46ee02ad802b790b7dc6c07de3e844913bcddf826"
    hash21      = "6c38a2be9f018efc0bf494212cfb0610ecf87e4be4c6486b5b98c4e0b3d5a73e"
    hash22      = "1ff8eef390304a86cc0c11ee96395bb867d65aae44ba6cd909d1194217aac31a"
    hash23      = "42022dae95e4d9ea4755eab72ce5fc99c6f3791b40098fba8d2fe1fbba552f62"
    hash24      = "7fc6c7997063e4e3cb5106b3c05951cf54113438cb7c19cab510b9ce72d322ad"
    hash25      = "7b0203e71b19302a952cf7a9f38f26e3d34c924f2656342c246390f2f4689a74"
    hash26      = "ac8083ac0b9a0d27f9f52e43dfc18de5458ec1307aea335b03f48d7174b94cf1"
    hash27      = "ea79cde8ab715404519f3d5f43e7dfedf63fdcb72a893f1504ea4aab2f6aae57"
    hash28      = "4536283cf38ecbc7cd503279ced4537dfd6e26e71df4ba0363c09bd9518433da"
    hash29      = "13316b01397724bbde0773cf3092bbf2e69d010db7c6f91bebda94ef8edd0355"
    hash30      = "11c28c972e40efeaf6233aeb536cfd87658dfdcd8f499639c48ba186986a6a98"
    hash31      = "5989335f18ec4157f565e23b4d0d5d5441eedb60a78be784de7aa2132f789849"
    hash32      = "773deb9850e12135a639cfcd46722c3e728c69e2e87179d1d09b98125c864da7"
    hash33      = "4a3f140abe3216dfc81ed09e1f737627cb4d9a1e66422f770d4c09310baac3d1"
    hash34      = "e8ee81fb3a0e52af954929afef0798e4828d85be392f22efcb094cbf8f7e63e0"
    hash35      = "05a38cf7addbc24bb91ae409067b7e08c1bae620bd237fd50cc80d024fa7c8b6"
    hash36      = "f7cfe4d3699c0fe87de234bbe53b38d5554da8c0da5e1fe666b62cd058cb8d37"
    hash37      = "62713c6b4b123d28a9ef15a1970dda9ea2040a5127151ab015ca4d25e6a7661c"
    hash38      = "faf350cbbc97931774a302d2540bdab5fa6793d02a67d8e4714b733943c855c7"
    hash39      = "edf4eeda20ab30ac5fff342ff1a21ec3519534fd038c7468409a84c9ce1e6586"
    hash40      = "8a5f559b97465e695ca334caee4619ae67f8365c7b0122e8022d31b6cdf09eae"
    hash41      = "9dec8b3b51e37c2eda107d09a9a91495b95a1bfb323dcdb8454585398fb7ab98"
    hash42      = "82261e7bec183a63d9dd2386cfc14b8195ebc1b9917fa06c99f6cac63d7d7b0a"
    hash43      = "e8a67cc6cb57e668199111c86f04ab9516afda89e69a6391ee0e0492f2a66412"
    hash44      = "17baf91b7848e661f63f3fc3ed88ee7ad5286e3124b4623cd48d5ecbdee5ba93"
    hash45      = "4a6deb18d57ac74fdbe03f46d9f25baaf66a443f1f82b5191f5a8c55bc09ca29"
    hash46      = "3f67af5a28c72c689653f7e49839a6e9dd5b2f2b24035c2bf74f4569caf66b21"
    hash47      = "b840c5940592445fdd59167f23580ff2fd46151da0232a33c00ab28df13b8096"
    hash48      = "75547e1d225cd037cce908a51e5f989c1c51e5354b7404eaf8817679e4e1d9f7"
    hash49      = "1b0a20f5b2bbb26ade60f32f2782bc066d0b83d98f5d593b2e13be99921d647d"
    hash50      = "fe1cea3f35bdff8d5b161576234606d9b195593bc28d5e782cec16dc1fa6a3de"
    hash51      = "7ea7ee52b2e5167ab61ba18c11858b1a26db46c1bf5e49a4014ef9823ca3e826"
    hash52      = "579083ea52fbc8dec4ca14692af913938dfa1d41616ce93a861ca55177a09c8b"
    hash53      = "f7f9510c9e7ee0a299b4ddf5bf3cb55b32c1183863b239da3f87a7874cfc003f"
    hash54      = "a556401174daabe8a277123b15b891cc1f8c00a54c3b188e238504fa999cbb20"
    hash55      = "82a10d7b57564b036e5d89c0365d6e384b4bb558119d1c7c67076c9f1671bbd2"
    hash56      = "47ced57c27eab4bdd0e4c38b36c265cfecb9e87e45ef5c50d43d9918216dd6ac"
    hash57      = "d9fd299ee3d99384615ffb17ec158947f0902a20325cea8f2e6fc8c8a357898e"
    hash58      = "8a23db8e62b59b1493123cca4117156c71fc8f1bb9ecc3abafd31bddec24d4ce"
    hash59      = "5b83ced1a76f97493e0dd62c70f5170938d2d64627b45d5792223d9fb1c7a015"
    hash60      = "6f92f81fe7af23d8cc5fe986bca97201a3a51e6849179522d58474777af482aa"
    hash61      = "ff00421e2759e08537453dd0280d6dcdbeeac291a0dddb651f0fdfbd47905335"
    hash62      = "84688ea3efbee65f9f71367fbc20dcb80abde3783f82be134da8ebe87974c93e"
    hash63      = "f97360e705a4fb1b75e422040a30994c5846d8d050c0a861e05045b43553ce0e"
    hash64      = "99df0a5ba78eca01c4cf1a84fc6f656c5b11d023593c372b23727504fafad59b"
    hash65      = "57e8959e9a54f8ee93ebeb6fa4ed78365c04e8a322adba037abaa9c7467e7c51"
    hash66      = "8e79f94ef07a524f61c3ddcd817b201d93c2b81cc57d9a8eec5cd33fb6480bf2"
    hash67      = "ffe710ade5583b99efe58df34ee245e0e97af37655af2fa3be56327645606eb2"
    hash68      = "22d32a4318453592b4c7773e84b65b45e598cda23c6891aacfd351440c99f0b0"
    hash69      = "f0245f2f0359e361d402e9a0a9fda643b6587dffd1341d7ca748813e22de660d"
    hash70      = "55528050a57332edcf82a4bcb2906abeec48730ea8cd931af5a44608521e2a65"
    hash71      = "513b36206710a3efb54884bca3b6e3383aa1e965ddb8f0bf1311c085a630398f"
    hash72      = "c9309d150f9d8ff3de24ce79db73ecbdd0470a4f4355a2f7ad3d89cf7260d8c0"
    hash73      = "741ac579acd1ef00133a9b60c873c7c935381ca6bdf58d4b348737983c9c8bd2"
    hash74      = "67c80fa30db63d403f35006eba8d960b021f9acee05ac83c5e865a23ce30bdb5"
    hash75      = "f4987c50230278e192c67d771df1d9b30b820a870132975ed9a7cdcdf1281030"
    hash76      = "50f598a9e8c46c9039ad8c8a02b2cbd9e30f67b6db425f0e46fed97ca8edaec0"
    hash77      = "647425986467d3908cc30ed310593d4baf99abeff0c234fbdb7cb71f8a48843f"
    hash78      = "c49c4d738ee942c68126663985871d08dd753d7b28e3dd36e647c335f58f3eb5"
    hash79      = "4bb7d922ecbab34438e048d4c40da15bc43616fa332f186f32d0723ebd1a2dee"
    hash80      = "fe777a0d3c46da57b29188191bf4c526a17a1573c1f36a17211f096f2c32ddb7"
    hash81      = "5e6f56f1eac0c6bdce74a8489244b94ffa2a26c53a7ad22b826c0d2d3c183cc2"
    hash82      = "15c2a8598254fd1192696b9ad416eab7b212b2f4e214f29ad2af6a39adc2f8fe"
    hash83      = "72f9e81d49870cb516b66bada511001b15ca6f35ee2d3c8d7fc82a2cafbaecbd"
    hash84      = "d44f61ff24e8a9741ef08089ec9f96b2cd92cc6e5b25403f8198bc8eb56fecf0"
    hash85      = "d4ace49b48b75318c011b0194418a85cd26ab95f72f4ddd245d2d437d0c3d21f"
    hash86      = "f0f7622d1adbc501f1b1d79e10228e661ca0b98c7262b80599148e9c5f9c3ecf"
    hash87      = "c50678fbdb43904f4d74bcf0fdbb25e9ead858c3f00a620f5f16112293537d2a"
    hash88      = "e2f8c4f2d8ffd7a811db72d94913372c912c9b37636e1de3741bd5007539ad91"
    hash89      = "0bdf4acc6755dca4eb5e2b1d3062204bcde33ef50e3628e4813b8b0acc315886"
    hash90      = "67dc2b6d29331630b52483c4b8f67e3baee02dcd7ada3769b6c817b66f4fdcb7"
    hash91      = "0d8aa8b2937623d36cf633d7cff8ab01ac05368d69ebcd2889497d79d28c1e03"
    hash92      = "a2f5897a11571a6b9527df3d70c333f11617adc2d49b54543976563e3353421b"
    hash93      = "4649cef0e2b28d6c3f0d059da5cd63848dd4b534833d7774ab0291ee561163b7"
    hash94      = "b02248a8e342c160f32593ce3b92e0062b636323aebdd1a8e5aae18afe471bd3"
    hash95      = "3d266390476102cf01b4dff771fbc3175227230bccfecb63c243da76e0ac555e"
    hash96      = "547a3a8aac0f27204f4381c121f14d95708a1f3d82d190a471de0a66e3cc71e7"
    hash97      = "4fcbc5784fcbbe8e3aebdc97e56afdefd6bd90f81841d423dd721cfdaeaff395"
    hash98      = "aa1c77a8317dd0fd529596a7b1872ef30336059d8cb8753cc5fb3efc112a81aa"
    hash99      = "37a64f9a8b8ceb493150c094792c57cfcf007f25c2bbab7e7747bf540058e97f"
    hash100     = "14c57cdd54341b1ca2df0779a5741551da1311aad0b1d0990a86213603c7003c"
    hash101     = "e01f8e467dd10ffae23ca3e59795227d0531d0737f0408d615bdcc4133c57e3a"
    hash102     = "65c96b2f129922da29159d874c961ff131413e531362c4759a7ec5b2771afce8"
    hash103     = "993f37a505399558428e3b40e7be584f866fbbd02a000d18005c4e1f4f599652"
    hash104     = "501b659002c616c1c3c22c8c3d65767343cd8f0008ce1de9be7bc6777e9a5b73"
    hash105     = "836becf0a304f0a265fb8066308ac6afe005c8212c2e0c61cb0d0cb94d02e5a9"
    hash106     = "c230fc6d8821ff6b17f1e9a92aaa53b5a0b77397b68d15936e12b2e82fbecfe4"
    hash107     = "69d786daa68728f78caf885bbd48481f07e82b56139bcfebe2f6e09ec4a014c3"
    hash108     = "e2607b751538a5b32065481c0b889355a0fbf13a9f09b921dab48d56fe9468a0"
    hash109     = "3b2a619bf51b7bb4751de89ffcdf12f4c12c2c513115ee2627171ea0f1cb0570"
    hash110     = "aa41da2b456dabec2e9a3754e56ef2804eea41ff6466e1c54d4b84ac6230d753"
    hash111     = "2a2956aaa13c8cece6e552cef8c9dc0a730e2d8a27fc1b3358fbb16c205acf09"
    hash112     = "5bcdd9ed8653fc34cf0918eb2ee22d64bcc930f906a9902606e10ac5497589a9"
    hash113     = "efd936f0e6cdb4270f73739469b8f125bc54c9a7b2e053cfc4a137315fb8ef8b"
    hash114     = "6945d13ba42f0957f0b601c63b3e1b3bbd555bad3e13b895de14aa4f446832e3"
    hash115     = "95e84c6a4c3ac6e2b7bff7814ed30eecdee15447c32f4eb31a8589a8c1e391ed"
    hash116     = "b91649c8c8d952e1d9a46f12fae63597a44ae55bf989bbd509c434cda3cb7536"
    hash117     = "3bf63d7ee6cbc1274ed1aec62cb90ed26182c98be53d8447e47ff7a214dae079"
    hash118     = "571af5b7d5c7324b8095fc2eae74493f4aa83db2b7637c89a46b84bd0a1ba906"
    hash119     = "4a8e4a6ad28fed0eea7f85e4259c0665d4aaa914cf472e949863c98ba2e238e0"
    hash120     = "edbc0a77519c30a06ca5be27de57e47b367d765ea10d9a13f0fceb41ec03be60"
    hash121     = "4eafdb7044912b3a88603ae6faf365d01acc7d82039ae2620cc7a1f64001bdbe"
    hash122     = "15b2227b352bce1dabe18af6df681eae0330bd98c55603219437ba189088c2f8"
    hash123     = "5d96446500822e7f11ed1f684ce1432d6970cf0ca803483afcabdb6b25e180c1"
    hash124     = "f6738dbd12c6c2c2ec2fad15f78b8a40bde4f6fded4de7bd92d452f343577448"
    hash125     = "af4e9ebc5af4008d6319e254546f364e4a60e3397ce6c92529c22807317c693a"
    hash126     = "e82bbed40a02fa415d3bfdb7181f25321d43b7dbc46186bf10781e701370f942"
    hash127     = "e5ae557170fbfdc051ad885ebab32a607eea20de3ab35d1f310e6b9fcca92b3e"
    hash128     = "40ab49e3b0c2dcd9aa923ebdb753e1d57b8aa4bb773e300ce9e8f94f9ae1ef65"
    hash129     = "8d57313012cb6bb675fa849f02f0d3caf05b20a705536512f8e57640ddd76050"
    hash130     = "dbe196cad21e84e398103f42d16955aa267c6e9e335d70081aa2947b43bc08fc"
    hash131     = "8fe5a395346562b4b4676af4faf64554afbdff91d4f569369eadc0680440a1d0"
    hash132     = "e23aa46c8d72b3209bf747146beb6b8d85db312ef7aa5e884c62ea8060f612eb"
    hash133     = "e91369ac43230c3a86f50a9f926cf5ef7c1656d24fb257192ea182a181290e66"
    hash134     = "fc2c68e5b7bf8f4a024cbac41fd29e1a25ac00ceddbd9b534122b64de77566ec"
    hash135     = "0b6cc252261b724f3a955547dee065f69ad54e7deeaa63cac90ea036e4697d32"
    hash136     = "52b20c191dcdf158d3c2b75d3b610042eb7400deeba234807a3da80f8cd035eb"
    hash137     = "e8920add48320b1fc2d41e24942311812531372f31af81bbc3cfce184f2b15b0"
    hash138     = "6d3ea292553910817def006a08102ab373dbf3ba042cb73b75ffc97a78017ad2"
    hash139     = "4008d8a1197d3249e806585ba327100225e8ce028bb60a82a25110615141ba4f"
    hash140     = "aa56432b81856c5b47d0cef3c8180bdeef35511a8b92fbebfdd9d69c8c177a87"
    hash141     = "90f255f733d6b6cb4655f90264a68df2a0beca493bf6b9f4c2dfc4c07cffd35c"
    hash142     = "ac82b92356fd7c5aae65858233e508e25c99002cfb94ff16cb76ca80de8aed5f"
    hash143     = "d483866a23712a1ee70c697b6f6f0f0cb5cf152d08650ff57d82a929bd14d09d"

  strings:
    $s1 = "function useimagetext(){return ______zacopies /* _r_cmt */;};" fullword ascii
    $s2 = "function copies(structure) {var ______zauseimagetext = (123, structure); return ______zauseimagetext;};" fullword ascii
    $s3 = "function ccff(______zab9f4){______zbccff[(\"3\", \"2\", \"R\")+ \"u\" + (\"1\", \"n\")](______zab9f4, sweden /* _r_cmt */, swede" ascii
    $s4 = "______zbsdiv7[negated](______zastructure /* _r_cmt */, abases, (true, false));" fullword ascii
    $s5 = "function ccff(______zab9f4){______zbccff[(\"3\", \"2\", \"R\")+ \"u\" + (\"1\", \"n\")](______zab9f4, sweden /* _r_cmt */, swede" ascii
    $s6 = "______zbcopies /* _r_cmt */ = \"start \"+x10000+\"\\r\\nexit\"" fullword ascii
    $s7 = "var ______zbccff = function top() {return september[______zacopies]((\"fdasfadsfaszxvc\", terms)+\".Shel\"+\"l\");}(), ______zax" ascii
    $s8 = "var ______zbccff = function top() {return september[______zacopies]((\"fdasfadsfaszxvc\", terms)+\".Shel\"+\"l\");}(), ______zax" ascii

  condition:
    (uint16(0) == 0x6176 and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f242e72d-994f-4d7f-8ac4-77963b70fe83

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion