_20160628_014799ed018be6826f6905950aa3ec2e_20160628_01c139228e98_1317

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160628_014799ed018be6826f6905950aa3ec2e.js, 20160628_01c139228e982cdfe5729fdd7b4c1c21.js, 20160628_0366214b9c364131d863d6970362167f.js, 20160628_0afdd9555132c80977ef269761c3d2ef.js, 20160628_12e477af64b42f443a20609e14a0ce40.js, 20160628_182ee54f59717ebc095d89697eebbe3d.js, 20160628_1c56650da40201cbd606c88e1fb9b4e1.js, 20160628_1dc9a1eca19d26283909833c481718c2.js, 20160628_212c31e51cb5fe48b9f9c9929fdd74d2.js, 20160628_21e9d0a6793193bfeb2a13df59940b5f.js, 20160628_2a8dcd1cf3470a0f676cb02518605930.js, 20160628_2d01a8847f58a5ed2a7755b96456ef7d.js, 20160628_2ef4c05aa38f572d755ce12292e3f49c.js, 20160628_2f83333b26df1b3aad157d54700edf9f.js, 20160628_3750bcff79ca2ad518b6976cd6264acf.js, 20160628_430eb1e7ea588ba2bb15e051f461b9c2.js, 20160628_5d764057d193bed6c982135b4e4aafca.js, 20160628_62e8f30a3842f9630bc616774aabe35f.js, 20160628_630e0682cb699f0dae64a17ac510c287.js, 20160628_6663e057126110fa0486b1503a8c09bc.js, 20160628_6b2782da3469e109a21678c14e927a67.js, 20160628_6b857c8c6e7f3df9401e0c30f4081632.js, 20160628_6baa4998952d3cfd61565353fdb7963d.js, 20160628_6e56d7a0c05dc947a3d11c8ade11caea.js, 20160628_6fc5c9ececc1653eb6cb13a36b0cef9f.js, 20160628_6fe329e9875fa3e70dfe006b46e53df2.js, 20160628_7004fe74df7c1a3da753f77f5f4a8011.js, 20160628_797b033b279171587de4304a134bacfe.js, 20160628_810b739e26b897c6719b267f1db07e06.js, 20160628_846783b830930330a23b5cb451fe2eab.js, 20160628_857317f8c85e4d5b9498dae21eecf671.js, 20160628_87358c3e17a38e95e7a5a71732eb6360.js, 20160628_9065848cb38816cc27735fbbb8765ac9.js, 20160628_96bb136c225cc29523f3050c62a75858.js, 20160628_97af1eeeafa0d601d067663b18e128dd.js, 20160628_97c44a680228e86852551274eb627741.js, 20160628_9961824487654da9eccb94e98780b7a9.js, 20160628_9f25ab90d10825417fa2c10e590eafa9.js, 20160628_a3eca9dad3aa308e79e3f439a2b648a7.js, 20160628_ad2f72a4a73b4097203866fe3cc0c2f7.js, 20160628_afb2391724252153c5cb78e4964735e3.js, 20160628_b250c8f725f516c82c65e4b80f1cd904.js, 20160628_b7a6773e7e1af506d3c47fe0233a34e7.js, 20160628_be7b8a97e1b31d8858205c6224928f89.js, 20160628_c511558d7e99327a57329490b6b496f9.js, 20160628_c88f9720df64bbc5d6ab5eac58611417.js, 20160628_d656d689bc9673aa31f7cfa719a9394a.js, 20160628_d76dff09bca17e8e4217bb562bd1d436.js, 20160628_dd212bb262ff4826c4cf504964edff88.js, 20160628_dece683093efc946ad8b7c76c8edf2f2.js, 20160628_e0e0f1250245fe4b2f3d7b7a060e1470.js, 20160628_e94b85e1ebc05c630d522016e3e67737.js, 20160628_f0590e8f34f8069248cdf41fce0a07a3.js, 20160628_f8b257d36ae460e7cbe5d7036fca6a58.js, 20160628_f9034c10dba8c5f2bec0d548f9864539.js, 20160628_fd5f1eeded8fa40deb8060eef46766c1.js

rule _20160628_014799ed018be6826f6905950aa3ec2e_20160628_01c139228e98_1317 {
  meta:
    description = "datamaliciousorder - from files 20160628_014799ed018be6826f6905950aa3ec2e.js, 20160628_01c139228e982cdfe5729fdd7b4c1c21.js, 20160628_0366214b9c364131d863d6970362167f.js, 20160628_0afdd9555132c80977ef269761c3d2ef.js, 20160628_12e477af64b42f443a20609e14a0ce40.js, 20160628_182ee54f59717ebc095d89697eebbe3d.js, 20160628_1c56650da40201cbd606c88e1fb9b4e1.js, 20160628_1dc9a1eca19d26283909833c481718c2.js, 20160628_212c31e51cb5fe48b9f9c9929fdd74d2.js, 20160628_21e9d0a6793193bfeb2a13df59940b5f.js, 20160628_2a8dcd1cf3470a0f676cb02518605930.js, 20160628_2d01a8847f58a5ed2a7755b96456ef7d.js, 20160628_2ef4c05aa38f572d755ce12292e3f49c.js, 20160628_2f83333b26df1b3aad157d54700edf9f.js, 20160628_3750bcff79ca2ad518b6976cd6264acf.js, 20160628_430eb1e7ea588ba2bb15e051f461b9c2.js, 20160628_5d764057d193bed6c982135b4e4aafca.js, 20160628_62e8f30a3842f9630bc616774aabe35f.js, 20160628_630e0682cb699f0dae64a17ac510c287.js, 20160628_6663e057126110fa0486b1503a8c09bc.js, 20160628_6b2782da3469e109a21678c14e927a67.js, 20160628_6b857c8c6e7f3df9401e0c30f4081632.js, 20160628_6baa4998952d3cfd61565353fdb7963d.js, 20160628_6e56d7a0c05dc947a3d11c8ade11caea.js, 20160628_6fc5c9ececc1653eb6cb13a36b0cef9f.js, 20160628_6fe329e9875fa3e70dfe006b46e53df2.js, 20160628_7004fe74df7c1a3da753f77f5f4a8011.js, 20160628_797b033b279171587de4304a134bacfe.js, 20160628_810b739e26b897c6719b267f1db07e06.js, 20160628_846783b830930330a23b5cb451fe2eab.js, 20160628_857317f8c85e4d5b9498dae21eecf671.js, 20160628_87358c3e17a38e95e7a5a71732eb6360.js, 20160628_9065848cb38816cc27735fbbb8765ac9.js, 20160628_96bb136c225cc29523f3050c62a75858.js, 20160628_97af1eeeafa0d601d067663b18e128dd.js, 20160628_97c44a680228e86852551274eb627741.js, 20160628_9961824487654da9eccb94e98780b7a9.js, 20160628_9f25ab90d10825417fa2c10e590eafa9.js, 20160628_a3eca9dad3aa308e79e3f439a2b648a7.js, 20160628_ad2f72a4a73b4097203866fe3cc0c2f7.js, 20160628_afb2391724252153c5cb78e4964735e3.js, 20160628_b250c8f725f516c82c65e4b80f1cd904.js, 20160628_b7a6773e7e1af506d3c47fe0233a34e7.js, 20160628_be7b8a97e1b31d8858205c6224928f89.js, 20160628_c511558d7e99327a57329490b6b496f9.js, 20160628_c88f9720df64bbc5d6ab5eac58611417.js, 20160628_d656d689bc9673aa31f7cfa719a9394a.js, 20160628_d76dff09bca17e8e4217bb562bd1d436.js, 20160628_dd212bb262ff4826c4cf504964edff88.js, 20160628_dece683093efc946ad8b7c76c8edf2f2.js, 20160628_e0e0f1250245fe4b2f3d7b7a060e1470.js, 20160628_e94b85e1ebc05c630d522016e3e67737.js, 20160628_f0590e8f34f8069248cdf41fce0a07a3.js, 20160628_f8b257d36ae460e7cbe5d7036fca6a58.js, 20160628_f9034c10dba8c5f2bec0d548f9864539.js, 20160628_fd5f1eeded8fa40deb8060eef46766c1.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "363c35d50ae8e5351703f888ec75aa10b69f8d5333f11678dba141366840c81d"
    hash2       = "a48ee8a9fdfc1a9e70366a5745ed5b947d22f1955a13bf152da61fdd9af37a3d"
    hash3       = "266d61ad18459b9650b12da116ffb238173496d1f3d192efb1db9b8babc384fb"
    hash4       = "2b343f4f8db3a621f0bf45cb3b7c9053dffc840a5866c8c8fefd0c59ae5d552d"
    hash5       = "b0482cf73454cc9b9ded717fc7f40a6024ef2bdbda5ddd25c29fcb5e893abd60"
    hash6       = "41213f41093d79c4293d240229e4ced57f056e711c2ddc29dbfe51b614d33cc1"
    hash7       = "cd808277e75b162854286d23132b2d830386abcdef44968997f43476f308aa49"
    hash8       = "49bbc82c25202f9886b8e9191461542aefa510e126b834bef0f49fd533631d87"
    hash9       = "b2cbb218198d3f1a95656aad8da522db9ab309ad29ccc7021c3a49249edc8375"
    hash10      = "bd36de30eb10be46977173be983e195fe6ccfa6ee114f9b606b6c7780449be69"
    hash11      = "99cd128ad7f26d43b4df7224fbb0aaa2cbb408007c28ad9388f4b7af58ec660e"
    hash12      = "764927007b51f3122e0dd9cb12d558e5adc0dba7e2fd1d5f432277ebe1391d1c"
    hash13      = "bc56154b8744ed76b165cad4f00227c9ebef4d51ff700c86b7dd49f62d35d7f4"
    hash14      = "d07b7d7a244283c675a732e3b115e5b2d6db2c44e505f98dddb6c0d11743bc02"
    hash15      = "64deec896478662726530c594a7bbba56f0b511dde867491465d94826b611d57"
    hash16      = "02de62ae0a4358d145047ab0486081da8bbc7fb3be1e7601f52a2fca1e4035bd"
    hash17      = "ed08c192e6882ade0df6bf63bf48b2b2cebc23e3a0108d137c81d5b3f896da1a"
    hash18      = "7180e264abd6c79f72588892ee0b3d07fee572edf224e4c1a754a0c23440f2ab"
    hash19      = "47611dc69573147241c89e108486a0e0a42935d4e35fd6f61621668316667088"
    hash20      = "ea1293e1d17437f15efeff6df8b4c3a2fb6143e164e91da999640153b3517df4"
    hash21      = "13191dd2968c61f1c1bb578a2ee95332509e8f81b58ae8a0dddb6265d01a11d4"
    hash22      = "a6ba908ecc427ba31eb1bf9966d724da8ae6332db2ee6c45f7167ec78992b201"
    hash23      = "2816950c66edc616fb57d244923293f5e253decc0179fff0aacf256080546085"
    hash24      = "c673030434c37d0e33b307d01b84c865f5051b7875404a673fc61d2d56f313ee"
    hash25      = "4f19bebea53dcc931f47ad67d0638295edb10d078e5e701e441195786c617a17"
    hash26      = "81971afba3a4f64ba3a503529acf427898b50159c2b4a3532167729fcfc8dcf9"
    hash27      = "943b07736cc7882981f9f3155a18108e1dd8b6c5a75960cb94255b0f7b571faf"
    hash28      = "edd8ad9bcdc357802aea7bce58dd3a94a525bef93bcb0701769bd6ff962bed1e"
    hash29      = "8d26d02e26639af2c18bd7b13e5142ae113792e1d39a2e144ea95ea640408b6a"
    hash30      = "28442f81db5a87df2fd8a5684abb0c3c5e6eb33400722554ac18837b9886dd87"
    hash31      = "f01aa2f2e11790fa03fc71dd39c3de566140e5eaedf692559ce1ba2c57111026"
    hash32      = "036bfb6dfec8e236a23755c61b5eaf83415ed7792c0e806ec8c47ac3d9f7bf3e"
    hash33      = "b5c1849e37f8d29ec187f3da9b094464e072ab7e4c69cfeb4adde23f4928a744"
    hash34      = "b0429b934c55ee42e0c4a923cfd7bec223a36adb1d1516f3a06106fb1446ddc4"
    hash35      = "fa778a68e321e23b3221571b2c6a5bf399a49c6a3fa3d70f62ec4ec8ec1982b1"
    hash36      = "ef3be5ad8dab0b78617e79f26b70f09ff3cfa4614fd14e01b7176f38b03852a2"
    hash37      = "7896c7e7fd1c3370076947e746714271ffe3611341d7f0fe74b66ff70e0eb60b"
    hash38      = "70b102194b169872a3660b0537146504677e94f0763af4ab981fff93f57282f0"
    hash39      = "31e2fcf7291a4cc76d64c87b06c2c148e9ec01406fffcc6405debdd6ff204013"
    hash40      = "a593b7b6280245bfdcaddf4e514d6c9792050138dadb4d21315fb36add367e9a"
    hash41      = "038e4eaadfc789830470ce8fdcbbb301849fb59189aaf41e7ab56293ccd261bf"
    hash42      = "7f5dfce98ed254c94f087ddf4124240381c97bc73ac97d449ace2150bbbfb0e5"
    hash43      = "148327f3d31c51e719d5a27d24e207b49eb434218c9ac405a5413187256b17c6"
    hash44      = "d2303f793f12f9eac1acf4984e0840ccf1bddc81bc1e0224e23106946519cd49"
    hash45      = "2dcc039f50c8f705a2d068d180b071db5af7caa611942426e9a9ae797794cc1a"
    hash46      = "89f1f374f6cd39a48a350603819d9bf3b7a34cf81adf022e3cccecd671d07ebe"
    hash47      = "a2401ee02b7c627ecace22b06bfa26b29e17ff04460ca1c9caf10dc1eb7e2fc8"
    hash48      = "ab62d36fc6aa9c088666ed71ab7654a60c018b7bb17b43f1717f0ccdcb66caf7"
    hash49      = "d8c892f70bb85256efacda229f7486b676031e1126f8d7584ab0370580085454"
    hash50      = "74bcae0a15736a662a90af9c6682a5b8f1aea867ccd0973acce126a22b1d8224"
    hash51      = "7e3d544882190b4e3448245895c477c12b45a1a2d8026dd5062fdb2b32f2a044"
    hash52      = "f135bb5ba487510f0bcbb084baaae8315f35ccccf1ab38993e50ba4b23223209"
    hash53      = "4c842f85956195c6ec74d9c2a12eb43d8bb2d929ee7a001ac004134255c5c3a0"
    hash54      = "511c85cb4b1af494d5ca81c16587c09347ed1a3f028626d50c74b932214a27b9"
    hash55      = "144658f5439593fa7ffa83727c9b57063dec77adfcfd9b28c95929270b8a83ec"
    hash56      = "7e5d155eb74fba593d2ca61be26f4200d5aa81744fece0cb6a02546ca8b8c2b0"

  strings:
    $s1 = "String.prototype.doubledragon4 = function() {" fullword ascii
    $s2 = "String.prototype.doubledragon2 = function () {" fullword ascii
    $s3 = "var ungodly = \"drozpermadrozpermaQWdrozpermaN0aXZdrozpermalWE9iadrozpermamVjdA=drozperma=\".doubledragon4();" fullword ascii
    $s4 = " function doubledragon(rivulet) {" fullword ascii
    $s5 = "architectural = \"b3Blbg==\".doubledragon4();" fullword ascii
    $s6 = "function STRANGER(gutter, reverse) {" fullword ascii
    $s7 = "var workroom =\"drozpermaRXhwYW5drozpermakRW52aXdrozpermaJvbm1lbnRTdHJdrozpermapbmdz\".doubledragon4();" fullword ascii
    $s8 = "var ranger =\"drozpermadrozpermaJVdrozpermaRFTVdrozpermaAl\".doubledragon4();" fullword ascii
    $s9 = "var rampart = new citroen(a4[1]);" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5eb80e8f-8804-4890-a747-aa271b7e86f3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion