_20160627_00687ed0b5021b59f36ed07f2b66f66d_20160627_044bedc886b0_1093

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160627_00687ed0b5021b59f36ed07f2b66f66d.js, 20160627_044bedc886b0d029ec3585a51beaf190.js, 20160627_16c7c52afb19891daf9a1db73390d9a5.js, 20160627_18e5744e8a3c62fd7a002ca1ead88002.js, 20160627_197f37a0232e96f6951cf87c3fdcbd99.js, 20160627_198eb7e06c5d489815e48826a45a5b2e.js, 20160627_1a419b73f0be77af8224a37d6830470a.js, 20160627_1b6e0004ca9bf8765dac690e6f8e1b16.js, 20160627_2b1b6be670fbb90bb673d956f69df06d.js, 20160627_2b60d717c27f23e82bc2124ba48d1021.js, 20160627_3587b08506041aa5b5171ce225892fa9.js, 20160627_411b0a6b7b1a9a1803c5a7639b98345a.js, 20160627_437b38b08c7239e2f78ecf8a7377b867.js, 20160627_4d397964d5576ad751e0d68b31cf71c6.js, 20160627_4eaa677bb74c7c15d3d7704a9af3f203.js, 20160627_5230b382e274bfe46f0c38db2bee4f23.js, 20160627_54b8cbdf2642849dc6e186e646f8f627.js, 20160627_56509203dac3d40c1cf6b8aacd2032a0.js, 20160627_5935e9662bd67bc515ee9ac215f87855.js, 20160627_59e03ed60d9bd17e04ac2ddcb199f70c.js, 20160627_68f56d51bab20470f281c4f89018d683.js, 20160627_748fe2b808ad6714ba82a8e9885c2962.js, 20160627_75b7a64d9ac08cb14d11ca3beeacfde7.js, 20160627_76ffe3568c6e3445568cafef8c94b40c.js, 20160627_7d2119cc031196fb296ca9f6ade46e2c.js, 20160627_826d0179d8d95999de89713e627e5993.js, 20160627_89c86324a4d9bf74176c3e0eaf37d2c6.js, 20160627_95929c91c6209eadcbb1dc439ce51214.js, 20160627_989297efb41ff5e32754fed03f910990.js, 20160627_a1bc4d4421d48212b1d1a6eccb4f3de9.js, 20160627_a2d63feeeedbc2a1a42b73edebd8c5bf.js, 20160627_ab08484589b8a22f1adce2be601c8a2d.js, 20160627_b2a97eea8d82febbd8de25b0445be770.js, 20160627_b97fbde473ca7c138a07288382b1e9f9.js, 20160627_bd201aa34b2c047d13c51443b280eb8d.js, 20160627_bf7ba6b3d493cd73049b22292dfa7496.js, 20160627_c0827510db00c082c5acba634e251447.js, 20160627_c19f05fb46ee291d72d04682e3dedfe5.js, 20160627_c8125b33647ed025857a10f320d92e7f.js, 20160627_c903a4e3ecbe5faf9690184cc285c3dd.js, 20160627_cc5f07ceb883be946758d0767879ca96.js, 20160627_d2cb0e88476090f4332afcf8a413d131.js, 20160627_d59963afe2bfd1ae1ed0a946200e1eb5.js, 20160627_d88d1ea91d179af2ee435fb5f0b0bacb.js, 20160627_dae4b0df20ede51eca98a72f79c1d516.js, 20160627_dc9b13e1d26c7f170a0d8cf164eb2e3b.js, 20160627_e395c0c8ef0c611f1cad9fb7ffa92636.js, 20160627_e5ef85887cbbaa9704913d46347135af.js, 20160627_ea6ab7df993d99c9f7d696b5703b4f6c.js, 20160627_eee7e58d4586e23b5b85c9adeeb0b8d6.js, 20160627_f5a6ea49069cd48052f5dd7af8b60309.js, 20160627_fabc25e1e1667f03b11f6ab7695ad9f7.js, 20160627_fb664925c7b3f94f499a6f5275c4824f.js

rule _20160627_00687ed0b5021b59f36ed07f2b66f66d_20160627_044bedc886b0_1093 {
  meta:
    description = "datamaliciousorder - from files 20160627_00687ed0b5021b59f36ed07f2b66f66d.js, 20160627_044bedc886b0d029ec3585a51beaf190.js, 20160627_16c7c52afb19891daf9a1db73390d9a5.js, 20160627_18e5744e8a3c62fd7a002ca1ead88002.js, 20160627_197f37a0232e96f6951cf87c3fdcbd99.js, 20160627_198eb7e06c5d489815e48826a45a5b2e.js, 20160627_1a419b73f0be77af8224a37d6830470a.js, 20160627_1b6e0004ca9bf8765dac690e6f8e1b16.js, 20160627_2b1b6be670fbb90bb673d956f69df06d.js, 20160627_2b60d717c27f23e82bc2124ba48d1021.js, 20160627_3587b08506041aa5b5171ce225892fa9.js, 20160627_411b0a6b7b1a9a1803c5a7639b98345a.js, 20160627_437b38b08c7239e2f78ecf8a7377b867.js, 20160627_4d397964d5576ad751e0d68b31cf71c6.js, 20160627_4eaa677bb74c7c15d3d7704a9af3f203.js, 20160627_5230b382e274bfe46f0c38db2bee4f23.js, 20160627_54b8cbdf2642849dc6e186e646f8f627.js, 20160627_56509203dac3d40c1cf6b8aacd2032a0.js, 20160627_5935e9662bd67bc515ee9ac215f87855.js, 20160627_59e03ed60d9bd17e04ac2ddcb199f70c.js, 20160627_68f56d51bab20470f281c4f89018d683.js, 20160627_748fe2b808ad6714ba82a8e9885c2962.js, 20160627_75b7a64d9ac08cb14d11ca3beeacfde7.js, 20160627_76ffe3568c6e3445568cafef8c94b40c.js, 20160627_7d2119cc031196fb296ca9f6ade46e2c.js, 20160627_826d0179d8d95999de89713e627e5993.js, 20160627_89c86324a4d9bf74176c3e0eaf37d2c6.js, 20160627_95929c91c6209eadcbb1dc439ce51214.js, 20160627_989297efb41ff5e32754fed03f910990.js, 20160627_a1bc4d4421d48212b1d1a6eccb4f3de9.js, 20160627_a2d63feeeedbc2a1a42b73edebd8c5bf.js, 20160627_ab08484589b8a22f1adce2be601c8a2d.js, 20160627_b2a97eea8d82febbd8de25b0445be770.js, 20160627_b97fbde473ca7c138a07288382b1e9f9.js, 20160627_bd201aa34b2c047d13c51443b280eb8d.js, 20160627_bf7ba6b3d493cd73049b22292dfa7496.js, 20160627_c0827510db00c082c5acba634e251447.js, 20160627_c19f05fb46ee291d72d04682e3dedfe5.js, 20160627_c8125b33647ed025857a10f320d92e7f.js, 20160627_c903a4e3ecbe5faf9690184cc285c3dd.js, 20160627_cc5f07ceb883be946758d0767879ca96.js, 20160627_d2cb0e88476090f4332afcf8a413d131.js, 20160627_d59963afe2bfd1ae1ed0a946200e1eb5.js, 20160627_d88d1ea91d179af2ee435fb5f0b0bacb.js, 20160627_dae4b0df20ede51eca98a72f79c1d516.js, 20160627_dc9b13e1d26c7f170a0d8cf164eb2e3b.js, 20160627_e395c0c8ef0c611f1cad9fb7ffa92636.js, 20160627_e5ef85887cbbaa9704913d46347135af.js, 20160627_ea6ab7df993d99c9f7d696b5703b4f6c.js, 20160627_eee7e58d4586e23b5b85c9adeeb0b8d6.js, 20160627_f5a6ea49069cd48052f5dd7af8b60309.js, 20160627_fabc25e1e1667f03b11f6ab7695ad9f7.js, 20160627_fb664925c7b3f94f499a6f5275c4824f.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "2bd2802b54a0d69de6f86530a84548aa4d04a4cc2149fad3fe26547c18e964ad"
    hash2       = "64858f9474f93ff6dc4e94887744c94e7cdde043d9e8c65d52857829544ca89c"
    hash3       = "4e98a36a682cb45ca4722ba4392f0dd6577d0c6560b02df363553076ade9072c"
    hash4       = "aa4edb2945cbbd7204ca82695d4852bb0398daaaebec44b193795f304ef84aeb"
    hash5       = "6bd11c0a7b620085bd7bfeddda8667ffeeaf54e04a48751eeda27577d58b4fb3"
    hash6       = "64fcc2cb0d17a7f3aab02dcc07a0325312a17d0a8b03ea048e02c89a320f57c1"
    hash7       = "4866c8693e8e51a71e154cabc7fc85440772411a00f67efaa7d8b61206425166"
    hash8       = "9a8d823be13afaf5037997f9deb05b8ac9743dc5269172b2ffb52ce75729679e"
    hash9       = "03a9a582fc109e9b12874e57a87f3740f1a4a314f4c4890bf38945a6cecf14f2"
    hash10      = "aba5d3efb82f389a309d3fbe6d4caf37d40184e0324893f3e709d610cd11bee0"
    hash11      = "bc6d931dd7e557303467b45ac0cfe6b08ffbbd98fb1058fcd040010fcf0930b8"
    hash12      = "3020fabf28d22855b8f22c10eee899678e6176a8b628a89e23211ea279905255"
    hash13      = "7f43e60e527507815bb5fb5ce08b0e8dda5d7dfd6e18c5a4fa29775eff2e7627"
    hash14      = "929ff027c92a245ffd5f16fbb2db89f949e5299058f68d1aeeb1d7849c0fff85"
    hash15      = "2f2ef255d5c1795b1582e839c8a7491dc3dbac3ebc4531d04b8940f1f0cde7e3"
    hash16      = "a367925ee4e1c3a107450b87907f4cfa08e109bf1e56e753ea0ffc42d891060e"
    hash17      = "cfb880d4e435e35018ba742e068a963f7a169841f110ef7f06f286edb40036aa"
    hash18      = "6aef522c24694dde03c46f77a7ed632fd2b32b5dd72bd884317ae5f679471f5b"
    hash19      = "18f6df370ad87477f919ef7498c0f9edb2c3c666449d0bdb20c455c8a69ea9d5"
    hash20      = "2b836c3b26e95e4ccaedd9b65605b30e253762fa2e2d8dfd0950dcf36eb81ad7"
    hash21      = "d447a235d42efabef6d7db4990a6b4a3f771d970b5b8fc5787a8dcbd15fc5a63"
    hash22      = "e5f86a653e1ec5b97c03024945534b6c373fb7f80a12aca06b741f431e4de119"
    hash23      = "bd0d31e817c1030c98cdf60f7e97fd01e422318ee95cd9114cd31e713072b272"
    hash24      = "fb79da76763f7bce193225f9dff80b234c94566a45ce39d752b156f2cccfdb31"
    hash25      = "dd04b00311cb033beae294bb384825ee7afc1a485567c177d4c30a5e05a198e9"
    hash26      = "9ba5ccb4aa417bba2905c338593bbc70492f7ca2a16b6bd8d3c70496da01d7e8"
    hash27      = "1b17855f25c1899fca485b94866e5d79a2c4975d3dfc4f1c7b5e9228631c926b"
    hash28      = "fa7db2dc16ddfd5bdc1880392d03ae46deab7485b19d412014791b4d8f08e20d"
    hash29      = "640ce6eaddb4082d22125c27ca6aa7f248907df84641eb70cbcf8972b49439a6"
    hash30      = "226b4c96769fa67b47f843344f24c6725ae468cc95fede4e6c53b815f1425756"
    hash31      = "5884413f85028fe7d95cf8ab22db2e01b1eaba288136cc10df76f46005957bea"
    hash32      = "ef727a47649f7a79d3e9600031986a1e173fb9805a0db2523624a930e63499a4"
    hash33      = "e0f844b433511979551a8dcd96e0381817cffe89b1157b3a10bd35115dd05f24"
    hash34      = "6a6a8fb5abf7951300cdadde61122e619db1fe0a13258515cb5a0e82f54fcbf7"
    hash35      = "8585784156634c40bd73100b69bf27bbabbb03d0bda09c6b9865da8949750dfd"
    hash36      = "22a073c52a1cdd57f7ccd15511b245aa68e739fc615856ea7e455b39d933e5d3"
    hash37      = "bd683e3870a7ad24a2d7e209eb9fe5e4a82c9a3e34c5cba5ed37cbd6756f8f5e"
    hash38      = "1d89df827e149be21373f00c690f2d2d9d3fc425db4cca17eaf54d37bff0bca6"
    hash39      = "5d81a2b5974deb83d61465b9ad1cbc913fb470c85b44ab80ce4b6dca9ee4e1dd"
    hash40      = "297e7b935367f673fa432cec66a6ef1526b7e8bade36e9b540b688374268d227"
    hash41      = "db052845cdbae8b7c70daef70e5f9c063f51f929eb76790fce599a61a95e8ab0"
    hash42      = "3bc7ef7a16c79ec5335c74f2420b0d87c9ada9b4867334d78c526910c630b161"
    hash43      = "f97264a35a695de0b2b232c8fcc8de5fbe59a67494148c0e38958f075a49a407"
    hash44      = "ec8abca4f8f9075906c9c0b6ab53699a4f31e074f653014b24676a0e79601a04"
    hash45      = "9ce1686fb520882ae74d310ee8e84fb5a378de7dde471eadad993345ec105bb9"
    hash46      = "d0c4313a126c8ac30bf775443972968fea286ae43f60ab1647d9f19b96336295"
    hash47      = "384c97c19d82b72858bf3160e63aef114ab0f5b571ca1378760fafd7470efe98"
    hash48      = "c61ad240dab57cae096f2603640dbd1b5ad6a19888a832b2b23dd48a92cd0057"
    hash49      = "01c0fd85f30a9af6c4a88a20dbbc6fff4fb3623d32b04a8f1bc2481c83b68cc4"
    hash50      = "eaa667bece74eeb9117f9f5e70a226738cbd5a969f4510346d8e42566f40b0cf"
    hash51      = "05a3775cb9b5858bb735814ea5ea901f33c36af45d70efef640efd88664ccf98"
    hash52      = "15d8aeee5d6fb0a89bd73c03c876f2660bd41c666f55fe3810c44b2bc7af19d4"
    hash53      = "d99e751d366fc107dbda9752f4b501baa8a4dbc4df1eb140c37eee59844d7b76"

  strings:
    $s1  = "var logan = this[druberri.shift()];" fullword ascii
    $s2  = "String.prototype.paprikash4 = function() {" fullword ascii
    $s3  = "var terrifying = druberri.pop().split(\">\");" fullword ascii
    $s4  = "String.prototype.paprikash2 = function () {" fullword ascii
    $s5  = "var workroom =\"dezd3monaRXhwYW5dezd3monakRW52aXdezd3monaJvbm1lbnRTdHJdezd3monapbmdz\".paprikash4();" fullword ascii
    $s6  = "var ranger =\"dezd3monadezd3monaJVdezd3monaRFTVdezd3monaAl\".paprikash4();" fullword ascii
    $s7  = "var ungodly = \"dezd3monadezd3monaQWdezd3monaN0aXZdezd3monalWE9iadezd3monamVjdA=dezd3mona=\".paprikash4();" fullword ascii
    $s8  = "architectural = \"b3Blbg==\".paprikash4();" fullword ascii
    $s9  = " function paprikash(rivulet) {" fullword ascii
    $s10 = "var amalgamation = druberri.shift();" fullword ascii
    $s11 = "var vulture = rampart[druberri.shift()](druberri.shift());" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

551ef894-8201-4e3f-b5d0-43aaa1015fda

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion