_20160429_063d7cddc5d490f34427ede56cf3124c_20160429_068c218d1e0f_889

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160429_063d7cddc5d490f34427ede56cf3124c.js, 20160429_068c218d1e0fcd015e0d014096151a0e.js, 20160429_08d035496966f49845d8d9173aa3973f.js, 20160429_10ebed3cee0dae3ff1531a23a38351da.js, 20160429_12f9015bf45524286e16cc2ef4e78153.js, 20160429_146806fb715b6faf53e1343a59243a9d.js, 20160429_15b0296260336ae063f4ba107d697d54.js, 20160429_17662c429da27d1e1b49e257ba7e6d51.js, 20160429_24c24edf561283bce218d642a3a8d541.js, 20160429_26282fa09ecdf166580a991ecf2cd326.js, 20160429_267fc525cf27f2ce2f0210bd07293119.js, 20160429_2695f460ce5adec39dd5205dea201f27.js, 20160429_36975db4a018a853d628a6c8ec3c7e54.js, 20160429_3ca5466ab3ac36fb78e0e0aa10f8cf38.js, 20160429_455079c21e16f660f83ecb53b41afb12.js, 20160429_50465b808df2dc8ecfd1bfc700f0a0c2.js, 20160429_51180c5d7dcab599de9c31689509e882.js, 20160429_5494b68064bd9b90ba4305a47fc72d98.js, 20160429_5513b87cf29c0034e765ccbf6b4c9a1b.js, 20160429_561f044d00ac8037998d112079c840c5.js, 20160429_59c5ba5786f921252a285a9f581f8e2e.js, 20160429_5bacc1c60f379c9e11d4a6b3ee01c540.js, 20160429_5d3560d7f52743d53f52d178031d6041.js, 20160429_5ef451bded204f092a1cf72a748b3408.js, 20160429_60e8dd409460a8aa7253d9dd25a79cca.js, 20160429_632144ea053d2043ea9a4f4768dcb45c.js, 20160429_6381fe6bfa33176b0b3c1fa58b58ebdf.js, 20160429_64917c741f2b2f80b875776f11c0c03a.js, 20160429_6622f4ccbba1619c1d93c9b2cd55c457.js, 20160429_7167b233aba1f0fdb8959e9004e5d121.js, 20160429_73593d1a28b551b7db41bbb4404d545c.js, 20160429_7514a839efba34306d74f65bb0b32973.js, 20160429_77fe5b9a59e4b7a26c178f2c472c0462.js, 20160429_79dbc9143b0fa0a9fe6e2165b0458737.js, 20160429_7a074b2a095f57324c821d28cb48a735.js, 20160429_7d0f660c5d19dce957a907b4f6d8ddd0.js, 20160429_8cbd5cfc96112f21035e234d3e2a6a5f.js, 20160429_8f98db0a7bb169653c86262868885446.js, 20160429_8fdade448fcaef7aec581e562352101b.js, 20160429_90e15e541c98edefc66e15c80b5f6ff8.js, 20160429_919c69a7d9821018fc2a4188b0c513cc.js, 20160429_98d18dfd6cd080600efefa2c25a3e74c.js, 20160429_a272f45858dca80594a871d6cb549a88.js, 20160429_a451ebd28a1ab40055082eec9b551b00.js, 20160429_ab2bac6395c6a134c986dc64509ec410.js, 20160429_ab776acd5f22ee3025839b3187d6cd39.js, 20160429_ae89505bae706752ad1ccd45989f7a3f.js, 20160429_aeda23c17e1ddd18c697302c1dd7f36d.js, 20160429_b0a569b301a066518ca8c4c45459460f.js, 20160429_b3de165c45c93f1886cf07dd35990b32.js, 20160429_b8215e9d18bb9779e4b650943b8c9583.js, 20160429_b86e7bedd5322edbc4e951bb88f3807d.js, 20160429_bc7fff8b38edc7a216957ca0685898a9.js, 20160429_bdcc43dc0b73060ffcc38240be93105a.js, 20160429_be08be24e63223ebd80efd034c524925.js, 20160429_befc700daf9339263f30bdb25e1b62b0.js, 20160429_bf7740ce61d52a452d20a06b8c97781c.js, 20160429_bfe29867cb3621a2ee61b40914fc9d1e.js, 20160429_ca706af668bd71b191ad5a4211e2f5fb.js, 20160429_dbad9658ce4f441a7b220b5d9247575e.js, 20160429_e9cd63f6c30369289f34e310a9b32540.js, 20160429_eccf3286864665cd8a2cda5074119a79.js, 20160429_edef42e9ac68d800b1a03b8fdd66444d.js, 20160429_ee19b9f22deac20eb742d858099b8562.js, 20160429_f2d58323a886b6d5b8a9deaaa6d631e8.js, 20160429_f5575383f24f64bb9b82479bc88e779b.js, 20160429_f643f2dab9a6376df98001360f30c811.js, 20160429_f7c5350bc54f868c6195ae757e591322.js

rule _20160429_063d7cddc5d490f34427ede56cf3124c_20160429_068c218d1e0f_889 {
  meta:
    description = "datamaliciousorder - from files 20160429_063d7cddc5d490f34427ede56cf3124c.js, 20160429_068c218d1e0fcd015e0d014096151a0e.js, 20160429_08d035496966f49845d8d9173aa3973f.js, 20160429_10ebed3cee0dae3ff1531a23a38351da.js, 20160429_12f9015bf45524286e16cc2ef4e78153.js, 20160429_146806fb715b6faf53e1343a59243a9d.js, 20160429_15b0296260336ae063f4ba107d697d54.js, 20160429_17662c429da27d1e1b49e257ba7e6d51.js, 20160429_24c24edf561283bce218d642a3a8d541.js, 20160429_26282fa09ecdf166580a991ecf2cd326.js, 20160429_267fc525cf27f2ce2f0210bd07293119.js, 20160429_2695f460ce5adec39dd5205dea201f27.js, 20160429_36975db4a018a853d628a6c8ec3c7e54.js, 20160429_3ca5466ab3ac36fb78e0e0aa10f8cf38.js, 20160429_455079c21e16f660f83ecb53b41afb12.js, 20160429_50465b808df2dc8ecfd1bfc700f0a0c2.js, 20160429_51180c5d7dcab599de9c31689509e882.js, 20160429_5494b68064bd9b90ba4305a47fc72d98.js, 20160429_5513b87cf29c0034e765ccbf6b4c9a1b.js, 20160429_561f044d00ac8037998d112079c840c5.js, 20160429_59c5ba5786f921252a285a9f581f8e2e.js, 20160429_5bacc1c60f379c9e11d4a6b3ee01c540.js, 20160429_5d3560d7f52743d53f52d178031d6041.js, 20160429_5ef451bded204f092a1cf72a748b3408.js, 20160429_60e8dd409460a8aa7253d9dd25a79cca.js, 20160429_632144ea053d2043ea9a4f4768dcb45c.js, 20160429_6381fe6bfa33176b0b3c1fa58b58ebdf.js, 20160429_64917c741f2b2f80b875776f11c0c03a.js, 20160429_6622f4ccbba1619c1d93c9b2cd55c457.js, 20160429_7167b233aba1f0fdb8959e9004e5d121.js, 20160429_73593d1a28b551b7db41bbb4404d545c.js, 20160429_7514a839efba34306d74f65bb0b32973.js, 20160429_77fe5b9a59e4b7a26c178f2c472c0462.js, 20160429_79dbc9143b0fa0a9fe6e2165b0458737.js, 20160429_7a074b2a095f57324c821d28cb48a735.js, 20160429_7d0f660c5d19dce957a907b4f6d8ddd0.js, 20160429_8cbd5cfc96112f21035e234d3e2a6a5f.js, 20160429_8f98db0a7bb169653c86262868885446.js, 20160429_8fdade448fcaef7aec581e562352101b.js, 20160429_90e15e541c98edefc66e15c80b5f6ff8.js, 20160429_919c69a7d9821018fc2a4188b0c513cc.js, 20160429_98d18dfd6cd080600efefa2c25a3e74c.js, 20160429_a272f45858dca80594a871d6cb549a88.js, 20160429_a451ebd28a1ab40055082eec9b551b00.js, 20160429_ab2bac6395c6a134c986dc64509ec410.js, 20160429_ab776acd5f22ee3025839b3187d6cd39.js, 20160429_ae89505bae706752ad1ccd45989f7a3f.js, 20160429_aeda23c17e1ddd18c697302c1dd7f36d.js, 20160429_b0a569b301a066518ca8c4c45459460f.js, 20160429_b3de165c45c93f1886cf07dd35990b32.js, 20160429_b8215e9d18bb9779e4b650943b8c9583.js, 20160429_b86e7bedd5322edbc4e951bb88f3807d.js, 20160429_bc7fff8b38edc7a216957ca0685898a9.js, 20160429_bdcc43dc0b73060ffcc38240be93105a.js, 20160429_be08be24e63223ebd80efd034c524925.js, 20160429_befc700daf9339263f30bdb25e1b62b0.js, 20160429_bf7740ce61d52a452d20a06b8c97781c.js, 20160429_bfe29867cb3621a2ee61b40914fc9d1e.js, 20160429_ca706af668bd71b191ad5a4211e2f5fb.js, 20160429_dbad9658ce4f441a7b220b5d9247575e.js, 20160429_e9cd63f6c30369289f34e310a9b32540.js, 20160429_eccf3286864665cd8a2cda5074119a79.js, 20160429_edef42e9ac68d800b1a03b8fdd66444d.js, 20160429_ee19b9f22deac20eb742d858099b8562.js, 20160429_f2d58323a886b6d5b8a9deaaa6d631e8.js, 20160429_f5575383f24f64bb9b82479bc88e779b.js, 20160429_f643f2dab9a6376df98001360f30c811.js, 20160429_f7c5350bc54f868c6195ae757e591322.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "985187321e2d6123907e8bcb0f62f9a7eaaa80785784b84f75b773643b57505a"
    hash2       = "450c9a501bdb442c2fb7539e6c26015f10441ef074b52fe7b1083f6117597205"
    hash3       = "ab567dee6b3745d365512e8d08dbd4f257cbb0aa7ed5a0ba53909c11375b4957"
    hash4       = "cf17d758dd6e4bd42fb4093d2ccc22453efc6c4abbcc93584508d9a26bce025b"
    hash5       = "9420209c26256f65b5684c936096994a210ecfe5bfc32716c0f8afb8a3c97d9e"
    hash6       = "dcac8e6d337a3815feb70fec1e3fdb4acf3b3f6072fc415fd61558e059341615"
    hash7       = "d7dd8fdf25e0a70c57e833197e59272c5a72bd6324cd94e4024216b2851c2fdd"
    hash8       = "df79028bdd24aa292604d603674e7ddc5cd132d28f6e89bc71041757ad8d2582"
    hash9       = "0fe8f17459a2a9233896f047e3e0430502af0105dbb969e5d3ae8d59902f27b4"
    hash10      = "d7778e51641f79cada58f33234ce0c225c763b4c547a5ad3edf624c40aa17449"
    hash11      = "3dff31140d679682cc84398c9057af7341d92bacc3b63bde1bd1fd38d40be38a"
    hash12      = "b54e076487c2d5b1bf0084e35cc937db42d79723eb9083879109322a1dd8c664"
    hash13      = "9d36834bc7a78c14b589a03b0f9face780087d125782bc13270f5ef611c2ad1a"
    hash14      = "88b144527f1d55a6664b18477bf04c27a883fe5b6e8d9de25b3a1c531277607e"
    hash15      = "94e667919beb711bd31b9ce7b76d011da1594e94730f8407be070b13b5405c14"
    hash16      = "a37c24d8c65d19e4ea154f3f84f0d5c39d3fae9803ea9e8d10e99c8cd4347029"
    hash17      = "704c34db4733fe82f1a25e998335e5ff3ccf266ac21299629e7c6f56c99a9bd2"
    hash18      = "8c0d1967c59853c191b7448136198e1e6489b9db863619177084bbd484788ed2"
    hash19      = "e69e216bfc7f4420f0d6b8350c8f4fac422e9b11615d1156647dd17ccc10c308"
    hash20      = "bbb42c534a52529b0a55934d5efade7aaeb4980c6d13d01f28887baa8414c080"
    hash21      = "dbe13132d5f6721ce1adc2542f74b8fd43949bbce6d395ee3added40126c8972"
    hash22      = "a9fac7fb14a02a23304985bc8c9955ff8c54e5abba070a00cb052a99019b65d4"
    hash23      = "c4fbf7d31260651ad5c2e37726dd30fc743529b243b8adb40d989e94035d1899"
    hash24      = "b719b12a13ab82cf8fe2b48961fadd8fd225c3817383241c515cc6cce71dfffe"
    hash25      = "6e807da85cee415f5a99eca7fb8d745a23e374ff0aef5d8155426640102792c3"
    hash26      = "3d0cbd7ecf8b16964eae4b866694bf6c70bcb8de3877b940583fbd730ba97f6f"
    hash27      = "8c8fe2518af35a66295267346b58fc884522f59d253e8a953b00643d448141f9"
    hash28      = "79261de78aafde2e4f2b884ed27288886e612e680ed6dab9b9d998b56a81805e"
    hash29      = "8440ab94072c908785ca8d3ee3fdf2fcae8cff6a755b07ca00b19552127355f1"
    hash30      = "4893d0fdf0857fad89d5c094bbd1bed0b0ed70ee00de4ff3c465a44e427f5c49"
    hash31      = "78104b28667357c4de6b6934e1dcad878929168dc7058565223e628ba4b88a65"
    hash32      = "767f184304df050edf0f480beccff25fe7eea2bf8f5ac66870cb1e24c93aba72"
    hash33      = "4a3ab99367e4404267c682ff58078beb4f7db12f1b3cc4b12d3cbddc68cde424"
    hash34      = "18dee1aa633797489bc826f91a9844cb732e2f603bdbbfeaff26d15c5f447a33"
    hash35      = "0e24c03153f4021f5dd1d47fb500605839bb8967d4904a475677cf44af76760e"
    hash36      = "44e09d1ea6d29dcd2122c25668b0c357ca2b0745b5b4a5bc95aebb4487b13a70"
    hash37      = "194c02cc2c37d1dd9898c2ac3a2a1012888134b15eceba05e7b565de99bef6ab"
    hash38      = "04901218004892c999f535b0b3d3c7f595428914cc13a4f71c5f7c69ddde97bf"
    hash39      = "67d0efd2b539ec174dded792bdfcaacfc798165abf5e00105a4557a1caa3902a"
    hash40      = "d4524514253d1543d836f2fa5837437f47464d987c11f0493395c2f50bb59b34"
    hash41      = "fbbf9b4613c8ba577f798aaaf6f82cfe3aa507ebf3c130e775bd258ce44246d4"
    hash42      = "dbd0e9edd80941adeb0d884321569730734bbf0f3bd715a9b1acc44d662e7e3c"
    hash43      = "858bef1bd516400523a91eb909408eeb3cdfcfd9d966682b9461f8de8e6939ab"
    hash44      = "655f9da705d6a9bac2f2de6ddf9f6f9ee207f0e1123c268e7669ce7f9f29563f"
    hash45      = "7f4440e507c96248f39a7e360dff0bade2c0030b3a45205c07a6e64aac153f39"
    hash46      = "32b74635021beb8e0dbcf7263b7fb4f006bed8cb183d05c4f746c44001c9dc88"
    hash47      = "b5ec74b26e40be4f0d219cd248e7c00218027e5a16d1d48e95deb933b2e10f3f"
    hash48      = "4bd1bbd308e9d84686bd598a10e492f008ee76212717ae5e165fe4d1ef8fd41e"
    hash49      = "c8e52bf1882b5b84ffe48de20c4ea9e7aff594903c7b0ec488b0aa5b21f9bc13"
    hash50      = "697218db1f2ea2bc50fd63205fdf2d12349c7923a764d9a6543f856fedb21a73"
    hash51      = "a1c2a91895944a46a8552e6530c05221113816103723181a5d0a89562895820d"
    hash52      = "fc4f9d589be4cd7ed32a5edd5fbfee54b59654dd07364cbee258bbc48b6f7737"
    hash53      = "256a998ce9e5eb5511899827302ff0618d945e26b8accc63c0b4e6db55bbc4bd"
    hash54      = "3e0e3950cfcce6ef9cf2292c2a254177e1bc9b6365df3221a3fd45a3432e6aaa"
    hash55      = "c7ee9a1836c6dcf3402eb2adbbebf58a0e3d7e1e23774e2cd9abc8caedad0cee"
    hash56      = "7749e3ddcefbdde063991e74b8b3cd57b702aabcdf259287a99e219fe0f9336b"
    hash57      = "c0e6e34e0ed3a08d137d850ad8d6a34ba82b74de22ca823430b4db748e287c4c"
    hash58      = "d4123d1b9aba36cd740b2fafc660a7f1e016511a5695a339be98f94cd1e5cdbb"
    hash59      = "33f6004c67859047e43db2eab6f7e8bd6b11e0f70965ac74ec154a27d3e4c569"
    hash60      = "d91883934720dc0fcc2bf2c7f3a42ce0ff46720a16abeac6b8848263fe723b4d"
    hash61      = "850cad26fb594235b46f17f135f06cf729e4f8e6e4b8c07666aa17452b269883"
    hash62      = "16fd2ab2a3842c78f2da319de860ba887c0af169a0a7c223bed35901055d628c"
    hash63      = "1582ee2d515134e6d0584f2096775889acfbc71f7c3ae3f49e7ee84458d3b122"
    hash64      = "8c5bdf9b374a093a9d64ca017e0368bb091a84fac6ee7a91dc50333c3805f2ad"
    hash65      = "97fd5e7d78ca56ec06d0d31c783c677e57eaa76b6c52eb9724ed18c0104d39fa"
    hash66      = "c2dd151f0531525172e2567e3acab803b7f61cda7d0583d7474fd506f00f78f9"
    hash67      = "1607fb95e405ff505fa6818b5f6d4774ff4c4038675254c8e355e0af705415b6"
    hash68      = "81994d727925b199e1df7622b97f882a279305f285754e7c4729e0d16ad5a0df"

  strings:
    $s1  = "zevTkRFppQ = \"}/* * Helper functions for managing events -- not part of the public interface. * Props to Dean Edwards\\\" addEv" ascii
    $s2  = "zevTkRFppQ = \"}/* * Helper functions for managing events -- not part of the public interface. * Props to Dean Edwards\\\" addEv" ascii
    $s3  = "  /** @type {$log} */" fullword ascii
    $s4  = "   * Hidden label for the delete button. Used to give context to screen readers." fullword ascii
    $s5  = "   * Hidden hint text for how to delete a chip. Used to give context to screen readers." fullword ascii
    $s6  = "  /** @type {angular.$scope} */" fullword ascii
    $s7  = "  /** @type {$element} */" fullword ascii
    $s8  = "  /** @type {Array.<Object>} */" fullword ascii
    $s9  = "  /** @type {Element} */" fullword ascii
    $s10 = "  /** @type {$timeout} **/" fullword ascii
    $s11 = "  /** @type {angular.NgModelController} */" fullword ascii
    $s12 = "String.prototype.immigration1 = function () {" fullword ascii
    $s13 = "   OXPzQaPwqV = \" handleObj is passed to all event handlers handleObj = jQuery.extend( { type: type, origType: origType, data: " ascii
    $s14 = "   * Model used by the input element." fullword ascii
    $s15 = "         virginian = IutpmE + \"/\" + dairy + dNmDxVL.shift();" fullword ascii
    $s16 = "   * Whether to use the mdOnAppend expression to transform the chip buffer" fullword ascii
    $s17 = "   * before appending it to the list." fullword ascii
    $s18 = "   OXPzQaPwqV = \" handleObj is passed to all event handlers handleObj = jQuery.extend( { type: type, origType: origType, data: " ascii

  condition:
    (uint16(0) == 0x657a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

41f7e021-af76-4241-b852-1b473f728413

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion