_20160519_02951b4f0a2f6c62ac0aa112f460f1ce_20160519_0389c89ddb2f_849

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160519_02951b4f0a2f6c62ac0aa112f460f1ce.js, 20160519_0389c89ddb2f7f114f988606f9819377.js, 20160519_03eea4e2fae07d91ff73f916adb40126.js, 20160519_03fa4d5363adc52577bc221979a03f2f.js, 20160519_0728dbf8eb97553e012f50629c79eebd.js, 20160519_08e526b933eb5ed5b7570fc4b204a48e.js, 20160519_0b979f49e04c35f6dd99021944a9a50a.js, 20160519_0e10774112929fedf3f10ace45030260.js, 20160519_0edc60176ec8107d0b8b77a9ed6ed4ef.js, 20160519_0feaf1b2bdb6ae3aebfd0212a217141c.js, 20160519_1071b3ec82d7019089c5739f98f79bea.js, 20160519_11a4ea4be290171e25ebaab3a1b38395.js, 20160519_11ad3ddd5f7e8d5b6be949a2e1fb167e.js, 20160519_136b0ce32fb56a706be02a62d4acbf82.js, 20160519_15c720e908224eb66d7121bf2b1c1a66.js, 20160519_16ec4e407d31599b272f8c1c749406e0.js, 20160519_17d43a0b4354c58846301ae1e9a954c6.js, 20160519_1852604c64e5ec25496daeeefae81183.js, 20160519_18aa0b6eec359e87f246dc982b91d985.js, 20160519_19286796e75352700a7857f6e478266b.js, 20160519_1bf11180f00c2ad80866af854ea28e4c.js, 20160519_1cf7f128551579d915b3b54cf587e4e6.js, 20160519_1e8219ea5a17a3d8172bb33191306972.js, 20160519_1fc1bee1b0299e85cd88fbaa8fea1731.js, 20160519_20dcd9a110d6efa0cb66037189d069b8.js, 20160519_215778b1c513b8344e6ce6bf92ac5fc3.js, 20160519_238c5a58bbbce3237d75c054a76a3913.js, 20160519_23a77895b3ea57cad5879d408c5264d5.js, 20160519_23ae5d8faaeabb1324a323908b2fa8c6.js, 20160519_23d3fe479dc7a8989ef416a6ca31925e.js, 20160519_2550cacb4bb73c76c9dddc64d53ec247.js, 20160519_2607365189d423afbc3a5420531122fd.js, 20160519_27cf1a4b23fc7c9cd10a23fc1ae83bf0.js, 20160519_2810683c294d52ff920a413458fa3de9.js, 20160519_29770a10e8f8bdd5e48c606b44ee6eef.js, 20160519_299d5c331da8b08b63fc1c317d22fc10.js, 20160519_2b1110d2224558cc91b118b60cc72570.js, 20160519_2b20f61b0903b24ee102f631de2877f6.js, 20160519_2f130c6d5e7edfcccd17b3f199c98257.js, 20160519_30282e1871d3a059fc2c5ce2b7a8b585.js, 20160519_318f683254981b85dc568496fe4d8301.js, 20160519_3306db6ab188b08e1569f5510c24f738.js, 20160519_38c9b21d61633d61322109976a4eff05.js, 20160519_3a4be7189159dc579966a789beae0aa6.js, 20160519_3c3cf40883a08c0e139f45710efdc79e.js, 20160519_3e003e432bc12a4551387dcefc7f4ef4.js, 20160519_3e460307d67f7c26e648a0223b09bc59.js, 20160519_40df9f083ee62f4f5b6b9298dcba7550.js, 20160519_41464e5a120b67d9431d0b79c578f9fe.js, 20160519_422b95f1e588884ac9ed68797536bded.js, 20160519_42e10aa03131771c1553d37f80f66c68.js, 20160519_434039eaa7905ff841a5759c1e5c2eab.js, 20160519_43c3dc3ea39226a7d3dbefee43be2f68.js, 20160519_44e4c6a08ff94072e1f171ddae8f1ced.js, 20160519_471a679471a97c32fe369a621e104a8a.js, 20160519_4925b5cf788a38e769afd615ae926b5f.js, 20160519_4aaf3e6e010cacc3138d3f71b13bc755.js, 20160519_4ae07497bcdec51ebfd20ed3ed074d59.js, 20160519_4c1e98ce5818711e8b28614a5608ab4e.js, 20160519_4d480a8cea7eb633f33c8ff43a1a67c1.js, 20160519_4e412eb34854927991c55514b1cf5e98.js, 20160519_5350dff6542c5d888d0d028773fd4a94.js, 20160519_53cd5755311e5ed31eec441e573960d4.js, 20160519_58d795253621bde73ab11b64803c050b.js, 20160519_5b10445694a5c72953b377f4ca87805a.js, 20160519_5b2adfa8a2ac18aaa49c23673051f934.js, 20160519_5c94f0bc47b3fd6199a5ca90deb1168e.js, 20160519_60035be208aa68fa015328294c847fa1.js, 20160519_6052a1c5b80341aaeca4c240f5fc231b.js, 20160519_60eb0f04644cf7b446a7591f95f1f238.js, 20160519_61c4c0f2c2fedf336d2db3c1c049b101.js, 20160519_649b47acf0000be25c4a176edf974411.js, 20160519_666abe43aee7f368e505bb9b734e2d13.js, 20160519_67c2280778e223e3b6503e5b63d8e718.js, 20160519_67fd80ec41c087d874bb3fe3fe2f5966.js, 20160519_68561cb1b7d206763f19833ca263049d.js, 20160519_69e27cf59d4cd27d4da4f9bcc1066d89.js, 20160519_6b8c2551c63be095fbc1958a5244f61a.js, 20160519_6c9c31a48658a154b412608a885e4187.js, 20160519_6ea567528f8a845a9f4670d38f7f150a.js, 20160519_6feeb71e86faa7681e1b5201ba2d4a8c.js, 20160519_7391a53f57d4e1d70f9a32c5cac2ea78.js, 20160519_75917e1f9e907715a926f865e87dea0e.js, 20160519_7761d812ef2ec7cd31ea4dc6fef27c29.js, 20160519_77699956db1bf8c389f8df5d2e8cc74d.js, 20160519_7869cae01a022d548fa491688036fd28.js, 20160519_79663f44c0284568368178cfd45f4a54.js, 20160519_7a5734d493b88f769fa207a45813e746.js, 20160519_7a7b7af73312b6e1d6cc979a9de02e95.js, 20160519_7a995583ee9dd82d12c0fc982f94fd30.js, 20160519_7adabfb3a6e1954c434d5c53d648bfff.js, 20160519_7add553756b46e541c92e151c17d128a.js, 20160519_7bc55bd8e4fd869b44caa11bd135bc17.js, 20160519_7d5057cebc51f1663d4bc562603e02b3.js, 20160519_7dda80b0b0273eea992179ad997707df.js, 20160519_7e92d445cf4d8484c5da554a3f60f45c.js, 20160519_7efffa054b3224091de2fa6a2a11837c.js, 20160519_7ff370256b4ef6638bd3a0e1c51acfc3.js, 20160519_81738caedd29c957d6e762fcfb3fe610.js, 20160519_82a4ee091ba78031e6ed93d235ee41f6.js, 20160519_850868bf44ef46c24bf4438edc801d7a.js, 20160519_858e53a0ad67b4e1243fd71f15362ec4.js, 20160519_860427814df6c0df5248de0a011de6ef.js, 20160519_871e7fe640a53fd3bb56ab9945dc3fb7.js, 20160519_8abf69528e081d264c3a97a8d2230b6b.js, 20160519_8c34e8599d8d856cc54d6eb8c3d0c1d3.js, 20160519_8e0c681ec79f83c7d63060ade8c466a8.js, 20160519_8ea9070e6902e3da6ebc1aabeb6964d5.js, 20160519_90b84ce5527ae4fdf579a8cec480e920.js, 20160519_919c0ece4628ae122a2847c70d1a8708.js, 20160519_9304619644e7f16580e4222a84f960b0.js, 20160519_95fdbd956eeb0c894c0aed60186c2481.js, 20160519_988da79bf186885d6101a7eb7d3e1c92.js, 20160519_9ac8b44d7889fc3c9c133d1c0e5e3ea9.js, 20160519_9ada55f71e801def5f13c6f3adaadf1e.js, 20160519_9c7a2d1064b3cfd9d81f9a5582216490.js, 20160519_9e2f4e490bfbc5f04463ec4c3cf1de99.js, 20160519_9e46a33377e51ae82d608013c5150491.js, 20160519_9e4ff7c9b95a349f7499c6b453d07246.js, 20160519_9f35fbf4bb5ed389ac4a717a83b8bdf8.js, 20160519_a2d3513092d36bed82c35fb12e3541a5.js, 20160519_a3e19493f445d3f7426928ab0f597c78.js, 20160519_a4654e129f2719ad25397419a08e372a.js, 20160519_a52ea1ba683d2145e121beccb353c539.js, 20160519_a584303bca05ea6e85f32a0563f23908.js, 20160519_a585014e3ad933cfa04650c3c96857fb.js, 20160519_a593537820659c67ab87a0736fa8e5a0.js, 20160519_a5bc0f16086980cb94011ce49108dcd7.js, 20160519_a80c0bfdd6ed923c77a654702fb6bce3.js, 20160519_aa986379480a00fdad71be3d90a91ca3.js, 20160519_aaa0fa821fb52267d455a2316aebf74d.js, 20160519_ac0b4772284985715f0674f7f18c6843.js, 20160519_afdb3c49c4c0dc5d9576b3fbf962d52a.js, 20160519_b0de87c06e41c79147fc47c9f0977fdc.js, 20160519_b0f0ed884a268978e413b6e099d78dc9.js, 20160519_b120fe1de87f8379ffb8417975969ead.js, 20160519_b154f48f6f6a31e06eca81e34d476e7e.js, 20160519_b15b5997bad51c66500ff2e2b3d29633.js, 20160519_b3f48ae6247a866c1c5102967fd888d9.js, 20160519_b5bb3f49da0b667262851b6bcd417f9e.js, 20160519_b68b05bc56fce37db14402796a5652b0.js, 20160519_b8664277db5ac0b1fbf540d0bcc0471e.js, 20160519_b8c2dad18c21db5bc84973834550abbb.js, 20160519_b91b844c4029f8181d8fef2972866972.js, 20160519_b9c099625e3ac715c69f3793c7312065.js, 20160519_bb960f4edbd0d8e36e685e50db49938b.js, 20160519_bfdd6a3f77de60aeaf7fac3f6553b1de.js, 20160519_c26287d8c68697d8a1f3420bcc3132ff.js, 20160519_c4b6cbb0a18fc8557b199e4d453c558b.js, 20160519_ca75020f4b2da5097378ea88837146ff.js, 20160519_ccb0471327409218fe19e70f81813d6b.js, 20160519_ce461354d02ab462f5a7cfb268d779a4.js, 20160519_cf10026f5315b3a36a704a3099eb43f1.js, 20160519_d21292c7b274b028c7a1c37cc0183cde.js, 20160519_d3e3262c086d1945ba57eb91565d61af.js,...

rule _20160519_02951b4f0a2f6c62ac0aa112f460f1ce_20160519_0389c89ddb2f_849 {
  meta:
    description = "datamaliciousorder - from files 20160519_02951b4f0a2f6c62ac0aa112f460f1ce.js, 20160519_0389c89ddb2f7f114f988606f9819377.js, 20160519_03eea4e2fae07d91ff73f916adb40126.js, 20160519_03fa4d5363adc52577bc221979a03f2f.js, 20160519_0728dbf8eb97553e012f50629c79eebd.js, 20160519_08e526b933eb5ed5b7570fc4b204a48e.js, 20160519_0b979f49e04c35f6dd99021944a9a50a.js, 20160519_0e10774112929fedf3f10ace45030260.js, 20160519_0edc60176ec8107d0b8b77a9ed6ed4ef.js, 20160519_0feaf1b2bdb6ae3aebfd0212a217141c.js, 20160519_1071b3ec82d7019089c5739f98f79bea.js, 20160519_11a4ea4be290171e25ebaab3a1b38395.js, 20160519_11ad3ddd5f7e8d5b6be949a2e1fb167e.js, 20160519_136b0ce32fb56a706be02a62d4acbf82.js, 20160519_15c720e908224eb66d7121bf2b1c1a66.js, 20160519_16ec4e407d31599b272f8c1c749406e0.js, 20160519_17d43a0b4354c58846301ae1e9a954c6.js, 20160519_1852604c64e5ec25496daeeefae81183.js, 20160519_18aa0b6eec359e87f246dc982b91d985.js, 20160519_19286796e75352700a7857f6e478266b.js, 20160519_1bf11180f00c2ad80866af854ea28e4c.js, 20160519_1cf7f128551579d915b3b54cf587e4e6.js, 20160519_1e8219ea5a17a3d8172bb33191306972.js, 20160519_1fc1bee1b0299e85cd88fbaa8fea1731.js, 20160519_20dcd9a110d6efa0cb66037189d069b8.js, 20160519_215778b1c513b8344e6ce6bf92ac5fc3.js, 20160519_238c5a58bbbce3237d75c054a76a3913.js, 20160519_23a77895b3ea57cad5879d408c5264d5.js, 20160519_23ae5d8faaeabb1324a323908b2fa8c6.js, 20160519_23d3fe479dc7a8989ef416a6ca31925e.js, 20160519_2550cacb4bb73c76c9dddc64d53ec247.js, 20160519_2607365189d423afbc3a5420531122fd.js, 20160519_27cf1a4b23fc7c9cd10a23fc1ae83bf0.js, 20160519_2810683c294d52ff920a413458fa3de9.js, 20160519_29770a10e8f8bdd5e48c606b44ee6eef.js, 20160519_299d5c331da8b08b63fc1c317d22fc10.js, 20160519_2b1110d2224558cc91b118b60cc72570.js, 20160519_2b20f61b0903b24ee102f631de2877f6.js, 20160519_2f130c6d5e7edfcccd17b3f199c98257.js, 20160519_30282e1871d3a059fc2c5ce2b7a8b585.js, 20160519_318f683254981b85dc568496fe4d8301.js, 20160519_3306db6ab188b08e1569f5510c24f738.js, 20160519_38c9b21d61633d61322109976a4eff05.js, 20160519_3a4be7189159dc579966a789beae0aa6.js, 20160519_3c3cf40883a08c0e139f45710efdc79e.js, 20160519_3e003e432bc12a4551387dcefc7f4ef4.js, 20160519_3e460307d67f7c26e648a0223b09bc59.js, 20160519_40df9f083ee62f4f5b6b9298dcba7550.js, 20160519_41464e5a120b67d9431d0b79c578f9fe.js, 20160519_422b95f1e588884ac9ed68797536bded.js, 20160519_42e10aa03131771c1553d37f80f66c68.js, 20160519_434039eaa7905ff841a5759c1e5c2eab.js, 20160519_43c3dc3ea39226a7d3dbefee43be2f68.js, 20160519_44e4c6a08ff94072e1f171ddae8f1ced.js, 20160519_471a679471a97c32fe369a621e104a8a.js, 20160519_4925b5cf788a38e769afd615ae926b5f.js, 20160519_4aaf3e6e010cacc3138d3f71b13bc755.js, 20160519_4ae07497bcdec51ebfd20ed3ed074d59.js, 20160519_4c1e98ce5818711e8b28614a5608ab4e.js, 20160519_4d480a8cea7eb633f33c8ff43a1a67c1.js, 20160519_4e412eb34854927991c55514b1cf5e98.js, 20160519_5350dff6542c5d888d0d028773fd4a94.js, 20160519_53cd5755311e5ed31eec441e573960d4.js, 20160519_58d795253621bde73ab11b64803c050b.js, 20160519_5b10445694a5c72953b377f4ca87805a.js, 20160519_5b2adfa8a2ac18aaa49c23673051f934.js, 20160519_5c94f0bc47b3fd6199a5ca90deb1168e.js, 20160519_60035be208aa68fa015328294c847fa1.js, 20160519_6052a1c5b80341aaeca4c240f5fc231b.js, 20160519_60eb0f04644cf7b446a7591f95f1f238.js, 20160519_61c4c0f2c2fedf336d2db3c1c049b101.js, 20160519_649b47acf0000be25c4a176edf974411.js, 20160519_666abe43aee7f368e505bb9b734e2d13.js, 20160519_67c2280778e223e3b6503e5b63d8e718.js, 20160519_67fd80ec41c087d874bb3fe3fe2f5966.js, 20160519_68561cb1b7d206763f19833ca263049d.js, 20160519_69e27cf59d4cd27d4da4f9bcc1066d89.js, 20160519_6b8c2551c63be095fbc1958a5244f61a.js, 20160519_6c9c31a48658a154b412608a885e4187.js, 20160519_6ea567528f8a845a9f4670d38f7f150a.js, 20160519_6feeb71e86faa7681e1b5201ba2d4a8c.js, 20160519_7391a53f57d4e1d70f9a32c5cac2ea78.js, 20160519_75917e1f9e907715a926f865e87dea0e.js, 20160519_7761d812ef2ec7cd31ea4dc6fef27c29.js, 20160519_77699956db1bf8c389f8df5d2e8cc74d.js, 20160519_7869cae01a022d548fa491688036fd28.js, 20160519_79663f44c0284568368178cfd45f4a54.js, 20160519_7a5734d493b88f769fa207a45813e746.js, 20160519_7a7b7af73312b6e1d6cc979a9de02e95.js, 20160519_7a995583ee9dd82d12c0fc982f94fd30.js, 20160519_7adabfb3a6e1954c434d5c53d648bfff.js, 20160519_7add553756b46e541c92e151c17d128a.js, 20160519_7bc55bd8e4fd869b44caa11bd135bc17.js, 20160519_7d5057cebc51f1663d4bc562603e02b3.js, 20160519_7dda80b0b0273eea992179ad997707df.js, 20160519_7e92d445cf4d8484c5da554a3f60f45c.js, 20160519_7efffa054b3224091de2fa6a2a11837c.js, 20160519_7ff370256b4ef6638bd3a0e1c51acfc3.js, 20160519_81738caedd29c957d6e762fcfb3fe610.js, 20160519_82a4ee091ba78031e6ed93d235ee41f6.js, 20160519_850868bf44ef46c24bf4438edc801d7a.js, 20160519_858e53a0ad67b4e1243fd71f15362ec4.js, 20160519_860427814df6c0df5248de0a011de6ef.js, 20160519_871e7fe640a53fd3bb56ab9945dc3fb7.js, 20160519_8abf69528e081d264c3a97a8d2230b6b.js, 20160519_8c34e8599d8d856cc54d6eb8c3d0c1d3.js, 20160519_8e0c681ec79f83c7d63060ade8c466a8.js, 20160519_8ea9070e6902e3da6ebc1aabeb6964d5.js, 20160519_90b84ce5527ae4fdf579a8cec480e920.js, 20160519_919c0ece4628ae122a2847c70d1a8708.js, 20160519_9304619644e7f16580e4222a84f960b0.js, 20160519_95fdbd956eeb0c894c0aed60186c2481.js, 20160519_988da79bf186885d6101a7eb7d3e1c92.js, 20160519_9ac8b44d7889fc3c9c133d1c0e5e3ea9.js, 20160519_9ada55f71e801def5f13c6f3adaadf1e.js, 20160519_9c7a2d1064b3cfd9d81f9a5582216490.js, 20160519_9e2f4e490bfbc5f04463ec4c3cf1de99.js, 20160519_9e46a33377e51ae82d608013c5150491.js, 20160519_9e4ff7c9b95a349f7499c6b453d07246.js, 20160519_9f35fbf4bb5ed389ac4a717a83b8bdf8.js, 20160519_a2d3513092d36bed82c35fb12e3541a5.js, 20160519_a3e19493f445d3f7426928ab0f597c78.js, 20160519_a4654e129f2719ad25397419a08e372a.js, 20160519_a52ea1ba683d2145e121beccb353c539.js, 20160519_a584303bca05ea6e85f32a0563f23908.js, 20160519_a585014e3ad933cfa04650c3c96857fb.js, 20160519_a593537820659c67ab87a0736fa8e5a0.js, 20160519_a5bc0f16086980cb94011ce49108dcd7.js, 20160519_a80c0bfdd6ed923c77a654702fb6bce3.js, 20160519_aa986379480a00fdad71be3d90a91ca3.js, 20160519_aaa0fa821fb52267d455a2316aebf74d.js, 20160519_ac0b4772284985715f0674f7f18c6843.js, 20160519_afdb3c49c4c0dc5d9576b3fbf962d52a.js, 20160519_b0de87c06e41c79147fc47c9f0977fdc.js, 20160519_b0f0ed884a268978e413b6e099d78dc9.js, 20160519_b120fe1de87f8379ffb8417975969ead.js, 20160519_b154f48f6f6a31e06eca81e34d476e7e.js, 20160519_b15b5997bad51c66500ff2e2b3d29633.js, 20160519_b3f48ae6247a866c1c5102967fd888d9.js, 20160519_b5bb3f49da0b667262851b6bcd417f9e.js, 20160519_b68b05bc56fce37db14402796a5652b0.js, 20160519_b8664277db5ac0b1fbf540d0bcc0471e.js, 20160519_b8c2dad18c21db5bc84973834550abbb.js, 20160519_b91b844c4029f8181d8fef2972866972.js, 20160519_b9c099625e3ac715c69f3793c7312065.js, 20160519_bb960f4edbd0d8e36e685e50db49938b.js, 20160519_bfdd6a3f77de60aeaf7fac3f6553b1de.js, 20160519_c26287d8c68697d8a1f3420bcc3132ff.js, 20160519_c4b6cbb0a18fc8557b199e4d453c558b.js, 20160519_ca75020f4b2da5097378ea88837146ff.js, 20160519_ccb0471327409218fe19e70f81813d6b.js, 20160519_ce461354d02ab462f5a7cfb268d779a4.js, 20160519_cf10026f5315b3a36a704a3099eb43f1.js, 20160519_d21292c7b274b028c7a1c37cc0183cde.js, 20160519_d3e3262c086d1945ba57eb91565d61af.js,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "01e97340822461132da02dfc33597fc8148dad06b1479f27dc40a2587620b2aa"
    hash2       = "974bb07644fa1a021760471a2409535a5fcd255eb1005a9e956f9d644de9cd6c"
    hash3       = "f21282ff0cf21dfaee757408c2d15dea1a804ed9b001df928af348b7a893fc4a"
    hash4       = "c22a6c116c9ea19038a7abdc107ffc4e7ebf41d9bf239599aafc6d270bdfbdd5"
    hash5       = "7a636edddfc39f5dff0624e9b4d757a5cac6def1029e896875ebfbc72dcb9e50"
    hash6       = "08a46632f7fa6673b25cfab2884f0df6ff55d3cd6997332f4e5b20c510e4e635"
    hash7       = "bf41f540127703bc47961705ce2c6e7e218cd40fc36a8ad3f5f3265e1bfc2a17"
    hash8       = "380656cf8661aacadf6e698b8e8066a482aaac6a88a149524af606bfd8924d70"
    hash9       = "2879c61cb91ab03026206f8a37feccb1e412c5457caa798b2c2d4f6bbcd45d3f"
    hash10      = "ad9a2ad209c702f2bd83f5c4e82ff19f1d5f47ac55ecccd376f2c37f594434eb"
    hash11      = "ef74cb56f70a65c644ff1d2e1466585a114e8405c1c58ab9f49bbc97c76f9dfd"
    hash12      = "2d9ec106b1883cd320749fee2ec97f6e15dce851ac7e32f7ae383ab66c948f8e"
    hash13      = "d585695bd4841715e590c9a3e8aa5cb9d63455984a3a31d925844499f7df5a1b"
    hash14      = "e14b8aaf87a0757fc5ba191136e28b6165345534b3fda2f14d48b9d6c50a467e"
    hash15      = "3145eac04c03775209fea020c1a8e42be0f0f0e4f29eb504c68aa72b8c0d140a"
    hash16      = "5c09a87f849a1b1b8f6e93921fbeb955f835d5c5cccaca8b2178cfb829a7d048"
    hash17      = "eef075c68d2c64df03bb7db45e8c468dbecaa68dd99b68894a49d8ead289f8c3"
    hash18      = "50b87e9e59171eff4b7bac83f4efe133d6f4fbbc06ff45360ef84875a427c233"
    hash19      = "bfb6642137c0bbe5bd40156128dca793562800bff97a9bf2ad7359e4511846ae"
    hash20      = "4cf42144763f24507033208a700504cbbb308b0946d9421af12ae80da03351e5"
    hash21      = "3da3a305ae71443b459956c9765e19797114d36a56cb9aa63e89b189f4138171"
    hash22      = "9f9f2701a9a90762fcd1e60cf08d1b37a9b86580a425dfcb5aacb9c29147e3ce"
    hash23      = "1bcfffd8120852f78c62c9dd13338ea736a90e5deabdb08c5e7e431d29ca4caf"
    hash24      = "c52cfa7f7c55235a8578945f623cbbe954daea0922b4c3176bc735dc8593f45f"
    hash25      = "f5f64f1ca9208ffe2a3944e39c89dff6b0f7e5faa0ce45eb94c5d5f667e54e9d"
    hash26      = "49d11db950577c621ca94007aeb68d2e2c9aec7da62c5cb6f2d4e1f89d04b675"
    hash27      = "22183ca94b9fee360eedd6ff68926b2a1206d1f2206fa0eead5da49469a60037"
    hash28      = "cfb16ee195faaa1212c34297a3febc8261defe1d313414fc1f647286be0b1b28"
    hash29      = "760ff59560ad013f3f7f4b298b56d532b0e5a7bbd8f299fc2528700f8caf6155"
    hash30      = "a7f3a99d718c6999d18ef0d581b1dcec553534fae127d5879e2aadf51a4dfb5e"
    hash31      = "69220fc4ca7b00cab15a0302e2b9a1afa03f11c50b830e66dc3f42fe99759aa3"
    hash32      = "f65826669d16fe49f3fc638f53937fb56d2f1156d93717a799d870e06536c4e8"
    hash33      = "c69639ca63c200b07d72341db14f5831a407b0fc05fb16d58eef7f7b1dde6054"
    hash34      = "74f192a1df3f324c9dde4c9ffd42e0ed95b3f5f158127c5efa135fc9d6107b4e"
    hash35      = "c56a4cf63147019048f90cb3ba1dbc70a3273b6627d1ada47fd3de9b8a204c93"
    hash36      = "945ac3c27abf6f884a27143dfb705d0d78801b2d78b3f0d2aea933e0095c1558"
    hash37      = "fdb8c6b2b3c70985a9b8d494e21a84a18a3f679a366eb1a92736065b5ea40443"
    hash38      = "ef9014c32cfa8966259c073eb3aa9cdc4bb6fd150738a22d56f18f3958f9082f"
    hash39      = "55660edaaaa13339f5f7df29141e82b2ba8337d5303ef255e6bfad6b79be2fb1"
    hash40      = "937debab8643284897cdb6fd4ea97149c190f7ce378f855013dd7b7bf10a340c"
    hash41      = "1a96e1040edfdcd2c31aadf6e64cf2e09bf04ed5b6a2cfb512b17c1060fb2f8d"
    hash42      = "7aa8b74828ae62d8923f2cea77a979003d0e7c94888dcc4390796cf702843b29"
    hash43      = "35d47ab44fbfbac54642f10d642927ba70b271121a0cde9976ea2e5ce9c0a2ba"
    hash44      = "1dddb24fb004cb01c5252bcda4d956476e3bb4190cc1f7e7070004ab43a22f7d"
    hash45      = "096fd8eb9976826aa9c34cdbcc0f6bc894a75f3b67447c57e1456ddebd120974"
    hash46      = "4796bf862bfd1c6cc7c13f803808ba3a30f3544479bb431c78ce50fdaa02d31b"
    hash47      = "2b731ba5a7f285b09c948e621dbf3006f1c89877082e6a602ce1821538b2f9fe"
    hash48      = "6590422d62e1d7e6a93d0836ac93a66ae4e4efb35fa8a303855bda0a1bb3974a"
    hash49      = "3465d64fdbdedf730e76a4c894832b01559f2dd5caa38f63cd2c5b9e66936752"
    hash50      = "80126d8334d7c0c82c71f965250ad65abcac8c7a71d660179ff0f7a1599736df"
    hash51      = "39a243f60f18a3ee610502089e46ba3e0c4ff15f09f12b10471c298967194ba3"
    hash52      = "c3b328eec8252a30a33a426d790041d35db4cd35c6813c34de89c6b636d9c8a3"
    hash53      = "b27cc23a34c09d5226166958bed3abf2cb21c49e31351ec011bc60ee9f29fd57"
    hash54      = "5eeb04772e3e25367e0d6b5c811db795be869f94e290fc903a1129d960a17f38"
    hash55      = "60cd899265e0f7f15cfe4c562c0d8ffa18b539faf5eae75b43d1849955d5507c"
    hash56      = "1946cf52868cc3f231b56ad844e7cf8dd569d193dad02aafabb16c0f8e90a4d8"
    hash57      = "1fb104b17c91b90c0c5278f6a49a9dd56e5a3fda971a0dab2468dcc9d63eb799"
    hash58      = "7634666e4d5c66c3651b5bd4857c78ae6f95d638267cc732491a5d39a465dc64"
    hash59      = "7e98e9c58fab20ac7a7e221984864e1390cf47a8440e4d8f7a914383b5449d49"
    hash60      = "f33f271d97252041d744665d888efc0439c657900f2486df26a6ea337c83fdbd"
    hash61      = "73619977435974a6f88a0fe815f02ecb67f4404ed2874e725a3c8d2d96c0ef19"
    hash62      = "28f7901bd6eac28a99a93cfee357030194e824c1464a52179e050f4495e66345"
    hash63      = "67f0dba4ca131b498048b574af2046cfff52bb095ca8ee61d8202d5591539c67"
    hash64      = "f602074815768d938b6f69941ed9ea1f270cfa8c12d977327d997e59ec70b5a0"
    hash65      = "34e440a72cc399cb6bb5ba1ddef959eaaa6af9c4093dfa86d4d73dcfc730e98c"
    hash66      = "ddfe94f61b66f2e166689135f7c6dc8579aa18e998d841d9e14d86fb3e8a29f7"
    hash67      = "8ff5d974be6fa06f12b1af88fe144e9c81da94b495ed744096e73254bb99c9d4"
    hash68      = "e2fd494a4beb50f136373be306d46398b5a877374aaf3d67bbd6ca0e996ac448"
    hash69      = "a0d4392d021ad63f743d23442640e2f233540dce1afad2e000195c0083b02716"
    hash70      = "63cf99179580ba989bd007e179168789dc06088efe0c7b56b494aca6f8f69519"
    hash71      = "20c379c9aa4f0a70e6b65de3c096f1cb03f91b2a4035aab8feb24237fea6530b"
    hash72      = "06a6e713dd028552767e4c24b1330a41f9f0fdd559b0cfba3c4b7396d5669f03"
    hash73      = "376a04717cfa0ca9c23dfdd3a3a22461820bc1403bf05fde103f038e0a93c58e"
    hash74      = "254151f94618e02d57191257028b2b7d7af32de772d479c9a33c1bec32d72999"
    hash75      = "95cecfe8082bbd95cf0699b84003f810f3a77247139e2077c1cafe57892dcf96"
    hash76      = "db3067e2d71ebd35aede83262ab94b03f2c53c8b6833139b305086f9771526a3"
    hash77      = "70de14a318d525544eedf260fc2bf5a0ef4458704977fa05338575284ba1222f"
    hash78      = "2828a216d6249010426f3230fd404341f6daffa4bd4861417ce7c3b43c30fc48"
    hash79      = "b0acca90f5ada0ba0c4a86a85a5570c1f8da0d428a7cd7253e55943683e73d1f"
    hash80      = "b8810364c5cda6ae1da1ef502847b134e09cf37149b66a8c911bf26d6ff0d32e"
    hash81      = "265dcb2448dd39f2aad55a0dcb2ab60736e4d347a61ad713cf07975187cb6330"
    hash82      = "1ef65bc9e0913b2a0a6fb83b79fbbc2ba6bbf79e1097bf4f9a4f6880aca8ef56"
    hash83      = "5b644c4d634e965c59eb28b9488ff4c94d026a40cb6796ed3f7f0c3ab4e7b6bb"
    hash84      = "b10487c49ed6ce264c8cc1a7262b7b60cba26108c0247ced3ae31c102edaa7d9"
    hash85      = "785070c5ce82e7a96e14025b9c4d7d0ed024973f96939f450d6d02d993229b51"
    hash86      = "4cf40860c9872b6e1955f73e4a2c872b3842550d072ae28e7a14458d3bbe9366"
    hash87      = "d2a4c6e4ffb65de73907b61e8d6341b0cf9a73c496bcf5a8a9344de5325b7066"
    hash88      = "b120cb492d6b35511b9cb60158e3d16b648e7086be62d7156d40b4bc80bd4db3"
    hash89      = "c82c22bdeb780a059ebe2fa48c95e0c154d5656e336b3b6d604a0f96f675b10e"
    hash90      = "a8dfee28bde0639f02d01aaaa54c552c02730e68f4b6e744ad334026a9a2ea56"
    hash91      = "9a8e52d3c08fd80ed769bbefe632500b7fd50138ca4c42b066653682b089d1a9"
    hash92      = "f5e644882d7beb87578a228a0c8cf53f9727322091747e010ad571452b7d543f"
    hash93      = "3e12c0404145cd48c6d75d17c7846461c809dd111a5b11f340b12ab69615369b"
    hash94      = "8cf4ae21ec5cbf24710b797b08563a3d411f32a7fef8fe38dcfe386f6fd9f815"
    hash95      = "175b107178057ee5e3d8367aa36d91fa293d52e3673e003addfac549000e45f2"
    hash96      = "077ee6e5b44579c2a90d3a93d666686b9b3a304a27d26cac477e3ce0b9109d4e"
    hash97      = "a5f4bce61e52bc13ba4520af2195fb68080118ae2565bdd4f91a44bc3c3a871e"
    hash98      = "d19529f11e50b0b2336cfd34f2d3d2eed93fd9129fae8cc43504a3174d6a8cc2"
    hash99      = "dcbc7f41a58174afb8bc340fad10d5c59697633839f08e4ffb93734ab93b9a4c"
    hash100     = "8d1b5879505de29535b32e92bf12fe88621fb461d83b869739f4d106bdad2b39"
    hash101     = "5cc60e6c7182f4ba657e2c7a6113f137a1a9421bb6edb3b27852fd67036be6d1"
    hash102     = "8006557bb41b1b9cf242078e4729747b995d3253c9ee74a856ed992db291ef74"
    hash103     = "f8acf8d0e3ad91dd3f58a26fb350d15e0ab780b2a3384ccd41509697ce1a5dc7"
    hash104     = "db6ab7f76bcb6d20da8a618339bdba845c83383346cd2e99b188ef324486dd7a"
    hash105     = "886fc2b4f108f69b4929dd4c76038cf3a9e427ddbbd1631d17d133a022698372"
    hash106     = "68055cbb268311bb4df732540e2a9934c053c2a182d940af4d169e018e74443a"
    hash107     = "0a1febea74823a143187d1c4952f553afd494ee42b4de9265f9b1780670515d3"
    hash108     = "9705354a28194a420efb3e6840a074840e8c742fad5c62e6f2821971aa7e6716"
    hash109     = "bdeb0eccdb0a88d58c9fb32fa83470c3c109e85070eff21684bb6181ef4d2088"
    hash110     = "febcd78934c89ef0e9efb1bf29a085c354e276681715f9f94f8db1bedec61802"
    hash111     = "774ee9421e8ec3f3d1f1298dfcd54324d002689ca9349053484677a1aa88aec4"
    hash112     = "e2b2d97e8d933025156c58ae88f551e1ec3c6fca44fd9ac6fe0fc40a594987d3"
    hash113     = "7376ba4df58024853aedfd4ea569d39c2283a7b6b1e186f827ace443abeed215"
    hash114     = "6be730b7863941dc727d499566486632947eab08c0ab63d29196196025c87638"
    hash115     = "5445ce3d044cb4da5f2cc69e25c4cff4cc70e2ab4c6dd3cb63f7667d7635ceaa"
    hash116     = "0f51f37bcbc3ee7e339fd7a64352e46dc2f6648a48c1388ec91af5497b3eaa27"
    hash117     = "132eb50108a820bc0c96ba4979f33a9c9cc79478f5342c08713bf6cbc1cf93fb"
    hash118     = "03f899296e88370669988b8e359d550e58da3a5d2b4b72084581ac4198c58d45"
    hash119     = "a99e233317209d29e1059ce2ab6d27a365fed3ccc83a38f7eacbcb76fab8a17f"
    hash120     = "37585cd76e750a52d42c9e50e42bfd754036b2dffc2bc8e514197bee6c74c1d3"
    hash121     = "74c181737cc7d73c3737196ac536a2b87ce46d83a618bb812bc48ea24a80408d"
    hash122     = "6e24595ca882ec7678222ee235f70f05ab166c6c7c3a1956b8430129887afeaf"
    hash123     = "a59abd1de952672a5f5a0fc271de71e9a8cd8f9512fcb05a836886037200c82c"
    hash124     = "32fad308de08af904e742949203709275620f2a650583c05626195fdfce3669f"
    hash125     = "427f1f787e10b48ae7b79853bc825f347576322d7d030fd871bb2a4a543aa07b"
    hash126     = "a84e747d33690bf5a6b622585426b2efdd7056b6ad71e36a2a84d262c1a0a1ba"
    hash127     = "7f970d6da44f9a70fcacd8d95f256952ec74f9907dffd0e8d52fb3f053fe14b3"
    hash128     = "34e2080a35057ed423c4e1e3235309d422aba1fdbab8a41cfae7e3f00c27a9f4"
    hash129     = "eb513cd253e6e510786251904677342e5ee21da5bb1ff63f851cd52f2bc166df"
    hash130     = "34aaa3656e7b375827e903f078b64046b9a98b848273ede53e52daa9f6b45531"
    hash131     = "e3ad38d7c551633621f63a8cb32a831f729e069686954eaaed3def8b4ea78a95"
    hash132     = "339fde7906387c35dbb1d6ae8fa706682ddd63d4365c8cba2329cb30c77f2c4c"
    hash133     = "e1421859185f351f3cc295b1617c3630a7fd06686c6eab7750e6cec04c7a2dd3"
    hash134     = "23a1ca40fdf4fd386b7be2512398f277b21d1005bf490b0b928f235168566e6f"
    hash135     = "e454a1562746423de0b9d193b888ddd857a97d87e2f79782ef613620c2876e14"
    hash136     = "09edbe62c23a130a0985dd8d56eea3d4660aaa08a0dc2ab3f03090bec668b800"
    hash137     = "413b732b05b2d9a3604004b54430f2f04321a6bd90a2b53c2de8a7c973c8e11b"
    hash138     = "159a5752f7e1a96dd53b99027053aee5d88588261cdf76d82cee5fdecc40c882"
    hash139     = "1fac2f4be074f39eccc201b7bd14aa15187c92cb5e1e60156f0467da8ffd1cbf"
    hash140     = "f2269c5ef93113701d5905e7bdd4d1032bce0dd53b38c287a217d4f77809a942"
    hash141     = "b6f9768f5119e07d37d5edc0f4cf068b2062bbf218652d018453974efaeee2b8"
    hash142     = "589db50e5bcb95494b6bf27240cf4479560aeddeb4efacd2dc4e679e7453c83e"
    hash143     = "ba8d7a68ec0a2121694e9c2613132a58c063813da22aaf3d38a2c39e64d3d4ed"
    hash144     = "48beca5bf2a46ffd239ced39547bbe9eae6f4b5b007b96fd6c4e74ebe4dfff1a"
    hash145     = "7e3b4dbb27c1b3105c16d38015ec9f5c2efbfe1860b44d0e1a53635ef0a0b90b"
    hash146     = "fa309af08a75817d8998d3485a9d7eb6be1731a9deef9703a66e1929d06f8fab"
    hash147     = "41248e0a8ffc5d068996aae214f9d5270d47df2f12d0309a7c6cdf3adeca07e5"
    hash148     = "dd294789e9c3dfb6592f91bcda6f412f12e7f88ea7248c19a163e3809bf00508"
    hash149     = "f8b027913b3b6ef028552c2c058810c9e0db3b185ef0a51577a29ca2d20a2cba"
    hash150     = "01378378c0e32a5e92e3a9dc0684adadf18aae8f5898684cf6b0253fc2032463"
    hash151     = "1f06d54c34a92cff3c1ad4be155756d563cf25e8314f672205836e9e8b581831"
    hash152     = "f0fd341154c0d8b20bfd284a152853889a96404de826765d5a8d1d79d5a7a8b6"
    hash153     = "9d961e7f384398b8d9fa80a0a159b2342be9d3d2128c9226905fa7d5ba0fcdfd"
    hash154     = "e8dc83e29a7451435880a7767514f293a476ac73e719bc2879f8e064f55ff9dd"
    hash155     = "01d43707bd1f74f223a96ae7630eb3fac2a5e2fddcf6e04be104e3d0743e9c7e"
    hash156     = "1e02972c28de73acf27f7da6c5996f0342314beb544c7d361249ba94cd3beae3"
    hash157     = "e392ed14e34f86f1ac536feb38bf4647a2630a5416f0859222a38ef4460df127"
    hash158     = "a5a3abb4b742671586d08561751fde99b807fcd474e6cb4133b7bb6ebf55733a"
    hash159     = "22999e39760e3030f1c605c9fbd7a272137c60ce9be8819aee0c12a4fac7f2f5"
    hash160     = "343e421ba6c1fd4bfe6bbc3eee73b0548bdfefb8fbf9ee7b93241bb2cc9d72c8"
    hash161     = "834638f34f83538b60ddc5db66944effb4f724c15230193b574e04933091b7d8"
    hash162     = "cdee522db1f0c8acbb369ee0666bb87cc1e094b25a8119c18f472697c37d0689"
    hash163     = "bbc89a95b94911202a345bff362eb7d71df73e702c97ef194bc9f0164093b7bc"
    hash164     = "9cd4c93d95b1494530f42c2486ba23dd2873d1c367efdc337f5b7bc3b5392572"
    hash165     = "6fd3903ee27770b7d821fb83244b53af7d9eecdaf2a66ee1596bd8ceab0cfd85"
    hash166     = "c69e69528e157f1d2340f2c49e03b3264668e8f38d95af7ff8613141eb109a37"
    hash167     = "d6712c66abc924bee8afb1d978a915b67a6c67c1620ee0405f39f7a3145867ee"
    hash168     = "c331044df81793f9dc59e5eddcf854152f6bbd68f3ac985aa1fad92c8e964726"
    hash169     = "7e723e60b340615226978f405f2e8e17abc947cd3d3f538f3d847504bcc18faf"
    hash170     = "27dc324c4cbf101c51338bf4acaa166bc10e0e3198d461f8fc5e0874793b93d6"
    hash171     = "b1273e8d03ee332be4585029fdf86ac6a43712423b5820ed374ef86e5f446aff"
    hash172     = "beb7dfcb3d420fab299f06a9bd59dcc52ae4192a3a93dbc95d7df2489d6e47de"
    hash173     = "1b27b239c3d753e3ed4239a9e202084725de72e928df02a36a6659f41cb43f38"
    hash174     = "26fdef24dd1c492ca76e4e9176206a55790692a5bbf041b7f5bd351a17d8c136"
    hash175     = "24a3ec2bac1d147a8fe4efd538d1c940a8dadbf56c6fc246cb4f6b110265aad5"
    hash176     = "9c9a8c3b27841021be38a15614b6fb1be5ee966fc755a87041362ea50b62d6d9"
    hash177     = "8b47b58fe4742ef5777bf5dc565c4f64a97f2ecca81f6b2e7ff3d7c009970fb0"
    hash178     = "d5a81af7cc91da6886a717235183d17bc47f8b930d33817c114b5d84afde5623"
    hash179     = "6767cbfa2eee60adaa5500bc95fdd140513228d74fcd33cc57a1dd79c64f96d8"
    hash180     = "a542b7579909b637127cb6f874377b4b02d3ae0af729ea6ef8b82640f38ae1a6"
    hash181     = "72a70a405c25b83833583be7bb56c270b80f667f6f85123824c3936c162c6039"
    hash182     = "4706bdeb8bd9f345f0823c3871f782cbf7e1459687eea2deff7ce0cd5328a070"
    hash183     = "cb1179dc4ea9fc94a0f761cc34cf6c52132e51f703e74367d776851e6e2d9a4b"
    hash184     = "94fdf312fe0053ee54306e67d10412272b62de05e1c967b3c049f27cf3fc7c77"
    hash185     = "0f9e91bcc20745c96fa1d896cf3e47710994bedb58ea86b00af269c1b2b0c589"
    hash186     = "10e23d45fee9a8f39a1404d8667579e6c39904670dc7447c8e7dfd41cbf391c7"
    hash187     = "5b8e5a1d3dde3c2b3e6ac2c7f13573b1ab711ed6d1a54a9e0cb9bd9e02b34657"
    hash188     = "7b281fee5b8d30885930457cd74b2b3d957c4aa53d458553e5f0ab7be1f63f0b"
    hash189     = "6181095238226d1da6a9e0400ab2c37f8ac1398d687b8e0803d621581b12c533"
    hash190     = "ba2a27e40c989213353dc45ffe8fc6c124f2d711e92278e7f06bb73016e26383"
    hash191     = "27bb43554361e9a95402d9164efb35339f1017156bd39c7b08203ec3e44d9872"
    hash192     = "f9dadb2f4c7ac0a7e29638370a24174378c905487ae6e04bbab18a2cb52171fa"
    hash193     = "0b58a893b506bb8e16a0d2faf8a7e108bdab3af49acfb3b811a3954c15399a86"
    hash194     = "dae7f6b5c3027ce3e93524f41fa7b5cba06c21d9c5696a8fb27613ce0ed87802"

  strings:
    $s1 = "function copies /* _r_cmt */(structure) {var ______zauseimagetext = (123, structure); return ______zauseimagetext;};" fullword ascii
    $s2 = "function useimagetext(){return ______zacopies;};" fullword ascii
    $s3 = "var ______zbccff /* _r_cmt */ = function top() {return september[______zacopies]((\"fdasfadsfaszxvc\", terms /* _r_cmt */)+\".Sh" ascii
    $s4 = "function ccff(______zab9f4){______zbccff[(\"3\", \"2\", \"R\")+ \"u\" + (\"1\", \"n\")](______zab9f4, sweden, sweden);};" fullword ascii
    $s5 = "var ______zbccff /* _r_cmt */ = function top() {return september[______zacopies]((\"fdasfadsfaszxvc\", terms /* _r_cmt */)+\".Sh" ascii
    $s6 = "______zbsdiv7[negated](______zastructure, abases, (true, false));" fullword ascii
    $s7 = "______zbcopies = \"start \"+x10000+\"\\r\\nexit\"" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8ebeacbc-2893-4f9b-b185-7bd367a2256b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion