_20160229_1551ab9293e2f79b5dc4f47aebe48f3b_20160229_379f80bf46a4_870

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160229_1551ab9293e2f79b5dc4f47aebe48f3b.js, 20160229_379f80bf46a4f2369eca5cad5bdb6fdc.js, 20160229_3e77b508b4051beee9e2e4dbb646717c.js, 20160229_5baee09376f074603de3e7d5d08ac67e.js, 20160229_b8241d95a7120a1051b517a77a02beb5.js, 20160229_da4deabed6316606808bdbbcb74efc44.js, 20160229_f5b828b0b31e760ad67c2ff441011d4f.js, 20160301_0755fdf07c5602b692fc588892676574.js, 20160301_0919139e813c363a0d55e2dfca34474f.js, 20160301_0da17d22c88a194ed73ded4b3f7ff88f.js, 20160301_17516bf993fd9f272024ffdba56c8a13.js, 20160301_22617442973b3b5274a6659e354ec3ea.js, 20160301_2c028a24b19eb7d8e846057bdc2d31ac.js, 20160301_3ec847aefd5422707402d9b826bea4dc.js, 20160301_3f50a7a8fd2b3e0ef856de476a1faa88.js, 20160301_56032876983a700f4fbce4329a5ed412.js, 20160301_75108f82e6f461e54127bb8a23b4f6f4.js, 20160301_8631d3c13222703ab21cef494d00e48a.js, 20160301_ae9a762ecb5d37397232cb5f36c88782.js, 20160301_af38583f011f6dc937251cd27a018092.js, 20160301_b927d8aa97c5f8f54708e927c9dc3fee.js, 20160301_c4b630be1d5678c72254fe0b95234680.js, 20160301_cf2abaf329de97a61663b6798f711982.js, 20160301_d0a2dd77d54c9ca66aed84ee6db1ee49.js, 20160301_d1ce57ae5b8a2b71c36b44192ca54661.js, 20160301_dbf89818012c1cb130a190bc6854a8d3.js, 20160301_ee460fa5b91ca2a785b5d5f9a3e22770.js

rule _20160229_1551ab9293e2f79b5dc4f47aebe48f3b_20160229_379f80bf46a4_870 {
  meta:
    description = "datamaliciousorder - from files 20160229_1551ab9293e2f79b5dc4f47aebe48f3b.js, 20160229_379f80bf46a4f2369eca5cad5bdb6fdc.js, 20160229_3e77b508b4051beee9e2e4dbb646717c.js, 20160229_5baee09376f074603de3e7d5d08ac67e.js, 20160229_b8241d95a7120a1051b517a77a02beb5.js, 20160229_da4deabed6316606808bdbbcb74efc44.js, 20160229_f5b828b0b31e760ad67c2ff441011d4f.js, 20160301_0755fdf07c5602b692fc588892676574.js, 20160301_0919139e813c363a0d55e2dfca34474f.js, 20160301_0da17d22c88a194ed73ded4b3f7ff88f.js, 20160301_17516bf993fd9f272024ffdba56c8a13.js, 20160301_22617442973b3b5274a6659e354ec3ea.js, 20160301_2c028a24b19eb7d8e846057bdc2d31ac.js, 20160301_3ec847aefd5422707402d9b826bea4dc.js, 20160301_3f50a7a8fd2b3e0ef856de476a1faa88.js, 20160301_56032876983a700f4fbce4329a5ed412.js, 20160301_75108f82e6f461e54127bb8a23b4f6f4.js, 20160301_8631d3c13222703ab21cef494d00e48a.js, 20160301_ae9a762ecb5d37397232cb5f36c88782.js, 20160301_af38583f011f6dc937251cd27a018092.js, 20160301_b927d8aa97c5f8f54708e927c9dc3fee.js, 20160301_c4b630be1d5678c72254fe0b95234680.js, 20160301_cf2abaf329de97a61663b6798f711982.js, 20160301_d0a2dd77d54c9ca66aed84ee6db1ee49.js, 20160301_d1ce57ae5b8a2b71c36b44192ca54661.js, 20160301_dbf89818012c1cb130a190bc6854a8d3.js, 20160301_ee460fa5b91ca2a785b5d5f9a3e22770.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "c1459b9f67457bf32e404b15aed1b412bc97a20fbe23ada29b6605b139db4201"
    hash2       = "dcb570abd57fba555b667289d83291134139281f396fa9465d07fcba15e86263"
    hash3       = "a9826944ef0e611406ae90f64fc715986b23de1330660e829b26f29ef53488bf"
    hash4       = "44b6ebc11f57fb2839b215f26b88d4060a22412645d9d5bf2e79e071ed06a25c"
    hash5       = "4da3797b20b99d8ab5923d15d1618e52d29a4684592740570310574b1ea879f2"
    hash6       = "091e4037a80e76517056ce72696c3bb56b12b30dbf83dd1f2617a4f719294b1f"
    hash7       = "542a6fc22960ab5ff9188f8686204f7de116b1ff2525cb398e9e1cdde5aeab80"
    hash8       = "c67007dd1ccb8504f2658e6e1bc7a56d462efb75d91873a5fd23b9afbf77751d"
    hash9       = "b2dac94bcf403cd6184faa7e65d60389a141ac1916d2f034df5fa20cbc7a3760"
    hash10      = "b12d15427a029e1655ef9649c3d713d0d7e164eb802171e915cd96945a2b5b86"
    hash11      = "3064c3c23f64a837d73b6bf152e1b68fb3fc67d8218a569d5638c15d67c9af2b"
    hash12      = "63ad53be744e8a8a8f9e93fac05e13088fbc3ac73643ed25060cc6e15c312ea3"
    hash13      = "f2d59f6bc6b43826ee0c1dc0337c019157d4bb44b2f40603831f5d820a4a848d"
    hash14      = "77c70de3f4ab9dbb83a807e3ee6f5d4fcff75ebbfd2aa31ac159408116b327dc"
    hash15      = "bd8fa077dcd9eb0a96f81cf9612d59df55460160ec403baffa7e671f875c58af"
    hash16      = "023fb4db952bf7a5e568497052d5b15dea4a37b242762d789848fd31f721f649"
    hash17      = "d1d3eef96c9ceac2c7f6516211211aced2934f0698ccc8dd5dd60d20b3512560"
    hash18      = "631e1268a2588bba731ed69ffdaadfd0284368d3aa5e42307631eb64bb24902f"
    hash19      = "d2497b9faa154d08811962932ccea40ede9f47be22b60ec02a37888691d8d2c4"
    hash20      = "0aafadd21ed34c692ad7daa1fa835594514aaf09327bcc0f68710e31e43b5c28"
    hash21      = "28769b2b26d4a0f9d591b3f8db6538d6e6679288d1f1e1f160c35f15420b7c34"
    hash22      = "b156552a0d347f3e807a7bbd50c9b1630e29b3ea2767ae3375e3ec4044bb7309"
    hash23      = "04fbf1125aeff4b8fc87930f4603500599f3dee5e597c5de4076abb07ec79c78"
    hash24      = "6d0e69fb9aaab15503bca2c1f6e01e61816449ee37f0654fff870d37fc2d88f5"
    hash25      = "4ce15aac5814a03c1930763da0ee6b59d256dfc832bd5b22e220f008af7b9efa"
    hash26      = "8d5f86310552a8abc845b8a2b011138362cbcccf6d293da2e4a48c1ea002edc8"
    hash27      = "b2087d9b068f223e7a8b277c2739c93d349fceee5792f9f7025fd088312e1fd4"

  strings:
    $x1  = "// if ( typeof module === \"object\" && typeof module.exports === \"object\" ) {   // For CommonJS and CommonJS-like environment" ascii
    $s2  = "ere a proper `window`   // is present, execute the factory and get jQuery.   // For environments that do not have a `window` wit" ascii
    $s3  = "//// Support: Firefox 18+ // Can\"t be in strict mode, several libs including ASP.NET trace // the stack via arguments.caller.ca" ascii
    $s4  = "// if ( typeof module === \"object\" && typeof module.exports === \"object\" ) {   // For CommonJS and CommonJS-like environment" ascii
    $s5  = "//// Support: Firefox 18+ // Can\"t be in strict mode, several libs including ASP.NET trace // the stack via arguments.caller.ca" ascii
    $s6  = "//}// Pass this if window is not defined yet }(typeof window !== \"undefined\" ? window : this, function( window, noGlobal ) {" fullword ascii
    $s7  = "real `window`.   // e.g. var jQuery = require(\"jquery\")(window);   // See ticket #14549 for more info.   module.exports = glob" ascii
    $s8  = "//(function( global, factory ) {" fullword ascii
    $s9  = "// // Define a local copy of jQuery  jQuery = function( selector, context ) {" fullword ascii
    $s10 = "    //var support = {};" fullword ascii
    $s11 = ".document ?    factory( global, true ) :    function( w ) {     if ( !w.document ) {      throw new Error( \"jQuery requires a w" ascii
    $s12 = "h a `document`   // (such as Node.js), expose a factory as module.exports.   // This accentuates the need for the creation of a " ascii
    $s13 = "    //var  version = \"1.12.1\"," fullword ascii
    $s14 = "lee and Firefox dies if // you try to trace through \"use strict\" call chains. (#13335) //\"use strict\"; var deletedIds = [];" fullword ascii

  condition:
    (uint16(0) == 0x2f2f and (1 of ($x*) and 4 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

13d31b74-aedc-4979-9e0c-aeac1414e2f1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion