_20160921_063094039ef79437a260d3dde960797a_20160921_0de23a42684a_1026

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160921_063094039ef79437a260d3dde960797a.js, 20160921_0de23a42684ac14027d562ff3e5fb6a8.js, 20160921_1267df6ebcd72f6d98872f0680fda2dd.js, 20160921_1b24f7151bebd3644ff0608076bd2de9.js, 20160921_1bb9bdcf05b8f8acd28d5286e804d5cc.js, 20160921_1e07803d7c44ae0b61b5ddf189c80675.js, 20160921_20daf816cda5af37e984359023f15db2.js, 20160921_215dd4f9feed109fed37b9c9dabdf1c2.js, 20160921_2195f5432b2fe0ac8f6e44e98fb2fbaa.js, 20160921_2f8fa7cee8a6f4f78978b7417f3f700e.js, 20160921_32a3b245a67cd982da1d38f57645b403.js, 20160921_35613f26ab8269650aa877fd5af3e43b.js, 20160921_35d4c12af7a9481959a41a055c396673.js, 20160921_378cbd2e27643682973c633e59454f9f.js, 20160921_3823f4aff4d341a62056d936e59de44c.js, 20160921_3ec558d1fbbb49dae502fbac7c879ad5.js, 20160921_4031e49cbb76e44dd58fa572b63a00c7.js, 20160921_460a913db46b41c41035cc210ed5fba0.js, 20160921_4809ff2679793c2b9af03e18ec3702ef.js, 20160921_4bad0ae96eb9fc3a1c603846a44ffe13.js, 20160921_4f8422c91e79e3073e201b0b279b1fbb.js, 20160921_4fa304d7c11deb5fb9cd6514d5a983de.js, 20160921_50b14bf13c50bc31f09e3c583e1d422d.js, 20160921_510713862e5c8c05841e5272407127f3.js, 20160921_52ab3697b827675e3be965f7171e236d.js, 20160921_531eaafa1b0a00d86f2203fbd289dd63.js, 20160921_5c25506bc44b50a0c8028dec6521139d.js, 20160921_5cabcf77c626e288d5cbd9104a914ae8.js, 20160921_5ed9729c3ab2cb9d37d8a088af1aba59.js, 20160921_65d76a5539546b98145997b9a44c1a09.js, 20160921_6d7b654a484acab4abb3060ebc68a164.js, 20160921_6db2cb585eb933d83d07b47d979b00ec.js, 20160921_6fabf8ef6df7ba14509fab6de95d721f.js, 20160921_70d636d209e6f109a21746567376cc81.js, 20160921_73e0cbee151147d27e01ecc015f640b4.js, 20160921_78bd4256ddc0b384791a12e8ab1fd8a4.js, 20160921_7ab823078d2353d978403d071ad27626.js, 20160921_7b23bcfdd1289634cd9a4c73f4cbb144.js, 20160921_7c5b5eaba938fa91eb6a9414212e13f9.js, 20160921_7e15ac2755366d4644a83de8ec9c1a47.js, 20160921_82861e992460412d02ca3f987da7d467.js, 20160921_8644cb559dff4747b398e56be3b4ea85.js, 20160921_8c8c9fad8af659443108d1078847a668.js, 20160921_910cd79d8583d0c6c23bd93547d341fd.js, 20160921_91424e3b4f105c156aa0fa6f22c2306f.js, 20160921_91734b00fd54cd3dd10c5f20c35d7864.js, 20160921_91af5c220d1ea27d72d05f472ba8fa16.js, 20160921_9b80c329004df146d978cb7b31b22c05.js, 20160921_9eb4e3262a9bc5c5f03ba0b7b62a3347.js, 20160921_a160e4a385807ffcdde4f99a0c57b6b2.js, 20160921_a210d5e93bf8b06dbd0a1b262abe210f.js, 20160921_aab5fb25ea8971982ac223655d50aba2.js, 20160921_abc9044816c2455dc24ac338746b6bd5.js, 20160921_afb633ee817d9b15b91ed82a059939fc.js, 20160921_afee44f6d8e742fd9b103fa8b026b3b3.js, 20160921_b091a235428e4f2a03a39b034feca4b8.js, 20160921_b23a0d871d76c64a3c71f0b0f52faaa8.js, 20160921_b6d1e9aee3a026c6f266b107f0b88f18.js, 20160921_b74bfd3dc7404d3d5a6512718aa52504.js, 20160921_c42fb5c75aea2648513013ad2eed9aaf.js, 20160921_c694815b18c140f34c0f79f86106d901.js, 20160921_c979e38640433b8c93e1c145417c85cb.js, 20160921_ce3c0604d52e9dc9119cefedfee34385.js, 20160921_ce9aea7615ba4a71719a9c0d7f838fc1.js, 20160921_d72e05128386ec5185fa7c82a29fe618.js, 20160921_dbc1b5f3d0381a2cf3968267e55b6f78.js, 20160921_dc1ff053e9dd688459c33dc98e88d636.js, 20160921_e0f7b2a32a0967097baa59c67369ba3a.js, 20160921_e8d738510e4d2e0efb6c7aa18a7a58d8.js, 20160921_eb8df0d94f3c78c9cec0bde62ab2e57e.js, 20160921_ee80dc6199fa2bd2aea50402a233f984.js, 20160921_f6f229e035b34b52398f9d713af3e947.js, 20160921_fa8c93ef210d8b4c6831cb1425f1dc9b.js

rule _20160921_063094039ef79437a260d3dde960797a_20160921_0de23a42684a_1026 {
  meta:
    description = "datamaliciousorder - from files 20160921_063094039ef79437a260d3dde960797a.js, 20160921_0de23a42684ac14027d562ff3e5fb6a8.js, 20160921_1267df6ebcd72f6d98872f0680fda2dd.js, 20160921_1b24f7151bebd3644ff0608076bd2de9.js, 20160921_1bb9bdcf05b8f8acd28d5286e804d5cc.js, 20160921_1e07803d7c44ae0b61b5ddf189c80675.js, 20160921_20daf816cda5af37e984359023f15db2.js, 20160921_215dd4f9feed109fed37b9c9dabdf1c2.js, 20160921_2195f5432b2fe0ac8f6e44e98fb2fbaa.js, 20160921_2f8fa7cee8a6f4f78978b7417f3f700e.js, 20160921_32a3b245a67cd982da1d38f57645b403.js, 20160921_35613f26ab8269650aa877fd5af3e43b.js, 20160921_35d4c12af7a9481959a41a055c396673.js, 20160921_378cbd2e27643682973c633e59454f9f.js, 20160921_3823f4aff4d341a62056d936e59de44c.js, 20160921_3ec558d1fbbb49dae502fbac7c879ad5.js, 20160921_4031e49cbb76e44dd58fa572b63a00c7.js, 20160921_460a913db46b41c41035cc210ed5fba0.js, 20160921_4809ff2679793c2b9af03e18ec3702ef.js, 20160921_4bad0ae96eb9fc3a1c603846a44ffe13.js, 20160921_4f8422c91e79e3073e201b0b279b1fbb.js, 20160921_4fa304d7c11deb5fb9cd6514d5a983de.js, 20160921_50b14bf13c50bc31f09e3c583e1d422d.js, 20160921_510713862e5c8c05841e5272407127f3.js, 20160921_52ab3697b827675e3be965f7171e236d.js, 20160921_531eaafa1b0a00d86f2203fbd289dd63.js, 20160921_5c25506bc44b50a0c8028dec6521139d.js, 20160921_5cabcf77c626e288d5cbd9104a914ae8.js, 20160921_5ed9729c3ab2cb9d37d8a088af1aba59.js, 20160921_65d76a5539546b98145997b9a44c1a09.js, 20160921_6d7b654a484acab4abb3060ebc68a164.js, 20160921_6db2cb585eb933d83d07b47d979b00ec.js, 20160921_6fabf8ef6df7ba14509fab6de95d721f.js, 20160921_70d636d209e6f109a21746567376cc81.js, 20160921_73e0cbee151147d27e01ecc015f640b4.js, 20160921_78bd4256ddc0b384791a12e8ab1fd8a4.js, 20160921_7ab823078d2353d978403d071ad27626.js, 20160921_7b23bcfdd1289634cd9a4c73f4cbb144.js, 20160921_7c5b5eaba938fa91eb6a9414212e13f9.js, 20160921_7e15ac2755366d4644a83de8ec9c1a47.js, 20160921_82861e992460412d02ca3f987da7d467.js, 20160921_8644cb559dff4747b398e56be3b4ea85.js, 20160921_8c8c9fad8af659443108d1078847a668.js, 20160921_910cd79d8583d0c6c23bd93547d341fd.js, 20160921_91424e3b4f105c156aa0fa6f22c2306f.js, 20160921_91734b00fd54cd3dd10c5f20c35d7864.js, 20160921_91af5c220d1ea27d72d05f472ba8fa16.js, 20160921_9b80c329004df146d978cb7b31b22c05.js, 20160921_9eb4e3262a9bc5c5f03ba0b7b62a3347.js, 20160921_a160e4a385807ffcdde4f99a0c57b6b2.js, 20160921_a210d5e93bf8b06dbd0a1b262abe210f.js, 20160921_aab5fb25ea8971982ac223655d50aba2.js, 20160921_abc9044816c2455dc24ac338746b6bd5.js, 20160921_afb633ee817d9b15b91ed82a059939fc.js, 20160921_afee44f6d8e742fd9b103fa8b026b3b3.js, 20160921_b091a235428e4f2a03a39b034feca4b8.js, 20160921_b23a0d871d76c64a3c71f0b0f52faaa8.js, 20160921_b6d1e9aee3a026c6f266b107f0b88f18.js, 20160921_b74bfd3dc7404d3d5a6512718aa52504.js, 20160921_c42fb5c75aea2648513013ad2eed9aaf.js, 20160921_c694815b18c140f34c0f79f86106d901.js, 20160921_c979e38640433b8c93e1c145417c85cb.js, 20160921_ce3c0604d52e9dc9119cefedfee34385.js, 20160921_ce9aea7615ba4a71719a9c0d7f838fc1.js, 20160921_d72e05128386ec5185fa7c82a29fe618.js, 20160921_dbc1b5f3d0381a2cf3968267e55b6f78.js, 20160921_dc1ff053e9dd688459c33dc98e88d636.js, 20160921_e0f7b2a32a0967097baa59c67369ba3a.js, 20160921_e8d738510e4d2e0efb6c7aa18a7a58d8.js, 20160921_eb8df0d94f3c78c9cec0bde62ab2e57e.js, 20160921_ee80dc6199fa2bd2aea50402a233f984.js, 20160921_f6f229e035b34b52398f9d713af3e947.js, 20160921_fa8c93ef210d8b4c6831cb1425f1dc9b.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "ce1eb4a08b98ec71f6759f87657e36ddf82182025b3e317c586fb55c186b9e6c"
    hash2       = "7237be0906b854ec3890943cde0c9a731117b836078be4256fe37413dd372a66"
    hash3       = "bf733ba7fbcc89931fdde522ae98997cc24f7014bdd535a49fc0223e8d0b0a2b"
    hash4       = "33f3c9ce370f10b37d492f9d2cda8602f5d90eb1573205e1a4da03da8066ff45"
    hash5       = "3937dec3a8d946e214facedccfe7f35e65dbd446a77d077a09996638d7524444"
    hash6       = "1a50e95e48071d391fd7544518c3c0394e9cde9051c76cf311992966b7414cc8"
    hash7       = "a45ccf6470d4ee194ed220125c42c5ac5d7c4b8a46cce738c6d12e9cc0bafea8"
    hash8       = "710f88c7fda95a8d3e0e04de1ffd81606d227d249d76eb0d7fbeba7a0284a86e"
    hash9       = "8753bd153b88da9a4351b5d6a0111d7af66a0f18e8b8a42beee11ad2916dc183"
    hash10      = "6410122a95cd840a4eef622389d8026475b4f6a156d4b5288cf227165c036c96"
    hash11      = "9f7e53a243b56341e3d17450083c46ba2a33141b25134577db086128321a8223"
    hash12      = "432da9fcdf6c0d62e24e70562f7949325e57abff120248541ccbdaf091d0a7f3"
    hash13      = "1c2412951fad30bb8b34aca279acd07c03a437936261b0d90334331b98cf1e99"
    hash14      = "8ce016002e44e1fbf4624122138e5a8b0261aff6487c52da0d644398da46a896"
    hash15      = "d0b475c02138425371c1df69faa8ac5c3d739764950c4a65034372b4455ac04d"
    hash16      = "71f652a0e52aa70fe3179b7e90dff8ba55b85022fbfe5d5d2db1bf6f32a04513"
    hash17      = "42519dff3fd2ed2dc9bcd0f12a16fe310be93f90efd5d40110f336dc5010d050"
    hash18      = "99bd08fbf869b4c9520d81d5b17512d87856474b8cf260494d0c88a47e0d37c9"
    hash19      = "2c2d464143196a0237396460d274213cf5b3de772f4205aee0525b67ca1bfd6c"
    hash20      = "a99f235f58613323f5c58def3503d47959f4a77f0697e30c75b6d221c4b40806"
    hash21      = "f1cc54af4d213d0cd37c81b29d25c29bf00892e3458ef2e236563c69fd58b94a"
    hash22      = "cef5a1e67f57d9f24065ff0145644e0185df6abc29113310c6782b30e0a9236b"
    hash23      = "b9aab1a9f889ee14c72c5b3718595b8a66b04e749b1cb75ceb264874c173aeab"
    hash24      = "9f9cd81d24cdba49fd83fed4aa0c3ce028729b44e223720bae200336b5992e5e"
    hash25      = "90a876a1d91ded80337b02adca1c227fdf5b5a96381a62397d3485e5e8ea108b"
    hash26      = "d28500022264ce61d9d988db6f8ddee46acc7dea6f898510f532ee48f87a0c93"
    hash27      = "b6178db9a292199c6992547ad654bf7056fa7f33310f29988e468f0cad5ed707"
    hash28      = "9493e4251106014081e4b141c6296c51b00c9ba7a799bcb978ea6226cd127d34"
    hash29      = "c5908838424a9cae8eb5587cff7048056b427db1deb512dcbe9ca852a402e03d"
    hash30      = "0a1b81d7435f521382a4cec07d80cbc8fe75f2ebac92fb6c4d105b19ec098560"
    hash31      = "2840e0696eacd7118885eaede05c3ef29d9cc682ba227d7797a60be4872d86c9"
    hash32      = "b98c5953d102d77c680619bcfd3ba762b3a28a14355f65c479544c745a7c9a12"
    hash33      = "a6962383b3793edac58fef061128f9047afb39eaa645d3f7977a775ceeb02e56"
    hash34      = "6e26044e7a07a5a675f3b388e6309b138b9e7a1aa61556485f444025164a158e"
    hash35      = "0ad4b632b07e5e4526b874097c116e5183b155ec4b9cf40e3f13ece0ce027344"
    hash36      = "c64d081235a424574ab6bbe64470cbee71a700f01b638afac6d0954ebc5cc0a0"
    hash37      = "32692e808eb087cfb43babd004792978a1918b8bad58bd7576ad1e83a17c97f8"
    hash38      = "7a94fbc46ac51a544406f9a59bf405cd1e19e8e6681d7feacbc81e5ab7d4a50b"
    hash39      = "9b25331c24a00cfccf7bf1604f7df1d245543734bf5553f0a7c3c911bb74cbb8"
    hash40      = "97eaf7c50f22bfc94f97a02e5e83a8f1fb3583717fb9f4a6666ae882ea4d6f55"
    hash41      = "2ed6678fea06b2b66ef873575f3af904bb62f54913a37c77387208fd53da33ba"
    hash42      = "d92ab3635a987485347ef1a40e84d56adf54d5da5be50490856e0386b6ccabda"
    hash43      = "05c35ee4072476c50081705469d125bb2570dea942839cab58bf87874667da59"
    hash44      = "77a08a00002fdf0cdac8ee96f3ed542c8dcd2c5851f8c2feec648c8adedf7468"
    hash45      = "b4a035e38404ad09be99953980865cdbcda5dd05b664dff96722afb53b0c9e29"
    hash46      = "cdae8af0c395dfe20c83f759c05d2fd6ae2859606871798c6b3a7a12257c7f70"
    hash47      = "d8a5c3b8bd7307238c3f0a133635143674d5db84b7c5615a145a8bea310c68de"
    hash48      = "d0ec644cd7307cbd280d369539e9834d3ad2ba0909b631b5a3640f8f6a1105d1"
    hash49      = "03bf8e47f97cab996cc7f2d8147659dc1143ccbe1fd09af6b8689379f7263407"
    hash50      = "c3eeb2af6e453aec7ede2bba435e7dcf60f7497a94584d1908a2235d79c28a34"
    hash51      = "681408ae198939a760d376554e62f86e9d1fe2306266ffaee496dc9eed4d0687"
    hash52      = "0387ef653c0ac9c5d0aaf638bde80688e7b6b279a435dcab3ff679313abfab3c"
    hash53      = "2bb53920235afb1c2d16f013bc118d1df64065eefc10c1b2b9e7a4b133850850"
    hash54      = "7a4e330bd3ec71aa3dc8fd3d5b2fa656b04d49cb5ee4e5478a50a6336c5bf9e5"
    hash55      = "dd1fb060f8cf9db47b88f548c50d48e0e942b01aac86e408632eb9f913c96480"
    hash56      = "c42887396845595b9d299a51d83fefe371bc73c7bfbcd3105457a9327da7e441"
    hash57      = "02969139df11550b994530c0bcbc6d946b6e49105015e9475f5de3942d78e5a1"
    hash58      = "e95dafe7c61e6b4aa30cf1d0f5e7ac22599967edab3c0a7152e74671d99054e2"
    hash59      = "359d333ab8fc51d27349ecaec71f8baf8e8aafae5bfe2d6afd26f4ed76e802db"
    hash60      = "5c8cdf3dbb94e197c36e5744084d12e198ecdab7243d67654934aa1cc9bf7ae9"
    hash61      = "650c20b763cdd9e1631c1f76f67b04a911cfce7996c1e9928b9c3b7fe1f8e7e5"
    hash62      = "62a468202853ba6a8adb456e8c12b66f8794360c094a85e6d4d2cf43d13a75ce"
    hash63      = "27a20a400d7aa13737d230acf36a2170494c7da92e72552775d19562ba331fdc"
    hash64      = "1dfc225800b3b802cbdd9312a3198f5eb4bbcdb06d5f9ffd026bb3fb4f5cf4e6"
    hash65      = "72502e65294651208a74590dc961703c09931d4341f59214d7303b271ca8abd5"
    hash66      = "e37cb576da589586ca091f887f2d941f81f58c7a8c3974b4e11928357dfee825"
    hash67      = "18a890096a5714e518b28d3f50f6487cfbc4164418daae1842b7d724e2c26bd6"
    hash68      = "d527617da74d553b6d56b37f7b101c14280b85e5e40e1f565fe396f8b97b29a2"
    hash69      = "e1cd4a36522d2ad8fc8435b6cb64d8e572d8b31d4203885fa375f539a3ea7891"
    hash70      = "768a9ba5aee8702bd0d4c71ccae6016847556423c2ece30b15169aaa7731f27b"
    hash71      = "b51d9165093e08385081a749ef6331a3556fe2739b6c8f85b62e7f6ec1b4f662"
    hash72      = "dbd2ccfd17959ea084fe518e1748ca4f14e74a14593d7c157b17f4437f4336e3"
    hash73      = "7e7bb1d2ade80c23d5462f8e4a470a3c3245b07b8a709a3c911ff76a8c32da35"

  strings:
    $s1  = "ction fuck(){return \"Xw\";})(),(function fuck(){return \"Yk\";})(),(function fuck(){return \"Mw\";})(),(function fuck(){return " ascii
    $s2  = "function fuck(){return \"IOs\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){ret" ascii
    $s3  = ";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"Za\";})(),(function fuck(){return \"Ar\";})(),(function fuck" ascii
    $s4  = "Za\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"Zy\";})(),(function fuck(){return \"Wo\";})(),(function" ascii
    $s5  = "n fuck(){return \"Za\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"GJx\";})(),(function fuck(){return \"" ascii
    $s6  = "ction fuck(){return \"IPu\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"GJx\";})(),(function fuck(){retur" ascii
    $s7  = " fuck(){return \"IPu\";})(),(function fuck(){return \"Py\";})(),(function fuck(){return \"QTc\";})(),(function fuck(){return \"I" ascii
    $s8  = "n \"Sx\";})(),(function fuck(){return \"Ug\";})(),(function fuck(){return \"Dc\";})(),(function fuck(){return \"Xw\";})(),(funct" ascii
    $s9  = "\"Py\";})(),(function fuck(){return \"Jh\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MBg\";})(),(funct" ascii
    $s10 = "})(),(function fuck(){return \"DWe\";})(),(function fuck(){return \"GJx\";})(),(function fuck(){return \"SUi\";})(),(function fu" ascii
    $s11 = "})(),(function fuck(){return \"Ug\";})(),(function fuck(){return \"Za\";})(),(function fuck(){return \"Mw\";})(),(function fuck(" ascii
    $s12 = "){return \"Oh\";})(),(function fuck(){return \"Wo0\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MBg\";}" ascii
    $s13 = "return \"QTc\";})(),(function fuck(){return \"RAi\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MBg\";})" ascii
    $s14 = "n \"GJx\";})(),(function fuck(){return \"GWo\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MBg\";})(),(f" ascii
    $s15 = "fuck(){return \"IPu\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"Fv\";})(),(function fuck(){return \"Jg" ascii
    $s16 = "fuck(){return \"Ug\";})(),(function fuck(){return \"Wo0\";})(),(function fuck(){return \"UOe\";})(),(function fuck(){return \"IP" ascii
    $s17 = "){return \"Za\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"Oh\";})(),(function fuck(){return \"Zy\";})(" ascii
    $s18 = "eturn \"IPu\";})(),(function fuck(){return \"XCr\";})(),(function fuck(){return \"CCb\";})(),(function fuck(){return \"SUi\";})(" ascii

  condition:
    (uint16(0) == 0x2f0a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

e1ee9834-3569-4c53-bcf8-45abe93fc61a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion