_20160921_0344ac0ed807ef595e2aeca98d44f575_20160921_052f92106046_1097

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160921_0344ac0ed807ef595e2aeca98d44f575.js, 20160921_052f92106046138b3c82e05878edd3a8.js, 20160921_0d4a04b6f4795f89c068cce75e132259.js, 20160921_0e1bfa63bcb2804e89834c330285643e.js, 20160921_105b4651b7160ca47c8bc86d4da31c43.js, 20160921_17bf61ad904bb1d3a22ca03d861f889f.js, 20160921_2bac0af1f20f4cf23b85236dea7e2f73.js, 20160921_2c5e8ccbd48636e7c625aae6ef954560.js, 20160921_3214ea252f2a25e018a03ee43ce952f5.js, 20160921_446be595a498644ab9c808b0a1d55fda.js, 20160921_4d30edc3a4e3226feee5b6289df9e399.js, 20160921_5745920040b3b3273f05bcfbefadb4d8.js, 20160921_5e78b76ea160d891abcb41db9983d51f.js, 20160921_7463e4586b309c15d7048a37c63c1226.js, 20160921_759ae57c0ca15acf993d43f7b7e2485d.js, 20160921_78345276f684d53628bbcac810994182.js, 20160921_814859e3f9dab39a18edf940d1dd5650.js, 20160921_87ced6523e47b3b752b2353107bc989a.js, 20160921_884f773b3c246c835029fc91499fb017.js, 20160921_945a46518061bd8e157aed251e0ffa9e.js, 20160921_95c689d7ff4700a03d604b71aaf3634b.js, 20160921_ad1fccc6910bd9c4a47aa9bd3e9239da.js, 20160921_b5efb4ba3e712545d64a2d00b3dcd76e.js, 20160921_d29f34806a7d94f2bbb7a733fc4c43bc.js, 20160921_d4e094c14df45f61de0e1163f51e03e6.js, 20160921_dc67677da64e0c03fb55538663264839.js, 20160921_e26fc4dc1ccef911251bba0675c76ce0.js, 20160921_e39622eeb1da8fbbf03ca86989251a47.js, 20160921_eda7773555acd8e0be7f4e8bf6d0b010.js

rule _20160921_0344ac0ed807ef595e2aeca98d44f575_20160921_052f92106046_1097 {
  meta:
    description = "datamaliciousorder - from files 20160921_0344ac0ed807ef595e2aeca98d44f575.js, 20160921_052f92106046138b3c82e05878edd3a8.js, 20160921_0d4a04b6f4795f89c068cce75e132259.js, 20160921_0e1bfa63bcb2804e89834c330285643e.js, 20160921_105b4651b7160ca47c8bc86d4da31c43.js, 20160921_17bf61ad904bb1d3a22ca03d861f889f.js, 20160921_2bac0af1f20f4cf23b85236dea7e2f73.js, 20160921_2c5e8ccbd48636e7c625aae6ef954560.js, 20160921_3214ea252f2a25e018a03ee43ce952f5.js, 20160921_446be595a498644ab9c808b0a1d55fda.js, 20160921_4d30edc3a4e3226feee5b6289df9e399.js, 20160921_5745920040b3b3273f05bcfbefadb4d8.js, 20160921_5e78b76ea160d891abcb41db9983d51f.js, 20160921_7463e4586b309c15d7048a37c63c1226.js, 20160921_759ae57c0ca15acf993d43f7b7e2485d.js, 20160921_78345276f684d53628bbcac810994182.js, 20160921_814859e3f9dab39a18edf940d1dd5650.js, 20160921_87ced6523e47b3b752b2353107bc989a.js, 20160921_884f773b3c246c835029fc91499fb017.js, 20160921_945a46518061bd8e157aed251e0ffa9e.js, 20160921_95c689d7ff4700a03d604b71aaf3634b.js, 20160921_ad1fccc6910bd9c4a47aa9bd3e9239da.js, 20160921_b5efb4ba3e712545d64a2d00b3dcd76e.js, 20160921_d29f34806a7d94f2bbb7a733fc4c43bc.js, 20160921_d4e094c14df45f61de0e1163f51e03e6.js, 20160921_dc67677da64e0c03fb55538663264839.js, 20160921_e26fc4dc1ccef911251bba0675c76ce0.js, 20160921_e39622eeb1da8fbbf03ca86989251a47.js, 20160921_eda7773555acd8e0be7f4e8bf6d0b010.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "f631e328f07a7c3d34221081061f64d96da25c4f05169c427adb507bb6941f58"
    hash2       = "4812ea00b657b288e9ad51c72fcf466179e82a552fa3278fa9a896cc053c9fdc"
    hash3       = "e80f63f8ef5a9b52f119cc58d120fd7d74784d15d23ddc339948cb92383c800c"
    hash4       = "d58b57cb825244d35e22402fcf08c9ababcc51eb72a7913c47dbb2143171df32"
    hash5       = "8e64d089e7076541ade19a5701fb8571545dde4a6c002b31df5fef02095005f7"
    hash6       = "3ad9770f05718e622431ef5405e0a702ec2484ecc5b434b1a634c99b480bc855"
    hash7       = "ac846ac68af7b06cbf71b32cbfb1cee6c1f6cd131d52124bb877e0b27979fd81"
    hash8       = "70244ca5fa124af09b1f94729567c09dbc52c05035ee7d20cbe87d35e1fe63c8"
    hash9       = "e406c80b4ad80ad1898c09cec0694086bfb24caedb8bc3bb213513d0b4232bd3"
    hash10      = "735df5a75dd8a8fa643384cdee60651aafaebc84d57deefb035eb570ba25a521"
    hash11      = "d28b5e72375443a9ef1a43fee185a0e5563672a0764eef4f58a90a27302162ea"
    hash12      = "86b6dab46ebbd6ed243e73b97070b8a7b74178533a419d7a22c3842a74574534"
    hash13      = "789149d5f226f5eb3642909acb465b5f94d946ee53a79d693b40f83359c4471f"
    hash14      = "96a40a72711934aeffde8b64056102f9e3de80fa22eecc0a25cf9c045d3ab190"
    hash15      = "d9d1c0189a6de533e712d41961659591f07faec880d17e164eed8e8084710d25"
    hash16      = "17b203684b4f2284de883c81e8fef63ea03c36bd0599ccb85d3175be35d9ac6d"
    hash17      = "c61c4f66b5cb5b5fa606db7d7b914cbb3fe4d8f1b8ae72ca6b16b707c575cfb0"
    hash18      = "46c521beb23d37cfa4d60cfcab38c941734971fe3102123b7e4c2813544d39b6"
    hash19      = "4523d83a689974fc97f79b6c7c440d4b9f2a13825d1b664954798d786c1e2609"
    hash20      = "cc3d236edb3b45a767b438fa21243a07176d6f5def724e03e45aca76b3127054"
    hash21      = "5783f1dc6f93c438a9ac56abe49d6a41942b0b140e5fe608a7748f646ea646e7"
    hash22      = "a49fc1cb85eaa58b7c63197e9fd25224f63dcb6c86b906933f698898634ead3e"
    hash23      = "ff8ef85b589636068d365f9ee4a0b9c7119baeb269d0a34c9810fca4b3faf1cf"
    hash24      = "70ffc02d6ba6dee7d11e2b608cd1544f99d837ffc746455c17b70d5b07ba0ac9"
    hash25      = "2877b2ace685858babd88dd0ef1659f49f21c3f8b907e5b3889ec46bf3a7104a"
    hash26      = "0421d641ee833363b2481952ecbaff1400ca62443adb847ffe03bed95e4077f8"
    hash27      = "f1074dcd9f3ae62af13634c9f88af0a235b2e315a2697fc222ce96bad51ca1a1"
    hash28      = "e0b1660f1c95284f1a0f8062a1f16e26aa3d58e3fa4cf47fc04824d02b754a56"
    hash29      = "af4e0a7c109ffa140c9db57a44bcd9c5d9b5a7c75daded0b422d2cec24c01c8b"

  strings:
    $s1  = "(),(function fuck(){return \"YQt\";})(),(function fuck(){return \"PDf\";})(),(function fuck(){return \"IPu\";})(),(function fuck" ascii
    $s2  = "nction fuck(){return \"Ik\";})(),(function fuck(){return \"Za\";})(),(function fuck(){return \"Ar\";})(),(function fuck(){return" ascii
    $s3  = "Za\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"Wo\";})(),(function fuck(){return \"Ve\";})(),(function" ascii
    $s4  = "(),(function fuck(){return \"IOs\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"UXf\";})(),(function fuck(" ascii
    $s5  = "(){return \"IPu\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"GJx\";})(),(function fuck(){return \"QTc\";" ascii
    $s6  = ",(function fuck(){return \"IPu\";})(),(function fuck(){return \"Ug\";})(),(function fuck(){return \"KVh\";})(),(function fuck(){" ascii
    $s7  = "eturn \"Fv\";})(),(function fuck(){return \"Za\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"Xw\";})(),(f" ascii
    $s8  = "function fuck(){return \"IPu\";})(),(function fuck(){return \"Vf\";})(),(function fuck(){return \"Nm\";})(),(function fuck(){ret" ascii
    $s9  = "return \"XCr\";})(),(function fuck(){return \"Jg\";})(),(function fuck(){return \"Vb\";})(),(function fuck(){return \"IPu\";})()" ascii
    $s10 = "ck(){return \"Xw\";})(),(function fuck(){return \"Fv\";})(),(function fuck(){return \"Jg\";})(),(function fuck(){return \"IOs\";" ascii
    $s11 = "w\";})(),(function fuck(){return \"We\";})(),(function fuck(){return \"Ai\";})(),(function fuck(){return \"Pc\";})(),(function f" ascii
    $s12 = "ction fuck(){return \"Fv\";})(),(function fuck(){return \"Vb\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return" ascii
    $s13 = "(){return \"IPu\";})(),(function fuck(){return \"ZLd\";})(),(function fuck(){return \"XHj\";})(),(function fuck(){return \"Ot\";" ascii
    $s14 = "n \"Fv\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return \"IPu\";})(),(func" ascii
    $s15 = ")(),(function fuck(){return \"Ot\";})(),(function fuck(){return \"Za\";})(),(function fuck(){return \"Dc\";})(),(function fuck()" ascii

  condition:
    (uint16(0) == 0x2f0a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

df294087-b94f-4a91-beaf-33ce31a5f5e7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion