_20160921_016aab466e10a29b831eb85b27664027_20160921_05de6ed1bba9_1434

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160921_016aab466e10a29b831eb85b27664027.js, 20160921_05de6ed1bba9a99cad4c92bf9ce97005.js, 20160921_06311313c2c91f30b188be9b0f27e37d.js, 20160921_13c992e435ed245b1977cea0df2db815.js, 20160921_13e37e5857b4357c4b5f40a021143101.js, 20160921_18cdf3dec8ac4b7697e775bc56ddeba9.js, 20160921_1c5a439961f0eccee5312fdbb892fb0e.js, 20160921_22785a85892e6eb0dbe789a8a528129f.js, 20160921_29976a5f68bbdfe415494e838aef0c3a.js, 20160921_2a4c1d98d0b8022ca5527a8e6d96e6e7.js, 20160921_37aa38f76e02afb64903280105ce4597.js, 20160921_37b52e41aabc93218d864c1665a33610.js, 20160921_37b7533d4596284ad0b05a77fca64e04.js, 20160921_3a185c9392a67b927e245520858a0afc.js, 20160921_3a89132c20887c3360a3708984b884fb.js, 20160921_3b3df29e27c35ab2e50a3446fa67bf66.js, 20160921_3c7fe346a31de0bd4c8d2ac0fc848e26.js, 20160921_3ca43590701fad2cb827b5edf3989d00.js, 20160921_4319d62667a3ba06f88c6ba9123c871b.js, 20160921_47da6150745eccf8bd846591c67ec5e7.js, 20160921_4a2d69f96df0dd4c57fda9e63c804950.js, 20160921_4b801afbcd9818be02d65ee0ac30ad19.js, 20160921_527d7c3756974f804734da343b6b6f0e.js, 20160921_53ea150fd63a4ef657412c858a71a13e.js, 20160921_5541f4e80ad2d4f163ebcd0e8c899e59.js, 20160921_5775da34d70f97a2d7aa3296f909af35.js, 20160921_5d475fd55c4e461509ccd87876cf56f7.js, 20160921_619a314e9bcca286c046dff250b54b6b.js, 20160921_68596411289b2d10a74a19f9fce4a325.js, 20160921_6a2eea5014c6e10514154c4a8ee7c1be.js, 20160921_6ad2178e7d047e60c71f9fe1ca457b74.js, 20160921_6d18600f3019656b0ab414a3d1a69ddb.js, 20160921_77c9e00128c9a883c23909fbb2c12569.js, 20160921_7cd473b59463126782b9a6cfaae72835.js, 20160921_7f829eb25609c6f6d37ef18f9c4f8ad7.js, 20160921_7ffe38e0972c323071684bfa98cafbdf.js, 20160921_802181e3d75c3e2d045cebba97849683.js, 20160921_80e6ac924bf190eef40e43ba5d57f11b.js, 20160921_814eb57aeffc75442964829345cc9f96.js, 20160921_87f13d652177c2ccba1196dd341efb6d.js, 20160921_89a260f4d6da4d97f251f843cf5e94b0.js, 20160921_8c33029db61426a234eddfae1623641b.js, 20160921_91d6a421bfd5ccdb59d33b75574567eb.js, 20160921_939d60f07d4171a5bae4c0b4ca33f3d9.js, 20160921_93e612a2f44e1198dfe3c296cb4f7b79.js, 20160921_97fcc16be1aae58b311e71df667be641.js, 20160921_98f234a378a6dd4e51c1730a4a700647.js, 20160921_9aa040f4b657816cc001fcf9a33be586.js, 20160921_a056f27a8b6d780ba88209aaee1ebb68.js, 20160921_a977d2870f5e9d12c659565b82cfaa70.js, 20160921_acebc8ac4559526a5a8de801968bd19f.js, 20160921_ad69715850fae108d9a16055efb4f51c.js, 20160921_b7400937fc4eb76c7ea3adaa321d7619.js, 20160921_b86272ed73cef9077c204056df823014.js, 20160921_ba8a9f239804499b5d1d2a06a862c1ca.js, 20160921_c1ad71fea9bd3e371590c0c373f087a1.js, 20160921_c6572694e5172932491036c67fc9ffe4.js, 20160921_cab66b13ccb843c90a2a068a082cd4ec.js, 20160921_cb6c4de61b30cd204129d0942321058c.js, 20160921_cf2bd9606d396ba99f8174f1946c8590.js, 20160921_d1c97b87a6985071e0e4edfb0e0dcc81.js, 20160921_d4a195112732d8d5ebb1bdc900a52d50.js, 20160921_d53637406b068b7f313912a4769e371e.js, 20160921_d7492227e681b1689bfc5442a91a169e.js, 20160921_d74d6a32efd0c1fd568c81769c75b5f0.js, 20160921_dd666c66b3f13d3a71b957c0e646c0a0.js, 20160921_e0f34764de4fcb908eef371ab4011f31.js, 20160921_eba3e9dc8ad614a7e5c422a93cd7b424.js, 20160921_ee1327bdf201e62d1f7ae5482cabbd90.js, 20160921_fff847efa0eaa326a0aad4d2fc81d41e.js, 20160922_2bdee31da941689170d6b7da303eeff6.js, 20160922_51694f0251fa3f1d7267b3d7973d4097.js, 20160922_92c62e47426236a3598469915ee3dcfe.js, 20160922_9d6af27348126e594fbe29c3cf568591.js, 20160922_abb8cfe456777bb23f3253a5921340d2.js

rule _20160921_016aab466e10a29b831eb85b27664027_20160921_05de6ed1bba9_1434 {
  meta:
    description = "datamaliciousorder - from files 20160921_016aab466e10a29b831eb85b27664027.js, 20160921_05de6ed1bba9a99cad4c92bf9ce97005.js, 20160921_06311313c2c91f30b188be9b0f27e37d.js, 20160921_13c992e435ed245b1977cea0df2db815.js, 20160921_13e37e5857b4357c4b5f40a021143101.js, 20160921_18cdf3dec8ac4b7697e775bc56ddeba9.js, 20160921_1c5a439961f0eccee5312fdbb892fb0e.js, 20160921_22785a85892e6eb0dbe789a8a528129f.js, 20160921_29976a5f68bbdfe415494e838aef0c3a.js, 20160921_2a4c1d98d0b8022ca5527a8e6d96e6e7.js, 20160921_37aa38f76e02afb64903280105ce4597.js, 20160921_37b52e41aabc93218d864c1665a33610.js, 20160921_37b7533d4596284ad0b05a77fca64e04.js, 20160921_3a185c9392a67b927e245520858a0afc.js, 20160921_3a89132c20887c3360a3708984b884fb.js, 20160921_3b3df29e27c35ab2e50a3446fa67bf66.js, 20160921_3c7fe346a31de0bd4c8d2ac0fc848e26.js, 20160921_3ca43590701fad2cb827b5edf3989d00.js, 20160921_4319d62667a3ba06f88c6ba9123c871b.js, 20160921_47da6150745eccf8bd846591c67ec5e7.js, 20160921_4a2d69f96df0dd4c57fda9e63c804950.js, 20160921_4b801afbcd9818be02d65ee0ac30ad19.js, 20160921_527d7c3756974f804734da343b6b6f0e.js, 20160921_53ea150fd63a4ef657412c858a71a13e.js, 20160921_5541f4e80ad2d4f163ebcd0e8c899e59.js, 20160921_5775da34d70f97a2d7aa3296f909af35.js, 20160921_5d475fd55c4e461509ccd87876cf56f7.js, 20160921_619a314e9bcca286c046dff250b54b6b.js, 20160921_68596411289b2d10a74a19f9fce4a325.js, 20160921_6a2eea5014c6e10514154c4a8ee7c1be.js, 20160921_6ad2178e7d047e60c71f9fe1ca457b74.js, 20160921_6d18600f3019656b0ab414a3d1a69ddb.js, 20160921_77c9e00128c9a883c23909fbb2c12569.js, 20160921_7cd473b59463126782b9a6cfaae72835.js, 20160921_7f829eb25609c6f6d37ef18f9c4f8ad7.js, 20160921_7ffe38e0972c323071684bfa98cafbdf.js, 20160921_802181e3d75c3e2d045cebba97849683.js, 20160921_80e6ac924bf190eef40e43ba5d57f11b.js, 20160921_814eb57aeffc75442964829345cc9f96.js, 20160921_87f13d652177c2ccba1196dd341efb6d.js, 20160921_89a260f4d6da4d97f251f843cf5e94b0.js, 20160921_8c33029db61426a234eddfae1623641b.js, 20160921_91d6a421bfd5ccdb59d33b75574567eb.js, 20160921_939d60f07d4171a5bae4c0b4ca33f3d9.js, 20160921_93e612a2f44e1198dfe3c296cb4f7b79.js, 20160921_97fcc16be1aae58b311e71df667be641.js, 20160921_98f234a378a6dd4e51c1730a4a700647.js, 20160921_9aa040f4b657816cc001fcf9a33be586.js, 20160921_a056f27a8b6d780ba88209aaee1ebb68.js, 20160921_a977d2870f5e9d12c659565b82cfaa70.js, 20160921_acebc8ac4559526a5a8de801968bd19f.js, 20160921_ad69715850fae108d9a16055efb4f51c.js, 20160921_b7400937fc4eb76c7ea3adaa321d7619.js, 20160921_b86272ed73cef9077c204056df823014.js, 20160921_ba8a9f239804499b5d1d2a06a862c1ca.js, 20160921_c1ad71fea9bd3e371590c0c373f087a1.js, 20160921_c6572694e5172932491036c67fc9ffe4.js, 20160921_cab66b13ccb843c90a2a068a082cd4ec.js, 20160921_cb6c4de61b30cd204129d0942321058c.js, 20160921_cf2bd9606d396ba99f8174f1946c8590.js, 20160921_d1c97b87a6985071e0e4edfb0e0dcc81.js, 20160921_d4a195112732d8d5ebb1bdc900a52d50.js, 20160921_d53637406b068b7f313912a4769e371e.js, 20160921_d7492227e681b1689bfc5442a91a169e.js, 20160921_d74d6a32efd0c1fd568c81769c75b5f0.js, 20160921_dd666c66b3f13d3a71b957c0e646c0a0.js, 20160921_e0f34764de4fcb908eef371ab4011f31.js, 20160921_eba3e9dc8ad614a7e5c422a93cd7b424.js, 20160921_ee1327bdf201e62d1f7ae5482cabbd90.js, 20160921_fff847efa0eaa326a0aad4d2fc81d41e.js, 20160922_2bdee31da941689170d6b7da303eeff6.js, 20160922_51694f0251fa3f1d7267b3d7973d4097.js, 20160922_92c62e47426236a3598469915ee3dcfe.js, 20160922_9d6af27348126e594fbe29c3cf568591.js, 20160922_abb8cfe456777bb23f3253a5921340d2.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "d6a541dd7e97eedc43f6bcf89f007176352c81c1d1240a76218e73cf5bb3b171"
    hash2       = "cc9a1bb338cbe502eae2d8092d1b4369f9be8a107f4db340bf51a1640991e960"
    hash3       = "2e8ad2d8de7bc2cc77c2b00b8eeb4fd7976cd68790eeb4b6bfd14ad188696ed0"
    hash4       = "289da9cff140ea3b4e35a1aa721314733c057d085ff9e8b5fc3ed7e10f75341b"
    hash5       = "bd94ae3a0c3b8dadcaba65cdd5f58ebd19d616ac5679af1b7891e5bf26889265"
    hash6       = "1a1aa090c906360f52952b29d512b8c450c7e8c8cff28bc6fded6af15377b37c"
    hash7       = "3fbb744f5c370c0fc7398db52f2d758d4ee9e8aaf91430daa5c6bada9598710f"
    hash8       = "3bd9f1cc39c45e7b6963f5eca04b26ef2eaf9c8005e5a0d5f12e868261ae58ca"
    hash9       = "218bc62c15296caf93128e0a5e06fde374e19fd4150b6c9b1def4d962554ef39"
    hash10      = "65be7c1c5efef8255d7094d95251c12de72303024061cff2152d54a244a049f0"
    hash11      = "768a32c669c193375bb8e7adb97cdbb697cd6f4f09fb5dc67bb63e62b7de29cf"
    hash12      = "c506490b3737e1b21522717204e4143ada427e9af58fe86e42ed31dfd0fde66a"
    hash13      = "61b41be208c77057ce2b56a866ae0e936c6372d0c3a92f126a1cf5090fe0a5e7"
    hash14      = "a5201f237db515e70a3934feb4ff64c4cccf728f340d6e9e46fbe4217f988165"
    hash15      = "9687ad9b2ded14e00c5b17393de82acd451266863fb217fc6647e1add112f2fd"
    hash16      = "dd15d322a8169ff9edb922ead245c93109f14c5fa4f31811eb58601888323ad2"
    hash17      = "9416bb519c790de32506a7f01be471201203ef899168387fe44a40151f0b662f"
    hash18      = "ef7c5701a8646e7803463e9a01e4f2e45cd535f2ed7174e97abde991a779b665"
    hash19      = "33e5babd254cb93078c026ebb6beb245e487651597122eb576cf5b870dfbf8ee"
    hash20      = "9a6547815adb02f36991578330e4cb005f8225b3a8e4c85d5e2c5907a22e325c"
    hash21      = "786d4a5233f100c1ba7f5e820c46309247158a45ed43bd58795f05152dbaecf6"
    hash22      = "f85dba2504097034fa23d87391ecdaf7fe5f29824616a8d91d353284964bfac1"
    hash23      = "7d2dd725d314277b3b7cf1c94ae8894dce1d36430ff22819c2fecb47f14c3f43"
    hash24      = "16ac7affa46e10764a6e40de21c545ac275939c77c4acf142df8e3f848362242"
    hash25      = "615edf37483855ab2b78dd87e38795245913e5fc6efc9bc47d9e698132792739"
    hash26      = "270e1d840937d10ac3eb1fdd04f0fbbbfd31a88a2f316c94c5167a23a2940644"
    hash27      = "dc4e4001f0f2e1f28098f6ad190b918a7ffe075d590fb142a508fdad546d9816"
    hash28      = "9f370548310908c52102d40d56781574ad404eafca7ac832d5e52d48f722bff5"
    hash29      = "52b104c52d9f1461833687ee9fc5da1913610266114cbc0018bf345ee135d662"
    hash30      = "b1fa490690ec2cf24ba4236d1fa675827bce812ac4cd92a59a9b5261b979f8a3"
    hash31      = "2e126f3a35c3e15739f44a3b15bf991678bc6c232e213be738a2521187bf8173"
    hash32      = "fb0471dc4828588d37d01ddaa7b9454e82acacc4dfdd9f0998b461661e3810db"
    hash33      = "95544bd07dbc8b2550e3a6bb328d49a808c8749bb3ced90cbb8f5f90782625a1"
    hash34      = "0e3e3663f9696265255bc848bc98ec77487c491ee2a30b3085dbc10087b935c5"
    hash35      = "cbb0232bbf0751233c3e647bef431987aa4666e8c60b9ff699f55e31318c3e22"
    hash36      = "4bc751383d4c72f88b3f59d9fde1f38f09a81b77ee4df0498bec1df7cd088bc7"
    hash37      = "ab42f16384f05ce6299f1ffd60f980af6ecf1fa2d23befc951797d1d52915400"
    hash38      = "e240b858e2fac9be9a3fc0f8611c4c05e6f217dd1e13ac43649aa6d7597ee450"
    hash39      = "2736df4d651a33824aba7abffa7c08414414ffed9f5f27b4b2d81101cfeb7117"
    hash40      = "52cce778f06a6477b6f4a6a9f48328a81d874164235533c2925fdd358b6279c3"
    hash41      = "700f6c802eb024896efe2b22255973b53752a8f129213c9bba2c4f2ebdc53988"
    hash42      = "8a7c2a5271a5dc64c200145fa7252ff19d736174b3556eb436f9ac8941daec71"
    hash43      = "fcd86e83ff6948b25dbdbac7ed6b6c8d750729e1da24f7598ff0e0b575909d4b"
    hash44      = "c23bfef986de7a073bbcd781aa45ad15287fb2c448d110b92a01e652f22ff335"
    hash45      = "e88aa94cf06df033312260c4a58f453654133758e66e1d2df4f11f9de9bfec7c"
    hash46      = "2459214bba37a40478bc984d75c7b1ababcbf0d17eeabe32578555058bdac21f"
    hash47      = "67d0e50d586bb8bcc6b12ccab848f1a72b3a329ddaa0c7f45ea3661082887c8d"
    hash48      = "06edaae6cd03c231dca115449fcaf6955b5f70df34983f02383296a412f73538"
    hash49      = "314665ef3670769c41db6783cc9eb408dcbce4749a56c09166a1862331791bf3"
    hash50      = "53eed08aece7cc2a81b9828098c3d3e70042a4891863f1130086a0661fc12870"
    hash51      = "79fe55ec3d2d6dbd854df9676c4565b6a8410e1d94298c2ff2f112036fcfac73"
    hash52      = "76ed8c5c3ace4ce119f1561d5d61ca2e454da79e9156a8397e72d6eed3a22d74"
    hash53      = "91a8cd111f3381e8f00611988dc7860cfb507d4d297884f9d7d7a01ae96c0fca"
    hash54      = "c639defcc03ef60ba09f66ea7a3067f4493b67650049d4d5576fb24d05a2ec25"
    hash55      = "4ab28724a794acc5764f2e51f93d2b91ef9513b43e4cb9b0d10bad2710c2e6d7"
    hash56      = "cf0e0decfb5414f48e1bcf494a6c63e6249e9ac1433d4fba6a461b5970957194"
    hash57      = "e6ae2536ba0486138837b2ae1457fd029e88f0c21975b726f4edd05ba182b08e"
    hash58      = "ce3b033b39aaca0b7c9abd0fc5eeb09d24d7096d0a399cebd99f7bd8d574f0d1"
    hash59      = "db98233c2508e4a2167ee46a334ce9052faa726615e89838f4fdb36b74fc5353"
    hash60      = "c5afd84ebe18fa55c764dd8e7349bc7b9cd8b10ab8d94500cbf7f62bd741c00d"
    hash61      = "b5d1f1d63107b329353fe8130c80608d28a9b1ed12f81c240129d04be6842bf0"
    hash62      = "679537ccc73765d47769657cc000499c86fa227678df5b0d4690ca0e2cf6325c"
    hash63      = "cafcf490b9e4364e16ee46f82e53896038b46a0b37f3fd7a33a363316965b400"
    hash64      = "63aa129680edf69c72e8f077be5e8562f041fa0b0c7e63a8a9b219c23749b135"
    hash65      = "eeb2c0427dff61d2dceedf890b96f76da6a37634fefa03079a481c476d7a3547"
    hash66      = "77e753e21a464bef9fad04f7d41ce8b192c797808ff1b22efe474c612c25f2b2"
    hash67      = "de457f8d789ffcd672900ad06037697526230f620a01d113732fa3683b1604b1"
    hash68      = "f0f6c6f4fe3daf7aae3b8d7276adbcc6577a8bf844eeae945023523b63b6cc9a"
    hash69      = "91500ac726f9d2548dffc99162aeece9863dc7b928106d27a769e6bbf9439f81"
    hash70      = "93f868a10878cb41f305e28c8802778903c99b84a1bc0647a0c2c78fd6310577"
    hash71      = "70ee088e40fb9f7bd2cc1514b94af7f28ef9fd68444cdbd3859858840ae0e498"
    hash72      = "c424926fb99cca3faf3dda68a4860b770a7f0467803b01fbdf54011c52f56a99"
    hash73      = "d6b6eb713cecae41143fb04e090a4809564a1837f49e53a84e27f0d3b0885df7"
    hash74      = "3634189c93f3a76e0a4df72e631f0715b4b71427c157ca5fe116252ca00f1d9b"
    hash75      = "658f6872a894eb9bcb193b7bf73260e92d4627036eede588553b81333dcf0c30"

  strings:
    $s1  = "(function f000(){return \"DYs\";})(),(function f000(){return \"Km\";})(),(function f000(){return \"Yz\";})(),(function f000(){re" ascii
    $s2  = "f000(){return \"Tn\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Um\";})(),(function f000(){return \"Mt" ascii
    $s3  = "f000(){return \"Tb\";})(),(function f000(){return \"ZIi\";})(),(function f000(){return \"DYx\";})(),(function f000(){return \"GG" ascii
    $s4  = "urn \"Go\";})(),(function f000(){return \"Sv\";})(),(function f000(){return \"BQb\";})(),(function f000(){return \"Yi\";})(),(fu" ascii
    $s5  = "),(function f000(){return \"GGn\";})(),(function f000(){return \"IAa\";})(),(function f000(){return \"Lp\";})(),(function f000()" ascii
    $s6  = "n \"WIj\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"Nx\";})(),(fun" ascii
    $s7  = "\"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"DYx\";})(),(function f000(){return \"Mc\";})(),(funct" ascii
    $s8  = "00(){return \"Tn\";})(),(function f000(){return \"Iq\";})(),(function f000(){return \"Wy\";})(),(function f000(){return \"Oe\";}" ascii
    $s9  = "f000(){return \"Br\";})(),(function f000(){return \"Yz\";})(),(function f000(){return \"MJq\";})(),(function f000(){return \"Br" ascii
    $s10 = "rn \"MMz\";})(),(function f000(){return \"YTp\";})(),(function f000(){return \"Vu\";})(),(function f000(){return \"GGn\";})(),(f" ascii
    $s11 = "(function f000(){return \"Mt\";})(),(function f000(){return \"Mc\";})(),(function f000(){return \"Oe\";})(),(function f000(){ret" ascii

  condition:
    (uint16(0) == 0x2f0a and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

81895549-9f7b-44f6-a64c-8f3c5caed212

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion