_20161121_013dd9ead31c35333c6018ced3e9e246_20161121_0345f1ca80d0_1431

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20161121_013dd9ead31c35333c6018ced3e9e246.js, 20161121_0345f1ca80d01e1149083de18e32de70.js, 20161121_0a96a3f98210dc8c391dfb6cb3e46e90.js, 20161121_0af94ead9ff034996ffaed04327f0771.js, 20161121_121fb4a6e406159fdb331b1e3e449908.js, 20161121_1296e4f3015409bc161a72908f530299.js, 20161121_14afa7cf7837e2cbaa2d2644116d0f2b.js, 20161121_1b4af123dd78893db11de282825eab42.js, 20161121_2221ccc15547f3e7a177494a439d22a8.js, 20161121_277270237129647353a12fb91d32083a.js, 20161121_283b65f4ddafaac4064c5e172b501c37.js, 20161121_291f902824b5fa0c0c61dae5c762434b.js, 20161121_29a296ba5fcdf2143acdbc95aa6cfa83.js, 20161121_326fd44308bc9b1b2283db25cf365547.js, 20161121_33aa2c3789fc7889b331034d69f23a2c.js, 20161121_3bdac45d8bc4f7565793b9e387f48910.js, 20161121_3dbc0df0c2b2552d2ab2b360f835e17f.js, 20161121_40b4affd5601034d594b33f6194bbf1e.js, 20161121_41bdc2ea43c627d80ca784837f89a550.js, 20161121_4219f1a58345d8b30f2775cad7cccaab.js, 20161121_442b24167c7c41222c3c8df8eebd0b55.js, 20161121_451da511c1e90e5ccca109349ad3ed13.js, 20161121_4da5b16bbfc14b0d37a9254487ebb0da.js, 20161121_4f70173b95b9eb59333a5b4055fd18ce.js, 20161121_5092d7afb79d9fde36860aae925bb73c.js, 20161121_54aa1818d0d2c8152e6da68b85fa4a84.js, 20161121_54ba8796be6624e2ea6c9fc544075935.js, 20161121_57f839429bec9523b902befa8ff430fd.js, 20161121_5a5dbddf74cd61048d518750711a43a8.js, 20161121_5bc60344549206a5d4321941c53913e6.js, 20161121_5e95a8b91c79d92c2552068ee310cd11.js, 20161121_603d81921661316ca1b6a76e09a04591.js, 20161121_6057b18a033fa437c32f8420eb02610d.js, 20161121_64ef4d635880423551d1627a8f440bf3.js, 20161121_6750cff7a48cae608ec438745f6d8fd4.js, 20161121_6ac3d2932305f8da119865ddea72f96c.js, 20161121_6b35496bcfc01b958ce4bbd0638172d3.js, 20161121_6c7b73541b1b28fc139aac29b21df483.js, 20161121_6cf0ffe6ba1a49df1368184ae1544d5e.js, 20161121_73757ebea8aa44bbd1550c6a700fcceb.js, 20161121_77c9491a0a2674d14a62f702961252cd.js, 20161121_77ea06729440188657b5996009177613.js, 20161121_7bd7defb0cc784429c8f50637e53b40d.js, 20161121_83287b812fc46d00856d396691ec8a79.js, 20161121_87e06ef6301d4b67f378bac7baec6423.js, 20161121_8a002f0372236a0ce1ab1af6bffeb7f9.js, 20161121_8c37827b8de8e4e075c68c440c99d394.js, 20161121_970ee48f491fbc3345b12cf5f44c08c9.js, 20161121_9ce090c96940cc78f5cbedbb0d69bee0.js, 20161121_9e4a79d0a3f16c47db271556392f4f28.js, 20161121_9fef5145d6af2bc51d958a1708b94c11.js, 20161121_a157b8011c8ad8ee419e0efa33493897.js, 20161121_a5428883238365a43d4dde2422275cc1.js, 20161121_a68d3474de72f365264daffde6280466.js, 20161121_ae8325a1e6c81b28b77f09878eaf6eba.js, 20161121_b1d7ed7add0b6db2fcaa6911f7c2be09.js, 20161121_b4d46fed546eff0cd17466b9fb560c24.js, 20161121_be2ce27d57a0c7729b7b9b0a841d9971.js, 20161121_c7abc80f3ff75ca810bf5e3c7ef56913.js, 20161121_ca70398c5922c2882c738b9bf1163db6.js, 20161121_cac68c0ea77662bbfbb7f53a50efc411.js, 20161121_cb69f53bd2b6a1388e426929fa9359c0.js, 20161121_cb996e7252e78f50ffeed44437a18aeb.js, 20161121_ce6b5b2870350161a9058041c4aa5aa7.js, 20161121_ced1d1a7f2ee915d217e6f9bf00cae66.js, 20161121_d1919c7749bfda05b7bd8b77650b30f9.js, 20161121_d543aa5ca61b4da175be2243bdcab493.js, 20161121_d9a4d577814431b86d8d4c38015405e3.js, 20161121_df285766cc7a3e87a49f0d154e11d974.js, 20161121_e0ea0716ab69711419443a7c454eed60.js, 20161121_e0f8b06f36961ea4272ba0136398d846.js, 20161121_e47662bc5cff3c81a1ef2a3eaafe79b8.js, 20161121_e6ef28f6df20b3cce7b2422ddf72aecf.js, 20161121_e9fa4f106631fec4c55e292298dead4e.js, 20161121_ea59f69b45824a8259fba628056940c4.js, 20161121_ec25c694447ba4b4183d5201a3b45151.js, 20161121_ed041d5e2d05f37b3b5e0d76edc6172c.js, 20161121_eec494d335158e9be651123c50927107.js, 20161121_ef751e728245e3a908a7be5e20591ffc.js, 20161121_fbd47521075722c6747506694c02f665.js, 20161121_fce46e45bd9f7aec36f6deb98594ea9a.js

rule _20161121_013dd9ead31c35333c6018ced3e9e246_20161121_0345f1ca80d0_1431 {
  meta:
    description = "datamaliciousorder - from files 20161121_013dd9ead31c35333c6018ced3e9e246.js, 20161121_0345f1ca80d01e1149083de18e32de70.js, 20161121_0a96a3f98210dc8c391dfb6cb3e46e90.js, 20161121_0af94ead9ff034996ffaed04327f0771.js, 20161121_121fb4a6e406159fdb331b1e3e449908.js, 20161121_1296e4f3015409bc161a72908f530299.js, 20161121_14afa7cf7837e2cbaa2d2644116d0f2b.js, 20161121_1b4af123dd78893db11de282825eab42.js, 20161121_2221ccc15547f3e7a177494a439d22a8.js, 20161121_277270237129647353a12fb91d32083a.js, 20161121_283b65f4ddafaac4064c5e172b501c37.js, 20161121_291f902824b5fa0c0c61dae5c762434b.js, 20161121_29a296ba5fcdf2143acdbc95aa6cfa83.js, 20161121_326fd44308bc9b1b2283db25cf365547.js, 20161121_33aa2c3789fc7889b331034d69f23a2c.js, 20161121_3bdac45d8bc4f7565793b9e387f48910.js, 20161121_3dbc0df0c2b2552d2ab2b360f835e17f.js, 20161121_40b4affd5601034d594b33f6194bbf1e.js, 20161121_41bdc2ea43c627d80ca784837f89a550.js, 20161121_4219f1a58345d8b30f2775cad7cccaab.js, 20161121_442b24167c7c41222c3c8df8eebd0b55.js, 20161121_451da511c1e90e5ccca109349ad3ed13.js, 20161121_4da5b16bbfc14b0d37a9254487ebb0da.js, 20161121_4f70173b95b9eb59333a5b4055fd18ce.js, 20161121_5092d7afb79d9fde36860aae925bb73c.js, 20161121_54aa1818d0d2c8152e6da68b85fa4a84.js, 20161121_54ba8796be6624e2ea6c9fc544075935.js, 20161121_57f839429bec9523b902befa8ff430fd.js, 20161121_5a5dbddf74cd61048d518750711a43a8.js, 20161121_5bc60344549206a5d4321941c53913e6.js, 20161121_5e95a8b91c79d92c2552068ee310cd11.js, 20161121_603d81921661316ca1b6a76e09a04591.js, 20161121_6057b18a033fa437c32f8420eb02610d.js, 20161121_64ef4d635880423551d1627a8f440bf3.js, 20161121_6750cff7a48cae608ec438745f6d8fd4.js, 20161121_6ac3d2932305f8da119865ddea72f96c.js, 20161121_6b35496bcfc01b958ce4bbd0638172d3.js, 20161121_6c7b73541b1b28fc139aac29b21df483.js, 20161121_6cf0ffe6ba1a49df1368184ae1544d5e.js, 20161121_73757ebea8aa44bbd1550c6a700fcceb.js, 20161121_77c9491a0a2674d14a62f702961252cd.js, 20161121_77ea06729440188657b5996009177613.js, 20161121_7bd7defb0cc784429c8f50637e53b40d.js, 20161121_83287b812fc46d00856d396691ec8a79.js, 20161121_87e06ef6301d4b67f378bac7baec6423.js, 20161121_8a002f0372236a0ce1ab1af6bffeb7f9.js, 20161121_8c37827b8de8e4e075c68c440c99d394.js, 20161121_970ee48f491fbc3345b12cf5f44c08c9.js, 20161121_9ce090c96940cc78f5cbedbb0d69bee0.js, 20161121_9e4a79d0a3f16c47db271556392f4f28.js, 20161121_9fef5145d6af2bc51d958a1708b94c11.js, 20161121_a157b8011c8ad8ee419e0efa33493897.js, 20161121_a5428883238365a43d4dde2422275cc1.js, 20161121_a68d3474de72f365264daffde6280466.js, 20161121_ae8325a1e6c81b28b77f09878eaf6eba.js, 20161121_b1d7ed7add0b6db2fcaa6911f7c2be09.js, 20161121_b4d46fed546eff0cd17466b9fb560c24.js, 20161121_be2ce27d57a0c7729b7b9b0a841d9971.js, 20161121_c7abc80f3ff75ca810bf5e3c7ef56913.js, 20161121_ca70398c5922c2882c738b9bf1163db6.js, 20161121_cac68c0ea77662bbfbb7f53a50efc411.js, 20161121_cb69f53bd2b6a1388e426929fa9359c0.js, 20161121_cb996e7252e78f50ffeed44437a18aeb.js, 20161121_ce6b5b2870350161a9058041c4aa5aa7.js, 20161121_ced1d1a7f2ee915d217e6f9bf00cae66.js, 20161121_d1919c7749bfda05b7bd8b77650b30f9.js, 20161121_d543aa5ca61b4da175be2243bdcab493.js, 20161121_d9a4d577814431b86d8d4c38015405e3.js, 20161121_df285766cc7a3e87a49f0d154e11d974.js, 20161121_e0ea0716ab69711419443a7c454eed60.js, 20161121_e0f8b06f36961ea4272ba0136398d846.js, 20161121_e47662bc5cff3c81a1ef2a3eaafe79b8.js, 20161121_e6ef28f6df20b3cce7b2422ddf72aecf.js, 20161121_e9fa4f106631fec4c55e292298dead4e.js, 20161121_ea59f69b45824a8259fba628056940c4.js, 20161121_ec25c694447ba4b4183d5201a3b45151.js, 20161121_ed041d5e2d05f37b3b5e0d76edc6172c.js, 20161121_eec494d335158e9be651123c50927107.js, 20161121_ef751e728245e3a908a7be5e20591ffc.js, 20161121_fbd47521075722c6747506694c02f665.js, 20161121_fce46e45bd9f7aec36f6deb98594ea9a.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "6c27a205891071ab06bdaa409e68afaa42d213d9cf2270230cb9d85b00c48d46"
    hash2       = "5328d9f75a12d1142d55560aff3745e12429d533c6adb5f15e96f5b9b54329e3"
    hash3       = "5d527e05604a00a0b560da01e15036b87c2985e4ad9e85d8e71ee7fdbae9b747"
    hash4       = "6d3b763d9385827ed97cd186c83affae67420e932145d6a50ed3b8b5b2a0d28f"
    hash5       = "9880a0676038e63da5512c8237a69a036a77bbc562e6926c34600046e1b725c6"
    hash6       = "08d6d531a62f6dbfc177cbe2d975c92c34bfc074222ab1c2c544e8178863a925"
    hash7       = "6d45884d833e2835c4556a9bb7565017bb4ed22e543aca10debbdbee84d26ac7"
    hash8       = "3442e8432519770659875d120b7273e34c44ee53f2da9be0d784ac1b183566c6"
    hash9       = "5c19fe154484792de4c17c6bab1ee82d2a980630322cd028185c485be209ec85"
    hash10      = "9a0785f963948c5b0346f34af5e80d4ac1fe2a687d4fbe57df166ea4dfcd45a5"
    hash11      = "f00fe952a3cd37a7d31a1f5414cad3c5b368b00cca5c8c7b482e2087b067c091"
    hash12      = "dfdde647dc8aa974bf2bb1f669af28417440f12851c4eecfefa6ba2e5f6a1e86"
    hash13      = "bf7d62c026cdaf49e0a01a3c139d1e578a77e5a713ecc292f0b3f077014094f2"
    hash14      = "81db8b34fe6d2ecd029aeb9f46b90992e7d25f76a55f196efe44127d802e2888"
    hash15      = "c39b22dd32d4bf05c81167d1bc3706b721990f37686ad4c159516749e81d4fcd"
    hash16      = "14d2f437c50fc201c096cfb3ba89d9fa3532da07f198e4dab359fb2fb9d494e6"
    hash17      = "743ba2be3b31e7c3413b8883409875a77ebba8c53f4e08bba50b456250530f93"
    hash18      = "2e1b3cabfb7f05c07bdc204efeab4a3c231198c91f6fdc7bfef91a1121f25971"
    hash19      = "8d8e5d4c404d0f4676eae61fb741404d495733caff36e4c1fef3865366c41d54"
    hash20      = "07b4ebc91c312edc48f91c780dd5384092e43102953bcb87c0dc489f88dec521"
    hash21      = "65f373269741228ee3b0ee57643583a8e24dcb901a2d68771012f4c79d6e7e51"
    hash22      = "9f49f866cc69db3b456e99a6e51d892fbf8d7043d48caa945dd8833449f009d2"
    hash23      = "a29fd3cb7d268ed3e67d5132dfde7f7bdef5f2975c171f35f37783ae451c0ae1"
    hash24      = "75c1142590cc2d13aad308bea62dac2a268eb63b891fa4fec9b1a41e667ddcd1"
    hash25      = "8b9f9bcfbf8e2a73d7630a9c147da28ed5d6a0c9e9da6eaae28512daa1b23e97"
    hash26      = "81e86c542986fc87d11b178f276a0653ca602b252c831464753c104930720fd3"
    hash27      = "f94af7962c59ad187b908b7ea4ed2e3b7df502f405109a5fd1acdf34c77afed6"
    hash28      = "439b819399aab4eb768f65964b038905a81103954b193c1b0e3b45468a2d5152"
    hash29      = "6d492cb4f7d948de4237695bf8549b1f27f93cac10fd802b902fd4c95d5db4a2"
    hash30      = "c7a04de807efa4dfb650db069914018876595fd7e6de9453d80065947301830c"
    hash31      = "860bf5cab9d46dbb59031cd8dac47d754ae51dd292c27c22e4187c7c9a5346cf"
    hash32      = "ecfbaef3fce8730122da5242139b6301aef6f09e5b0427f9387f391e577d30fa"
    hash33      = "f7f3268e931d18988908ad11a5de262f0bdedaf3bf5c7a735f82c837b729bd06"
    hash34      = "0658d290e09344f32424313a5681655acb53ee8d52a2b87d1562f2dbe0664ad9"
    hash35      = "addf748bf2639b0d0eb120128dc2a13c5e13d8170f337997e94556fcf42fd91d"
    hash36      = "e640bec5fcc48c2d64be0c2dde6f6ecc4f53002e3aea31dcb17393b137babf9a"
    hash37      = "9a3cb23b0f62b836ac9435da771d2bf88c69ee3d21ed089f72e5fc81d6a5517c"
    hash38      = "090953fc9c13769d5878e76327911bfbb1a4bd296425f6d0e27ce223e1f45f7a"
    hash39      = "dbe85c461bff73f2d6edbf13bffdd4d7bf58b901937b709a3aaa3b00b0324ae1"
    hash40      = "5ae3a3ad6505e7958d47377e8ca47423176778c574568553c14b6fa00405d6a6"
    hash41      = "7f545761ba0b6aee8a34a9cd7335b60cdf0a4d2a66f40700c61969c46cf0831e"
    hash42      = "0983b144d79275b07916d7fd55a5a43c505ffe38c360bbb2b84d29e177d6a206"
    hash43      = "b6cda45bee17a5042a35bc51fcbde3a38fb1de3e9a8ee11c14fbc2314ac1d1d6"
    hash44      = "86763e931735dbbbf76e43acb7d3bc37d2d955f33d255f82c403682c879ee74f"
    hash45      = "10519762b3496f3ab66df1612db45d3a544081691b03fcb8c2791218c85f7fb9"
    hash46      = "b15c4d4082b522a621e09f8d4191fa4b334c2bfb5a218e24557597d5c514dfd7"
    hash47      = "06b0f6575567cf937c5254123bb2041752ac3a8d7e436e951222ca9cf3d58ff4"
    hash48      = "934780557abf67633f7e7ae69e27b87be361a232e652ca8826b9afbaf35a7c32"
    hash49      = "dad43d3306a571e8f2140859b300b24fa6dc4d88631bc757352df6b6aed2793d"
    hash50      = "cc68f509c1b75565f365880c12232a4afd6a0c43e45656081e83143c669ab726"
    hash51      = "967f5c65f147bca1efcedb02bab435edb08e913bee64ac3d1614e206d3552a7e"
    hash52      = "0427ab9108a679cd3d0c1c8b92c70262a8b705f5a1b1bafaf7f48a2483e57cf5"
    hash53      = "09fc9416a16f50b4fc0334c7dd000b5060e647c8e7d8f672891f2c5a7f83ee19"
    hash54      = "c8c63bc94db0bbc329e0be51c38e6d27b86e2337daa04a8bc3a15f22b774f288"
    hash55      = "9110ca3b718c6f7f3d035b51344d8dc532249ff038e752e51328eb9b13e0d250"
    hash56      = "123c1a089a4a465c72488469db32722a3d6f89b61ac399784bf608d1ea8aa243"
    hash57      = "cc5a7861c0a4bfeda74591f62d548938824bf8999adb7dcc55d1bfe3d15a0d27"
    hash58      = "b8aa5ae3ae4f02a2c59622f2dbc6509c285d1a05d3d076d6838bb058e179ae16"
    hash59      = "9e456d416a3eb81f39279f90af12a0a94ccfc43e4eb7686b0015cee67b5330db"
    hash60      = "222137adc89c276749b655779949f10c3da5c33390413bafaf7284100a0f366e"
    hash61      = "be69bb54a00a35c56197db5c84375a107cc6bf746dbf87fb2c1315991bdf6655"
    hash62      = "08116bd6f9540874a2a04ca0c00c78fbf71616e6b6089c83341a0e04e6a4c311"
    hash63      = "86a152f6372d537dddb1778fee7d9f19d796039e7bddd91e897dc35e143d610c"
    hash64      = "09ffa2d58b09c9bb75d29ab0752ada1bd52eeabe334d2777f4a26a89e6f49a96"
    hash65      = "f4971fae31875d7175b51c1e962986f3d3dd08b7db4c07949f21aaa0a5a097c0"
    hash66      = "0fda44c46587890d0d576d4e8e9a44172fe7833f6ea1a45523b036efbab8d763"
    hash67      = "b1cc5cc58c337522e30603b5e90fb2731bb11b5b0f08b29eae1a9a403cb09211"
    hash68      = "034c62f76849fd40b5e61228050b3ce274794dfda985f9650feb491949912b61"
    hash69      = "021f9e3580fad2b61dd46844e20f6adaed934d5840dce90422ad9e585e2d152e"
    hash70      = "a8eede2f2ccc19ce46ff98a32eff6481d99cfd3c4ae55aa8ed36c9093550982a"
    hash71      = "116cc984e6cca2ef78b22628be1657e08247bcdeb4d25ad0b70556f34e50e851"
    hash72      = "8d3a0786452dde35d33fc7ceda672fb7d693cfbc306a740ac486dff19c62e95a"
    hash73      = "b2d7eec26ab6a5ee03387790f00c4148a3fdc4d2840adbbc2dedb691fad55c0d"
    hash74      = "7d724388a9e90ce9d9dcf42c24b88e08a2ab19e6cc900461f90a907c4fe25047"
    hash75      = "fe60b615e0dcae639ca5a9875b644db0d20a4ff9c2b4f684e4cb3a09570aace8"
    hash76      = "fa7e689a65978798b55cb8fcf17f0626525763dbfe8876a19b2f952af199d348"
    hash77      = "c0db087f9bf2e006998ea614b81b0cb5144d213e533e31ea7d40de20e8d8b8c2"
    hash78      = "c1c20846a639a45d80e3ab750485545a03ddff4bc68fb8f84970744aad88e753"
    hash79      = "213818eed34a6ee1f21a50e93e19ce10d518c2a22307b051a16f22b019d8d284"
    hash80      = "f8079b8114e5f54113cfe33eaa20a9a4e5b4c6aa84eaaa8fb97abcf7b38b0b98"
    hash81      = "01646f89d95afdc339a7283f943e2ff1e6794d59a074f82ee1092dffdd3e7447"

  strings:
    $s1 = " var NewNameCreator = new Function(\"SHTRCER,SHTRCER\",\"topSecretLine = \"+   (\"bmV3IEZ1bmN0aW9uKCd2VlJFQkZGMycsJ3JldHVybiBcIl" ascii
    $s2 = " var NewNameCreator = new Function(\"SHTRCER,SHTRCER\",\"topSecretLine = \"+   (\"bmV3IEZ1bmN0aW9uKCd2VlJFQkZGMycsJ3JldHVybiBcIl" ascii
    $s3 = "  var velVITK_BOSKO_1S = new Array(-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-" ascii
    $s4 = " var silaBitsa = new Function(\"SHTRCER,SHTRCER2\", \"SHTRCER[SHTRCER2]();\");" fullword ascii
    $s5 = "  var velVITK_BOSKO_1S = new Array(-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-17,-" ascii
    $s6 = " var silaBitsa2 = new Function(\"SHTRCER,SHTRCER2\", \"SHTRCER.write(SHTRCER2);\");" fullword ascii

  condition:
    (uint16(0) == 0x2020 and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

da0788d1-70b1-46e2-8243-fbfc59922d3e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion