_20160531_144bc93739199ccdaf921d1c3d7a006a_20160531_18fcc2fbd816_850
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160531_144bc93739199ccdaf921d1c3d7a006a.js, 20160531_18fcc2fbd816c64bd7a02d8444b20d04.js, 20160531_2802b1988b0c25de9bdc81c7ebdb3be2.js, 20160531_2b7dffb4baf9b81e0894b343a3612ea1.js, 20160531_33433fef1348f5ebb9e1f31b5a4c7ef4.js, 20160531_37c541b6df8b2f0fbaf3eeb071a9740c.js, 20160531_4acc248f7b9154c0471173d7c6e112fb.js, 20160531_50906aa81b5d6e6678e9cf33debce466.js, 20160531_54cc124a9111ec1890b0a818027ff969.js, 20160531_560427c1c6c2c96bad78ac23973fd5b7.js, 20160531_62c541ca14e5660418358d4bfb7ea529.js, 20160531_68bd970b7e49c351ffbefef127b87766.js, 20160531_6c25590580ec49b3aed4b943af2a8c89.js, 20160531_82f36cab77a5fb7cff7abe38ddb3fa9c.js, 20160531_8f6f1c92389a0518c93fc225a8196640.js, 20160531_93fb074f31e7e0fa7a5657969272870e.js, 20160531_94fa5d8115f285acaf40f57fe529d1c0.js, 20160531_95181aafe8843e898c0b6b3148fce1c1.js, 20160531_96a1a3dfb47468968e4dccf236af712a.js, 20160531_a7f3e9e8b48cc8f2ff2d86cbe13eabc5.js, 20160531_b1d9ffc72ac469a7320f6d6e0adcaab3.js, 20160531_b5db8988120eb48b202e99c33b3cb0d3.js, 20160531_b8d45bcc4602f31ac4b70505d6e38d05.js, 20160531_c206cf94d5c3474df87388fa769ed695.js, 20160531_c2cd2d1c59fc2004754787799b65995b.js, 20160531_cd390555a2f9dd3a392f22f581f3886a.js, 20160531_e4d988554416f75e29ce9b96fb9fec95.js, 20160531_ea2fca459f0c3fc5de7fc27ad6cc320a.js, 20160531_ed5ba6492d88c7cfaa7cd1f7b73534ab.js, 20160531_eeed4210c12cf1fe97571a1a28ccbb30.js, 20160531_f8ba0df894bb9fccd527d55a1fa4bff1.js, 20160531_fc183781173aadde0eac5d1e8f734c12.js
rule _20160531_144bc93739199ccdaf921d1c3d7a006a_20160531_18fcc2fbd816_850 {
meta:
description = "datamaliciousorder - from files 20160531_144bc93739199ccdaf921d1c3d7a006a.js, 20160531_18fcc2fbd816c64bd7a02d8444b20d04.js, 20160531_2802b1988b0c25de9bdc81c7ebdb3be2.js, 20160531_2b7dffb4baf9b81e0894b343a3612ea1.js, 20160531_33433fef1348f5ebb9e1f31b5a4c7ef4.js, 20160531_37c541b6df8b2f0fbaf3eeb071a9740c.js, 20160531_4acc248f7b9154c0471173d7c6e112fb.js, 20160531_50906aa81b5d6e6678e9cf33debce466.js, 20160531_54cc124a9111ec1890b0a818027ff969.js, 20160531_560427c1c6c2c96bad78ac23973fd5b7.js, 20160531_62c541ca14e5660418358d4bfb7ea529.js, 20160531_68bd970b7e49c351ffbefef127b87766.js, 20160531_6c25590580ec49b3aed4b943af2a8c89.js, 20160531_82f36cab77a5fb7cff7abe38ddb3fa9c.js, 20160531_8f6f1c92389a0518c93fc225a8196640.js, 20160531_93fb074f31e7e0fa7a5657969272870e.js, 20160531_94fa5d8115f285acaf40f57fe529d1c0.js, 20160531_95181aafe8843e898c0b6b3148fce1c1.js, 20160531_96a1a3dfb47468968e4dccf236af712a.js, 20160531_a7f3e9e8b48cc8f2ff2d86cbe13eabc5.js, 20160531_b1d9ffc72ac469a7320f6d6e0adcaab3.js, 20160531_b5db8988120eb48b202e99c33b3cb0d3.js, 20160531_b8d45bcc4602f31ac4b70505d6e38d05.js, 20160531_c206cf94d5c3474df87388fa769ed695.js, 20160531_c2cd2d1c59fc2004754787799b65995b.js, 20160531_cd390555a2f9dd3a392f22f581f3886a.js, 20160531_e4d988554416f75e29ce9b96fb9fec95.js, 20160531_ea2fca459f0c3fc5de7fc27ad6cc320a.js, 20160531_ed5ba6492d88c7cfaa7cd1f7b73534ab.js, 20160531_eeed4210c12cf1fe97571a1a28ccbb30.js, 20160531_f8ba0df894bb9fccd527d55a1fa4bff1.js, 20160531_fc183781173aadde0eac5d1e8f734c12.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "580b5b60334ba18f07f69a59b006b89a4dfaa1932527aacb35a89062f7101632"
hash2 = "e73b110c29d35eedc2e5c15c4237044cd3626b158795ac3de99c60b6bff49bf1"
hash3 = "0b7edf533a707e4c2162a01e08a219b3ed51f08779ff958aeab4a5aad07b7fb1"
hash4 = "c6c2197765795de2b4a706314910079d70f714e74588ed48d9e0c3862f6ac9a7"
hash5 = "5a0faf13de97a4627bcb8b71943b800b641d832440ad51db010778ff53582195"
hash6 = "00dbaa2c91620bd499c53ac6cb9e70a6244147ccbf8201d4d86057730955e2ad"
hash7 = "c46a16ced2da90dc5477a1c713dd5d739735d308a43074e55d08fd58c698a8a4"
hash8 = "16febbd2667eb7401eeee67682314c039815b68b2e34b2a294428e6479419848"
hash9 = "a56256ab0ac5b2138dd9103580b348d04bd80d9a181d18e3c3c7b07579cedfdf"
hash10 = "36d29608a7e2038f7177b6929b63d7f2e75d4346c219a657d0aa7147c4aa1c7a"
hash11 = "4539f803fc68c46c6db4e773295163c836a7ebda208e19d0cad84b566635673e"
hash12 = "5d749af0c870e7f208775d7d8678f9fa3e8a6327c641b8b456d388e8c726e0a2"
hash13 = "a01da116a5241cf9e812fba54f94d58ba7e4b57ed61be97e7d028268c77f701a"
hash14 = "b4482cf76622f29e75c8441aa1ece498b61d485fec3b339e24dfcde36dc64957"
hash15 = "55ddc1bf7213580e28a6e3a9360c79efb6b1c449d98844e47d0a80b8b95ecaa6"
hash16 = "cd15f76cac8d2a123c2408293211a13c3871409efa9027837c285c352fc9fd44"
hash17 = "4661e93a8aba76c7d12fa5e23a6a117035b257fdb26674838fb83c3d8ba99b55"
hash18 = "912c7ae40370c16bb638d77bf687b3fd94c1361ff0c226fd61156b274ae0d58b"
hash19 = "04060b294febaea32cd981982f2d34dbf3f6f73e00e4557d595274fece55b47c"
hash20 = "afe9b3a70b294516612f5674881fece055afcf26966cff314783c5e6ec0a5b90"
hash21 = "4c04ff86c2b4478a43c7fb6a5e3d490fd65c57a0a4dc135cc082ae91fd17b58c"
hash22 = "6748d64af5e753c68537ec15c3dd10a8ff8535c0f40447deaa17ccf92fabb7a1"
hash23 = "b768d0ac0d365ab059ab43daf6fe9a429e0880c7dd292289b9a0ed6b62518eb0"
hash24 = "f46c88628811b9c33bf94101fbfd6e685ab9362e751b075c87e05213c52922a7"
hash25 = "a6f8df1d841e539ff2b2e4db1f4f50f91c7f5549dc0d288cad6ab4abe8a0cae6"
hash26 = "2f58dbfffe01078b41c1ab91cc83ba52d2526f43508bb9c8af629fb4b3ae9a26"
hash27 = "a1060dae9f1ad6ea17536d997bbf44fa011b79e7c8a5f5867e12ceb6123f0f87"
hash28 = "cf91efe41a54fee16abf19ac03fd9ef643c47e03b0e95ebf553ea8b6522e7d1c"
hash29 = "609630a94ff951c7ced9d6ed04d5df54e11d726f5499e24615928c2263616319"
hash30 = "3d61ec7ad94404ed8b70d7a3e2a22af8595afa384894624a3db9ce6b8dd9910a"
hash31 = "7d38223cf6b4f0ba4cd9343f4221935f6ea279da3f633ee0b8d2eca0f6d84e41"
hash32 = "db7b08b4d9433463e167c6262a7817b8f807eede53c510cc3f1dd3ebddfb3b06"
strings:
$s1 = "var tainted=[-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-" ascii
$s2 = "-1];boston=[];var scour={\":\":\".\",U:\"S\",381:\"X\"},include=0;function a(b){return 1==b?2:17}" fullword ascii
$s3 = "ring.fromCharCode((c&15)<<4|(b&60)>>2);do{c=g.charCodeAt(d++)&255;if(61==c)return f;c=tainted[c]}while(d<e&&-1==c);if(-1==" fullword ascii
$s4 = "t(b.x,b.y):new Point(b,c)};Point.add=function(b,c){return new Point(b.x+c.x,b.y+c.y)};Point.subtract=function(b,c){return new Po" ascii
$s5 = "String.prototype.forego4=function(){var b,c,d,e,f,g=this.replace(/meredith/g,\"\");e=g.length;d=0;for(f=\"\";d<e;){do b=tainted[" ascii
$s6 = "function forego(b){mainstream=b;for(var c in scour)mainstream=mainstream.replace(c,scour[c]);return mainstream}var bradford=1;fu" ascii
$s7 = "arCodeAt(d++)&255];while(d<e&&-1==b);if(-1==b)break;do c=tainted[g.charCodeAt(d++)&255];while(d<e&&-1==c);if(-1==c)break;f+=Stri" ascii
$s8 = "QWmeredithN0aXZmeredithlWE9iameredithmVjdA=meredith=\".forego4();String.prototype.forego2=function(){return this[\"c3Vic3RyaW5n" ascii
$s9 = "orego4()](include,bradford)};" fullword ascii
$s10 = "function forego(b){mainstream=b;for(var c in scour)mainstream=mainstream.replace(c,scour[c]);return mainstream}var bradford=1;fu" ascii
$s11 = "c)break;f+=String.fromCharCode((b&3)<<6|c)}return f};var isolate=\"meredithJVmeredithRFTVmeredithAl\".forego4(),jennifer=\"mered" ascii
$s12 = "nction Point(b,c){this.x=b||0;this.y=c||0}Point.create=function(b,c){return isArray(b)?new Point(b[0],b[1]):isObject(b)?new Poin" ascii
$s13 = "c){return b.x==c.x&&b.y==c.y};Point.angle=function(b){return Math.atan2(b.y,b.x)};" fullword ascii
$s14 = "ng.fromCharCode(b<<2|(c&48)>>4);do{b=g.charCodeAt(d++)&255;if(61==b)return f;b=tainted[b]}while(d<e&&-1==b);if(-1==b)break;f+=St" ascii
$s15 = "c)break;f+=String.fromCharCode((b&3)<<6|c)}return f};var isolate=\"meredithJVmeredithRFTVmeredithAl\".forego4(),jennifer=\"mered" ascii
$s16 = "Point.scale=function(b,c,d){isObject(c)?(d=c.y,c=c.x):isNumber(d)||(d=c);return new Point(b.x*c,b.y*d)};Point.equals=function(b," ascii
$s17 = "Point.scale=function(b,c,d){isObject(c)?(d=c.y,c=c.x):isNumber(d)||(d=c);return new Point(b.x*c,b.y*d)};Point.equals=function(b," ascii
$s18 = "\"_F13_\";e.close();MGXMylMKMa=\"_F14_\";utilitarian[marketing](d,bradford,!0)}}catch(f){kgwnmdM=\"_F15_\"}}try{prague(\"aHRmere" ascii
condition:
(uint16(0) == 0x6176 and (8 of them)
) or (all of them)
}