_20160921_016aab466e10a29b831eb85b27664027_20160921_016c552b04b5_1021

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160921_016aab466e10a29b831eb85b27664027.js, 20160921_016c552b04b5a3cc8c83233d34c7fc80.js, 20160921_037dfac14c3541d1a412418c64cad2f2.js, 20160921_05de6ed1bba9a99cad4c92bf9ce97005.js, 20160921_06311313c2c91f30b188be9b0f27e37d.js, 20160921_073b3e31779f349650fc6977a0add94b.js, 20160921_0a459915b243d5878c25fef831b72789.js, 20160921_0cff9f0910485bb8f0857165e2e4169e.js, 20160921_0d3dee472bd7a0a1e2c48044e2c47f0b.js, 20160921_0fe6501a0417801a0e1868963016e9be.js, 20160921_10a3e0605b8ced0a0dee77069aa99014.js, 20160921_13c992e435ed245b1977cea0df2db815.js, 20160921_13e37e5857b4357c4b5f40a021143101.js, 20160921_16200453422b5793a6a93d4bb423b0ea.js, 20160921_17bab7cc945fd06123e7b9b16dea263f.js, 20160921_17ed90b369ab37cb5f1e7dcf8f6bb253.js, 20160921_18cdf3dec8ac4b7697e775bc56ddeba9.js, 20160921_18e4d81197d615e3008ec96ea25b7dc4.js, 20160921_1af58d1231756b320d04226685b5a131.js, 20160921_1c5a439961f0eccee5312fdbb892fb0e.js, 20160921_22785a85892e6eb0dbe789a8a528129f.js, 20160921_2316e7089bcfa9e840be327e9e562c57.js, 20160921_25c11e2eab44b5e0380e0bd805a72790.js, 20160921_27fb26e7e153703634890a2f9e37ef7b.js, 20160921_28d059ae521dbabe2afdc3bfd464938c.js, 20160921_297b9b66086a46a28327ea94b4a62e58.js, 20160921_29976a5f68bbdfe415494e838aef0c3a.js, 20160921_2a4c1d98d0b8022ca5527a8e6d96e6e7.js, 20160921_2b1783136e2caa674fa83100212e0871.js, 20160921_2fddda42e5911e6501568e734d430149.js, 20160921_32423c6c4f53c5e0240449620e4b98c9.js, 20160921_334dc22c3620386c4119de547e0c0f38.js, 20160921_37277908f8111ad292e17a84927fe01d.js, 20160921_37aa38f76e02afb64903280105ce4597.js, 20160921_37b52e41aabc93218d864c1665a33610.js, 20160921_37b7533d4596284ad0b05a77fca64e04.js, 20160921_382a0f9b1ae693f8ade627fd2d6a8b52.js, 20160921_3941d41b2f7cb84a9ce802558f71cf2e.js, 20160921_3974cbb8b2af1f98b68ab31621da93d9.js, 20160921_3a185c9392a67b927e245520858a0afc.js, 20160921_3a89132c20887c3360a3708984b884fb.js, 20160921_3b3df29e27c35ab2e50a3446fa67bf66.js, 20160921_3c7fe346a31de0bd4c8d2ac0fc848e26.js, 20160921_3ca43590701fad2cb827b5edf3989d00.js, 20160921_40c9b3a004789873984432b531f4fb80.js, 20160921_4319d62667a3ba06f88c6ba9123c871b.js, 20160921_4787695fef4453a16be881bbe0f96c1a.js, 20160921_47da6150745eccf8bd846591c67ec5e7.js, 20160921_4a2d69f96df0dd4c57fda9e63c804950.js, 20160921_4ad5ed78dc05b02005f65ab785b9c74a.js, 20160921_4b801afbcd9818be02d65ee0ac30ad19.js, 20160921_527d7c3756974f804734da343b6b6f0e.js, 20160921_53ea150fd63a4ef657412c858a71a13e.js, 20160921_54325d6949c5c03d42a42e11b24dee5c.js, 20160921_54ac484c468ac2ca7fe6c7210ca717bb.js, 20160921_5541f4e80ad2d4f163ebcd0e8c899e59.js, 20160921_5775da34d70f97a2d7aa3296f909af35.js, 20160921_5d475fd55c4e461509ccd87876cf56f7.js, 20160921_5d6863feab411af8217516a1b111aa40.js, 20160921_5eea6af1c50b807f547cb710eb413110.js, 20160921_5f0fd6cffcc723799fdcc54a3c2a7ba5.js, 20160921_60c26fdfafa2666b92246aea46e32175.js, 20160921_6167c3d38189e7b1134d16083ffbd574.js, 20160921_619a314e9bcca286c046dff250b54b6b.js, 20160921_649e29a058d10c3bf9a5a5a06eb3b603.js, 20160921_6748b4ad3c83a7c4aeacfc0817a81797.js, 20160921_68596411289b2d10a74a19f9fce4a325.js, 20160921_68d4a1cff7c2dbc758cf0077184d0d52.js, 20160921_68e1fc90afca497654d8f771197c2097.js, 20160921_6a2eea5014c6e10514154c4a8ee7c1be.js, 20160921_6ad2178e7d047e60c71f9fe1ca457b74.js, 20160921_6d18600f3019656b0ab414a3d1a69ddb.js, 20160921_73b5a50d06622b8411077815f2717627.js, 20160921_77c9e00128c9a883c23909fbb2c12569.js, 20160921_7912bf3790296273bb8c94248adbbc9a.js, 20160921_7cd473b59463126782b9a6cfaae72835.js, 20160921_7f829eb25609c6f6d37ef18f9c4f8ad7.js, 20160921_7ffe38e0972c323071684bfa98cafbdf.js, 20160921_802181e3d75c3e2d045cebba97849683.js, 20160921_80e6ac924bf190eef40e43ba5d57f11b.js, 20160921_814eb57aeffc75442964829345cc9f96.js, 20160921_86391eeb92939f7926213db5cee16e4d.js, 20160921_87f13d652177c2ccba1196dd341efb6d.js, 20160921_882f77897bba85afdc56810c29ef4cbb.js, 20160921_89a260f4d6da4d97f251f843cf5e94b0.js, 20160921_8aaa596582e26eec62319f01660d922b.js, 20160921_8b27f7688489936aa1cc7fded52f4a64.js, 20160921_8c33029db61426a234eddfae1623641b.js, 20160921_8ed14dc63f5bac37baa70510a94f2915.js, 20160921_91d6a421bfd5ccdb59d33b75574567eb.js, 20160921_939d60f07d4171a5bae4c0b4ca33f3d9.js, 20160921_93e612a2f44e1198dfe3c296cb4f7b79.js, 20160921_97fcc16be1aae58b311e71df667be641.js, 20160921_98f234a378a6dd4e51c1730a4a700647.js, 20160921_994c4aa8813658fbb0b792d8aa221e53.js, 20160921_9a54c73297e1211ec78765c2c1c7c05b.js, 20160921_9aa040f4b657816cc001fcf9a33be586.js, 20160921_9d32b55f93b83e117524c4df15361eee.js, 20160921_a056f27a8b6d780ba88209aaee1ebb68.js, 20160921_a1cbb43a1e22a4b1fd63ee1a724173eb.js, 20160921_a39f22c0c39a7d5bb3c55dd00a36b5b1.js, 20160921_a977d2870f5e9d12c659565b82cfaa70.js, 20160921_acebc8ac4559526a5a8de801968bd19f.js, 20160921_ad69715850fae108d9a16055efb4f51c.js, 20160921_b18e047e5b3fa2131425e272781d97b4.js, 20160921_b2867778b87ab68774c77840f21eaed0.js, 20160921_b32c8921e3390cb8f9450436f4e43cfb.js, 20160921_b7400937fc4eb76c7ea3adaa321d7619.js, 20160921_b86272ed73cef9077c204056df823014.js, 20160921_b8c98d7e4e5c69c2f4fa4fec37a59dfb.js, 20160921_ba8a9f239804499b5d1d2a06a862c1ca.js, 20160921_c1184914bc801e9725b7f52a13eaa885.js, 20160921_c1ad71fea9bd3e371590c0c373f087a1.js, 20160921_c6572694e5172932491036c67fc9ffe4.js, 20160921_c79bcee11e764b4ca54b637f14f94e36.js, 20160921_c86a534fb694b7c269b48a9dc32f8a87.js, 20160921_cab66b13ccb843c90a2a068a082cd4ec.js, 20160921_cae1392fd0c6da8c370b46e3e8040401.js, 20160921_cb6c4de61b30cd204129d0942321058c.js, 20160921_cb7b906c44a337d403a375918e9db0c5.js, 20160921_cdeac57ac549120611856c7af0c490f6.js, 20160921_cf2bd9606d396ba99f8174f1946c8590.js, 20160921_cff7808833d9e819d4a4f10450848a81.js, 20160921_d1c97b87a6985071e0e4edfb0e0dcc81.js, 20160921_d4a195112732d8d5ebb1bdc900a52d50.js, 20160921_d53637406b068b7f313912a4769e371e.js, 20160921_d57bd7101328f2bbf1f061a7dab83490.js, 20160921_d6e5226f779c21f4fc4b67aeddca2869.js, 20160921_d7492227e681b1689bfc5442a91a169e.js, 20160921_d74d6a32efd0c1fd568c81769c75b5f0.js, 20160921_d999dcba53f56b5a9c1abcc062fbeb80.js, 20160921_da7f7f057c35b886425ec822f654da90.js, 20160921_daba59e7a6b9ed6983cd2cbef1eb1597.js, 20160921_dc8499faf06c485edd1ddc8df3a39f1c.js, 20160921_dd28b3b2e4fae279f1dc4ba30acafda9.js, 20160921_dd666c66b3f13d3a71b957c0e646c0a0.js, 20160921_e0f34764de4fcb908eef371ab4011f31.js, 20160921_e83251070761df6a7fe56a790f4a7a43.js, 20160921_eba3e9dc8ad614a7e5c422a93cd7b424.js, 20160921_ee1327bdf201e62d1f7ae5482cabbd90.js, 20160921_f232e0ba2dbd66b232f717e912f70cd7.js, 20160921_f75fc7d6e5f9a9e633ed6b173201a2a9.js, 20160921_f9054cc04d83c2e4156f98873a8df799.js, 20160921_fbc9133aa5350aa4ce872cb5927c8f4f.js, 20160921_fd5fc067457571e92a95bd16158d41e6.js, 20160921_fe8abdad2bc00d1378e2964402e33217.js, 20160921_fff847efa0eaa326a0aad4d2fc81d41e.js, 20160922_2bdee31da941689170d6b7da303eeff6.js, 20160922_2c550b6efe6ec163893e1c555d256b4e.js, 20160922_433c067ed37935e72b4e47664c370c44.js, 20160922_51694f0251fa3f1d7267b3d7973d4097.js, 20160922_6bc7e7cb9bbab9434a7d6dc7718c610f.js, 20160922_7706788d60398ea7d883afb2532d218f.js, 20160922_92c62e47426236a3598469915ee3dcfe.js, 20160922_9d6af27348126e594fbe29c3cf568591.js,...

rule _20160921_016aab466e10a29b831eb85b27664027_20160921_016c552b04b5_1021 {
  meta:
    description = "datamaliciousorder - from files 20160921_016aab466e10a29b831eb85b27664027.js, 20160921_016c552b04b5a3cc8c83233d34c7fc80.js, 20160921_037dfac14c3541d1a412418c64cad2f2.js, 20160921_05de6ed1bba9a99cad4c92bf9ce97005.js, 20160921_06311313c2c91f30b188be9b0f27e37d.js, 20160921_073b3e31779f349650fc6977a0add94b.js, 20160921_0a459915b243d5878c25fef831b72789.js, 20160921_0cff9f0910485bb8f0857165e2e4169e.js, 20160921_0d3dee472bd7a0a1e2c48044e2c47f0b.js, 20160921_0fe6501a0417801a0e1868963016e9be.js, 20160921_10a3e0605b8ced0a0dee77069aa99014.js, 20160921_13c992e435ed245b1977cea0df2db815.js, 20160921_13e37e5857b4357c4b5f40a021143101.js, 20160921_16200453422b5793a6a93d4bb423b0ea.js, 20160921_17bab7cc945fd06123e7b9b16dea263f.js, 20160921_17ed90b369ab37cb5f1e7dcf8f6bb253.js, 20160921_18cdf3dec8ac4b7697e775bc56ddeba9.js, 20160921_18e4d81197d615e3008ec96ea25b7dc4.js, 20160921_1af58d1231756b320d04226685b5a131.js, 20160921_1c5a439961f0eccee5312fdbb892fb0e.js, 20160921_22785a85892e6eb0dbe789a8a528129f.js, 20160921_2316e7089bcfa9e840be327e9e562c57.js, 20160921_25c11e2eab44b5e0380e0bd805a72790.js, 20160921_27fb26e7e153703634890a2f9e37ef7b.js, 20160921_28d059ae521dbabe2afdc3bfd464938c.js, 20160921_297b9b66086a46a28327ea94b4a62e58.js, 20160921_29976a5f68bbdfe415494e838aef0c3a.js, 20160921_2a4c1d98d0b8022ca5527a8e6d96e6e7.js, 20160921_2b1783136e2caa674fa83100212e0871.js, 20160921_2fddda42e5911e6501568e734d430149.js, 20160921_32423c6c4f53c5e0240449620e4b98c9.js, 20160921_334dc22c3620386c4119de547e0c0f38.js, 20160921_37277908f8111ad292e17a84927fe01d.js, 20160921_37aa38f76e02afb64903280105ce4597.js, 20160921_37b52e41aabc93218d864c1665a33610.js, 20160921_37b7533d4596284ad0b05a77fca64e04.js, 20160921_382a0f9b1ae693f8ade627fd2d6a8b52.js, 20160921_3941d41b2f7cb84a9ce802558f71cf2e.js, 20160921_3974cbb8b2af1f98b68ab31621da93d9.js, 20160921_3a185c9392a67b927e245520858a0afc.js, 20160921_3a89132c20887c3360a3708984b884fb.js, 20160921_3b3df29e27c35ab2e50a3446fa67bf66.js, 20160921_3c7fe346a31de0bd4c8d2ac0fc848e26.js, 20160921_3ca43590701fad2cb827b5edf3989d00.js, 20160921_40c9b3a004789873984432b531f4fb80.js, 20160921_4319d62667a3ba06f88c6ba9123c871b.js, 20160921_4787695fef4453a16be881bbe0f96c1a.js, 20160921_47da6150745eccf8bd846591c67ec5e7.js, 20160921_4a2d69f96df0dd4c57fda9e63c804950.js, 20160921_4ad5ed78dc05b02005f65ab785b9c74a.js, 20160921_4b801afbcd9818be02d65ee0ac30ad19.js, 20160921_527d7c3756974f804734da343b6b6f0e.js, 20160921_53ea150fd63a4ef657412c858a71a13e.js, 20160921_54325d6949c5c03d42a42e11b24dee5c.js, 20160921_54ac484c468ac2ca7fe6c7210ca717bb.js, 20160921_5541f4e80ad2d4f163ebcd0e8c899e59.js, 20160921_5775da34d70f97a2d7aa3296f909af35.js, 20160921_5d475fd55c4e461509ccd87876cf56f7.js, 20160921_5d6863feab411af8217516a1b111aa40.js, 20160921_5eea6af1c50b807f547cb710eb413110.js, 20160921_5f0fd6cffcc723799fdcc54a3c2a7ba5.js, 20160921_60c26fdfafa2666b92246aea46e32175.js, 20160921_6167c3d38189e7b1134d16083ffbd574.js, 20160921_619a314e9bcca286c046dff250b54b6b.js, 20160921_649e29a058d10c3bf9a5a5a06eb3b603.js, 20160921_6748b4ad3c83a7c4aeacfc0817a81797.js, 20160921_68596411289b2d10a74a19f9fce4a325.js, 20160921_68d4a1cff7c2dbc758cf0077184d0d52.js, 20160921_68e1fc90afca497654d8f771197c2097.js, 20160921_6a2eea5014c6e10514154c4a8ee7c1be.js, 20160921_6ad2178e7d047e60c71f9fe1ca457b74.js, 20160921_6d18600f3019656b0ab414a3d1a69ddb.js, 20160921_73b5a50d06622b8411077815f2717627.js, 20160921_77c9e00128c9a883c23909fbb2c12569.js, 20160921_7912bf3790296273bb8c94248adbbc9a.js, 20160921_7cd473b59463126782b9a6cfaae72835.js, 20160921_7f829eb25609c6f6d37ef18f9c4f8ad7.js, 20160921_7ffe38e0972c323071684bfa98cafbdf.js, 20160921_802181e3d75c3e2d045cebba97849683.js, 20160921_80e6ac924bf190eef40e43ba5d57f11b.js, 20160921_814eb57aeffc75442964829345cc9f96.js, 20160921_86391eeb92939f7926213db5cee16e4d.js, 20160921_87f13d652177c2ccba1196dd341efb6d.js, 20160921_882f77897bba85afdc56810c29ef4cbb.js, 20160921_89a260f4d6da4d97f251f843cf5e94b0.js, 20160921_8aaa596582e26eec62319f01660d922b.js, 20160921_8b27f7688489936aa1cc7fded52f4a64.js, 20160921_8c33029db61426a234eddfae1623641b.js, 20160921_8ed14dc63f5bac37baa70510a94f2915.js, 20160921_91d6a421bfd5ccdb59d33b75574567eb.js, 20160921_939d60f07d4171a5bae4c0b4ca33f3d9.js, 20160921_93e612a2f44e1198dfe3c296cb4f7b79.js, 20160921_97fcc16be1aae58b311e71df667be641.js, 20160921_98f234a378a6dd4e51c1730a4a700647.js, 20160921_994c4aa8813658fbb0b792d8aa221e53.js, 20160921_9a54c73297e1211ec78765c2c1c7c05b.js, 20160921_9aa040f4b657816cc001fcf9a33be586.js, 20160921_9d32b55f93b83e117524c4df15361eee.js, 20160921_a056f27a8b6d780ba88209aaee1ebb68.js, 20160921_a1cbb43a1e22a4b1fd63ee1a724173eb.js, 20160921_a39f22c0c39a7d5bb3c55dd00a36b5b1.js, 20160921_a977d2870f5e9d12c659565b82cfaa70.js, 20160921_acebc8ac4559526a5a8de801968bd19f.js, 20160921_ad69715850fae108d9a16055efb4f51c.js, 20160921_b18e047e5b3fa2131425e272781d97b4.js, 20160921_b2867778b87ab68774c77840f21eaed0.js, 20160921_b32c8921e3390cb8f9450436f4e43cfb.js, 20160921_b7400937fc4eb76c7ea3adaa321d7619.js, 20160921_b86272ed73cef9077c204056df823014.js, 20160921_b8c98d7e4e5c69c2f4fa4fec37a59dfb.js, 20160921_ba8a9f239804499b5d1d2a06a862c1ca.js, 20160921_c1184914bc801e9725b7f52a13eaa885.js, 20160921_c1ad71fea9bd3e371590c0c373f087a1.js, 20160921_c6572694e5172932491036c67fc9ffe4.js, 20160921_c79bcee11e764b4ca54b637f14f94e36.js, 20160921_c86a534fb694b7c269b48a9dc32f8a87.js, 20160921_cab66b13ccb843c90a2a068a082cd4ec.js, 20160921_cae1392fd0c6da8c370b46e3e8040401.js, 20160921_cb6c4de61b30cd204129d0942321058c.js, 20160921_cb7b906c44a337d403a375918e9db0c5.js, 20160921_cdeac57ac549120611856c7af0c490f6.js, 20160921_cf2bd9606d396ba99f8174f1946c8590.js, 20160921_cff7808833d9e819d4a4f10450848a81.js, 20160921_d1c97b87a6985071e0e4edfb0e0dcc81.js, 20160921_d4a195112732d8d5ebb1bdc900a52d50.js, 20160921_d53637406b068b7f313912a4769e371e.js, 20160921_d57bd7101328f2bbf1f061a7dab83490.js, 20160921_d6e5226f779c21f4fc4b67aeddca2869.js, 20160921_d7492227e681b1689bfc5442a91a169e.js, 20160921_d74d6a32efd0c1fd568c81769c75b5f0.js, 20160921_d999dcba53f56b5a9c1abcc062fbeb80.js, 20160921_da7f7f057c35b886425ec822f654da90.js, 20160921_daba59e7a6b9ed6983cd2cbef1eb1597.js, 20160921_dc8499faf06c485edd1ddc8df3a39f1c.js, 20160921_dd28b3b2e4fae279f1dc4ba30acafda9.js, 20160921_dd666c66b3f13d3a71b957c0e646c0a0.js, 20160921_e0f34764de4fcb908eef371ab4011f31.js, 20160921_e83251070761df6a7fe56a790f4a7a43.js, 20160921_eba3e9dc8ad614a7e5c422a93cd7b424.js, 20160921_ee1327bdf201e62d1f7ae5482cabbd90.js, 20160921_f232e0ba2dbd66b232f717e912f70cd7.js, 20160921_f75fc7d6e5f9a9e633ed6b173201a2a9.js, 20160921_f9054cc04d83c2e4156f98873a8df799.js, 20160921_fbc9133aa5350aa4ce872cb5927c8f4f.js, 20160921_fd5fc067457571e92a95bd16158d41e6.js, 20160921_fe8abdad2bc00d1378e2964402e33217.js, 20160921_fff847efa0eaa326a0aad4d2fc81d41e.js, 20160922_2bdee31da941689170d6b7da303eeff6.js, 20160922_2c550b6efe6ec163893e1c555d256b4e.js, 20160922_433c067ed37935e72b4e47664c370c44.js, 20160922_51694f0251fa3f1d7267b3d7973d4097.js, 20160922_6bc7e7cb9bbab9434a7d6dc7718c610f.js, 20160922_7706788d60398ea7d883afb2532d218f.js, 20160922_92c62e47426236a3598469915ee3dcfe.js, 20160922_9d6af27348126e594fbe29c3cf568591.js,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "d6a541dd7e97eedc43f6bcf89f007176352c81c1d1240a76218e73cf5bb3b171"
    hash2       = "a691692f0982e93fd21c441e8c6d39328f1ea5990ce24999b2df98ee3488f667"
    hash3       = "bdbf3b67df915739d64604188a4862042efa316e641ef50d228a41f9327767cc"
    hash4       = "cc9a1bb338cbe502eae2d8092d1b4369f9be8a107f4db340bf51a1640991e960"
    hash5       = "2e8ad2d8de7bc2cc77c2b00b8eeb4fd7976cd68790eeb4b6bfd14ad188696ed0"
    hash6       = "60d01505d8ea4f2da2961c36fda33950e39ba720d54d967d434c0c5003ff7d2f"
    hash7       = "9f8d1944044e8a67a527f50e4aeb45e9358929b0d0f7aaf1730d2782f07a09de"
    hash8       = "3dbe3dcf31ef6a75ca25b690245a2ec8ebd1f75d9a20a2b5dac46791b6ad354f"
    hash9       = "9ffda0cd0cd96558031ec49484507d0af3efe8f0ec6fee33e947b4b9515ab24f"
    hash10      = "2926229ccbf6b86ba0ed1aa3ab5b137a43467ffe25d09479a7998c2fdc4b2b30"
    hash11      = "462b92b513dfa104fe3c095cbf98c34389b13ed004671baf4f95430e8487a108"
    hash12      = "289da9cff140ea3b4e35a1aa721314733c057d085ff9e8b5fc3ed7e10f75341b"
    hash13      = "bd94ae3a0c3b8dadcaba65cdd5f58ebd19d616ac5679af1b7891e5bf26889265"
    hash14      = "d968eb9bb2807e5889794bf130036c2c81716cd0166eed67a45c9ef3f81607c3"
    hash15      = "a1dd80ed4e2509af999afcf84c8f78ecc409616f9d6e072d25cb980d8bf9e464"
    hash16      = "81de0ae14e0c288b697a0e3c7f3ced9b68b8377e75dff5322d654841e642a8a7"
    hash17      = "1a1aa090c906360f52952b29d512b8c450c7e8c8cff28bc6fded6af15377b37c"
    hash18      = "4b707313cf8ee2fdf903e5516937a17e48e75059c21a08483659705a96da9670"
    hash19      = "de59166ad132c3c5ad12a85d2d837c1aec192afb497be23c517c637a08d25171"
    hash20      = "3fbb744f5c370c0fc7398db52f2d758d4ee9e8aaf91430daa5c6bada9598710f"
    hash21      = "3bd9f1cc39c45e7b6963f5eca04b26ef2eaf9c8005e5a0d5f12e868261ae58ca"
    hash22      = "11216ce48a9d383f0d3cab03de05ba1550ae25c7b5d18a758666cfdd75159fe2"
    hash23      = "912d9aec3079fb6a2e4f83d3826286707a52a653de6ec6eede9711d5b416a790"
    hash24      = "867c0b561ad28bc562227169c7a21fbf367232ec2d2454d4bd819e1a42cc1b62"
    hash25      = "e141f467019579b96a9cc109c7a3e7efb3b51b1378b450a816089a6ae7d406f7"
    hash26      = "4d719bbec78475fb1d00242f1258699600032a10dd821cc9dfec2254bbe341f7"
    hash27      = "218bc62c15296caf93128e0a5e06fde374e19fd4150b6c9b1def4d962554ef39"
    hash28      = "65be7c1c5efef8255d7094d95251c12de72303024061cff2152d54a244a049f0"
    hash29      = "4f4f696f319827ea3bc8e0b927eddbd7a588f390148cae3276f1573d816d8889"
    hash30      = "39e075f0b6da6e9616ecc55632d12b76e677c40d3e27c38908b71f907b17d8e1"
    hash31      = "1627aa0e729ffe8aba0e7faa8a6286c25a744600e193b72dbc3254fcc98a6003"
    hash32      = "a69d8e08a2b4320b4183bfad7a1baa8fc49b7361116aeb9e3a542ae416cd93d5"
    hash33      = "cac56e804b2f49b3fcd9bbc13fbdc4deb3a0ef68848e6527c15ab41f1104f286"
    hash34      = "768a32c669c193375bb8e7adb97cdbb697cd6f4f09fb5dc67bb63e62b7de29cf"
    hash35      = "c506490b3737e1b21522717204e4143ada427e9af58fe86e42ed31dfd0fde66a"
    hash36      = "61b41be208c77057ce2b56a866ae0e936c6372d0c3a92f126a1cf5090fe0a5e7"
    hash37      = "4170edc38601b30ac37c9e43a569e4e01000505e73d89702266efb685dc6a8ac"
    hash38      = "af803579fff33b5e316911dc121155eb553434eec287816287bbd86b427b3f7f"
    hash39      = "707fba854060aa6294a0cf0c11b8eed992c56785375920bc41b7e95f514ab760"
    hash40      = "a5201f237db515e70a3934feb4ff64c4cccf728f340d6e9e46fbe4217f988165"
    hash41      = "9687ad9b2ded14e00c5b17393de82acd451266863fb217fc6647e1add112f2fd"
    hash42      = "dd15d322a8169ff9edb922ead245c93109f14c5fa4f31811eb58601888323ad2"
    hash43      = "9416bb519c790de32506a7f01be471201203ef899168387fe44a40151f0b662f"
    hash44      = "ef7c5701a8646e7803463e9a01e4f2e45cd535f2ed7174e97abde991a779b665"
    hash45      = "b913ca9b6976b1846b7d36cab5b8fc09147f8eda84e9fde77f0aab4dfe5a2ab3"
    hash46      = "33e5babd254cb93078c026ebb6beb245e487651597122eb576cf5b870dfbf8ee"
    hash47      = "6a11e3d64ee2711e84433d2b8035ce0dafbcffa760c2026e3cfe9ba310008f90"
    hash48      = "9a6547815adb02f36991578330e4cb005f8225b3a8e4c85d5e2c5907a22e325c"
    hash49      = "786d4a5233f100c1ba7f5e820c46309247158a45ed43bd58795f05152dbaecf6"
    hash50      = "7e5f9d362688f19111d3dbdf393d51e133fcc63eb7db27536cb31d1205ccc9e3"
    hash51      = "f85dba2504097034fa23d87391ecdaf7fe5f29824616a8d91d353284964bfac1"
    hash52      = "7d2dd725d314277b3b7cf1c94ae8894dce1d36430ff22819c2fecb47f14c3f43"
    hash53      = "16ac7affa46e10764a6e40de21c545ac275939c77c4acf142df8e3f848362242"
    hash54      = "0fa3791b48292bf705ed06d701118840e9c87ae1f9ac323fe09b8ad04cedc171"
    hash55      = "5b883334540a4216b3582d1f2fa0a27f21b9c64a87944c8e58d9fab0f609eef3"
    hash56      = "615edf37483855ab2b78dd87e38795245913e5fc6efc9bc47d9e698132792739"
    hash57      = "270e1d840937d10ac3eb1fdd04f0fbbbfd31a88a2f316c94c5167a23a2940644"
    hash58      = "dc4e4001f0f2e1f28098f6ad190b918a7ffe075d590fb142a508fdad546d9816"
    hash59      = "0dbd74ce266dbd495fb6fc7810ec67099f628d975c524a9190f91ccc4bf433bb"
    hash60      = "0791148d3e03ce3d231765cb1183a7c90ac5567405736f3d6780502908893b46"
    hash61      = "f215df78f73f84c8424edec81b4a9e43c0b766f9010caf095301b900f03214fb"
    hash62      = "e4cfca41d64bbf1a0959643523d4734a108bc3ecf6147c83f60db030586c6f25"
    hash63      = "02d7a73acd6af9940f585a0e89095467489ba0ac094eb93050d43dab5745e5bd"
    hash64      = "9f370548310908c52102d40d56781574ad404eafca7ac832d5e52d48f722bff5"
    hash65      = "6565dca0eb9e0e467a96242f29a80c650cc40a8892572ce8c28bfd197ace7fd0"
    hash66      = "f5e85f2791984d17e00bdb2b7163597d52bf88d9da5a0caedc977a31026ee9f7"
    hash67      = "52b104c52d9f1461833687ee9fc5da1913610266114cbc0018bf345ee135d662"
    hash68      = "4d2799f014910856c25b225165971fbe59cf99c8eb1db930d774de46f64d76c2"
    hash69      = "2dfe35f2d9bfd20a5e4771207c1627566795391c957d7b630cc669d3d8856ffd"
    hash70      = "b1fa490690ec2cf24ba4236d1fa675827bce812ac4cd92a59a9b5261b979f8a3"
    hash71      = "2e126f3a35c3e15739f44a3b15bf991678bc6c232e213be738a2521187bf8173"
    hash72      = "fb0471dc4828588d37d01ddaa7b9454e82acacc4dfdd9f0998b461661e3810db"
    hash73      = "ff8a171dec88d707916b1928e49d84c61474fe9b0faf2916e72eadb2b404d04b"
    hash74      = "95544bd07dbc8b2550e3a6bb328d49a808c8749bb3ced90cbb8f5f90782625a1"
    hash75      = "3bf106f8ef0e4b03e869f1cf914513f711eb52824441a1f2740f3faec2821404"
    hash76      = "0e3e3663f9696265255bc848bc98ec77487c491ee2a30b3085dbc10087b935c5"
    hash77      = "cbb0232bbf0751233c3e647bef431987aa4666e8c60b9ff699f55e31318c3e22"
    hash78      = "4bc751383d4c72f88b3f59d9fde1f38f09a81b77ee4df0498bec1df7cd088bc7"
    hash79      = "ab42f16384f05ce6299f1ffd60f980af6ecf1fa2d23befc951797d1d52915400"
    hash80      = "e240b858e2fac9be9a3fc0f8611c4c05e6f217dd1e13ac43649aa6d7597ee450"
    hash81      = "2736df4d651a33824aba7abffa7c08414414ffed9f5f27b4b2d81101cfeb7117"
    hash82      = "1238f360c84929f303678fcd3899297cac43bef18dc5a731b7a6272fde7fe4e6"
    hash83      = "52cce778f06a6477b6f4a6a9f48328a81d874164235533c2925fdd358b6279c3"
    hash84      = "9e1a86c6dc71a5b10659658c07a01bb1541887750ecf88ab56997c7dbc2d180c"
    hash85      = "700f6c802eb024896efe2b22255973b53752a8f129213c9bba2c4f2ebdc53988"
    hash86      = "345c67f8d573844507dfad7f05cf340f1a2bb19331e3e0d242c508445594aac6"
    hash87      = "dbf2fa1deb81fd17a55e884848d77b2d3c5d766fed0005f738840703aa8a9dda"
    hash88      = "8a7c2a5271a5dc64c200145fa7252ff19d736174b3556eb436f9ac8941daec71"
    hash89      = "e01d4cea60f1c16b2fc3a28a98b5ad4d421b0c4e8e5f757805e98a1436a9fadd"
    hash90      = "fcd86e83ff6948b25dbdbac7ed6b6c8d750729e1da24f7598ff0e0b575909d4b"
    hash91      = "c23bfef986de7a073bbcd781aa45ad15287fb2c448d110b92a01e652f22ff335"
    hash92      = "e88aa94cf06df033312260c4a58f453654133758e66e1d2df4f11f9de9bfec7c"
    hash93      = "2459214bba37a40478bc984d75c7b1ababcbf0d17eeabe32578555058bdac21f"
    hash94      = "67d0e50d586bb8bcc6b12ccab848f1a72b3a329ddaa0c7f45ea3661082887c8d"
    hash95      = "b7087906f833cc4e256e80f75293dfea38a9cf9102994a76779be7198f94535b"
    hash96      = "3d2e8d0924bbdcf83eaa5ef9fde5baf8f4e12cf5c14d5f8ceb77a4c3e708abd3"
    hash97      = "06edaae6cd03c231dca115449fcaf6955b5f70df34983f02383296a412f73538"
    hash98      = "3fe6572823305aa2316dd2ce562c85b9f6eb40f26ee354b5e0ff97b66cffd652"
    hash99      = "314665ef3670769c41db6783cc9eb408dcbce4749a56c09166a1862331791bf3"
    hash100     = "4154e4928eccd35fa0d42dbefe4a742700d77124216f8b5756b8ef63634071d3"
    hash101     = "6a56bdeaf1decad9c4fa4ee5ac7e377d80dfd12601d1317d02f12d9d9fb19646"
    hash102     = "53eed08aece7cc2a81b9828098c3d3e70042a4891863f1130086a0661fc12870"
    hash103     = "79fe55ec3d2d6dbd854df9676c4565b6a8410e1d94298c2ff2f112036fcfac73"
    hash104     = "76ed8c5c3ace4ce119f1561d5d61ca2e454da79e9156a8397e72d6eed3a22d74"
    hash105     = "033421645eb5cdfdccc02e470b5304f91fa62121d1e117f1aebca723440cec70"
    hash106     = "ae46b7285b241d53af42d1248b27d7d1186f12901d6fc0284d48665a3b217777"
    hash107     = "5ab35ff2eba15a460823fc709e29f7c1041f054096a3690e92c926943d39d6a8"
    hash108     = "91a8cd111f3381e8f00611988dc7860cfb507d4d297884f9d7d7a01ae96c0fca"
    hash109     = "c639defcc03ef60ba09f66ea7a3067f4493b67650049d4d5576fb24d05a2ec25"
    hash110     = "f1ea05bc317ec861954db64b30bd293d8ee2f663106d48389d91cfb77247fb1e"
    hash111     = "4ab28724a794acc5764f2e51f93d2b91ef9513b43e4cb9b0d10bad2710c2e6d7"
    hash112     = "b978f77ee1e2384ffdbb55f48f7d8fb0a9b642fc4b2f38d86c68e4f6357d5153"
    hash113     = "cf0e0decfb5414f48e1bcf494a6c63e6249e9ac1433d4fba6a461b5970957194"
    hash114     = "e6ae2536ba0486138837b2ae1457fd029e88f0c21975b726f4edd05ba182b08e"
    hash115     = "fdd10a2dcebc0c4099b99fb3316b9cdd6c3afd60abc1b93345fc041eb2405ec0"
    hash116     = "921432f56757fdaa414b8b2f729fdd46e41c954a0a96b706c646c1d5ab09e5cb"
    hash117     = "ce3b033b39aaca0b7c9abd0fc5eeb09d24d7096d0a399cebd99f7bd8d574f0d1"
    hash118     = "f67c8d099609c97880a9ea12beb3c83faaf2411bf12032595ad5baa45d985a04"
    hash119     = "db98233c2508e4a2167ee46a334ce9052faa726615e89838f4fdb36b74fc5353"
    hash120     = "2a06a7a374bfacf6c8c177295f8ab5c8e4e8db511406cc33fcef97866f72f9dc"
    hash121     = "53694193718c2cb2f90fada2d6a11f07ab2c3f8451a0f41ae580b87a142e212e"
    hash122     = "c5afd84ebe18fa55c764dd8e7349bc7b9cd8b10ab8d94500cbf7f62bd741c00d"
    hash123     = "542990d73514ef4ff7fb1540013f789833830036dc9c9c2ad8c49c1bdabb1f2a"
    hash124     = "b5d1f1d63107b329353fe8130c80608d28a9b1ed12f81c240129d04be6842bf0"
    hash125     = "679537ccc73765d47769657cc000499c86fa227678df5b0d4690ca0e2cf6325c"
    hash126     = "cafcf490b9e4364e16ee46f82e53896038b46a0b37f3fd7a33a363316965b400"
    hash127     = "fa72df41c05c5483fee755296c5d2da37c5e14a015c2aac82e7d9ad428cc2376"
    hash128     = "42ec93947d9a157ccd37a3c75c7a06b75fa756fee925b759536deb0993f07a5b"
    hash129     = "63aa129680edf69c72e8f077be5e8562f041fa0b0c7e63a8a9b219c23749b135"
    hash130     = "eeb2c0427dff61d2dceedf890b96f76da6a37634fefa03079a481c476d7a3547"
    hash131     = "3bf893eeec71a95167368eb58abcbfe36362779b946b3e0d29c9032ec427ebd4"
    hash132     = "b6935463e925cb13fc2413b3d7559cf8e9f5072c15dc73075977046a3e27e417"
    hash133     = "94c619539e853fdec1958270da7516c52bbcf442ee9ca0569d11e19e70ae29eb"
    hash134     = "f991a0c08a08712da63725a1264034411c38050f80181edfb6cee6760198ffd6"
    hash135     = "841abb0789337235f3a5367c6d4aa3806741a639f1faf0d54e41f125ecc1be02"
    hash136     = "77e753e21a464bef9fad04f7d41ce8b192c797808ff1b22efe474c612c25f2b2"
    hash137     = "de457f8d789ffcd672900ad06037697526230f620a01d113732fa3683b1604b1"
    hash138     = "0ca0db55a551923b328ba28035ed857a5c51dfd4c6e1060bd34ab4bc3d27b75f"
    hash139     = "f0f6c6f4fe3daf7aae3b8d7276adbcc6577a8bf844eeae945023523b63b6cc9a"
    hash140     = "91500ac726f9d2548dffc99162aeece9863dc7b928106d27a769e6bbf9439f81"
    hash141     = "d8231c7ebf650f58f63f7ed6d3017e0ee9895c1dd821750dcc6c78003fc81b2b"
    hash142     = "b78b074fdbad3a2d311b3fe1363fedad42cd9a804cba11641844abee41e9ad5f"
    hash143     = "7cfaa97d52690e3fa38d039126186e468701b138b24622f48887707d5da022f0"
    hash144     = "520ea6f275b172709ff81bfec4d8a5a9f734ab080b25e7c50bfe2a36800af6e3"
    hash145     = "e32ed831874bb280ae970e019573b598cf97788865b3fea13118546e435353f9"
    hash146     = "39d0496129988da40dbbddcff6610a39be1f05ddd7f48a13058b749810c8400d"
    hash147     = "93f868a10878cb41f305e28c8802778903c99b84a1bc0647a0c2c78fd6310577"
    hash148     = "70ee088e40fb9f7bd2cc1514b94af7f28ef9fd68444cdbd3859858840ae0e498"
    hash149     = "deabc297df80ed9899178f4a02c9538b2fe3ee2038528e07da89655f0d68b1a1"
    hash150     = "9070188f3e02706e771ccc37b9b462d58035283f00f156012a41459fa5293e32"
    hash151     = "c424926fb99cca3faf3dda68a4860b770a7f0467803b01fbdf54011c52f56a99"
    hash152     = "1ce9e0dc49979ee9e18675311cb94170c53d3836b9d2c99b0e6d51f9cc27fe15"
    hash153     = "53ed2c9df290c888bf2af9ce5d017a8ed1c6b1bb1c82aa0376f1bc204aa27eb7"
    hash154     = "d6b6eb713cecae41143fb04e090a4809564a1837f49e53a84e27f0d3b0885df7"
    hash155     = "3634189c93f3a76e0a4df72e631f0715b4b71427c157ca5fe116252ca00f1d9b"
    hash156     = "658f6872a894eb9bcb193b7bf73260e92d4627036eede588553b81333dcf0c30"
    hash157     = "73bcfec2ac113640d73b2ea0f0c348d7bc7d672d6be74cb4398f8669b599694b"
    hash158     = "a67ca3e1e87611dc94e916e6896d144c03fa7f8a6411fdeb74092be2a79bcad4"
    hash159     = "c85cab0d5b0c79fe38ee2b60c2ea7eca36bb7dbe9442cff0a497346184cecee8"
    hash160     = "da7f290c48869e8adc8a27e6344a762283ddaa55eae77000c5439a118d259a98"
    hash161     = "ff3bd7f3bb53e5b0bbfefd44c539b38a506a76e4dae03eaa91c64f99e34b846b"

  strings:
    $s1  = "})(),(function f000(){return \"Do\";})(),(function f000(){return \"MKa\";})(),(function f000(){return \"Lo\";})(),(function f000" ascii
    $s2  = "),(function f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(function f000(){return \"MKa\";})(),(function f000(){" ascii
    $s3  = "ion f000(){return \"Do\";})(),(function f000(){return \"MKa\";})(),(function f000(){return \"Lo\";})(),(function f000(){return " ascii
    $s4  = ";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(function f000" ascii
    $s5  = "urn \"Br\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(fun" ascii
    $s6  = "tion f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(function f000(){return \"MKa\";})(),(function f000(){return " ascii
    $s7  = "unction f000(){return \"Br\";})(),(function f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(function f000(){retur" ascii
    $s8  = "on f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(function f000(){return \"MKa\";})(),(function f000(){return \"" ascii
    $s9  = "(),(function f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(function f000(){return \"MKa\";})(),(function f000()" ascii
    $s10 = "\"Br\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(functio" ascii
    $s11 = "ction f000(){return \"Do\";})(),(function f000(){return \"MKa\";})(),(function f000(){return \"Lo\";})(),(function f000(){return" ascii
    $s12 = "unction f000(){return \"Br\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Zj\";})(),(function f000(){retur" ascii
    $s13 = "eturn \"Do\";})(),(function f000(){return \"MKa\";})(),(function f000(){return \"Lo\";})(),(function f000(){return \"Yz\";})(),(" ascii
    $s14 = ";})(),(function f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(function f000(){return \"MKa\";})(),(function f00" ascii
    $s15 = "0(){return \"Br\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Zj\";})(),(function f000(){return \"Do\";})" ascii
    $s16 = ",(function f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(function f000(){return \"MKa\";})(),(function f000(){r" ascii
    $s17 = "ction f000(){return \"Br\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Zj\";})(),(function f000(){return " ascii
    $s18 = "n \"Br\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Zj\";})(),(function f000(){return \"Do\";})(),(funct" ascii

  condition:
    (uint16(0) == 0x2f0a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

43444119-a0b8-4ece-8a78-5e01da367dea

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion