_20160628_014799ed018be6826f6905950aa3ec2e_20160628_01c139228e98_1177

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160628_014799ed018be6826f6905950aa3ec2e.js, 20160628_01c139228e982cdfe5729fdd7b4c1c21.js, 20160628_0366214b9c364131d863d6970362167f.js, 20160628_0afdd9555132c80977ef269761c3d2ef.js, 20160628_12e477af64b42f443a20609e14a0ce40.js, 20160628_182ee54f59717ebc095d89697eebbe3d.js, 20160628_1c56650da40201cbd606c88e1fb9b4e1.js, 20160628_1dc9a1eca19d26283909833c481718c2.js, 20160628_212c31e51cb5fe48b9f9c9929fdd74d2.js, 20160628_21e9d0a6793193bfeb2a13df59940b5f.js, 20160628_2a8dcd1cf3470a0f676cb02518605930.js, 20160628_2d01a8847f58a5ed2a7755b96456ef7d.js, 20160628_2ef4c05aa38f572d755ce12292e3f49c.js, 20160628_2f83333b26df1b3aad157d54700edf9f.js, 20160628_3750bcff79ca2ad518b6976cd6264acf.js, 20160628_430eb1e7ea588ba2bb15e051f461b9c2.js, 20160628_5d764057d193bed6c982135b4e4aafca.js, 20160628_62e8f30a3842f9630bc616774aabe35f.js, 20160628_630e0682cb699f0dae64a17ac510c287.js, 20160628_6663e057126110fa0486b1503a8c09bc.js, 20160628_6b2782da3469e109a21678c14e927a67.js, 20160628_6b857c8c6e7f3df9401e0c30f4081632.js, 20160628_6baa4998952d3cfd61565353fdb7963d.js, 20160628_6e56d7a0c05dc947a3d11c8ade11caea.js, 20160628_6fc5c9ececc1653eb6cb13a36b0cef9f.js, 20160628_6fe329e9875fa3e70dfe006b46e53df2.js, 20160628_7004fe74df7c1a3da753f77f5f4a8011.js, 20160628_797b033b279171587de4304a134bacfe.js, 20160628_810b739e26b897c6719b267f1db07e06.js, 20160628_846783b830930330a23b5cb451fe2eab.js, 20160628_857317f8c85e4d5b9498dae21eecf671.js, 20160628_87358c3e17a38e95e7a5a71732eb6360.js, 20160628_9065848cb38816cc27735fbbb8765ac9.js, 20160628_96bb136c225cc29523f3050c62a75858.js, 20160628_97af1eeeafa0d601d067663b18e128dd.js, 20160628_97c44a680228e86852551274eb627741.js, 20160628_9961824487654da9eccb94e98780b7a9.js, 20160628_9f25ab90d10825417fa2c10e590eafa9.js, 20160628_a3eca9dad3aa308e79e3f439a2b648a7.js, 20160628_ad2f72a4a73b4097203866fe3cc0c2f7.js, 20160628_afb2391724252153c5cb78e4964735e3.js, 20160628_b250c8f725f516c82c65e4b80f1cd904.js, 20160628_b7a6773e7e1af506d3c47fe0233a34e7.js, 20160628_be7b8a97e1b31d8858205c6224928f89.js, 20160628_c511558d7e99327a57329490b6b496f9.js, 20160628_c88f9720df64bbc5d6ab5eac58611417.js, 20160628_d656d689bc9673aa31f7cfa719a9394a.js, 20160628_d76dff09bca17e8e4217bb562bd1d436.js, 20160628_dd212bb262ff4826c4cf504964edff88.js, 20160628_dece683093efc946ad8b7c76c8edf2f2.js, 20160628_e0e0f1250245fe4b2f3d7b7a060e1470.js, 20160628_e94b85e1ebc05c630d522016e3e67737.js, 20160628_f0590e8f34f8069248cdf41fce0a07a3.js, 20160628_f8b257d36ae460e7cbe5d7036fca6a58.js, 20160628_f9034c10dba8c5f2bec0d548f9864539.js, 20160628_fd5f1eeded8fa40deb8060eef46766c1.js, 20160629_08be64b8f170385b4755908d05333115.js, 20160629_08eecbb4d397cbd2b555da8619b519bb.js, 20160629_114869672119badc90af6b85c5e1733c.js, 20160629_15f1a6f8c1f4c7ad6dd7dfc8845bc04f.js, 20160629_19313a4593df0b37ba5df1984f373405.js, 20160629_1a7576c33449268b2364dea50babeb44.js, 20160629_1beaba2fb8fe72ce9cf330e1ca8184a8.js, 20160629_1d151ac6c8bf35ecd0f071e4e09a09f0.js, 20160629_1ea310e3eee7cc0d6de6692b90aba6d4.js, 20160629_2055d37e90e99bcc62f0344b0e66ed03.js, 20160629_2aa771a8b8ffdcde5a4b3d3f9187f8c2.js, 20160629_2b4a140940057b31564da7365825ff5e.js, 20160629_34fd9b5ba600074c44b6e27791e01be6.js, 20160629_3be4eed8d5cc074dc97a8630c922a931.js, 20160629_3ee9ff9e49b32f7f3d9275a54f497c1f.js, 20160629_401c29141bf6c0f2b495fa58c7ae9bd8.js, 20160629_40cafc544dfb07cd9b88dc2e9cc8826b.js, 20160629_4df886f56d006ee7b6873e326aed434c.js, 20160629_4f83d97ae52cc55a0d53fdd7218013af.js, 20160629_57d2b6b2e2d81e112d8cce1a6dcbd71a.js, 20160629_59394e922f83cd71e458fd28e84572db.js, 20160629_644d56e7aebdc47c2ac6602e4ab1d44f.js, 20160629_6c7dd04708f1f572c233601b3e171778.js, 20160629_7aca6b86b9935ac3d51d566a3b01d948.js, 20160629_7f89de2b175fa1baafb424e213410abd.js, 20160629_86cb4331d6a49da65d425a7ea3de61d0.js, 20160629_89fb90fc74e2de4a58e1c6e6f0100ba7.js, 20160629_8d81f8c19010a041d7f517ab41ce6828.js, 20160629_9734aaa64392a138a111f1835be33506.js, 20160629_988bd2bfa4c16cd50defdb84e0b0fb1d.js, 20160629_99dfac566f3fe756139f07d9b7ff235a.js, 20160629_9a254bf8c9cfbd7605a8b2512faf869f.js, 20160629_9a61e276ec4ad7ea3d33ee41a31bd215.js, 20160629_9eafc46c47ddbd4862d5142bbb25efa8.js, 20160629_9fb186435edc115d0acfe80d7010b747.js, 20160629_ac239c2b1e9caef446f162a9eaeb36d7.js, 20160629_b1b99f47d0eb9a240166c21b559c1c9f.js, 20160629_b9d59d606950ddd30b1d492c36e768c9.js, 20160629_c21589f471c0b54db67e81c6836ad13e.js, 20160629_c5865d80dd4424075dfddd3f8bc85210.js, 20160629_ccef88c16f5172a64941a2cf5d5ec933.js, 20160629_d72b454e6db53d68b1a6bc0ece46b494.js, 20160629_d83df84b425ce9442cb2020f2bdf6c4b.js, 20160629_d8e88084fba9d0f38ddbe81466fda746.js, 20160629_da99a5ef165a79550f42f7d02e28bcbd.js, 20160629_e0282b8a8f71c0045dca05afce2d5359.js, 20160629_e0b39151f8c93b6797f6402f956c3dfe.js, 20160629_e884ce0201c5d28bdd656b0985625b9b.js, 20160629_e97b0d5343576da803c2e752b0f5a08a.js, 20160629_ef6f6a96d1421f06ab06f69e78c781d3.js, 20160629_f08c636f1554974f6d4503515459d6b8.js

rule _20160628_014799ed018be6826f6905950aa3ec2e_20160628_01c139228e98_1177 {
  meta:
    description = "datamaliciousorder - from files 20160628_014799ed018be6826f6905950aa3ec2e.js, 20160628_01c139228e982cdfe5729fdd7b4c1c21.js, 20160628_0366214b9c364131d863d6970362167f.js, 20160628_0afdd9555132c80977ef269761c3d2ef.js, 20160628_12e477af64b42f443a20609e14a0ce40.js, 20160628_182ee54f59717ebc095d89697eebbe3d.js, 20160628_1c56650da40201cbd606c88e1fb9b4e1.js, 20160628_1dc9a1eca19d26283909833c481718c2.js, 20160628_212c31e51cb5fe48b9f9c9929fdd74d2.js, 20160628_21e9d0a6793193bfeb2a13df59940b5f.js, 20160628_2a8dcd1cf3470a0f676cb02518605930.js, 20160628_2d01a8847f58a5ed2a7755b96456ef7d.js, 20160628_2ef4c05aa38f572d755ce12292e3f49c.js, 20160628_2f83333b26df1b3aad157d54700edf9f.js, 20160628_3750bcff79ca2ad518b6976cd6264acf.js, 20160628_430eb1e7ea588ba2bb15e051f461b9c2.js, 20160628_5d764057d193bed6c982135b4e4aafca.js, 20160628_62e8f30a3842f9630bc616774aabe35f.js, 20160628_630e0682cb699f0dae64a17ac510c287.js, 20160628_6663e057126110fa0486b1503a8c09bc.js, 20160628_6b2782da3469e109a21678c14e927a67.js, 20160628_6b857c8c6e7f3df9401e0c30f4081632.js, 20160628_6baa4998952d3cfd61565353fdb7963d.js, 20160628_6e56d7a0c05dc947a3d11c8ade11caea.js, 20160628_6fc5c9ececc1653eb6cb13a36b0cef9f.js, 20160628_6fe329e9875fa3e70dfe006b46e53df2.js, 20160628_7004fe74df7c1a3da753f77f5f4a8011.js, 20160628_797b033b279171587de4304a134bacfe.js, 20160628_810b739e26b897c6719b267f1db07e06.js, 20160628_846783b830930330a23b5cb451fe2eab.js, 20160628_857317f8c85e4d5b9498dae21eecf671.js, 20160628_87358c3e17a38e95e7a5a71732eb6360.js, 20160628_9065848cb38816cc27735fbbb8765ac9.js, 20160628_96bb136c225cc29523f3050c62a75858.js, 20160628_97af1eeeafa0d601d067663b18e128dd.js, 20160628_97c44a680228e86852551274eb627741.js, 20160628_9961824487654da9eccb94e98780b7a9.js, 20160628_9f25ab90d10825417fa2c10e590eafa9.js, 20160628_a3eca9dad3aa308e79e3f439a2b648a7.js, 20160628_ad2f72a4a73b4097203866fe3cc0c2f7.js, 20160628_afb2391724252153c5cb78e4964735e3.js, 20160628_b250c8f725f516c82c65e4b80f1cd904.js, 20160628_b7a6773e7e1af506d3c47fe0233a34e7.js, 20160628_be7b8a97e1b31d8858205c6224928f89.js, 20160628_c511558d7e99327a57329490b6b496f9.js, 20160628_c88f9720df64bbc5d6ab5eac58611417.js, 20160628_d656d689bc9673aa31f7cfa719a9394a.js, 20160628_d76dff09bca17e8e4217bb562bd1d436.js, 20160628_dd212bb262ff4826c4cf504964edff88.js, 20160628_dece683093efc946ad8b7c76c8edf2f2.js, 20160628_e0e0f1250245fe4b2f3d7b7a060e1470.js, 20160628_e94b85e1ebc05c630d522016e3e67737.js, 20160628_f0590e8f34f8069248cdf41fce0a07a3.js, 20160628_f8b257d36ae460e7cbe5d7036fca6a58.js, 20160628_f9034c10dba8c5f2bec0d548f9864539.js, 20160628_fd5f1eeded8fa40deb8060eef46766c1.js, 20160629_08be64b8f170385b4755908d05333115.js, 20160629_08eecbb4d397cbd2b555da8619b519bb.js, 20160629_114869672119badc90af6b85c5e1733c.js, 20160629_15f1a6f8c1f4c7ad6dd7dfc8845bc04f.js, 20160629_19313a4593df0b37ba5df1984f373405.js, 20160629_1a7576c33449268b2364dea50babeb44.js, 20160629_1beaba2fb8fe72ce9cf330e1ca8184a8.js, 20160629_1d151ac6c8bf35ecd0f071e4e09a09f0.js, 20160629_1ea310e3eee7cc0d6de6692b90aba6d4.js, 20160629_2055d37e90e99bcc62f0344b0e66ed03.js, 20160629_2aa771a8b8ffdcde5a4b3d3f9187f8c2.js, 20160629_2b4a140940057b31564da7365825ff5e.js, 20160629_34fd9b5ba600074c44b6e27791e01be6.js, 20160629_3be4eed8d5cc074dc97a8630c922a931.js, 20160629_3ee9ff9e49b32f7f3d9275a54f497c1f.js, 20160629_401c29141bf6c0f2b495fa58c7ae9bd8.js, 20160629_40cafc544dfb07cd9b88dc2e9cc8826b.js, 20160629_4df886f56d006ee7b6873e326aed434c.js, 20160629_4f83d97ae52cc55a0d53fdd7218013af.js, 20160629_57d2b6b2e2d81e112d8cce1a6dcbd71a.js, 20160629_59394e922f83cd71e458fd28e84572db.js, 20160629_644d56e7aebdc47c2ac6602e4ab1d44f.js, 20160629_6c7dd04708f1f572c233601b3e171778.js, 20160629_7aca6b86b9935ac3d51d566a3b01d948.js, 20160629_7f89de2b175fa1baafb424e213410abd.js, 20160629_86cb4331d6a49da65d425a7ea3de61d0.js, 20160629_89fb90fc74e2de4a58e1c6e6f0100ba7.js, 20160629_8d81f8c19010a041d7f517ab41ce6828.js, 20160629_9734aaa64392a138a111f1835be33506.js, 20160629_988bd2bfa4c16cd50defdb84e0b0fb1d.js, 20160629_99dfac566f3fe756139f07d9b7ff235a.js, 20160629_9a254bf8c9cfbd7605a8b2512faf869f.js, 20160629_9a61e276ec4ad7ea3d33ee41a31bd215.js, 20160629_9eafc46c47ddbd4862d5142bbb25efa8.js, 20160629_9fb186435edc115d0acfe80d7010b747.js, 20160629_ac239c2b1e9caef446f162a9eaeb36d7.js, 20160629_b1b99f47d0eb9a240166c21b559c1c9f.js, 20160629_b9d59d606950ddd30b1d492c36e768c9.js, 20160629_c21589f471c0b54db67e81c6836ad13e.js, 20160629_c5865d80dd4424075dfddd3f8bc85210.js, 20160629_ccef88c16f5172a64941a2cf5d5ec933.js, 20160629_d72b454e6db53d68b1a6bc0ece46b494.js, 20160629_d83df84b425ce9442cb2020f2bdf6c4b.js, 20160629_d8e88084fba9d0f38ddbe81466fda746.js, 20160629_da99a5ef165a79550f42f7d02e28bcbd.js, 20160629_e0282b8a8f71c0045dca05afce2d5359.js, 20160629_e0b39151f8c93b6797f6402f956c3dfe.js, 20160629_e884ce0201c5d28bdd656b0985625b9b.js, 20160629_e97b0d5343576da803c2e752b0f5a08a.js, 20160629_ef6f6a96d1421f06ab06f69e78c781d3.js, 20160629_f08c636f1554974f6d4503515459d6b8.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "363c35d50ae8e5351703f888ec75aa10b69f8d5333f11678dba141366840c81d"
    hash2       = "a48ee8a9fdfc1a9e70366a5745ed5b947d22f1955a13bf152da61fdd9af37a3d"
    hash3       = "266d61ad18459b9650b12da116ffb238173496d1f3d192efb1db9b8babc384fb"
    hash4       = "2b343f4f8db3a621f0bf45cb3b7c9053dffc840a5866c8c8fefd0c59ae5d552d"
    hash5       = "b0482cf73454cc9b9ded717fc7f40a6024ef2bdbda5ddd25c29fcb5e893abd60"
    hash6       = "41213f41093d79c4293d240229e4ced57f056e711c2ddc29dbfe51b614d33cc1"
    hash7       = "cd808277e75b162854286d23132b2d830386abcdef44968997f43476f308aa49"
    hash8       = "49bbc82c25202f9886b8e9191461542aefa510e126b834bef0f49fd533631d87"
    hash9       = "b2cbb218198d3f1a95656aad8da522db9ab309ad29ccc7021c3a49249edc8375"
    hash10      = "bd36de30eb10be46977173be983e195fe6ccfa6ee114f9b606b6c7780449be69"
    hash11      = "99cd128ad7f26d43b4df7224fbb0aaa2cbb408007c28ad9388f4b7af58ec660e"
    hash12      = "764927007b51f3122e0dd9cb12d558e5adc0dba7e2fd1d5f432277ebe1391d1c"
    hash13      = "bc56154b8744ed76b165cad4f00227c9ebef4d51ff700c86b7dd49f62d35d7f4"
    hash14      = "d07b7d7a244283c675a732e3b115e5b2d6db2c44e505f98dddb6c0d11743bc02"
    hash15      = "64deec896478662726530c594a7bbba56f0b511dde867491465d94826b611d57"
    hash16      = "02de62ae0a4358d145047ab0486081da8bbc7fb3be1e7601f52a2fca1e4035bd"
    hash17      = "ed08c192e6882ade0df6bf63bf48b2b2cebc23e3a0108d137c81d5b3f896da1a"
    hash18      = "7180e264abd6c79f72588892ee0b3d07fee572edf224e4c1a754a0c23440f2ab"
    hash19      = "47611dc69573147241c89e108486a0e0a42935d4e35fd6f61621668316667088"
    hash20      = "ea1293e1d17437f15efeff6df8b4c3a2fb6143e164e91da999640153b3517df4"
    hash21      = "13191dd2968c61f1c1bb578a2ee95332509e8f81b58ae8a0dddb6265d01a11d4"
    hash22      = "a6ba908ecc427ba31eb1bf9966d724da8ae6332db2ee6c45f7167ec78992b201"
    hash23      = "2816950c66edc616fb57d244923293f5e253decc0179fff0aacf256080546085"
    hash24      = "c673030434c37d0e33b307d01b84c865f5051b7875404a673fc61d2d56f313ee"
    hash25      = "4f19bebea53dcc931f47ad67d0638295edb10d078e5e701e441195786c617a17"
    hash26      = "81971afba3a4f64ba3a503529acf427898b50159c2b4a3532167729fcfc8dcf9"
    hash27      = "943b07736cc7882981f9f3155a18108e1dd8b6c5a75960cb94255b0f7b571faf"
    hash28      = "edd8ad9bcdc357802aea7bce58dd3a94a525bef93bcb0701769bd6ff962bed1e"
    hash29      = "8d26d02e26639af2c18bd7b13e5142ae113792e1d39a2e144ea95ea640408b6a"
    hash30      = "28442f81db5a87df2fd8a5684abb0c3c5e6eb33400722554ac18837b9886dd87"
    hash31      = "f01aa2f2e11790fa03fc71dd39c3de566140e5eaedf692559ce1ba2c57111026"
    hash32      = "036bfb6dfec8e236a23755c61b5eaf83415ed7792c0e806ec8c47ac3d9f7bf3e"
    hash33      = "b5c1849e37f8d29ec187f3da9b094464e072ab7e4c69cfeb4adde23f4928a744"
    hash34      = "b0429b934c55ee42e0c4a923cfd7bec223a36adb1d1516f3a06106fb1446ddc4"
    hash35      = "fa778a68e321e23b3221571b2c6a5bf399a49c6a3fa3d70f62ec4ec8ec1982b1"
    hash36      = "ef3be5ad8dab0b78617e79f26b70f09ff3cfa4614fd14e01b7176f38b03852a2"
    hash37      = "7896c7e7fd1c3370076947e746714271ffe3611341d7f0fe74b66ff70e0eb60b"
    hash38      = "70b102194b169872a3660b0537146504677e94f0763af4ab981fff93f57282f0"
    hash39      = "31e2fcf7291a4cc76d64c87b06c2c148e9ec01406fffcc6405debdd6ff204013"
    hash40      = "a593b7b6280245bfdcaddf4e514d6c9792050138dadb4d21315fb36add367e9a"
    hash41      = "038e4eaadfc789830470ce8fdcbbb301849fb59189aaf41e7ab56293ccd261bf"
    hash42      = "7f5dfce98ed254c94f087ddf4124240381c97bc73ac97d449ace2150bbbfb0e5"
    hash43      = "148327f3d31c51e719d5a27d24e207b49eb434218c9ac405a5413187256b17c6"
    hash44      = "d2303f793f12f9eac1acf4984e0840ccf1bddc81bc1e0224e23106946519cd49"
    hash45      = "2dcc039f50c8f705a2d068d180b071db5af7caa611942426e9a9ae797794cc1a"
    hash46      = "89f1f374f6cd39a48a350603819d9bf3b7a34cf81adf022e3cccecd671d07ebe"
    hash47      = "a2401ee02b7c627ecace22b06bfa26b29e17ff04460ca1c9caf10dc1eb7e2fc8"
    hash48      = "ab62d36fc6aa9c088666ed71ab7654a60c018b7bb17b43f1717f0ccdcb66caf7"
    hash49      = "d8c892f70bb85256efacda229f7486b676031e1126f8d7584ab0370580085454"
    hash50      = "74bcae0a15736a662a90af9c6682a5b8f1aea867ccd0973acce126a22b1d8224"
    hash51      = "7e3d544882190b4e3448245895c477c12b45a1a2d8026dd5062fdb2b32f2a044"
    hash52      = "f135bb5ba487510f0bcbb084baaae8315f35ccccf1ab38993e50ba4b23223209"
    hash53      = "4c842f85956195c6ec74d9c2a12eb43d8bb2d929ee7a001ac004134255c5c3a0"
    hash54      = "511c85cb4b1af494d5ca81c16587c09347ed1a3f028626d50c74b932214a27b9"
    hash55      = "144658f5439593fa7ffa83727c9b57063dec77adfcfd9b28c95929270b8a83ec"
    hash56      = "7e5d155eb74fba593d2ca61be26f4200d5aa81744fece0cb6a02546ca8b8c2b0"
    hash57      = "761674a745e2a57b31e49cd3e3839c6ab9082a099efcc4c9a130e3d488096609"
    hash58      = "777e7ef4d1a069da2c098cf7ab5b78e0ad7feb180be1394c011697d497985797"
    hash59      = "91a338f23dab591d96eff6d604ee12896bc165077af2ebfd20287e7ea3fce5e9"
    hash60      = "fbd68b908e281f8612d6b259cbbe093d4ace83d570efd6854f6e4ae1872f265b"
    hash61      = "45f337882239b9ba2db80063ded313fe834d3a30a311823b58ac648a7e6d537f"
    hash62      = "2cc858e64cfd7b439b6483de31a24f28a7cf8241c864da2503324139763dd14c"
    hash63      = "53ecd5a45f8e23b7853932dba75fc850517fa386521024631abf7b0ef967d24e"
    hash64      = "2e7ed5ec961964c467a4be229aec166b7a02a72bf2127db66f601c54958a5062"
    hash65      = "b2a2df638de92952f6762733a39610af18a8cf23679358f650b5fba68272175f"
    hash66      = "fbec22d0d98b4fb2013d445c450814c9a6773e163fe5c97d0ae9d72b7f65289f"
    hash67      = "43f3a61f214f42fc952af5cfa4a6b48bcf536f611efee1fd9c8350c94e48ac49"
    hash68      = "3d8b8c908f39b1705913fa7b3fa6be7c352413786c5edd44278725a60b8c159f"
    hash69      = "49ef528c0ed9756f6ab5aebdd5b68ecee9a1078d3027134a7ef1ee08f3a22194"
    hash70      = "6d9a3b41ec30d9d88fde84865f6f54d250ab09fd59abff4c9a5357e7f67c03ed"
    hash71      = "babb91e6115809807aef38441e19426b583c6fdb7d7d47fac60f44981f8aebb4"
    hash72      = "1c0e65a2d7bfc061751ec54de4ab53861eba52bd2b24493365953d8146c65e5d"
    hash73      = "e4dc4df37861cbc799525300afa68c7a48db4e21a3f5fe8da226fff0c59a7801"
    hash74      = "12d29dbbe562d6ea4f0799d32d19f691def7968af8769856b06a6eef4661a5f3"
    hash75      = "0dbf1322b1b079cc309e087f4dfdf005af258b83b099d9e067d6af341a9ebd1a"
    hash76      = "41ad67dbdea760ede896461f3091be6c17ba6a97e515e7ddf97a956e12774b80"
    hash77      = "62472eefeca9095327fcac2acfc2d5f0796cb2b564c2887ebf1f0dd02568568e"
    hash78      = "fa83b19ffe560d7dafc5dbdffe6b2ea603bdc631dc4792bb7c2325600498acae"
    hash79      = "0b6ae1e2c03668f52958554343903b41f34ce24023c7c25d1c9ce5fdbe02b59f"
    hash80      = "031c68eeba0d780f31a8d62c8f7f62672de55f14059bc9ae4684e264120829a4"
    hash81      = "99193ee3cdb57759f3d7b1c054ec664662c1810cc741c8ed940e0bfcaf59f371"
    hash82      = "4fd1cc49384cb5645f8415af63983617c4d37aa9eed3a5ee776fc3e3f8a83117"
    hash83      = "2d823961c42a79494f7da903f754510325c1dc2c53a425344c49593ec347116b"
    hash84      = "79509416d104a131828fbf5b55693a7219c8ec02f2f1572087927ed8f470ed30"
    hash85      = "7f89575fc2798a291a01a182eeb7f855b3b40afa0a61093be355768678c6061c"
    hash86      = "80e73ada959635a4f5f28977b0b5ae5aa672c471070857a914352833030c445b"
    hash87      = "4dc4080575da91baf583934e6f3cf08f148eb3de5f1c61f6eecab2f965235b22"
    hash88      = "b420b6ef1111db3f7aec7924aff1386d78a8586ddffc56c373bd5ab67b525e74"
    hash89      = "baa5d0697c4b1e72d688bbf940b18a4b4f97bf14f1d364ce3b55da9b0f98ff3e"
    hash90      = "df158d2921adf0f7f876a2464c3af113e24749f2390349db3ae7e1f92a59093a"
    hash91      = "8bc59bbfe8a51effa1e199484fb3943945c8ef9c38a65ee9474cc75f79cb7681"
    hash92      = "6b128203a421fb07ebc1e8ca38d3d4b313cf2fb0c1851aa0b7d93cc6bf1b2943"
    hash93      = "f18cfba4bad58badec104ff9b1b31037bd9b77e3bb2db7013ce6caf6f4198280"
    hash94      = "0a492dcf3cf193a0528ea0e45a1d8a7668df6b2fbf0f5e08cdeabda5885c1aa1"
    hash95      = "c5eb8401ccf25a1dae2abf764400da0dc33fe07d0409c43c2d9c8cd744aae8b6"
    hash96      = "36c6279b9108b26fa2c1ba2d95cfb7590bc3decfb13d6d8101fc0144360a50df"
    hash97      = "723cf51270f7a4da29794253d7f4247a0ba375cd137319bdac1380fc1749b88d"
    hash98      = "b129c7822c5ab66db4e02e437221351d0475aa191548bf47cc493f2d1a2170a6"
    hash99      = "269a1d4a51ca5a04aa36f9a1b5d7f327f2192b6652d2ecc7363fd87a9a1ec1cf"
    hash100     = "39f741c427f9bc381b8b86ce5e94e344481649bbe6dd7f6e90c853c52b5c0749"
    hash101     = "cfafa044670fe5c63d70743e4b9ac3ae42885f8048dc1235827bb60bb321c4e2"
    hash102     = "192b7b1aac58d2bea4c2c63b3a7c577dfdd61f3d8196e2a40c70d06357244b4a"
    hash103     = "1baffb6b6fc160c788d62a1bd2806dbccabac35671c0b8c0fc5bc172857e31fe"
    hash104     = "29798c7136a816fd52fca58dd9ee2209ae2286179650400686542c408523f10c"
    hash105     = "be9d12f08e3fabfdcbadb4799149cbabbd56c4998532f401cda5f82513181c6a"
    hash106     = "71a1569feffd4a625f594051921edcbc4d5ee297174eb77c5a783433e69f0661"
    hash107     = "5f2980c46f74fb45654c94b3af9d3d20f3351cedccb759b668187e2306a9ac5f"

  strings:
    $s1  = "var libel = new Array(-1, -1, -1, -1, -1, -1,-1,-1);" fullword ascii
    $s2  = "var unlike = { ':': '.','U': 'S','1010': 'X'};" fullword ascii
    $s3  = "var amalgamation = d1.shift();" fullword ascii
    $s4  = "libel = libel.concat(new Array(-1, -1, -1, -1, -1, -1,-1));" fullword ascii
    $s5  = "libel = libel.concat(new Array(-1, -1, -1, -1, -1));" fullword ascii
    $s6  = "var vulture = rampart[d1.shift()](d1.shift());" fullword ascii
    $s7  = "var citroen = this[d1.shift()];" fullword ascii
    $s8  = "libel = libel.concat(new Array(-1, -1, -1, -1, -1, -1,-1,-1));" fullword ascii
    $s9  = "var libel = libel.concat(new Array(63, 52, 53, 54, 55, 56, 57)).concat(new Array(" fullword ascii
    $s10 = "libel = libel.concat(libel);" fullword ascii
    $s11 = "} catch (RFXuYwO) {" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b223550e-e97f-4fa5-8679-5893222d510a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion