_20160527_03346e9b34cf014e3bcac7ab74620f44_20160527_1301b7d081c7_890
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160527_03346e9b34cf014e3bcac7ab74620f44.js, 20160527_1301b7d081c783cbee0ba428516a959a.js, 20160527_18a1ede6577e47a62538d2dcc90e5f9b.js, 20160527_1df80a13510c64465f39cce7cc88ba15.js, 20160527_1e2df6ead1e5157eafea9ad911a9e689.js, 20160527_2af46ef67de20d80772221d35c0463f3.js, 20160527_3dfc7e75deeac3b8daca52ebef74bebe.js, 20160527_43b56a8d378f4d6b55ab7db16b97af1e.js, 20160527_4509e920b1109a677141a43b9e6ffb46.js, 20160527_5118dd563988711f8e71585e728e3c13.js, 20160527_59a5b86b7c52c7db35a19653b5afabf0.js, 20160527_60424c8fc12c035db7842f7cf718c098.js, 20160527_6317767d20141a4799f781d4f564cecf.js, 20160527_7080fc069727084e5e044c742d9ff0ac.js, 20160527_70d113f48fc96cc1eb7f58c38344de27.js, 20160527_78fa0968087fbb57416008a56657a1bb.js, 20160527_87d04c3b3ecdd32569d73428920a6c87.js, 20160527_8a705b994bdaaf19b7c97c4be4f9a6ed.js, 20160527_8b7f52f213e1ced9de77eed697f740bf.js, 20160527_93192e364b38544d4b218ddf7fe5ab4b.js, 20160527_9b1e079af91463f9181f7bd808987cf0.js, 20160527_9f806433c27e1680375616740c1e4e68.js, 20160527_a50eb3ff5fe2424bc7d5775a2b269d9c.js, 20160527_acb152a3ecf6302ecc817e9bbe49992b.js, 20160527_ae357b31954a4a42f9a7fda45298a387.js, 20160527_b007345ebbc337dcc4ab947e309832a8.js, 20160527_b77485d9f7c90640712e875b76073a3f.js, 20160527_b8dc9d4a4a76cf073dccd8ea65f480dd.js, 20160527_b91caab2d694ef0645f313c3b0579a66.js, 20160527_c48e7764cc3586ed08c238688ebcd4bb.js, 20160527_cbe323f2e007fa87d0d73dec34a45a75.js, 20160527_cd1007d0e054da8de2a65a3b98071ceb.js, 20160527_ce66aa6be27881b69c842cc911901f5a.js, 20160527_d82facac76a2bdeea4909155a7b71914.js, 20160527_de979c0aceecc0d19e6cfb9ded63431d.js, 20160527_e70b99e27c1f68a43daf4eb90df786d7.js, 20160527_e9238b56cbbce7939eddad577472fbb4.js, 20160527_ef745970e06fb80f9ca0161d68c2dc61.js, 20160527_f6918d38e7b2212a5c1989fcab7111d8.js
rule _20160527_03346e9b34cf014e3bcac7ab74620f44_20160527_1301b7d081c7_890 {
meta:
description = "datamaliciousorder - from files 20160527_03346e9b34cf014e3bcac7ab74620f44.js, 20160527_1301b7d081c783cbee0ba428516a959a.js, 20160527_18a1ede6577e47a62538d2dcc90e5f9b.js, 20160527_1df80a13510c64465f39cce7cc88ba15.js, 20160527_1e2df6ead1e5157eafea9ad911a9e689.js, 20160527_2af46ef67de20d80772221d35c0463f3.js, 20160527_3dfc7e75deeac3b8daca52ebef74bebe.js, 20160527_43b56a8d378f4d6b55ab7db16b97af1e.js, 20160527_4509e920b1109a677141a43b9e6ffb46.js, 20160527_5118dd563988711f8e71585e728e3c13.js, 20160527_59a5b86b7c52c7db35a19653b5afabf0.js, 20160527_60424c8fc12c035db7842f7cf718c098.js, 20160527_6317767d20141a4799f781d4f564cecf.js, 20160527_7080fc069727084e5e044c742d9ff0ac.js, 20160527_70d113f48fc96cc1eb7f58c38344de27.js, 20160527_78fa0968087fbb57416008a56657a1bb.js, 20160527_87d04c3b3ecdd32569d73428920a6c87.js, 20160527_8a705b994bdaaf19b7c97c4be4f9a6ed.js, 20160527_8b7f52f213e1ced9de77eed697f740bf.js, 20160527_93192e364b38544d4b218ddf7fe5ab4b.js, 20160527_9b1e079af91463f9181f7bd808987cf0.js, 20160527_9f806433c27e1680375616740c1e4e68.js, 20160527_a50eb3ff5fe2424bc7d5775a2b269d9c.js, 20160527_acb152a3ecf6302ecc817e9bbe49992b.js, 20160527_ae357b31954a4a42f9a7fda45298a387.js, 20160527_b007345ebbc337dcc4ab947e309832a8.js, 20160527_b77485d9f7c90640712e875b76073a3f.js, 20160527_b8dc9d4a4a76cf073dccd8ea65f480dd.js, 20160527_b91caab2d694ef0645f313c3b0579a66.js, 20160527_c48e7764cc3586ed08c238688ebcd4bb.js, 20160527_cbe323f2e007fa87d0d73dec34a45a75.js, 20160527_cd1007d0e054da8de2a65a3b98071ceb.js, 20160527_ce66aa6be27881b69c842cc911901f5a.js, 20160527_d82facac76a2bdeea4909155a7b71914.js, 20160527_de979c0aceecc0d19e6cfb9ded63431d.js, 20160527_e70b99e27c1f68a43daf4eb90df786d7.js, 20160527_e9238b56cbbce7939eddad577472fbb4.js, 20160527_ef745970e06fb80f9ca0161d68c2dc61.js, 20160527_f6918d38e7b2212a5c1989fcab7111d8.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "eaf6770b8444a3abf1a8ae714f63da8e9c019b9b7fa695928a22ae040dc4fda1"
hash2 = "3c6c11c277af649021f2ad3f024dbb75df236c019a01cceb637d7ba1d6839483"
hash3 = "fee67fcc6c61700a9296d2832c763ea176e6615e0a23627825b9c06fe75888cd"
hash4 = "235326ebd20b2055b2ced94f439b2523f605c40a26a2e2073d1ff588df0a3575"
hash5 = "457305f608c9b8dd558730c96e6fe6fd63fb8a2c8b9d15007dc193beddfe1902"
hash6 = "359055cd37cf63824dfa95bdae1a664da65ff40afe1a1bab90bb6403b113d6ff"
hash7 = "efc1b47575511c3bac3edad939a74fc9b92385d453f5f33b9927293fd25aafd5"
hash8 = "04e801ef1a21ad737bb1fee9d9a838e8cee712634cc216215f4633a6c0f281e3"
hash9 = "8c78517433c7b32114d5e04dc5dbfbb1399b34e9cc94454eae67154286e58c4c"
hash10 = "1ce1c8a3cd08c7d61b580e43348ade4f4ebb4efc057a30b1b8aefd4c69609c04"
hash11 = "dac3c9042bf7092898452390c2bf91f050faea82cac951f122dec1dc86d334f0"
hash12 = "888a13aa79c44ad5f7ce565050bb11b8288319b2e4707b2ec2e44b99e5f314c2"
hash13 = "b6e0dd868281e3d80d3206f46e338827804db3ca6fe77bec02aabc7fb11b5fd1"
hash14 = "94703b671a0c34005b9a51341a0d79131613c0bfbc269f97b119e9163bd321a9"
hash15 = "712e23df22f6487b1ac511f58671060c4299ebb746f4412493a73a12ac481f15"
hash16 = "600c8acc201b44b55ce56c7f4856c39d22def67b95aa97a1f68c87a7058847a0"
hash17 = "31462d8299021650c43e57112bd1d11ce3a6e7e76f2df8ca01c27d5d1374c665"
hash18 = "c130935aa8aed6989dc894e223513d896f9be8bcad318ee7ce7258c29bf73997"
hash19 = "34773521606f9e69ad0c271b6b541fd9e8722b0abeb2906d1663c3da809b3d8f"
hash20 = "34b2e58db716374bc2aa224b864102da5a3c4a02a83273ca44628b5b538401a6"
hash21 = "a9be2776a5da72d0c4a631d7270c4d3c857cf22f2ae20e44614ea8ce8ded2cdd"
hash22 = "2965bb3ba85c619c1a1b77a9e0c7d017010e238edc79e7c80b9a33a654407a75"
hash23 = "e7a3fa960da5122d6751dc5f94d3430c43820f6f5fcbad74ef1d782223198176"
hash24 = "90a37d4e45dd76478555e4c21beb5b6e63b914c5537327229d58065a5a8db864"
hash25 = "241f3369d985c7594e11f0b0843214291a56b3d95e04dc8ae53c8e59744fb299"
hash26 = "a86c2cfd9a977cb7f4bb5ec642925a57ea0c0e7ab670a780685801be6dbec1cc"
hash27 = "fd77fb0dbac047fd1cfbe4ec94ba66a6ecc2ca9966b33f71c448d009e82017a5"
hash28 = "d2fa95c71b2310402c6c3deff72e3f631da335c8de3f1ea98f8dbce793b2f80a"
hash29 = "5b47e65e4ef715fe99cf0b79d0db9642f66effd9a49b3417635ddfb349dbd14a"
hash30 = "670a8eefdb31013dee7432d9140bed12f362b8c37b299667e27532c70da51309"
hash31 = "90d1f5c110fdf65f162e4b8f3c5f78d732a294b17931f24f7e43e734b83bc30b"
hash32 = "f787ae2fa4179f1a2ff81546c729e4b4529f3a02689f3eacc88a0689bb417beb"
hash33 = "6fcd6bb026d5012ba9991243004237ffd9bf1ee72eddcbada5059f1098408adc"
hash34 = "2ec95c387178648e0cc8a79dff98005fb0a8aecf8e0942aa084c8da1262a11a9"
hash35 = "f8fa5e35bf3c3a1089f5bb0bb267e96bbfd437a73434b70455e0cae39107e41e"
hash36 = "bc5c16672aa7f4fce5f5e28d39eb398e872aa6df4e04c8e2ffb654d41cd7ad55"
hash37 = "d3cc811833e0482ff021548c8ea352a5f7e3d6716fada931ec0b9084530c65ba"
hash38 = "678625d4b8905e0ceeaade049963cfea170b4b6ef92c310bd4e1d888aa258859"
hash39 = "5e15026767e6d3885e878ba88462ca7bdb4adba9509d5b9cb79ff7219e833e58"
strings:
$s1 = "-1,-1];sardinia=[];var tommy={\":\":\".\",U:\"S\",381:\"X\"},compulsory=0;function a(b){return 1==b?2:17}" fullword ascii
$s2 = "var derogatory=[-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-" ascii
$s3 = "y):new Point(b,c)};Point.add=function(b,c){return new Point(b.x+c.x,b.y+c.y)};Point.subtract=function(b,c){return new Point(b.x-" ascii
$s4 = "this[\"c3Vic3RyaW5n\".insubordination4()](compulsory,assignments)};" fullword ascii
$s5 = "String.prototype.insubordination4=function(){var b,c,d,e,f,g=this.replace(/disability/g,\"\");e=g.length;d=0;for(f=\"\";d<e;){do" ascii
$s6 = "Point.equals=function(b,c){return b.x==c.x&&b.y==c.y};Point.angle=function(b){return Math.atan2(b.y,b.x)};" fullword ascii
$s7 = "e&&-1==c);if(-1==c)break;f+=String.fromCharCode((b&3)<<6|c)}return f};var economic=\"disabilityJVdisabilityRFTVdisabilityAl\".in" ascii
$s8 = "erogatory[g.charCodeAt(d++)&255];while(d<e&&-1==b);if(-1==b)break;do c=derogatory[g.charCodeAt(d++)&255];while(d<e&&-1==c);if(-1" ascii
$s9 = "oint(b,c){this.x=b||0;this.y=c||0}Point.create=function(b,c){return isArray(b)?new Point(b[0],b[1]):isObject(b)?new Point(b.x,b." ascii
$s10 = "if(-1==b)break;f+=String.fromCharCode((c&15)<<4|(b&60)>>2);do{c=g.charCodeAt(d++)&255;if(61==c)return f;c=derogatory[c]}while(d<" ascii
$s11 = "bordination4();Point.interpolate=function(b,c,d){return new Point(b.x+(c.x-b.x)*d,b.y+(c.y-b.y)*d)};var madness=\"disabilityQWdi" ascii
$s12 = "e&&-1==c);if(-1==c)break;f+=String.fromCharCode((b&3)<<6|c)}return f};var economic=\"disabilityJVdisabilityRFTVdisabilityAl\".in" ascii
$s13 = "function insubordination(b){weeks=b;for(var c in tommy)weeks=weeks.replace(c,tommy[c]);return weeks}var assignments=1;function P" ascii
$s14 = "==c)break;f+=String.fromCharCode(b<<2|(c&48)>>4);do{b=g.charCodeAt(d++)&255;if(61==b)return f;b=derogatory[b]}while(d<e&&-1==b);" ascii
$s15 = "abilityN0aXZdisabilitylWE9iadisabilitymVjdA=disability=\".insubordination4();String.prototype.insubordination2=function(){return" ascii
$s16 = "function insubordination(b){weeks=b;for(var c in tommy)weeks=weeks.replace(c,tommy[c]);return weeks}var assignments=1;function P" ascii
$s17 = "c.x,b.y-c.y)};Point.scale=function(b,c,d){isObject(c)?(d=c.y,c=c.x):isNumber(d)||(d=c);return new Point(b.x*c,b.y*d)};" fullword ascii
condition:
(uint16(0) == 0x6176 and (8 of them)
) or (all of them)
}