_20161125_00cd7bc929bbd4af6d2831bd8a1d901e_20161125_00ec09436961_914

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20161125_00cd7bc929bbd4af6d2831bd8a1d901e.js, 20161125_00ec0943696169ea7f9f7d2bd741e4d9.js, 20161125_06630413b43c88d0130abaeaa0a7792b.js, 20161125_06e0c305f582699d5ee2596e285fce51.js, 20161125_06eee589c053ac942db72e665f645325.js, 20161125_074035851d8342bb3a2363a299031796.js, 20161125_080a04bb2a27ac3b68307a3ca45f2791.js, 20161125_0a28c0de074ff0da194de7a3660065ad.js, 20161125_0b2e9106d5a04dab5842b5d06821d49f.js, 20161125_0b89855b73e4fa64e39e322cdcb058e5.js, 20161125_0d695ade323893fafe9705c71d169a07.js, 20161125_0ea25f5559f511a77eee356c90801421.js, 20161125_13a7ef3d80e5f7481b29355e57496da1.js, 20161125_15fbe55c6e1f1ac8e7124cad4a88bb8d.js, 20161125_172481a02b7c805582ac84400407bca4.js, 20161125_173819edb1deb1748551415f64b98e03.js, 20161125_19127a4fd71bf13347ac3c248626faf1.js, 20161125_1c5f5d8c3beafc4ce907b8d50edec105.js, 20161125_1eeb9ccd3a2817ea2b479bca64f2c31e.js, 20161125_242e89b40bcd122935911798e3dbc699.js, 20161125_2ad9191601368054a9b5b5da60477f29.js, 20161125_2d55a397223b67141fcdd5cc91de500b.js, 20161125_2db5b080ac609c4cdd71cee5983e723f.js, 20161125_2f1efc84fc086d67e954c8c0f3fc56fd.js, 20161125_305770b7190ae7f68edc524cd0ea785b.js, 20161125_33a9202e03a81500e104ba99ad4ce9aa.js, 20161125_39abb2851fe5cf524c1823ffb49ab257.js, 20161125_3a6b318297c7926174d707c45a7eb8aa.js, 20161125_3b7f1bf8aa870a9c92f783ecff3e3084.js, 20161125_3f040e89e5415e7b96618cca08882763.js, 20161125_454f23e357278f89d479b5e9a0493461.js, 20161125_4b7a0d9d19b51b2f46399bd8aaa8d506.js, 20161125_4faf4a7aec23b0a8133511113332d257.js, 20161125_5119a24a141a128c1329adb849946ea2.js, 20161125_51ad2cbedf59fa434f26e8bc91ad1f9e.js, 20161125_55713b4d7c92781e5688b404978e2033.js, 20161125_58505c743e9b1961fde11879c22c2295.js, 20161125_58cc90361b15efbce554a301fcf105f5.js, 20161125_5bbdca5c45b68c00c77c72cfe7af01b2.js, 20161125_5f065c83f3801deccffb4fa8bc4bf5bb.js, 20161125_617b7568b9df349ed456fb692e3578cf.js, 20161125_61cc6b592e6ae52c9d3ddc8eec4b4165.js, 20161125_622807fc461e612958d0837822180626.js, 20161125_6744503fa4ba0ab0e022048147826029.js, 20161125_692608e6d3458064a142a45f7c1558fd.js, 20161125_6b9f7733499f29d9b4c130876b6bac5b.js, 20161125_6c31e19d4597af5a1892326961c3b676.js, 20161125_6dd2eaf8fe6426542137c5738a6f1218.js, 20161125_6e3320226684738020b210f8994b0998.js, 20161125_7025001db07950a69baab2576ebb76f6.js, 20161125_70620fd752a94510164ec35201c23a3b.js, 20161125_7346533efcc6168feaf844a65387dd17.js, 20161125_756c2db09655fa5c36ad3e22efb70fc4.js, 20161125_764685a0e4d30611135371fc771ae7ca.js, 20161125_76646ab0a3e4cac4ade85996f962d273.js, 20161125_775fa54acf3bd87a9b77044a9b17efcf.js, 20161125_7aa645d0727e00645052ed0156decb7b.js, 20161125_7ad84027a694643dbda099faf8893fb9.js, 20161125_7f7f4bdd1d4dd0993b63ca188b8f8fb4.js, 20161125_80995fcdfc15a8b6a1c09aa4a301f312.js, 20161125_818dc97f6c33a3ebe503846407aa9ef1.js, 20161125_8447abf58ac12c65cebed210b390d80e.js, 20161125_84e4581e25dc4c294fa1ef444b0b169e.js, 20161125_85002bc1fb5b3ba02116faeaa05141ff.js, 20161125_875d0c0bec3d0b58bc2a9b11291404f4.js, 20161125_882420110902501fb558858e73c2d4c9.js, 20161125_8a52a22999e856080590515b8025dbdc.js, 20161125_8c9960bd0536c95bb9cae59664549714.js, 20161125_8ffb9bc98c8496658d165e2cef2866d2.js, 20161125_9338aff9b9a600f6e66369ddf8d17b55.js, 20161125_93d682df9be408117c325d9753055a0e.js, 20161125_960343063b95120c19a48dcd04ae4f49.js, 20161125_9ad63cb170ae6723dda539714dbb3c81.js, 20161125_9e45b940b39ceac0e20379cb36fb76a9.js, 20161125_9f470ebf37bd3559f290262e304aa94b.js, 20161125_9f7a673c3842298a7a77e0005666359c.js, 20161125_a04d5a85f75785c7dfbf8b1f88822aca.js, 20161125_a28178a5ebed49c868a0b2d210c03959.js, 20161125_a2b3d75d10bd1b68597fb4d4f54226ec.js, 20161125_a2be39db3a06010c8d1c80565972225d.js, 20161125_a58620607ede874d89b936a4c347978e.js, 20161125_a59aaf93be7cf3dc598b3c2f5720a854.js, 20161125_a6296a65cc07df167604f927e0404120.js, 20161125_a7ecf47e8819c719c7cc910b49215f9a.js, 20161125_a8fb63efb9712371b3b1e8d7be501193.js, 20161125_a9602db3aaae5fe3f41f858f5ef45cf2.js, 20161125_ad0a4d6d1cdc38edecbfa4187c83b41e.js, 20161125_af5e6df4ca21d3b62c66c5053a959f5c.js, 20161125_b1a650b8ae9b54f51d9527dcc6e12978.js, 20161125_b2977f43ff6fe06b8b32d82834c71add.js, 20161125_b4938d2506f923821c6c86884f409274.js, 20161125_b5417bf58b1bcf9873a5d046cc2dc4ab.js, 20161125_b85dc3f207c4117e8cca5a62e343956a.js, 20161125_b9c936efc13dc9c1834a370147fdcf82.js, 20161125_bc08f391951bbeb3d3ee4cda2d557c04.js, 20161125_be47a2f7e1b117fbd4aaa1ab1060e899.js, 20161125_c1a749474c782225c49e466fc70185a0.js, 20161125_c53eacb44d7a72f25808fba177a8e68e.js, 20161125_c747346132ac061b9d1a9fd31892cb02.js, 20161125_c9cec23aa07fdf6c716bd354dd33cb3c.js, 20161125_d1a23b76cc2a1ec23cc91d61626a5ed5.js, 20161125_d339e4d355df8c4ece21af77095fa719.js, 20161125_d504de29eb14f42a6585e9dbcdfe2365.js, 20161125_d57096a636f4bca783efde6dbd002304.js, 20161125_d75f8942f4ff50dfb1141e089d03e1c0.js, 20161125_d88c8b600a56e2ea85fcd0884bbf38c9.js, 20161125_d8a6a53d598b5491ac7a45af79b85821.js, 20161125_d9106e2f7a6eeb6f320a915881d47b41.js, 20161125_dd06e3019365d0e7a0817f3151a61fba.js, 20161125_de9461ef9fe13a551a8df9e050693cd4.js, 20161125_e0a9d339f6ac130b9c2f659680523726.js, 20161125_e16a2d783eb691c717075dd2c6255c56.js, 20161125_e3994008dcb3acb8d7f3ee2d01aaceb0.js, 20161125_ea5eedb4e0f5b78794cea12f01060dba.js, 20161125_edad70395c8c24199d39a33161fcbace.js, 20161125_f042fef4875018f42f432e1789a294e2.js, 20161125_f233bd0b1c385b0798ef22524891061b.js, 20161125_f39e62667514aee99fe40702273b9f71.js, 20161125_f52f8b987409aa73c1f8ad00140b4b73.js, 20161125_f54064886f71d501054ca1e0ac00b047.js, 20161125_f827fe19f0c8b1f52550bc86648fad41.js, 20161125_fb1bcbf2faa22cdedeabc6f8177e3ebf.js, 20161125_fb5e09b07ce72af89bc980a8a140941c.js, 20161125_fd2c99c91cef2a675f8f38f5f4b6eee5.js, 20161125_ff4634998af9a273a85ca5cb6e5ec488.js

rule _20161125_00cd7bc929bbd4af6d2831bd8a1d901e_20161125_00ec09436961_914 {
  meta:
    description = "datamaliciousorder - from files 20161125_00cd7bc929bbd4af6d2831bd8a1d901e.js, 20161125_00ec0943696169ea7f9f7d2bd741e4d9.js, 20161125_06630413b43c88d0130abaeaa0a7792b.js, 20161125_06e0c305f582699d5ee2596e285fce51.js, 20161125_06eee589c053ac942db72e665f645325.js, 20161125_074035851d8342bb3a2363a299031796.js, 20161125_080a04bb2a27ac3b68307a3ca45f2791.js, 20161125_0a28c0de074ff0da194de7a3660065ad.js, 20161125_0b2e9106d5a04dab5842b5d06821d49f.js, 20161125_0b89855b73e4fa64e39e322cdcb058e5.js, 20161125_0d695ade323893fafe9705c71d169a07.js, 20161125_0ea25f5559f511a77eee356c90801421.js, 20161125_13a7ef3d80e5f7481b29355e57496da1.js, 20161125_15fbe55c6e1f1ac8e7124cad4a88bb8d.js, 20161125_172481a02b7c805582ac84400407bca4.js, 20161125_173819edb1deb1748551415f64b98e03.js, 20161125_19127a4fd71bf13347ac3c248626faf1.js, 20161125_1c5f5d8c3beafc4ce907b8d50edec105.js, 20161125_1eeb9ccd3a2817ea2b479bca64f2c31e.js, 20161125_242e89b40bcd122935911798e3dbc699.js, 20161125_2ad9191601368054a9b5b5da60477f29.js, 20161125_2d55a397223b67141fcdd5cc91de500b.js, 20161125_2db5b080ac609c4cdd71cee5983e723f.js, 20161125_2f1efc84fc086d67e954c8c0f3fc56fd.js, 20161125_305770b7190ae7f68edc524cd0ea785b.js, 20161125_33a9202e03a81500e104ba99ad4ce9aa.js, 20161125_39abb2851fe5cf524c1823ffb49ab257.js, 20161125_3a6b318297c7926174d707c45a7eb8aa.js, 20161125_3b7f1bf8aa870a9c92f783ecff3e3084.js, 20161125_3f040e89e5415e7b96618cca08882763.js, 20161125_454f23e357278f89d479b5e9a0493461.js, 20161125_4b7a0d9d19b51b2f46399bd8aaa8d506.js, 20161125_4faf4a7aec23b0a8133511113332d257.js, 20161125_5119a24a141a128c1329adb849946ea2.js, 20161125_51ad2cbedf59fa434f26e8bc91ad1f9e.js, 20161125_55713b4d7c92781e5688b404978e2033.js, 20161125_58505c743e9b1961fde11879c22c2295.js, 20161125_58cc90361b15efbce554a301fcf105f5.js, 20161125_5bbdca5c45b68c00c77c72cfe7af01b2.js, 20161125_5f065c83f3801deccffb4fa8bc4bf5bb.js, 20161125_617b7568b9df349ed456fb692e3578cf.js, 20161125_61cc6b592e6ae52c9d3ddc8eec4b4165.js, 20161125_622807fc461e612958d0837822180626.js, 20161125_6744503fa4ba0ab0e022048147826029.js, 20161125_692608e6d3458064a142a45f7c1558fd.js, 20161125_6b9f7733499f29d9b4c130876b6bac5b.js, 20161125_6c31e19d4597af5a1892326961c3b676.js, 20161125_6dd2eaf8fe6426542137c5738a6f1218.js, 20161125_6e3320226684738020b210f8994b0998.js, 20161125_7025001db07950a69baab2576ebb76f6.js, 20161125_70620fd752a94510164ec35201c23a3b.js, 20161125_7346533efcc6168feaf844a65387dd17.js, 20161125_756c2db09655fa5c36ad3e22efb70fc4.js, 20161125_764685a0e4d30611135371fc771ae7ca.js, 20161125_76646ab0a3e4cac4ade85996f962d273.js, 20161125_775fa54acf3bd87a9b77044a9b17efcf.js, 20161125_7aa645d0727e00645052ed0156decb7b.js, 20161125_7ad84027a694643dbda099faf8893fb9.js, 20161125_7f7f4bdd1d4dd0993b63ca188b8f8fb4.js, 20161125_80995fcdfc15a8b6a1c09aa4a301f312.js, 20161125_818dc97f6c33a3ebe503846407aa9ef1.js, 20161125_8447abf58ac12c65cebed210b390d80e.js, 20161125_84e4581e25dc4c294fa1ef444b0b169e.js, 20161125_85002bc1fb5b3ba02116faeaa05141ff.js, 20161125_875d0c0bec3d0b58bc2a9b11291404f4.js, 20161125_882420110902501fb558858e73c2d4c9.js, 20161125_8a52a22999e856080590515b8025dbdc.js, 20161125_8c9960bd0536c95bb9cae59664549714.js, 20161125_8ffb9bc98c8496658d165e2cef2866d2.js, 20161125_9338aff9b9a600f6e66369ddf8d17b55.js, 20161125_93d682df9be408117c325d9753055a0e.js, 20161125_960343063b95120c19a48dcd04ae4f49.js, 20161125_9ad63cb170ae6723dda539714dbb3c81.js, 20161125_9e45b940b39ceac0e20379cb36fb76a9.js, 20161125_9f470ebf37bd3559f290262e304aa94b.js, 20161125_9f7a673c3842298a7a77e0005666359c.js, 20161125_a04d5a85f75785c7dfbf8b1f88822aca.js, 20161125_a28178a5ebed49c868a0b2d210c03959.js, 20161125_a2b3d75d10bd1b68597fb4d4f54226ec.js, 20161125_a2be39db3a06010c8d1c80565972225d.js, 20161125_a58620607ede874d89b936a4c347978e.js, 20161125_a59aaf93be7cf3dc598b3c2f5720a854.js, 20161125_a6296a65cc07df167604f927e0404120.js, 20161125_a7ecf47e8819c719c7cc910b49215f9a.js, 20161125_a8fb63efb9712371b3b1e8d7be501193.js, 20161125_a9602db3aaae5fe3f41f858f5ef45cf2.js, 20161125_ad0a4d6d1cdc38edecbfa4187c83b41e.js, 20161125_af5e6df4ca21d3b62c66c5053a959f5c.js, 20161125_b1a650b8ae9b54f51d9527dcc6e12978.js, 20161125_b2977f43ff6fe06b8b32d82834c71add.js, 20161125_b4938d2506f923821c6c86884f409274.js, 20161125_b5417bf58b1bcf9873a5d046cc2dc4ab.js, 20161125_b85dc3f207c4117e8cca5a62e343956a.js, 20161125_b9c936efc13dc9c1834a370147fdcf82.js, 20161125_bc08f391951bbeb3d3ee4cda2d557c04.js, 20161125_be47a2f7e1b117fbd4aaa1ab1060e899.js, 20161125_c1a749474c782225c49e466fc70185a0.js, 20161125_c53eacb44d7a72f25808fba177a8e68e.js, 20161125_c747346132ac061b9d1a9fd31892cb02.js, 20161125_c9cec23aa07fdf6c716bd354dd33cb3c.js, 20161125_d1a23b76cc2a1ec23cc91d61626a5ed5.js, 20161125_d339e4d355df8c4ece21af77095fa719.js, 20161125_d504de29eb14f42a6585e9dbcdfe2365.js, 20161125_d57096a636f4bca783efde6dbd002304.js, 20161125_d75f8942f4ff50dfb1141e089d03e1c0.js, 20161125_d88c8b600a56e2ea85fcd0884bbf38c9.js, 20161125_d8a6a53d598b5491ac7a45af79b85821.js, 20161125_d9106e2f7a6eeb6f320a915881d47b41.js, 20161125_dd06e3019365d0e7a0817f3151a61fba.js, 20161125_de9461ef9fe13a551a8df9e050693cd4.js, 20161125_e0a9d339f6ac130b9c2f659680523726.js, 20161125_e16a2d783eb691c717075dd2c6255c56.js, 20161125_e3994008dcb3acb8d7f3ee2d01aaceb0.js, 20161125_ea5eedb4e0f5b78794cea12f01060dba.js, 20161125_edad70395c8c24199d39a33161fcbace.js, 20161125_f042fef4875018f42f432e1789a294e2.js, 20161125_f233bd0b1c385b0798ef22524891061b.js, 20161125_f39e62667514aee99fe40702273b9f71.js, 20161125_f52f8b987409aa73c1f8ad00140b4b73.js, 20161125_f54064886f71d501054ca1e0ac00b047.js, 20161125_f827fe19f0c8b1f52550bc86648fad41.js, 20161125_fb1bcbf2faa22cdedeabc6f8177e3ebf.js, 20161125_fb5e09b07ce72af89bc980a8a140941c.js, 20161125_fd2c99c91cef2a675f8f38f5f4b6eee5.js, 20161125_ff4634998af9a273a85ca5cb6e5ec488.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "e330209077817fb10bdc0fbbca556371ef7bd4262774e54ecf6b1724073da8ca"
    hash2       = "7f5c7334fde0592be3002a5906a248738671d6deb7380a2f9298f8a4ec79322e"
    hash3       = "e853bac13068a0b08dbe714c645a209bc548352398e36b4eceb2fcf9cd0b3be2"
    hash4       = "545f2a413cc5ce35263b03db379a2fbaedc8d49167cc47a56282ad159648c992"
    hash5       = "74f4a979ee482ccd6725d7db1020f4db5697f9a8c8e6e98f3f2995cf1c4a0309"
    hash6       = "b5c12e6dd5ccaba2c693c8668c0a53c5bb2085639869ac9c06a688efba8c014a"
    hash7       = "3b7d3c9a59f6ad913eae41a11975095cb10fd580fdc8020f99e6ffd70a9da141"
    hash8       = "82b9b40d3ae793de0d7b373b64c174c9f711ba524749539a248d3fa001b957c3"
    hash9       = "7da493fb151725ac189041c92c786a466d5c705c7ad058900e7854044c348738"
    hash10      = "d6016a8c6d6ea667ba68e41fe76e3e4f22ae3d6a76b28e92528b266ccd97dc3e"
    hash11      = "160465d78de14c13013aa0a9955191ff6895e7f73b083cb7d56736c3ed98ff76"
    hash12      = "2be18634ebc06bb770cb8a00d72285aa6b729cbeb48621eeac84f62e859dc448"
    hash13      = "f52894307056af0faf85285f9bd870e4a0c56d7b54eae47c49d8547d5f17c85a"
    hash14      = "f24ee685618a60a9f293efd53ef7e848ae32353560901fa6ba1f7405bc7f82c0"
    hash15      = "8ed6ea21f29ca541b9db6f09171e09c4213a417f93e2e456f94b37ce4f922a7d"
    hash16      = "e39bff28865c2f0be943c074ab58c66147235c0f4c63983041b448a4acfb597e"
    hash17      = "76a387816cb82299ba1fb9c2871b296b939ff37224ad1b61b4947f2d93610bcd"
    hash18      = "b81fdb2cf964fad43e92e870cfd252202733bde10c07999fcb19da22ce0d9d17"
    hash19      = "3a68773f86cac081d7746ddeacff4bc320d9b0e5961ef73eea5f09a9d83c7f5b"
    hash20      = "642cf6dcc6b2fa56864f4f1cda316fd4673dee68558c1e4af0a323ed52f07a8a"
    hash21      = "03893330ec5325a18bee2b1b2610b1711bbe28272188dd6f085680260375e3ef"
    hash22      = "f6a139c15e002c98097e9408b995453fccd3066fb1a67cc4683e96f1dc20c5ee"
    hash23      = "410bc0e7580f88e63a9a7ebe074b62dc3eae5a1e3b522b42a932bf16e56e29f7"
    hash24      = "a21603cd9d0d16edce9a17a50c3a686a678e4ed1d5c03cd27ee7abd68d647e04"
    hash25      = "9f1b57682f1b4de1e5739d28120acd2a1f429f810eb998dcd38886ad79f628fc"
    hash26      = "66eb72a5b03a208affd98be7916b22ce18289cba320e03bd9e3e2c4dd5f46928"
    hash27      = "53b6a40f9d227b8ed09a850bcfaee4b16a0f34e5f1b9121fec6bba561a50ed67"
    hash28      = "49d1e841734cc3b5a1fe1a5cb996886b9dd62730de8bda8b185cc3b90cba526a"
    hash29      = "437ba89e1338b4ca116a872e8df82b9ff8d6c323af759effd8342e9268c559ca"
    hash30      = "d6d3925cd0afc3bdc82b29e2eae0d3d056a2038ffbb6b37721ee59b390483edd"
    hash31      = "15bed8fb3546877d8b670f4a9472ea2135e9e9d9600775e8e2b5df1f540cf2f0"
    hash32      = "7464d6e941c00f618051dc6806a018dd84e029dd67bad95a2c1f7d5f519514d2"
    hash33      = "41fe64da0ecb9435fb266e512861acbb010b20c7d96e1b080bfafb2121be04de"
    hash34      = "7ca53f0c4f254e1ffd7823db0849e2abc2959e84c0f089e61905d1767cf142d8"
    hash35      = "d626f9c54d10590a3c76f0705e9d175032e9cc84672a73ef499342898da5b878"
    hash36      = "cbad61ae9e872791e7281cf5d3965c11e64375330bcb0be3eb855945021c0ad8"
    hash37      = "60561972127104ce790a941db8af606a81ebe4301491a50a059fafc170f32f98"
    hash38      = "45f0c97a86176fa4c18cbf9a928dd3b6706a3d0e7d191fb5901d54c4eb38b45c"
    hash39      = "cae942cc88c534bbb716cdf186682390c8a0624a52e466d12bc38ec413f0afd9"
    hash40      = "81d6ea2a36a9034804cff6411e0fdf7533e03ba7985f58962a25862b3c44fe99"
    hash41      = "f1fee898b0372a3c820832b292422f78db2d3f688aeba7aab62b68b93405a487"
    hash42      = "9108b09c6ef37287089ba0b9929e33874954ac07566ec06941d3aa650b5821bb"
    hash43      = "3e1db89ac118e0062890b93d82806d8d313e7f93b7736782e190490908e60b32"
    hash44      = "70a857bbc246223d337186cef5f78d26cb3ad28c9d163644e582d63f3031ea7c"
    hash45      = "542fdd1400ebdc46c35d78525bb2ffcc9acd9828351e2baaa01e044ac6af83eb"
    hash46      = "b53ce09cf6123538271b620bb6ffff11ea3bc72dcfd393d55e1ea665c84ea257"
    hash47      = "d66da5d21bb8eaa19c6d0fcb5a24f756e1ae43fe0930774ae217862374600540"
    hash48      = "db94dd037d963e50c2506a21661fd16f9318bc4635e749c0228379cbe4fa3251"
    hash49      = "2ef92854fe60addc020148cc408de5def19ec83f720f775467f0005544c7fa18"
    hash50      = "e6688f9aea1b86f8a3a41f1ef317009281f1c6ec7c5bc6674fea0aac4cb1a144"
    hash51      = "10ead5e7d037818d5053a9808de0c4f82efdf05439b2d1ee3a7448225b6eecea"
    hash52      = "a3c83f94b3af04213734e8042c878dae68c719ddc473f8c2400aacf58a80a4d0"
    hash53      = "8a8218f4fd61604d1f2c9a3e34fd486a11ee19db63577d54e206f52a10e046b3"
    hash54      = "cda8df1c38bdad7718c0a2f44a631e727ac59b603b18ef57a6db12700f366ea9"
    hash55      = "1d47144f5a0e8315ac41eee3b95edd6ff47b9c0f080995d82a86f31f1c932e02"
    hash56      = "852b6fa2e6a7aee749440fe3120685111d4b08b0d0712bee4b65ad00a28d8d81"
    hash57      = "de2ac35861fef710324245e716e9e60ff327e0afa3935515c31820ac626de0ee"
    hash58      = "52d0c027d9985a634b629d22eaf827e611f52bc6a02bf0e31cc421a4f8cf7759"
    hash59      = "2fc0bbf160133a6fee00a2d99dddc9a5be02bf1b8538b5b0ea8b6e9d65c9ac85"
    hash60      = "4facaee773e9169b9cedfd3de325d3acf6602c712e3632a27ac85242fee4f91d"
    hash61      = "4bdd3cbac844956b8b57d8928a44c56b48c444ebd4cb61928c9286f3cb85c500"
    hash62      = "897ab8c48983bf6aa2b0fcd99eca248b4e77b9cbd9153d2fd77358838721d338"
    hash63      = "61c0370aef4ecfe190c9e66f2ebb16271dde14a8f82595a0c6561d35029267c9"
    hash64      = "d8fc6720b338911475968a3d0e2ccbe5ce1020b1a3c05d1f80a5ba0b9797991f"
    hash65      = "f10aed8520d2a2c86a48da79b1fa9564f2a0632f5c2bee5d1e9f9c2a13faf998"
    hash66      = "35613691beefa9c9327a53f9a3a04a6cb57a84ab33870108f8dfb482ba566ab5"
    hash67      = "c4f7c6863c750ee56c3d9cecc482cda53adcd6f8d425fcb5e152be59370c1d8b"
    hash68      = "0cb32d8ec710a5fcee0258bbfff6cde3884fa35a5e513a4c4114295295be3c6d"
    hash69      = "6ef933e8d7259b0af7059df1f4791a1614d8a9e039376fce87b510dea41e04d0"
    hash70      = "02f4489b90f3f09f0c2ee9f477a0d59939a1ddfc356df5cec9ef8a8649095df8"
    hash71      = "15c2aeb6d4c596416d4c4ed1aa07da4dba6b3e3f5eb4bd367a13922920ddb5d4"
    hash72      = "5d97901d693b0584649a84392eb1870270190c0763991deee102583e1a124d82"
    hash73      = "c73c2b2e6ecbcc8981df7faddb56f4cfb7fdda91c9d7e8153fea8d198488a083"
    hash74      = "3b2d3c88c7129809d93a780523489d543424c3df52c1d941f98d7fa97f2affb0"
    hash75      = "5326772d9b12ebe7aaa586ba95392d5006571a6d30522d5ba31b1ff07994f23c"
    hash76      = "bef30fd8d0c71d4f263244c5119674b4fd8dbde340a6b09f6363ce062e3eb941"
    hash77      = "c7dba2fadada7d11dc78dbc9c16873d89980acf36e93930e3808232d9dd9d80d"
    hash78      = "4e348b3e18d3a02c4742f042aa476f5a7409426b7232efaada1d8d938d16d6f0"
    hash79      = "2ac4cdc8af32d66290f2fe6386805aeb37208f6e919a62fb9cbad85ab4d81caa"
    hash80      = "3cd3986862cb4f1fdc3e57163d52ed45416005b0eb6b0d22b6344062caec43ae"
    hash81      = "febab3f4b2b70e7ffa2b706994e3f64e9019aa7c294f317bbe700164af66e0a1"
    hash82      = "473cc006d9181ad877575dac96063b149b3ecd8c16e239c2fd0776591b7c41ef"
    hash83      = "9de9ca03964ca67db6bff38329e66755da31b16d20440c09a1b634fb5e12e9ee"
    hash84      = "e995955001b01526f99841224ecaccb7338564218a95bd99d701c72ca7df7ef9"
    hash85      = "29081caea958f9d27bc41dd0d31d59d7056b5a70de1f588e8a488114c6160f9d"
    hash86      = "9628086698aa9b57f4d1856146db8359988f5de35f2072ef3548b37377249bf7"
    hash87      = "9b157fd70d0d12cc2be2bf5d29bf7e54c052d38595949981bc65ab1e8fd10373"
    hash88      = "6e33b64c4f97b430ede04ccea7db17df3c3cfcf1b1395c05fb9c87a714eac4d0"
    hash89      = "c4758d914aab434c95a205a2de9ce9e3c1c74179f1198c91d91dd081dd81e2cc"
    hash90      = "8a312424c87f019b9773341c70faf13c73c200c9ce1802ecfd61c9df08774992"
    hash91      = "b34dd6096b6fd6220579d73fbd1351677cd6e5b2984248474dcbfea03e34f5f6"
    hash92      = "24dcb86f5eb975b9676340669013ed6c267a104cda680dcc7a31f253930ad064"
    hash93      = "57a034cfcbc2ac129a4186c13e02934bd656f775ea5bbb760cb1a8dc13a0641a"
    hash94      = "b335af0753ad4425ad016b777e49c2c03dc68bc8a9d1b90864a79fbab07fb323"
    hash95      = "c89550ec36deb4362b49c9b45919a6d74c107605a4e2db56fb913035e4d0dd86"
    hash96      = "b361bc3ce933ddfd214a033b93de889fca96345491ae6dc7e0721f4f6682c199"
    hash97      = "a11233adf8b6ce07cef5a6da7014233964290aa42c4d300a26956369a3cc9b8b"
    hash98      = "bef790b998c1bc3b17b332e489f5e8626a4c7ca456d555037a00cb0edff035f3"
    hash99      = "b2d77b859520a1653b98787605ab4d12ffc6a45323548fb3f3f22b6edb5c329f"
    hash100     = "230864cc901fdf7e6cddb1bd5e72d93934163f3fa2275c026b762e7f35d3f99c"
    hash101     = "d06f280269c92b350352efc52beed6146738d93a9acbff3c55867f39f9d27a1f"
    hash102     = "c2b8c8f171b808a26e3162dc37a256f8237fd38a90f643ee807e02cac07b4f31"
    hash103     = "b3024737d895feae18b049fc960974e28ec46b21b00955021801263236a23432"
    hash104     = "4b6fcacf8c6d6d57c681e236fdb5d05b609fc12af486df4d2d4ba7f28cfa37d3"
    hash105     = "0caea65e2a2ae44e8f2af7747673979b35a11b112a8ec2a927aee76c04617f85"
    hash106     = "4336c8372861f21ab073d178da6a137055e34593f68800773e27d4acd34ace28"
    hash107     = "9dc78644b223d32bbc2657bddd5f1a85a7daaccfe1b29ad04b4d1610cd5284a8"
    hash108     = "38ad53e4dd574f16f786bc9b707ea5fadbb5b27870730d78b2b7ca901779a3ab"
    hash109     = "964aebd6a182d60f32154d31ddd6451bc654534eb2b7382883f897208a731351"
    hash110     = "7bfb202a629e0d38f6e665845169fc4498d12f767d2c5528f752f9b505c436ff"
    hash111     = "ce2d61eb5377e19d253c8b88d2c6645d026c8edf0c9070db5b08da0411e7f3b9"
    hash112     = "674b3120085ef6068ef64dd9a1e4c2029b1184187ecee8a9eef8a72f61241192"
    hash113     = "0e792867a3fd62dea9d9fb8651bcee9c503962a2c2ce8b8740f8f0377e5fdbe2"
    hash114     = "597264c78536cf7cbbabe18a5dd0df6787301658e3ea73445967ffc74d63d1b8"
    hash115     = "8480db2aab67ca715c9858a983962ddd027edeb638bb05799b5cb2542989c771"
    hash116     = "6fe88a9c6faf64d660e2ec53205faa47ea29d2484f7cd57b4c896d1bf203768b"
    hash117     = "71d3f0b538b901b99d669dea5e8f32a8d0fffc37c7cba67fad8d4163c471f4b4"
    hash118     = "3c77d878d3e6c7751528d988b79036b12220fc98c2dd4ce3ef57429b8fc625b7"
    hash119     = "ff4be4496b1bd26f004cd4484867ec15f3fff635a8bec389363be54427779447"
    hash120     = "8eb03b791264d171c9653039071881c6f47deb61bd715b7dc49f1117e49a7e57"
    hash121     = "34720de36fe3d63e5f5751f1d116566da2e4c7d2a0c85dbdb4a02178ca245c41"
    hash122     = "637febd8e7b299fd7a5382536aeb44fc3a931d9192d84a0b9fdce57f0e4012e0"
    hash123     = "0ee86207b23535a7234123af827c0867d5b3279ff3c76cc56aee2a945b737732"
    hash124     = "f0735344b9bede6446a6ec0dea1c8cf9b4ae5f483244ff80f95e81a8e795d48b"
    hash125     = "116d002e01c117390d90f2f309a4ebf4378fd458d64fb4f7a61b3e90fc367cdf"

  strings:
    $s1  = " var NewNameCreator = new Function(\"TELEGRAFF,TELEGRAFF\",\"topSecretLine = \"+   (\"bmV3IEZ1bmN0aW9uKCd2VlJFQkZGMycsJ3JldHVybi" ascii
    $s2  = " var NewNameCreator = new Function(\"TELEGRAFF,TELEGRAFF\",\"topSecretLine = \"+   (\"bmV3IEZ1bmN0aW9uKCd2VlJFQkZGMycsJ3JldHVybi" ascii
    $s3  = " var TortPankakyFF = new Function(\"DAS\",\"VG9ydFBhbmtha3kgPSBuZXcgRnVuY3Rpb24oJ1JlZWJva0dhbGF4eUZST0d2b3N0b2Nobml5JywgdmVsVklU" ascii
    $s4  = " var silaBitsa2 = new Function(\"TELEGRAFF,TELEGRAFF2\", \"TELEGRAFF.write(TELEGRAFF2);\");" fullword ascii
    $s5  = " var levitron = new Array(-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-1" ascii
    $s6  = " var Limbus2000=new Function(\"HORN\",' var GALAXY = \"chastity necessarily()\";var kelso = \"ACLINTONO\"+\"DB\"+\".S\"+\"tr32\"" ascii
    $s7  = " var TortPankakyFF = new Function(\"DAS\",\"VG9ydFBhbmtha3kgPSBuZXcgRnVuY3Rpb24oJ1JlZWJva0dhbGF4eUZST0d2b3N0b2Nobml5JywgdmVsVklU" ascii
    $s8  = " var levitron = new Array(-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-1" ascii
    $s9  = " var Limbus2000=new Function(\"HORN\",' var GALAXY = \"chastity necessarily()\";var kelso = \"ACLINTONO\"+\"DB\"+\".S\"+\"tr32\"" ascii
    $s10 = " var silaBitsa = new Function(\"TELEGRAFF,TELEGRAFF2\", \"TELEGRAFF[TELEGRAFF2]();\");" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8433d239-d3ce-46e3-9e6c-14987080b559

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion