_20160919_00e808d634efe942b67c4da9aa4ef89c_20160919_019ec14b689b_1095

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160919_00e808d634efe942b67c4da9aa4ef89c.js, 20160919_019ec14b689b130163b891a8134e0124.js, 20160919_05a9d9bedf487d7dbb1717461af889d9.js, 20160919_06bd386d7301f9645126e5350f6063fb.js, 20160919_07a02dd5b7ea8651c2c1b48b07bc45ab.js, 20160919_07d3a67b263570769cb6322be556d479.js, 20160919_0aa1f74a4d0503c81f69a7ac4ec50e84.js, 20160919_0d2000956784681bc379a55cdb915504.js, 20160919_0e3e1b7181264b8eb911fe42fbc5c732.js, 20160919_0e5a17b152e647a4fbb5dbcb6b1c067a.js, 20160919_0f306f8f462e138b9e8b88ff29421755.js, 20160919_0f85167e3d3c55c3178a6fc7a9a998bd.js, 20160919_1092cd570c4a1074521a4e745837abcf.js, 20160919_118f96dbd435c6be4e6debc6d97193a2.js, 20160919_11a4b51e35ce1650d20ba30b7bc5ab0a.js, 20160919_13a4feae653472950730d2cb6169649a.js, 20160919_13f9728bee0bcd6e5f6eebc1208b6cd2.js, 20160919_163c16bac578e4ab54ea85ec04c14444.js, 20160919_1853680b9117d4b62894017eafb078df.js, 20160919_18a28fe419fb3e3a578e0839496ca899.js, 20160919_1e4ee20462f9d7ecab58978fad585387.js, 20160919_25b6f6d9e93fa10235adee51a130c08f.js, 20160919_25fa31f060fe717d323a87b3033a3d40.js, 20160919_26c0955b44afeed66c6529cc2c49a628.js, 20160919_27d18f62ad04a2e3d6d83fa4ea6959e9.js, 20160919_289b4c6988516e9c817d9a22f13a0674.js, 20160919_2a9dc5ac34b6ade02d363626316797bf.js, 20160919_2ea69cfbb600612bcc168fc700ce0345.js, 20160919_304d6622c1945ef70348e3c5a174d7c8.js, 20160919_354c5110dbea6115d4081e3ee9c245e0.js, 20160919_377018d49349221a7445d080adfc7beb.js, 20160919_38685c10b2bbc51ba631603c710e6a36.js, 20160919_38916b609c52a02f34b9949d846f251d.js, 20160919_39c10fec1dd4a6692f3b861816b389e2.js, 20160919_3c1e15ff569e0f454af18e85c332d09f.js, 20160919_3c2496f737e0c1d87d28cc0f7c0e715c.js, 20160919_3d2ce8266361b74a3e06452eccd26dfc.js, 20160919_42299e58ac38a3888adcf0033f908396.js, 20160919_469bda7c7f6d39885f738072548e2311.js, 20160919_482407c413a0e0d3e5baf5000d8b5262.js, 20160919_49943b916cdb3c4892e89b08a9ea3e6b.js, 20160919_4bd8935299d4fbc78bc663808787fce9.js, 20160919_4bf6d651f09165df2beb428d80dfef66.js, 20160919_4e9dcdbbd62ddad5a57ed867f6311586.js, 20160919_4ec44166a779d11d625fb6b74241eb3d.js, 20160919_5189b8770347d089b2ab2f8102b94962.js, 20160919_523c4420767f82c583402b30ce4e1019.js, 20160919_556a10a0b5c9a9d6f671c23ada6764c4.js, 20160919_566cefc1681640b75279908833a6511e.js, 20160919_5acce879ee989190e517248eb3fa4deb.js, 20160919_5b7acb4cc45d5e99de8c3335f4aeb12f.js, 20160919_5c2a63300fb916702a9f0209606fa3f8.js, 20160919_5d8714f8542a83a534bec9e95b309ea4.js, 20160919_5e025b67de33e107f993e6fb207bd8d5.js, 20160919_5fd6bd61b50f8e8b2832b2f3bfe2da7e.js, 20160919_60452bce5a2ee4a9943509d11300c71a.js, 20160919_619c73e569466e784463b5b3eb254126.js, 20160919_6398c6fb0aae7b9e3113654d212ed84a.js, 20160919_63a8422fbe2bfb350360c0e4317be777.js, 20160919_6498b3647030ecb689df56c2c64ae7af.js, 20160919_66f96a80bdcb6ef9d62d528360ce3a4f.js, 20160919_6a0fcad8985ee5db0a1185f2466002cf.js, 20160919_6a67474655801b6d6f944d9e3eb6178c.js, 20160919_6be58dfe57b176efc42a4d86d6a20a5b.js, 20160919_6dabe43ea333148490bab911d80d3af6.js, 20160919_6dfa5f19cd1137fa9c343905eb11114b.js, 20160919_6e2eac2fd14ca33d94c6e8a2c1ef35a6.js, 20160919_716c6b9750d932aa7369a2000209c7e9.js, 20160919_71a874322240d4abe212f53db055dbab.js, 20160919_728c2bc6518d351bc9981e3cab5f36bf.js, 20160919_7486ad74bbe3f4fe5133e5d21c275a23.js, 20160919_7950a1b86646ca3fcae2b5e16035002f.js, 20160919_7b51777913973e588cf0a11b77cee6b6.js, 20160919_7ca0c55355319a21c135f4e157e0d1bb.js, 20160919_7e642062e3d3bba11f8856d5ad75423b.js, 20160919_7f2c565e98519426fc3f7e6c7cd5b092.js, 20160919_7f5667a4be5d7206b68407662ceb05e4.js, 20160919_80e7c798a78a928237b990a5ef8ebaf8.js, 20160919_81952000356204b0d47713aa7a6e0e76.js, 20160919_848e24319f62de8f64a52558cf6b040f.js, 20160919_858259e2917181755a360cbe89b3b941.js, 20160919_8982b9f890edc0273904bc5a64078a01.js, 20160919_8d3641bccc59aaa1ed9af684abb23390.js, 20160919_9298d6a1033ce3ec374e65df6c5ff535.js, 20160919_97119b391a6052ea7aae75154300fe82.js, 20160919_980b98dec1d2ea68363d3472bb15c9ee.js, 20160919_991d8393f4f20c78877b676e934976b1.js, 20160919_998fa15051169c8ba448735be10c8d9b.js, 20160919_a14ee5a979b15021e01270cf04ec2705.js, 20160919_a1a8e0d5c4a54514befb5c2b5dab111f.js, 20160919_a425afa075a40978a5cda7d5e0b6c80d.js, 20160919_a6171576b7b248ea7a9e322e42900453.js, 20160919_a6ba9dad6f9e064187403fcb624bf00a.js, 20160919_a84ee7278036e3b768aa32fc49bcb2b6.js, 20160919_ad0f4d2e8c5027e48ece6d31afbe3182.js, 20160919_ad913256bbb956de75e87d078bac1d08.js, 20160919_ae77e681e557f13a3e86865edfaded3d.js, 20160919_aff69030c9b35f488a86a406bdc2ba4b.js, 20160919_b269c0309c836b32220abe027bbb2c52.js, 20160919_b27770392d29f72e3d68d293fb676eae.js, 20160919_b44dd80781824eadee9534b089047bfe.js, 20160919_b5deb5215698a59101cceaeec03e41ff.js, 20160919_b6a0007a9b9aee3a43a98de3e8ad82f2.js, 20160919_b711cbd501c2aa0dab52babddbf5c4f3.js, 20160919_b817dab9a5f910bc5912f0974f91c4a8.js, 20160919_b9824e5c24e8bb2c3cade34c010328cc.js, 20160919_bbb115888533418ea7e8d8e0716633bf.js, 20160919_bcf5ebc2d83bb4b812860df7561c9d44.js, 20160919_bcf808f55206b86708078a41d2c47481.js, 20160919_c0dd45c7b9141f9f5e48f22338c89ddc.js, 20160919_c2e6be601d2e2f8b5dbd9a1a4b3e750a.js, 20160919_c2fef090a48baae415e59c9c696d154d.js, 20160919_c370316b2850d42a3baeb8a4ba464cd2.js, 20160919_c4fd77af3f1647c58b27da2f12a13cdc.js, 20160919_c94fae9d89bb5f3544a1baa93fc744ae.js, 20160919_c95fb93132b513ff973a7edb130ac7d6.js, 20160919_c9f005a526488657d8a1f28ae0a654ae.js, 20160919_cb689b66884c8445453cb4e451fe8d47.js, 20160919_cedafcc1aab4395cb53604a5527b8a15.js, 20160919_d137f544997df192ae7e9c850d783da5.js, 20160919_d14d1613e81858ee5f320808af09cdad.js, 20160919_d188ad4ea09829066f9b49657a9e6b6d.js, 20160919_d444b5fe129dc829d2c648c6bf9d8df7.js, 20160919_d45fee7ff821541cf7d869236fcd78a1.js, 20160919_d46a12237e5f9cf10a6ff0c569e1bc41.js, 20160919_d47586a03e23d43a6ad7801e669ba656.js, 20160919_d51f1dfca8ec34d346bbcb0738391f50.js, 20160919_d5500a956e7a590442b31d0003c365df.js, 20160919_d5d448e56b6e79eeffd541c9f8eee60e.js, 20160919_d87adfd79433d47bdc8490bcc4a33984.js, 20160919_dbff687e5162f23cae49d9938a1904b0.js, 20160919_dca0aed255bce71e5c6ab10f7a10ecb3.js, 20160919_dd1d7751b914cf2533cab2bfa54f84df.js, 20160919_e18c93426cddcbed3368394eee59e8e8.js, 20160919_e3eed0365462adf65083aeceb9b356e7.js, 20160919_e50542f2b155d505c0de1abc29540772.js, 20160919_e5f1d64698286e2f3c76c1796425d6c1.js, 20160919_e6213e5808027a3701bd757ee6384f82.js, 20160919_eaa43a1500d8302d6b0560f5debf7638.js, 20160919_eaf8a2c5dc452b4b8621427efc1d2b4b.js, 20160919_ee8ad8fb6785fc4c6fd06f0e2dc6aff1.js, 20160919_f1726955f72d2b1ceb41a55a57105d86.js, 20160919_f1a0baf6f5744eb951bb07be8bda9265.js, 20160919_f46ac030c8a40d15c0f42089f1f01322.js, 20160919_f4c0ab00577c380cf44469ed33287bbe.js, 20160919_f7152b0fee5375177e23e59789c8ad36.js, 20160919_f8e5e798a854c5c8230708f1e13c76c3.js

rule _20160919_00e808d634efe942b67c4da9aa4ef89c_20160919_019ec14b689b_1095 {
  meta:
    description = "datamaliciousorder - from files 20160919_00e808d634efe942b67c4da9aa4ef89c.js, 20160919_019ec14b689b130163b891a8134e0124.js, 20160919_05a9d9bedf487d7dbb1717461af889d9.js, 20160919_06bd386d7301f9645126e5350f6063fb.js, 20160919_07a02dd5b7ea8651c2c1b48b07bc45ab.js, 20160919_07d3a67b263570769cb6322be556d479.js, 20160919_0aa1f74a4d0503c81f69a7ac4ec50e84.js, 20160919_0d2000956784681bc379a55cdb915504.js, 20160919_0e3e1b7181264b8eb911fe42fbc5c732.js, 20160919_0e5a17b152e647a4fbb5dbcb6b1c067a.js, 20160919_0f306f8f462e138b9e8b88ff29421755.js, 20160919_0f85167e3d3c55c3178a6fc7a9a998bd.js, 20160919_1092cd570c4a1074521a4e745837abcf.js, 20160919_118f96dbd435c6be4e6debc6d97193a2.js, 20160919_11a4b51e35ce1650d20ba30b7bc5ab0a.js, 20160919_13a4feae653472950730d2cb6169649a.js, 20160919_13f9728bee0bcd6e5f6eebc1208b6cd2.js, 20160919_163c16bac578e4ab54ea85ec04c14444.js, 20160919_1853680b9117d4b62894017eafb078df.js, 20160919_18a28fe419fb3e3a578e0839496ca899.js, 20160919_1e4ee20462f9d7ecab58978fad585387.js, 20160919_25b6f6d9e93fa10235adee51a130c08f.js, 20160919_25fa31f060fe717d323a87b3033a3d40.js, 20160919_26c0955b44afeed66c6529cc2c49a628.js, 20160919_27d18f62ad04a2e3d6d83fa4ea6959e9.js, 20160919_289b4c6988516e9c817d9a22f13a0674.js, 20160919_2a9dc5ac34b6ade02d363626316797bf.js, 20160919_2ea69cfbb600612bcc168fc700ce0345.js, 20160919_304d6622c1945ef70348e3c5a174d7c8.js, 20160919_354c5110dbea6115d4081e3ee9c245e0.js, 20160919_377018d49349221a7445d080adfc7beb.js, 20160919_38685c10b2bbc51ba631603c710e6a36.js, 20160919_38916b609c52a02f34b9949d846f251d.js, 20160919_39c10fec1dd4a6692f3b861816b389e2.js, 20160919_3c1e15ff569e0f454af18e85c332d09f.js, 20160919_3c2496f737e0c1d87d28cc0f7c0e715c.js, 20160919_3d2ce8266361b74a3e06452eccd26dfc.js, 20160919_42299e58ac38a3888adcf0033f908396.js, 20160919_469bda7c7f6d39885f738072548e2311.js, 20160919_482407c413a0e0d3e5baf5000d8b5262.js, 20160919_49943b916cdb3c4892e89b08a9ea3e6b.js, 20160919_4bd8935299d4fbc78bc663808787fce9.js, 20160919_4bf6d651f09165df2beb428d80dfef66.js, 20160919_4e9dcdbbd62ddad5a57ed867f6311586.js, 20160919_4ec44166a779d11d625fb6b74241eb3d.js, 20160919_5189b8770347d089b2ab2f8102b94962.js, 20160919_523c4420767f82c583402b30ce4e1019.js, 20160919_556a10a0b5c9a9d6f671c23ada6764c4.js, 20160919_566cefc1681640b75279908833a6511e.js, 20160919_5acce879ee989190e517248eb3fa4deb.js, 20160919_5b7acb4cc45d5e99de8c3335f4aeb12f.js, 20160919_5c2a63300fb916702a9f0209606fa3f8.js, 20160919_5d8714f8542a83a534bec9e95b309ea4.js, 20160919_5e025b67de33e107f993e6fb207bd8d5.js, 20160919_5fd6bd61b50f8e8b2832b2f3bfe2da7e.js, 20160919_60452bce5a2ee4a9943509d11300c71a.js, 20160919_619c73e569466e784463b5b3eb254126.js, 20160919_6398c6fb0aae7b9e3113654d212ed84a.js, 20160919_63a8422fbe2bfb350360c0e4317be777.js, 20160919_6498b3647030ecb689df56c2c64ae7af.js, 20160919_66f96a80bdcb6ef9d62d528360ce3a4f.js, 20160919_6a0fcad8985ee5db0a1185f2466002cf.js, 20160919_6a67474655801b6d6f944d9e3eb6178c.js, 20160919_6be58dfe57b176efc42a4d86d6a20a5b.js, 20160919_6dabe43ea333148490bab911d80d3af6.js, 20160919_6dfa5f19cd1137fa9c343905eb11114b.js, 20160919_6e2eac2fd14ca33d94c6e8a2c1ef35a6.js, 20160919_716c6b9750d932aa7369a2000209c7e9.js, 20160919_71a874322240d4abe212f53db055dbab.js, 20160919_728c2bc6518d351bc9981e3cab5f36bf.js, 20160919_7486ad74bbe3f4fe5133e5d21c275a23.js, 20160919_7950a1b86646ca3fcae2b5e16035002f.js, 20160919_7b51777913973e588cf0a11b77cee6b6.js, 20160919_7ca0c55355319a21c135f4e157e0d1bb.js, 20160919_7e642062e3d3bba11f8856d5ad75423b.js, 20160919_7f2c565e98519426fc3f7e6c7cd5b092.js, 20160919_7f5667a4be5d7206b68407662ceb05e4.js, 20160919_80e7c798a78a928237b990a5ef8ebaf8.js, 20160919_81952000356204b0d47713aa7a6e0e76.js, 20160919_848e24319f62de8f64a52558cf6b040f.js, 20160919_858259e2917181755a360cbe89b3b941.js, 20160919_8982b9f890edc0273904bc5a64078a01.js, 20160919_8d3641bccc59aaa1ed9af684abb23390.js, 20160919_9298d6a1033ce3ec374e65df6c5ff535.js, 20160919_97119b391a6052ea7aae75154300fe82.js, 20160919_980b98dec1d2ea68363d3472bb15c9ee.js, 20160919_991d8393f4f20c78877b676e934976b1.js, 20160919_998fa15051169c8ba448735be10c8d9b.js, 20160919_a14ee5a979b15021e01270cf04ec2705.js, 20160919_a1a8e0d5c4a54514befb5c2b5dab111f.js, 20160919_a425afa075a40978a5cda7d5e0b6c80d.js, 20160919_a6171576b7b248ea7a9e322e42900453.js, 20160919_a6ba9dad6f9e064187403fcb624bf00a.js, 20160919_a84ee7278036e3b768aa32fc49bcb2b6.js, 20160919_ad0f4d2e8c5027e48ece6d31afbe3182.js, 20160919_ad913256bbb956de75e87d078bac1d08.js, 20160919_ae77e681e557f13a3e86865edfaded3d.js, 20160919_aff69030c9b35f488a86a406bdc2ba4b.js, 20160919_b269c0309c836b32220abe027bbb2c52.js, 20160919_b27770392d29f72e3d68d293fb676eae.js, 20160919_b44dd80781824eadee9534b089047bfe.js, 20160919_b5deb5215698a59101cceaeec03e41ff.js, 20160919_b6a0007a9b9aee3a43a98de3e8ad82f2.js, 20160919_b711cbd501c2aa0dab52babddbf5c4f3.js, 20160919_b817dab9a5f910bc5912f0974f91c4a8.js, 20160919_b9824e5c24e8bb2c3cade34c010328cc.js, 20160919_bbb115888533418ea7e8d8e0716633bf.js, 20160919_bcf5ebc2d83bb4b812860df7561c9d44.js, 20160919_bcf808f55206b86708078a41d2c47481.js, 20160919_c0dd45c7b9141f9f5e48f22338c89ddc.js, 20160919_c2e6be601d2e2f8b5dbd9a1a4b3e750a.js, 20160919_c2fef090a48baae415e59c9c696d154d.js, 20160919_c370316b2850d42a3baeb8a4ba464cd2.js, 20160919_c4fd77af3f1647c58b27da2f12a13cdc.js, 20160919_c94fae9d89bb5f3544a1baa93fc744ae.js, 20160919_c95fb93132b513ff973a7edb130ac7d6.js, 20160919_c9f005a526488657d8a1f28ae0a654ae.js, 20160919_cb689b66884c8445453cb4e451fe8d47.js, 20160919_cedafcc1aab4395cb53604a5527b8a15.js, 20160919_d137f544997df192ae7e9c850d783da5.js, 20160919_d14d1613e81858ee5f320808af09cdad.js, 20160919_d188ad4ea09829066f9b49657a9e6b6d.js, 20160919_d444b5fe129dc829d2c648c6bf9d8df7.js, 20160919_d45fee7ff821541cf7d869236fcd78a1.js, 20160919_d46a12237e5f9cf10a6ff0c569e1bc41.js, 20160919_d47586a03e23d43a6ad7801e669ba656.js, 20160919_d51f1dfca8ec34d346bbcb0738391f50.js, 20160919_d5500a956e7a590442b31d0003c365df.js, 20160919_d5d448e56b6e79eeffd541c9f8eee60e.js, 20160919_d87adfd79433d47bdc8490bcc4a33984.js, 20160919_dbff687e5162f23cae49d9938a1904b0.js, 20160919_dca0aed255bce71e5c6ab10f7a10ecb3.js, 20160919_dd1d7751b914cf2533cab2bfa54f84df.js, 20160919_e18c93426cddcbed3368394eee59e8e8.js, 20160919_e3eed0365462adf65083aeceb9b356e7.js, 20160919_e50542f2b155d505c0de1abc29540772.js, 20160919_e5f1d64698286e2f3c76c1796425d6c1.js, 20160919_e6213e5808027a3701bd757ee6384f82.js, 20160919_eaa43a1500d8302d6b0560f5debf7638.js, 20160919_eaf8a2c5dc452b4b8621427efc1d2b4b.js, 20160919_ee8ad8fb6785fc4c6fd06f0e2dc6aff1.js, 20160919_f1726955f72d2b1ceb41a55a57105d86.js, 20160919_f1a0baf6f5744eb951bb07be8bda9265.js, 20160919_f46ac030c8a40d15c0f42089f1f01322.js, 20160919_f4c0ab00577c380cf44469ed33287bbe.js, 20160919_f7152b0fee5375177e23e59789c8ad36.js, 20160919_f8e5e798a854c5c8230708f1e13c76c3.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "f6891ece25838a5b6e24399cc5c3c4fb9c5c60e6abcff8f9992be64674aca0c8"
    hash2       = "54989be78984c3b4e8da73540b9247da47ca42e03806be3d880d43ba7145f19f"
    hash3       = "227945045117966c27bd423b0e9cfac526acabbcb04b0e65fdd31877908e2d80"
    hash4       = "bec087691f657cb1caf971dc84ccfa0268588973ef51eeb2cff59ec416af4d9d"
    hash5       = "8a77649f25d250fa74aafab8770128092de5ce201c0013a4a16e33e7f9105bf8"
    hash6       = "49bf77e3db54afd621653dcca39a4a0ee08673251e7fb09aab800d286160527c"
    hash7       = "f8f182641f2f63d19beb4064e19d5a4c24035bc46307ead4b416d3253110ca48"
    hash8       = "fb5126660de4e2b3eb97cb70c1142a18cf28be0c519af52de8526efa6ef9a6cc"
    hash9       = "2a97c5cc4d3a535f28775f0c80b394e8d044e2c515174f559428c11e2166a501"
    hash10      = "8badb32741ccd41c62bc165d651951e5d5b1f3bf6232f3249a7fdb7be68cfe6a"
    hash11      = "8d1ff43bc497a17d57e0b7e86dfa9be27c3cbdb5806f445b308f1adcbe19556c"
    hash12      = "7162cf0241d2138d7a02fc31f08f4632e10546ae773b46c71608f076ccf225a1"
    hash13      = "e491f12be988b6c3f75477ce350bffed529ee5eaf88516b7ef4864512c6291de"
    hash14      = "86d103d181e01f68f81995e4206bfa602c7b7f95f20fea8ffc3b19de6a11d23c"
    hash15      = "09c57b6130fd1dec8caca6aac33dd77d2eb567643c4eb1737135bf98e056d951"
    hash16      = "03380796e39bd1797427c62e86cf8be232f28583da3b20c422f36d289265c63f"
    hash17      = "d13be42cd715c0dcf44294c308677904014e3455c2abdd566d3e809e143e14fa"
    hash18      = "0ff6a1821e8cfd0cdf1084b5d23b7aa9b72771df13ca9b67bce2ee49dc943e6d"
    hash19      = "bf77ed05c05471d07c605d225f946ef74cf30ce20c0961d81868b6fe1dd8ce0f"
    hash20      = "997774577688d81e9f0941823abf84682069d83915a8d4c7aec82c14c8e37147"
    hash21      = "b76233fe92bc353960466022ee5a3576c227ee9e468028fbb3c441fd75db1615"
    hash22      = "2c43ee2a4baaeebed5771a5361b97a983d1f16b68218954daea9c6f0955b72fb"
    hash23      = "1a547e2c7170457d5e72b10fe975fd1b728ef077a4c2c11a566cddc6a00bdc20"
    hash24      = "96f2fda6be619c35452d5feca74b1c11b37af3acaa0a8c917a793e6cc6b4987c"
    hash25      = "30bb25bf0703b9517b12aa38315d87beac175d1463c2d725878233990c81dbb3"
    hash26      = "eb6ecbb7c40a706b7a141e7502eec2dc598176499319747af00becfda517a587"
    hash27      = "87928805882b037842af35bfce308764511a8273fcb2af786e35ec10714f04b5"
    hash28      = "3d74b6e09bf006c1ae0def5740cfe1690311ab3b80af00489ee777afab920730"
    hash29      = "2cc7c2c71467f2822d35c874119d36f32ffc9a682e79e848f280a8b8e0d3ef9b"
    hash30      = "b3f6555e25aaf0ff2f638c1044efe7ca8993dfbeeb48adab0cfe8a10e06561a1"
    hash31      = "066024783cf1912cd8c41d731beae2e597e9cc291cabcc925229d97e067f463a"
    hash32      = "6483d7d1bf55360596ae31a0e91e6289ff1398c82ea1caf6787abc15c6978ea5"
    hash33      = "f9e602be9529f73e7e3fa5f185f22c05951aa9bdadf0823dc4391b2b6773e845"
    hash34      = "3e61c261a3c20a48c5682e8756ada60ab95a32bd6f141be6195506f003691f8c"
    hash35      = "516ace12c81b5110dd0db0d7590adfef6282f6b6dc1d57de7a758b0e17ef55d5"
    hash36      = "d337a9a99693b41be782b93c19e8f4faee6bb91ca4f0dbe2fd15ee2ca6aa5884"
    hash37      = "9c5610c16d7591df886c30fe634f0eb10e17592b0d32e7e56be33636d9460296"
    hash38      = "b8f64fc5cc6a6ca35b6f4ee3af5f6db3699e9a0463ad1853fcb4dbae58f06706"
    hash39      = "cc30555f1c5c3400f0a1892da589550d052f13e38c3ea13933e53ece5f18e6b5"
    hash40      = "60d929c43b2317afcb52ad79558f87be55aebe612be645893fa146fac3ecaa67"
    hash41      = "a542e91a526e261ae230d504de9ecd0d014899aae339c5e17db7b3717dcd263d"
    hash42      = "a48a02ddeccacd1bcdc68949a4258a73d127868e80752361e90737151630cf2f"
    hash43      = "4fed1177f9a849bdff61c5485bb681906e0de6cb982c7c7f605c00cfaf56819c"
    hash44      = "a6bb19a2ad5db1f6749b083b60093846e8ae08612cd159892fc5eaebbbca95b1"
    hash45      = "db1cac53dcaadefb3625c8d16fd2eefbeb2602fa64bca232c2e6686fc7ff6471"
    hash46      = "00a41ead3497c4053351cd27b81d409022ced55e9b69889375158602c6359533"
    hash47      = "6d92a11387af73779f8d4e9c2148d5238fe77f325c97a463ee70daeb76dad733"
    hash48      = "b78a9a03bab13f25897e226a6fd337c627bc107e07096d7bd88e7064efaef096"
    hash49      = "5c66faceb846a6ac655c354b4b9ff38b667063eb78d5fd6c84e5d43b44aad9ee"
    hash50      = "411a77e68f1b1be5862e912b4ec8d4dcb3c98e12868fc0e76bfa0ff4856dd1f9"
    hash51      = "335738a0c1edca134cc92f6a84e18bec1a2a1e626920f1ba8f4f6cc7650aa641"
    hash52      = "b9de1b29bd4d69e19694d213b099fe9792f5867079c8f3f1f0854cc26962027a"
    hash53      = "66fe8af71234ab23568efe1a303f927cc63015fb05d57707debc388027e2313d"
    hash54      = "d3afd6ee615d3113b779678f920b84d9e7022972972369619c1daa863f3b64d6"
    hash55      = "c68dea4aef3641bc0ed2d1afb7668e7ecf3c0bd95293e110df18684f4a8af787"
    hash56      = "62be4d43b18d0401c566ea61f8efd6e4b638ba6057417463e5bd7d0c7ab4d0a0"
    hash57      = "0ef1a5774c858a15c7c6bc7e46e8470862010787284872e154172f5cdc1daf38"
    hash58      = "d57c0f1f8080683c5d8be7a382dbafede2cf9af541f4f03901a0b08f05defb7e"
    hash59      = "a52734b938dd24132585f4a8da7c1af84fd52bd1579b6260c41594a7a20547f6"
    hash60      = "2a25377fa77f73f6feb576b032361073b54c5d7be97881a6fba5f9cf503992c6"
    hash61      = "007dde7539f9da9f788125f90141b4a010011e835219d633b298d2c7377dad60"
    hash62      = "5716578b0813c05883cb8fa0ce249e83a9badbfafd9ed16c3695d1537acb7939"
    hash63      = "14556d2eb81525b679c058aa1e11fd40c7dd1ecdd178c121d5c308a9555eb946"
    hash64      = "460bd22a5e581d56a36d4b180307b93f1f94aa91d0361ddacdeed157cd5f338d"
    hash65      = "0281ef2c37e30c0a8c583eb04388a2d0e2c21a97602b2d534412e1ea96861b97"
    hash66      = "da4620d4e17bdc2e28f184861003c52222d1e81e8396911cbcf22af1c0d6b664"
    hash67      = "68365ce52e0d0a59601e682111502f508cb38f6e2bcfc08714366ae62cc49bd0"
    hash68      = "3887de3fc077beb8f2341fe1687403e25c138150fa1cfdf167ad502354b4cdd5"
    hash69      = "f7d1338ac570fbb89b04d4becb4625f698ffadc0a7e414d4ddd2268ecfac7752"
    hash70      = "ad85877606444bc57ab5dec1e7de48b9659cf68f530ae592eab5e948593718ae"
    hash71      = "5969d898755da83e4c98e61e34dd52468f0c7760e03256ced0c66fa1dde58429"
    hash72      = "5fa46bb8fd97ba439440a6ec0150d1137a7a93969c3adad7bd38219dfa6fcc6d"
    hash73      = "5f4a7a7205aa8afe0f46981f5c8d4ad52a957b77efec0293e44815e827d68467"
    hash74      = "f18bce6533670ab8dc329d0a9c4314210f2075dfce51a106905393085c26e1ad"
    hash75      = "d4b3ca536c709871d43ff67a732c5d4a17a9ff153c2092628f7878d2a1e5fa14"
    hash76      = "7cc5d9426d4293d4e857b35b40be8c67e1de98a39aa48407489ef3821ecff0d8"
    hash77      = "46b5c887d29131060148f5c089a02348ab9b1dd878b7837b53b8d12eb8c1b9fa"
    hash78      = "e46c5d37664802071f2688f8ea07c42e59b61e6cf58608acba308f85d42f29ef"
    hash79      = "3314f8fd1a77451d20ab4d8858fee0cad342502f2b4aa8ed488333409f89c898"
    hash80      = "36c7e130bf608481b0e56b051cc5212acf4efed11a11e83e764d04d54395095f"
    hash81      = "bf4f2fdc0231986b4e5cfc16e6f60e57d79a5c2e0f9bcc4b796d1bfaafcc2a65"
    hash82      = "b8bfb730f2016be978d1ac982c3c0cf3a4cdd978c78f3d990815d17130c6dc46"
    hash83      = "a06c3a5f8a8c8f0fb4d1d799928e7b4b6128ebaf32c4254a6ed548efadd5b9ba"
    hash84      = "b2188f37a66038e0950756bf5f480b8ae56fe4e6c87969636094330dd12fa311"
    hash85      = "bb0680158d79571589b609f9f31efba64c78193f6a08e82ebfcba29b530f855e"
    hash86      = "563d031a895c6199a918c76d5b69fb1f8ee8dd666707be85664971441c887c27"
    hash87      = "763f889adc44ff9c59292c0e8a09b8e4b6e4199b34a9c10aa55a5137e5a7bc0e"
    hash88      = "db43e5144c1e80f829f0ce3c76b08b664aabe21a31be23f2554addafc3a9bd67"
    hash89      = "c7ba8379df4982fc6dbeb3ef3f08a909a93a64299603ba614a2391abff4e1f43"
    hash90      = "2c2a3ea3249a8abc1c8334300cf1f4f58456b674bd3361f899e1e46e9078aded"
    hash91      = "93340f9eba8ea4b19bc8ad0179dfc7ca5f5ea065564108de081c58725518b54b"
    hash92      = "d2b61cb14bee83912ca3c033fe7793e4717bc58ebfd29d088a49fcd236d18ce6"
    hash93      = "2c6b14553afdfd5c5c454279c089d2500afccf93bf89cf6d1dbe13383aea8142"
    hash94      = "b66dbc6b314b41eb33b021072d3388ae06c81aec5e3afca232be532f1559fd36"
    hash95      = "e9079c30ec2015b83438b0619dee16af07641b0c8bf79c2e1b274431f2680505"
    hash96      = "b4e67e506ee42bcdbb3ed3133e6eb8e8b44a1d762483e2fa9f5785f8e807d086"
    hash97      = "b9c7760844b524b8d2e077211e60e9bccc6b5b0bb5160a4cdba98fd0399a9f6e"
    hash98      = "7dc940d173619103e873e7e329766d6c31f2aef5f511c82be5fb0f02a71081e9"
    hash99      = "d5d81c97cdb7ea6e64452fb051e9974622fd4616c53da34ad23558c7c5980c33"
    hash100     = "c14d05c3d828b037f478c06f87040af944efb635fdb0ada501c125b5f09703c5"
    hash101     = "994b1483e57e91805a509cf6955a6a7f1596a06972ff098453482556fe74e1cd"
    hash102     = "5ec55dfbc458e0f213e0599e104b6245becb96f1a7d87cd91656245cb5ecc3a5"
    hash103     = "44018c9e87b259653853d37df150d4cc7c2acb0a5d57a2b1ede763b10cff88ae"
    hash104     = "46a139e6bca072d9ca195d32090de64cfd43dcf18c54f7e2b3303ab0a89bb459"
    hash105     = "98fc12602e1b6803b0a89e0b7132c6c51075fa04d43fbe73ec18ffb7fc4d6ffd"
    hash106     = "11c583d1ccfa26fa02ed1a0564e32bd9d3ec8e37e5e9c03c8aac22e68adff414"
    hash107     = "c4c070c0cf0f7f41f13718c76c84eb2ac75143c6ff1b6cf39d3660b457ca840e"
    hash108     = "3d2e8c21ab205981a70c0f549d5c43c0144a24585ea31ea24434302bfb72a90b"
    hash109     = "a7b0ab46f02ca527ab6391ec9aab1d0d668053d61d222aa63cfd6f088c63e6e2"
    hash110     = "307ebc0d2cac8877f248f66129531ce9eb879d041475868d8fb37f6cf36c4334"
    hash111     = "a54a3ce7e2e83753de7e6bb44da998e19126637b0ff67507d349ad346fb8f1a4"
    hash112     = "210b17e59dcc257d31f025a79d4c948d01887e22255c7f4dbc15f6408c0611ae"
    hash113     = "711acc89778d5696b9f74a604ee8160c7befe4637a5c46a22fb972f4bdb398b5"
    hash114     = "7336f321006f203e96256e5e3b24fd2a78f6f3f668fafc33a1c316b7d9a48606"
    hash115     = "c2291662335d55e5d99d827bafface58a4dbdd08a96bb377091578cdd4aa5fb0"
    hash116     = "fdc3318fe7fe81c5ff6df8ab36c43848a4850588fc04c9ef05a999db03c5c29d"
    hash117     = "1be6bfb8271952825705b7caece38a53cbf016c4105b12fbef498daf4dae8984"
    hash118     = "84b30053811fbd8594f5249c4909d05164aff43b959064e96fa99b36256ecb10"
    hash119     = "165af5d8a6b0c7fa32824e6ad7019cebefc5a6674c32357edd1d797b43ec7ec3"
    hash120     = "11674574f8fc26897b00c12dbfb0a7238f900209a87b64f4b6cadb4f1ac79390"
    hash121     = "206f42b8c093bd83590d1c852de2cc317930348f9ca6625011f5250e3cd86e03"
    hash122     = "77c139cfcd7e3b255009c87e124e2d1f162a035a363b1202239131ecbc3e501b"
    hash123     = "7806b758ac8ebdb26c8cc1e36807ff05fb37f3386afc97e6154c124593f66616"
    hash124     = "6c437be15380269400dea6f9d21d5a164a9a92b96aee6f462edb37237e404c24"
    hash125     = "bcdfef2f3113c36a5bf92f0da95adfc0648b73ed0c0e69b22ccdeb4f33f354c6"
    hash126     = "4a1e6595ca6249ae8a61aad31749b60d32e0d2dd8bb33f7bdee6896de8c9aa8e"
    hash127     = "2bd2584f99d265d115e279b3365ec84c85195fba81d86c332df983881a4bd71d"
    hash128     = "722cfe2fc3b037b6b25565dae1fc3ef18063701ef4a3a9c5fc4ee52c30e17079"
    hash129     = "1a9d62aa58fbad0a6e4de7a9910e46921d171440c2aa13e29d5f86f7ea022455"
    hash130     = "acb43cdcc1b52fb79eb2abcf0f969b00ddd759a95451d331e9b3ad6886073bb6"
    hash131     = "6a2659dc6a02c9ffb6dde804f8fb92e08734d5d760db67b05ee3a6e726ae19a3"
    hash132     = "90a7ed9d565cf1c5e7d944b8ca59e5f46985641b51e32377a012649251547389"
    hash133     = "a10fd9ace2a68c373000a55bcedf40dcb5b86b49476bbdf24765fbdf80e29bbd"
    hash134     = "149930db24977a5474e79f5174f89ffb319b927e26d1f550f90f0e3d9a63ae3f"
    hash135     = "6d764d29d11f6eeded31c717e5aec41a295865606ee8076f7f55c4f4a56328b9"
    hash136     = "0129aa2aa2ca782bbfbe0a768831604b743ab3fb536144fc5985232bbe51e51d"
    hash137     = "a94649508a134dec341215f1beab56237a9f2217099cdc486872c0e9d0daf699"
    hash138     = "c54ee4cb13e00eea42aaee97cd3b1b2018580c98c5f5759e8e77832a43575669"
    hash139     = "8ffd235d17b0a285cb9b3915018157c6e4c2d5ebd051e522be2f11bb04524c6d"
    hash140     = "693a524103453508352b403d6485bdf69db955c04185f877b8c51c8505124642"
    hash141     = "93dd95845835308d77268198ca4e0bcb791426cbb130c6912ee7ad7e92668ca2"
    hash142     = "3548d4cc4457c0b70f8dbc6bc919481185701df1aaf94c3bc8e23fc28bc3e4d7"
    hash143     = "396c7f37a3a902aaeb92529d591c81d62b7dbc7498b978a9823569bf1a46cff3"
    hash144     = "88c0c37f1d30722352de039881bd2b7dcdbf06cb171dc5856aaeb32ad1102103"
    hash145     = "d287bf71532d97fa47d99d9418ce18bd9c74e8463752d882cfb6d383a59023c3"
    hash146     = "86e3c86517ad958e31e780c899d79210b662764a3073686d9e6dc0ca18ebb256"
    hash147     = "2560ab895009e3f3402d277208e305e957bbb656a6fe9790484823a2b540a0c1"

  strings:
    $s1  = "\\x2a\";})()]], \"JYs\": [3, [4, (function avast(){return \"5\";})()]], \"Hc\": [3, [4, (function avast(){return \"3\";})()]], " ascii
    $s2  = "], \"Dq\": [3, [4, (function avast(){return \"\\x28\";})()]], \"Yi\": [3, [4, (function avast(){return \"\\x29\";})()]], \"Ay\":" ascii
    $s3  = "]], \"Ru\": [3, [4, (function avast(){return \"\\x47\";})()]], \"JWk\": [3, [4, (function avast(){return \"\\x40\";})()]], \"ITe" ascii
    $s4  = ": [3, [4, (function avast(){return \"\\x4b\";})()]], \"WTd\": [3, [4, (function avast(){return \"\\x4c\";})()]], \"Yn\": [3, [4," ascii
    $s5  = "return \"\\x22\";})()]], \"MLp\": [3, [4, (function avast(){return \"\\x20\";})()]], \"Mf\": [3, [4, (function avast(){return \"" ascii
    $s6  = "return \"\\x44\";})()]], \"XZg\": [3, [4, (function avast(){return \"\\x45\";})()]], \"GBs\": [3, [4, (function avast(){return " ascii
    $s7  = "nction avast(){return \"\\x4d\";})()]], \"NAx\": [3, [4, (function avast(){return \"\\x4e\";})()]], \"Lz\": [3, [4, (function av" ascii
    $s8  = "[4, (function avast(){return \"7\";})()]], \"MAe\": [3, [4, (function avast(){return \"\\x25\";})()]], \"Ym\": [3, [4, (function" ascii
    $s9  = "rn \"\\x4f\";})()]], \"Lp\": [3, [4, (function avast(){return \"2\";})()]], \"RAp\": [3, [4, (function avast(){return \"\\x4a\";" ascii
    $s10 = "n \"\\x7c\";})()]], \"JTa\": [3, [4, (function avast(){return \"\\x7b\";})()]], \"Kh\": [3, [4, (function avast(){return \"\\x2f" ascii
    $s11 = "(function avast(){return \"\\x41\";})()]], \"Eb\": [3, [4, (function avast(){return \"\\x42\";})()]], \"CRm\": [3, [4, (function" ascii
    $s12 = "ion avast(){return \"\\x2b\";})()]], \"Hf\": [3, [4, (function avast(){return \"\\x2c\";})()]], \"Sn\": [3, [4, (function avast(" ascii
    $s13 = "nction avast(){return \"\\x7d\";})()]], \"Oq\": [3, [4, (function avast(){return \"\\x7a\";})()]], \"Vx\": [3, [4, (function ava" ascii
    $s14 = "t\": [3, [4, (function avast(){return \"\\x2d\";})()]], \"BYr\": [3, [4, (function avast(){return \"\\x2e\";})()]], \"GGc\": [3," ascii
    $s15 = "3b\";})()]], \"Pc\": [3, [4, (function avast(){return \"\\x3e\";})()]], \"Uj\": [3, [4, (function avast(){return \"\\x3d\";})()]" ascii
    $s16 = "3, [4, (function avast(){return \"6\";})()]], \"SIk\": [3, [4, (function avast(){return \"8\";})()]], \"Xh\": [3, [4, (function " ascii
    $s17 = " avast(){return \"\\x3a\";})()]], \"Ph\": [3, [4, (function avast(){return \"\\x3c\";})()]], \"JKw\": [3, [4, (function avast(){" ascii

  condition:
    (uint16(0) == 0x0a0a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

04060430-abc7-4704-b6a7-005c1da544f7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion