_20160916_00721e8cbbd639833a93ceaadd14b3b7_20160916_01407f91d032_1433

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160916_00721e8cbbd639833a93ceaadd14b3b7.js, 20160916_01407f91d032e59f40969ffed914983f.js, 20160916_01dca5811e42f99c60fa87ea5b5d6202.js, 20160916_096031258b8adbc02933507056b512b7.js, 20160916_0b6dc0ac143d4c031d1f42d1412ba94f.js, 20160916_0ef8e510aefbcbf5a9cf46e24d5db77f.js, 20160916_1275dc82a6dc4b2b1c675b40e534bc78.js, 20160916_21a1da57d87d84384491661de2b24b8c.js, 20160916_2379736c294967461ac872c992198a77.js, 20160916_2436d6cc9bea8b755e605d776a468b55.js, 20160916_266a3d97d66d229b85f4151eb64179a8.js, 20160916_291f53a1535ad463b844d1e53d7d22f3.js, 20160916_29332d35682de03d2aee9e287d0b03b1.js, 20160916_334173b17fb525667309f71910d83702.js, 20160916_35ad47b96edc7e313e7cfa66786ac7bc.js, 20160916_3615195ffdf9cc92767641ce6aabbc35.js, 20160916_3e173ab05263e72b908e70ba40211d44.js, 20160916_3e6964f22ed21cd402d8dffcb853b13d.js, 20160916_3fba18aa094a5cc1d88ea286ec04da83.js, 20160916_429245313a3d9a3a9df6be1bb4c8951e.js, 20160916_46ebb6be5a234f64a2655db75d4864ab.js, 20160916_46f319af85269a7a804886fb9138dc0d.js, 20160916_47411e8f44fab43643cfa3ee2b945da0.js, 20160916_4aaf7a16919a8085ece48b513a00cde1.js, 20160916_4d1a88a58cd0419fd28bec2d6cf1068f.js, 20160916_50f8733fd58bb3377c41aa8135420569.js, 20160916_54f6a9ce09bc322c710f889d5f90e29f.js, 20160916_57484bcc3943be4d3be258795c6a681c.js, 20160916_5bc207c10fd521d24f9c2316f5085995.js, 20160916_6d6457730c894609ef0b271880778e69.js, 20160916_7a0435ec9d4ae562afef326ee7ad9828.js, 20160916_7a544569d06dab4560709bac3145f450.js, 20160916_832e4c45751f1ad50d543a2f1079f3c5.js, 20160916_89cc571d942bbd8e363e14c50063e70b.js, 20160916_8bb6b581fa9815f9bb6970cb08295728.js, 20160916_8dd3fde7fb035b51da1147aa1f451488.js, 20160916_8f3ed3a4eababc796a38ef65c6ba42fb.js, 20160916_904ee8f803a98e134bae66f68aa4478d.js, 20160916_91533517076dc31c151c897adf5e663b.js, 20160916_96aff0e273e8ecac5a4ecdec39c5e400.js, 20160916_a2fdad5cc3d1018d45471c64c36b1452.js, 20160916_b30553fa84e8c53913b26de4cea7d060.js, 20160916_c12cf0b2ce31abf6da87b6bf3adb0b99.js, 20160916_c6053ff5ba36db965462a2794254119a.js, 20160916_c7ba0ed3b4d69af5d821bf167620354b.js, 20160916_ce45b230c84dca35125a5fcda2db0d5e.js, 20160916_cfce11bc17f019da445c5d9e4ff84bbe.js, 20160916_e0e2d3ef8b46b5d513b8413ddecd1d15.js, 20160916_e18b068f2ad7d2cba9c53a7bdd6edb15.js, 20160916_e19f56456293ac53b981f0eec88db951.js, 20160916_e442065131d3156fae9938b60b94334d.js, 20160916_e52210a1ec8a520c9c5bb50e7fccc631.js, 20160916_ea51714e2939515e0f3be177e1b7c6aa.js, 20160916_eb28d78f50bff23175a93562d67f752e.js, 20160916_edf37b41000ad69a746e0b6d92b69cf1.js, 20160916_f55df9bd4e84cdc112b8a0def67b947c.js, 20160916_f922c84ebdef3164fff9196954487280.js, 20160916_fcd8b69c3002111c03814ce404d648b4.js

rule _20160916_00721e8cbbd639833a93ceaadd14b3b7_20160916_01407f91d032_1433 {
  meta:
    description = "datamaliciousorder - from files 20160916_00721e8cbbd639833a93ceaadd14b3b7.js, 20160916_01407f91d032e59f40969ffed914983f.js, 20160916_01dca5811e42f99c60fa87ea5b5d6202.js, 20160916_096031258b8adbc02933507056b512b7.js, 20160916_0b6dc0ac143d4c031d1f42d1412ba94f.js, 20160916_0ef8e510aefbcbf5a9cf46e24d5db77f.js, 20160916_1275dc82a6dc4b2b1c675b40e534bc78.js, 20160916_21a1da57d87d84384491661de2b24b8c.js, 20160916_2379736c294967461ac872c992198a77.js, 20160916_2436d6cc9bea8b755e605d776a468b55.js, 20160916_266a3d97d66d229b85f4151eb64179a8.js, 20160916_291f53a1535ad463b844d1e53d7d22f3.js, 20160916_29332d35682de03d2aee9e287d0b03b1.js, 20160916_334173b17fb525667309f71910d83702.js, 20160916_35ad47b96edc7e313e7cfa66786ac7bc.js, 20160916_3615195ffdf9cc92767641ce6aabbc35.js, 20160916_3e173ab05263e72b908e70ba40211d44.js, 20160916_3e6964f22ed21cd402d8dffcb853b13d.js, 20160916_3fba18aa094a5cc1d88ea286ec04da83.js, 20160916_429245313a3d9a3a9df6be1bb4c8951e.js, 20160916_46ebb6be5a234f64a2655db75d4864ab.js, 20160916_46f319af85269a7a804886fb9138dc0d.js, 20160916_47411e8f44fab43643cfa3ee2b945da0.js, 20160916_4aaf7a16919a8085ece48b513a00cde1.js, 20160916_4d1a88a58cd0419fd28bec2d6cf1068f.js, 20160916_50f8733fd58bb3377c41aa8135420569.js, 20160916_54f6a9ce09bc322c710f889d5f90e29f.js, 20160916_57484bcc3943be4d3be258795c6a681c.js, 20160916_5bc207c10fd521d24f9c2316f5085995.js, 20160916_6d6457730c894609ef0b271880778e69.js, 20160916_7a0435ec9d4ae562afef326ee7ad9828.js, 20160916_7a544569d06dab4560709bac3145f450.js, 20160916_832e4c45751f1ad50d543a2f1079f3c5.js, 20160916_89cc571d942bbd8e363e14c50063e70b.js, 20160916_8bb6b581fa9815f9bb6970cb08295728.js, 20160916_8dd3fde7fb035b51da1147aa1f451488.js, 20160916_8f3ed3a4eababc796a38ef65c6ba42fb.js, 20160916_904ee8f803a98e134bae66f68aa4478d.js, 20160916_91533517076dc31c151c897adf5e663b.js, 20160916_96aff0e273e8ecac5a4ecdec39c5e400.js, 20160916_a2fdad5cc3d1018d45471c64c36b1452.js, 20160916_b30553fa84e8c53913b26de4cea7d060.js, 20160916_c12cf0b2ce31abf6da87b6bf3adb0b99.js, 20160916_c6053ff5ba36db965462a2794254119a.js, 20160916_c7ba0ed3b4d69af5d821bf167620354b.js, 20160916_ce45b230c84dca35125a5fcda2db0d5e.js, 20160916_cfce11bc17f019da445c5d9e4ff84bbe.js, 20160916_e0e2d3ef8b46b5d513b8413ddecd1d15.js, 20160916_e18b068f2ad7d2cba9c53a7bdd6edb15.js, 20160916_e19f56456293ac53b981f0eec88db951.js, 20160916_e442065131d3156fae9938b60b94334d.js, 20160916_e52210a1ec8a520c9c5bb50e7fccc631.js, 20160916_ea51714e2939515e0f3be177e1b7c6aa.js, 20160916_eb28d78f50bff23175a93562d67f752e.js, 20160916_edf37b41000ad69a746e0b6d92b69cf1.js, 20160916_f55df9bd4e84cdc112b8a0def67b947c.js, 20160916_f922c84ebdef3164fff9196954487280.js, 20160916_fcd8b69c3002111c03814ce404d648b4.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "0b3963039f15f2d68b7e4a365c3ea3963b3cb4f56967893130fb0ea61edd585d"
    hash2       = "56bb5456d5ce47f94f214102585f499b25cfebb7dfa17124f88be9b2bd83d15b"
    hash3       = "361e379fcaa9a3e9c29076ea4339ba1f839269f15a92f80e730f43ed58816b14"
    hash4       = "16d565e1d0f1acde8c12aaaa7d2f79386b5b6efe17335c1eca7188282cd3076e"
    hash5       = "7878ab9a0c39429e96d42f1e205f7e96943a4553ea3cec081e01d071820df3ef"
    hash6       = "c4c2e249588474b467117892316086a6ea3c7e01a3b074e0dd8575256a0877dd"
    hash7       = "d819ad33077fc0c221ade0a7eed0c6677c0d8cfc488ca76a62ce863e1a99a9bb"
    hash8       = "8ab531e64b7c945f12d1612ba3c98e9db75bb2e403a53411322f5a66a6b55414"
    hash9       = "69c69f238a1d7df1d66604959d79df56022db32b4eae50717120c1783decdb9b"
    hash10      = "9ee7ea7e23bd6dc87809516ab26d9719ca26699ca24bb970667212be2d85fcf3"
    hash11      = "113a127482f6f6907a12932e10dc8770433e91688ef2cc3b992c09cb40060b9a"
    hash12      = "2f8346be8aadd68511a9b6443c7425db5e1477c5bfbce655fc97c26f2de6ff98"
    hash13      = "ade01c81d94f88e7dddf1ee816df89be0fafac09fdcf8a429bd8fc4aa85bd99a"
    hash14      = "fd8cc4137601b03d52cea6f776e02fa6b86f114d4a8bf860db1583e05d2cdd6f"
    hash15      = "a2e3d4944e9b3294fbe4f73bc3725c5cf49b9f8edcd54ca9bbe9a72d48e0bfb6"
    hash16      = "ffc99022b774721e9ad14ed855906f1ab02c3ddd37ad2c2aab64418cc5e81dfc"
    hash17      = "520331e38cca40c62f75a98c216ae4255d6f6a1a505c4e4ed29cdf1b6c99eac2"
    hash18      = "02043d491443899884bf51e377710216491b16764d73977809cbf4adda42109c"
    hash19      = "3a770508d51d7c4aa219abd546d8bc2527b2f2fe9b919fa32ff06ec35a135101"
    hash20      = "3d8ff049a2cce6512abbb714966a56a071242c087be12b0a8002de4b49eeece0"
    hash21      = "5e3b14b8ba5dec7cfef89344b6f34a681a952c0d68dbfd464f015843775558e3"
    hash22      = "5b68125c74296cbd692272fef92db601e36705d0a55100a4384a27b6b45fc9b7"
    hash23      = "19f6ec338d2ebbeea4faf364ee386c2cd53ba2bb626934939e9eaa2f92538ef7"
    hash24      = "69022aac84e502302f00409d36f169f57dde14357b5f413270e9c05da24fa7e1"
    hash25      = "2f4437b9fe3d7f0f35405535627f9b4954d99c0631f4a3266f6f328d50ab9c69"
    hash26      = "959ff4ddb666e054f7a6841936a3d012f70cdb8af121e6147234edb0748513f5"
    hash27      = "19bb6e0c02d8f77058e9af7062b66271ec489bc083cba04ae21537ed189fdc4e"
    hash28      = "297649c66ac08ad932838f0678b8cdb29bb0c0b2e861b73d83ead9f5935a791d"
    hash29      = "d9d6f539176e1512250c58ca255ce08562019491d82e9921270aeef4328e7436"
    hash30      = "dd6aa734e9da2175a9bc840f55505e9bab36fdea169515be97d7aa84297a017a"
    hash31      = "cd0de4160854ae61a1320a5c73e1a5cdbbefe66297b007de0e16c8481a419f67"
    hash32      = "955555f4685255175e9f65dd91b329061253e120b8970a17cd46a9aa7bf6268a"
    hash33      = "03f4bc46d1c4d3e828f23d2c5084529a39e63161153e13b03372f284ea26ca7e"
    hash34      = "e52cbccd3ea66c64ad9505a2bdbc9e400dc30132ce82e95fbf9690ff72509d55"
    hash35      = "4c092828aa38bfcccbd5bf492a1c4b6b0fcc1b33b418077765e4405b2dac6ca3"
    hash36      = "9ef7251034c4889203f725e535abb8210101dada73115a537d855c7609a4e318"
    hash37      = "0fa95a0319e8f9f33602b7954618590a96b15d00f6848c40927669b10cb16d53"
    hash38      = "c7cfee0c5df0a4f57ee231570757dc6ce0b23a1a5c3c4effb5ff8bd28252d59e"
    hash39      = "d7ef49a2fafe7465cfd4b023326d5f92e4b9118b8a50a8f4b126df966f20eed0"
    hash40      = "c65c23975f6f6482f196f85ecb35e0bfe7f50eb86a9e2007efeeedc15c7e448c"
    hash41      = "4084e3d5cfb32f7ca4e17560f37632ab761fdee49479ee02c36e8ca5c63bfb1a"
    hash42      = "787de81f1f9b3cc22c8a37ef1ea7864df976c3154c0e7b9a7d0952ac0ba2e909"
    hash43      = "c080ff74fb5cbfa2540ec050bc99000e4e9f656039aeb4bd1a346de8c3a0900c"
    hash44      = "986227b3ce381b705c1d492088ff69045c3ac5fa43572ea2bf409653a50f55e0"
    hash45      = "f66eb5c4ef65a824aeb7fb9233683ef27776d1e73f350b2440fb20472a21f0fb"
    hash46      = "0f59966b4d36cd4e8127143d8022e48e1e858bdcb3ae7147d22c772a60b6ffc4"
    hash47      = "aa35763897de6bd84df63b95b717bed948f1a86cea84aca8c65630b312561e58"
    hash48      = "ad43ff7c50cd5873e8f0eee4a4aa53909e3e2a79285407598c254a1c3ac5168b"
    hash49      = "eec6bf898905992abda46493e151419d8cebdc5ae80bcf21dbe701f2898f5211"
    hash50      = "8e01ff14e60af73621f61a74c9ebaf82c8cea79a5ab130c64d0a5fa3a765c8f6"
    hash51      = "b08b9a6a5df777138a7b78bdd418893759a8dccab7ce5bb59ee0de97605039d1"
    hash52      = "f79ccc5925a4e85333370fd004daacb765576be2389f240185b9463e7fed46f5"
    hash53      = "d77d73e699d35334b3ab80dfe32d1448757c1b1b3b188d69b59d6df37c9e749b"
    hash54      = "66b3c8dd82790cde5dc6f5db31c28583997fdef6abbb3396fe9f87d1e169362a"
    hash55      = "f512d4e282bc093552d0ae39ad34c91005b099f8740d31fdc1fe36a8b4a67ffa"
    hash56      = "c837f53ac21d41d36d90230dee13c57e833a9fe3da804712f096edc25e5e4d72"
    hash57      = "5ba58dbebfad46ee802dbccae30aff75fc5e118adcc7a31548caa0d1e4d3ffef"
    hash58      = "072800f8c393cc64fd45d5e681064c6b2df9bdbc7210ea94add3cc5b4646b4c3"

  strings:
    $s1  = "\\x7d\";})()], \"Om\": [3, (function f(){return \"\\x7a\";})()], \"Pw\": [3, (function f(){return \"\\x7c\";})()], \"VXz\": [3, " ascii
    $s2  = "})()], \"Fw\": [3, (function f(){return \"\\x58\";})()], \"Kw0\": [3, (function f(){return \"1\";})()], \"XAu\": [3, (function f" ascii
    $s3  = "eturn \"\\x78\";})()], \"GEb\": [3, (function f(){return \"\\x75\";})()], \"Wx\": [3, (function f(){return \"\\x74\";})()], \"IP" ascii
    $s4  = " [3, (function f(){return \"\\x3e\";})()], \"OEq\": [3, (function f(){return \"\\x3d\";})()], \"YMu\": [3, (function f(){return " ascii
    $s5  = "rn \"\\x5d\";})()], \"XNp\": [3, (function f(){return \"\\x5c\";})()], \"Ul\": [3, (function f(){return \"\\x5b\";})()], \"PCp\"" ascii
    $s6  = " \"Pd\": [3, (function f(){return \"8\";})()], \"Vr\": [3, (function f(){return \"\\x44\";})()], \"XUi\": [3, (function f(){retu" ascii
    $s7  = "tion f(){return \"\\x2e\";})()], \"Fg\": [3, (function f(){return \"\\x2b\";})()], \"WCx\": [3, (function f(){return \"\\x2c\";}" ascii
    $s8  = "return \"\\x6d\";})()], \"KMo\": [3, (function f(){return \"\\x6e\";})()], \"Cv\": [3, (function f(){return \"9\";})()], \"TOq\"" ascii
    $s9  = "{return \"\\x4a\";})()], \"YRq\": [3, (function f(){return \"\\x4b\";})()], \"Ut\": [3, (function f(){return \"\\x4c\";})()], \"" ascii
    $s10 = "var WZf = {\"FMt\": [3, (function f(){return \"\\x6b\";})()], \"CVy\": [3, (function f(){return \"\\x79\";})()], \"Ci\": [3, (fu" ascii
    $s11 = "ion f(){return \"\\x77\";})()], \"LUb\": [3, (function f(){return \"\\x76\";})()], \"Gd\": [3, (function f(){return \"\\x71\";})" ascii
    $s12 = "rn \"\\x4e\";})()], \"Ks\": [3, (function f(){return \"\\x4f\";})()], \"Ze\": [3, (function f(){return \"2\";})()], \"GQo\": [3," ascii
    $s13 = "ction f(){return \"\\x3a\";})()], \"OGa\": [3, (function f(){return \"\\x3c\";})()], \"IMf\": [3, (function f(){return \"\\x3b\"" ascii

  condition:
    (uint16(0) == 0x0a0a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d5cf7172-06b5-4551-ae8f-e4cfa5a9d5fb

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion