_20160906_0292c9ba83bb305e4fb299d6342dd7f6_20160906_0866425bddf9_1524

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160906_0292c9ba83bb305e4fb299d6342dd7f6.js, 20160906_0866425bddf985031af505ef49986b91.js, 20160906_0f01c9de8873a585badc7e05e0e3f142.js, 20160906_201e9711a02133a7f48d8c6f540a7c68.js, 20160906_2a8007752534e29a1955591816714f80.js, 20160906_2ffa9959f700777a2a401b6e3475e9eb.js, 20160906_390024fcef27f001a021f0d19d601b6d.js, 20160906_395690a0b0f536d5249b076cfaf347d3.js, 20160906_41ef03320f2f4c84f9f2be8674e892a0.js, 20160906_429018c07c42ad3d445c8d2c76ded96e.js, 20160906_42eaa10f53ac267cce156825f9676ac9.js, 20160906_43e411925b9fc49436f534fb4b8a9146.js, 20160906_442d8b74e5430f7e88ab4becc907c899.js, 20160906_49e3c875c900e945267515c6fb0516c4.js, 20160906_4ff6b2bccf1e42d9833466e05f6b0c2d.js, 20160906_5933e8c2417a6f23930d379be26db4d6.js, 20160906_5a19cb6fa4f29737e4fa6c55116a253c.js, 20160906_5e3fcd72a150eed3a491dd2661043695.js, 20160906_5ecb4343ce82cb279b6ff6372bb71073.js, 20160906_637be674457da45c4956173ec4fba906.js, 20160906_66f995b5ee6532a5e5e64af34b9fa5a2.js, 20160906_6dde8379338de93174d95745c4aa6f8f.js, 20160906_701cdd824f51288ca79ecb30f1e5d276.js, 20160906_7205e7ef13f6d06870c2589d0aca89ca.js, 20160906_724011054b0eaa1bb103889417fdd8cc.js, 20160906_737c311d02cf993e122869b4a3e651ae.js, 20160906_791da0a73edc907ffb98573089a971e9.js, 20160906_793959e572b1367810063f5f9690ffee.js, 20160906_79f4932e56af89b1509f1a09fb6b5dfd.js, 20160906_7a674cdd2092fd56d375fa7b049cf70c.js, 20160906_80f5ea2003be2156243445bce20e1be5.js, 20160906_870c828ba65323c22a3d0f63e2b0981e.js, 20160906_8bd481872bc68cb46b83fb4cf0927c31.js, 20160906_8d34a74d94336d09d1fcf2db8e699e6d.js, 20160906_9458f13568c0cae3310ef50811c693d9.js, 20160906_a366f95f1194eceb8a88874e9b83cccd.js, 20160906_a8a448c274752c790567a25764e28ec2.js, 20160906_aeb36114621823f39b9ef32086d29ff2.js, 20160906_b3ee4a951f626aa9e232dd89af46c726.js, 20160906_c2517217b4a4dafbff446ecf9d26117d.js, 20160906_d13486e5bf57eff6763122c9cc5c26a3.js, 20160906_d1434c644bf23f54766888c4edd0316c.js, 20160906_d37a40498b4c122fa891fd00e97a8aa9.js, 20160906_d3a5d8411b4a62acb8ef56383bdd0d31.js, 20160906_d43aed7ae290ed572cbca9002fb86675.js, 20160906_d65e6510bfc5894db6217b9d3b583752.js, 20160906_da51bb6609c8847e326df1239daf0fee.js, 20160906_e409e2b04b5f948991d9ebfe73faeb51.js, 20160906_e72b2b1ad7429fbd459ca612e89c5420.js, 20160906_e8f9dc0ef5bffb7035914e9c7dec7363.js, 20160906_ea5e223ccf8e5ed3849c3c4c7230e22c.js, 20160906_eb29a1dd0a0715b0c25ff32ecf87adec.js, 20160906_f3a27e89a6638bcbd7c3039bdf5ce0ed.js, 20160906_f66629da399af7273ea13bc3c1efbd6d.js, 20160906_f7c6806531b6607d1042b5f54fc6b1d5.js, 20160914_031aadbec3c615bbd716004e53da6729.js, 20160914_0399742a331716256c1996caffe5088b.js, 20160914_03f2f6cc0cd9b445708651148c57d8a3.js, 20160914_04946d748bd481474e216b9a233f2909.js, 20160914_067a45b9b9ac56f9aeb10ba8651400f3.js, 20160914_06bf9998e7a289b11eeb2935f1fa569c.js, 20160914_0ddb0727dedf9a56d640b9fce8a36379.js, 20160914_133c19ad9c8e7f488d1a3897b5a126cc.js, 20160914_1535054ea607358e4696bfddcc37f0ed.js, 20160914_171951f0f6ace0ad8827cc178e5ac887.js, 20160914_18e65633960e2af813695d02cdadc8b3.js, 20160914_1a325977e2e9c55c3f50f47961d35165.js, 20160914_1c455e5460d53d4a025f119b5d8dfe7e.js, 20160914_1d21abdd8898dd49bdfdfcc00cce34b8.js, 20160914_1f59fe75432975e748949ce0253a9700.js, 20160914_210cea2212d638efa1fd51125e5dd968.js, 20160914_219426db0402dd06a00419570d456701.js, 20160914_21f1462f214d67c2864c103e739ba6b0.js, 20160914_2628e79563d9edd2a40260b56331a8fb.js, 20160914_2aaff8f30ecfbf5b33b7e3b51afcbd60.js, 20160914_2ab54d108ae398d0647a2bd7851e4c25.js, 20160914_2bf1e08d4188abc4ca918195575cf835.js, 20160914_2df5a8d9ffeb03037b2ff78eb3895755.js, 20160914_31b482a15c94e323f61fe6e48ed53af9.js, 20160914_3306ded8c9623f873de4e66cba4c8f0f.js, 20160914_33919c7fadf66e99c410cb406fe1eb8c.js, 20160914_33d703918716c7e1664230bda52497d4.js, 20160914_34ccde637aa3d6c5b8e0b30bca63c18f.js, 20160914_372ff85a86b52ad45458f0ab207bca64.js, 20160914_39324e63fb4a017eb0e6e4b49fa5a21a.js, 20160914_39c6c8543bfa6ede911a5697dcd5cf59.js, 20160914_3a4528ebdbdfb4ce7cdc33c83d079920.js, 20160914_3b143ccd3dd5dd1465debbb879cf01c0.js, 20160914_3e75591924b004db3f3b4487e358ccb4.js, 20160914_3fe0f69e5c2d387f8f5a13a0ec6b8a10.js, 20160914_4817388b3f7f35afe76fe8a8c9e4710e.js, 20160914_4b7efb295bc85c0fe9f93f96861d6b5a.js, 20160914_4cc31ea65fc9f7f00154fe4b3c75ce55.js, 20160914_512a40229134abff8354cf5b6fbe0909.js, 20160914_5256910fe6933a4bb63b6beaebd6c67c.js, 20160914_53de68e320b6d6fab40264a20964ad06.js, 20160914_5480e01c72b642e89f593fa06210a4ea.js, 20160914_54ae2dc0d99615b672a7aa07728d0ea7.js, 20160914_55b25a51669913932377de9b0f473739.js, 20160914_59dd90bafe12e44dbf588a8582954f65.js, 20160914_5a765c986a8eabe85d56bc5470f1dffa.js, 20160914_5b6a0206fa47b9b25a2648792569a074.js, 20160914_5c44af1db9ae61b0b2b67a7eddce7de8.js, 20160914_5deb7a41ded5d4fd3f219c41948ae966.js, 20160914_5f6c8927c28d428165bf04496ba587c6.js, 20160914_60c409929016e46d229a48abe662c1e2.js, 20160914_664e5da91895638de3d1ca98d95f41ed.js, 20160914_67f4767e392cbddd80704ccda891b8ac.js, 20160914_68fc76be16778b378dc398ae06720e44.js, 20160914_69721d885320f45baa749bcc84a9ba4b.js, 20160914_6985f7007ff328615bf2c6b30b8f57eb.js, 20160914_699eb204851b6d73f792eaaad7b2c799.js, 20160914_69f533787f718699acd177e246a15c6e.js, 20160914_6d879208b300bdc5d9328dad8bbd3636.js, 20160914_6fcd18c69e40ecd2e4bb4ea1c2787ee4.js, 20160914_70aea6be88fe8b034f3247625d733774.js, 20160914_71bdffca9d683f85cea993991271f94e.js, 20160914_7201f40923abfd7165cbbdaba2ae3397.js, 20160914_7645352806e19e3b7a88ac1a4978d193.js, 20160914_7cae8d01a36dd6c6f05aa61d2ff5455c.js, 20160914_7fba08249cba92edb00fdb84b5b58ccf.js, 20160914_885a26864b158dd44c011d16c1298d9d.js, 20160914_8a37ad718808fe2265ef9c0ee72f6532.js, 20160914_8af40a67235d08b49d110e366cdcee9b.js, 20160914_8b5b3772bc293aadf880545c91f44928.js, 20160914_8e373522a5035dd0910de4ce8da9a7ba.js, 20160914_8eee4cfc8c73a0e5b91066042ee85e95.js, 20160914_8f894459f7e49b05b9015bb4532b8106.js, 20160914_961baf89f01cd307b72390c8e0597eed.js, 20160914_99f320f2203596adb91fec472dc64682.js, 20160914_9a96f5b24701efaf20485e9cbd7096db.js, 20160914_9db80c2824fee13e94e52f1f86d403ad.js, 20160914_9dd7a2145e86ada17e213b6aca4bebc3.js, 20160914_a12f45d44f3aeb956cddc715235ed69f.js, 20160914_a13ab0124226e8d57c843f306759f7cf.js, 20160914_a53d69c99c1a33d068476d1235c11cda.js, 20160914_a87403d0cb0797b41b1e2587b8e56829.js, 20160914_ac6936b6dcffcfd90672dc2cf10c3abc.js, 20160914_acdcf784e052f4f1e35d74e624ecd347.js, 20160914_ae6b8e37cb6748d4000bc4c571fac8c7.js, 20160914_b5f4fe376878e11d6cc31fb0b486a166.js, 20160914_b933b4876fdc0635192eba814f714e7e.js, 20160914_b9e025801e533d7fad5e21880d6b2554.js, 20160914_ba4edc46a297dc0fe50a20f9455c7e7a.js, 20160914_bb22dabbe56764fada92e964079bee95.js, 20160914_bc0aa7838487fa2a284d8fc078c6bc38.js, 20160914_bdbe9e72d01205d5bf3f6eafd3b48dc4.js, 20160914_bdd1b4eef4f60dfa64b3c06790a1916b.js, 20160914_beb009a86bb7e5611f88d143d300fba6.js, 20160914_c1f67d00bf9bb7fd36a3a8afb72ae177.js, 20160914_c2d78d91978bdf550e71014b2dc310c7.js, 20160914_c35c26b5549cae4542ee053813da978b.js, 20160914_c41f7290ead7e8832133c9783ed7254f.js, 20160914_c89479681552813f1b80069578edcfec.js, 20160914_cf4420448238c4dd53b439c590172448.js,...

rule _20160906_0292c9ba83bb305e4fb299d6342dd7f6_20160906_0866425bddf9_1524 {
  meta:
    description = "datamaliciousorder - from files 20160906_0292c9ba83bb305e4fb299d6342dd7f6.js, 20160906_0866425bddf985031af505ef49986b91.js, 20160906_0f01c9de8873a585badc7e05e0e3f142.js, 20160906_201e9711a02133a7f48d8c6f540a7c68.js, 20160906_2a8007752534e29a1955591816714f80.js, 20160906_2ffa9959f700777a2a401b6e3475e9eb.js, 20160906_390024fcef27f001a021f0d19d601b6d.js, 20160906_395690a0b0f536d5249b076cfaf347d3.js, 20160906_41ef03320f2f4c84f9f2be8674e892a0.js, 20160906_429018c07c42ad3d445c8d2c76ded96e.js, 20160906_42eaa10f53ac267cce156825f9676ac9.js, 20160906_43e411925b9fc49436f534fb4b8a9146.js, 20160906_442d8b74e5430f7e88ab4becc907c899.js, 20160906_49e3c875c900e945267515c6fb0516c4.js, 20160906_4ff6b2bccf1e42d9833466e05f6b0c2d.js, 20160906_5933e8c2417a6f23930d379be26db4d6.js, 20160906_5a19cb6fa4f29737e4fa6c55116a253c.js, 20160906_5e3fcd72a150eed3a491dd2661043695.js, 20160906_5ecb4343ce82cb279b6ff6372bb71073.js, 20160906_637be674457da45c4956173ec4fba906.js, 20160906_66f995b5ee6532a5e5e64af34b9fa5a2.js, 20160906_6dde8379338de93174d95745c4aa6f8f.js, 20160906_701cdd824f51288ca79ecb30f1e5d276.js, 20160906_7205e7ef13f6d06870c2589d0aca89ca.js, 20160906_724011054b0eaa1bb103889417fdd8cc.js, 20160906_737c311d02cf993e122869b4a3e651ae.js, 20160906_791da0a73edc907ffb98573089a971e9.js, 20160906_793959e572b1367810063f5f9690ffee.js, 20160906_79f4932e56af89b1509f1a09fb6b5dfd.js, 20160906_7a674cdd2092fd56d375fa7b049cf70c.js, 20160906_80f5ea2003be2156243445bce20e1be5.js, 20160906_870c828ba65323c22a3d0f63e2b0981e.js, 20160906_8bd481872bc68cb46b83fb4cf0927c31.js, 20160906_8d34a74d94336d09d1fcf2db8e699e6d.js, 20160906_9458f13568c0cae3310ef50811c693d9.js, 20160906_a366f95f1194eceb8a88874e9b83cccd.js, 20160906_a8a448c274752c790567a25764e28ec2.js, 20160906_aeb36114621823f39b9ef32086d29ff2.js, 20160906_b3ee4a951f626aa9e232dd89af46c726.js, 20160906_c2517217b4a4dafbff446ecf9d26117d.js, 20160906_d13486e5bf57eff6763122c9cc5c26a3.js, 20160906_d1434c644bf23f54766888c4edd0316c.js, 20160906_d37a40498b4c122fa891fd00e97a8aa9.js, 20160906_d3a5d8411b4a62acb8ef56383bdd0d31.js, 20160906_d43aed7ae290ed572cbca9002fb86675.js, 20160906_d65e6510bfc5894db6217b9d3b583752.js, 20160906_da51bb6609c8847e326df1239daf0fee.js, 20160906_e409e2b04b5f948991d9ebfe73faeb51.js, 20160906_e72b2b1ad7429fbd459ca612e89c5420.js, 20160906_e8f9dc0ef5bffb7035914e9c7dec7363.js, 20160906_ea5e223ccf8e5ed3849c3c4c7230e22c.js, 20160906_eb29a1dd0a0715b0c25ff32ecf87adec.js, 20160906_f3a27e89a6638bcbd7c3039bdf5ce0ed.js, 20160906_f66629da399af7273ea13bc3c1efbd6d.js, 20160906_f7c6806531b6607d1042b5f54fc6b1d5.js, 20160914_031aadbec3c615bbd716004e53da6729.js, 20160914_0399742a331716256c1996caffe5088b.js, 20160914_03f2f6cc0cd9b445708651148c57d8a3.js, 20160914_04946d748bd481474e216b9a233f2909.js, 20160914_067a45b9b9ac56f9aeb10ba8651400f3.js, 20160914_06bf9998e7a289b11eeb2935f1fa569c.js, 20160914_0ddb0727dedf9a56d640b9fce8a36379.js, 20160914_133c19ad9c8e7f488d1a3897b5a126cc.js, 20160914_1535054ea607358e4696bfddcc37f0ed.js, 20160914_171951f0f6ace0ad8827cc178e5ac887.js, 20160914_18e65633960e2af813695d02cdadc8b3.js, 20160914_1a325977e2e9c55c3f50f47961d35165.js, 20160914_1c455e5460d53d4a025f119b5d8dfe7e.js, 20160914_1d21abdd8898dd49bdfdfcc00cce34b8.js, 20160914_1f59fe75432975e748949ce0253a9700.js, 20160914_210cea2212d638efa1fd51125e5dd968.js, 20160914_219426db0402dd06a00419570d456701.js, 20160914_21f1462f214d67c2864c103e739ba6b0.js, 20160914_2628e79563d9edd2a40260b56331a8fb.js, 20160914_2aaff8f30ecfbf5b33b7e3b51afcbd60.js, 20160914_2ab54d108ae398d0647a2bd7851e4c25.js, 20160914_2bf1e08d4188abc4ca918195575cf835.js, 20160914_2df5a8d9ffeb03037b2ff78eb3895755.js, 20160914_31b482a15c94e323f61fe6e48ed53af9.js, 20160914_3306ded8c9623f873de4e66cba4c8f0f.js, 20160914_33919c7fadf66e99c410cb406fe1eb8c.js, 20160914_33d703918716c7e1664230bda52497d4.js, 20160914_34ccde637aa3d6c5b8e0b30bca63c18f.js, 20160914_372ff85a86b52ad45458f0ab207bca64.js, 20160914_39324e63fb4a017eb0e6e4b49fa5a21a.js, 20160914_39c6c8543bfa6ede911a5697dcd5cf59.js, 20160914_3a4528ebdbdfb4ce7cdc33c83d079920.js, 20160914_3b143ccd3dd5dd1465debbb879cf01c0.js, 20160914_3e75591924b004db3f3b4487e358ccb4.js, 20160914_3fe0f69e5c2d387f8f5a13a0ec6b8a10.js, 20160914_4817388b3f7f35afe76fe8a8c9e4710e.js, 20160914_4b7efb295bc85c0fe9f93f96861d6b5a.js, 20160914_4cc31ea65fc9f7f00154fe4b3c75ce55.js, 20160914_512a40229134abff8354cf5b6fbe0909.js, 20160914_5256910fe6933a4bb63b6beaebd6c67c.js, 20160914_53de68e320b6d6fab40264a20964ad06.js, 20160914_5480e01c72b642e89f593fa06210a4ea.js, 20160914_54ae2dc0d99615b672a7aa07728d0ea7.js, 20160914_55b25a51669913932377de9b0f473739.js, 20160914_59dd90bafe12e44dbf588a8582954f65.js, 20160914_5a765c986a8eabe85d56bc5470f1dffa.js, 20160914_5b6a0206fa47b9b25a2648792569a074.js, 20160914_5c44af1db9ae61b0b2b67a7eddce7de8.js, 20160914_5deb7a41ded5d4fd3f219c41948ae966.js, 20160914_5f6c8927c28d428165bf04496ba587c6.js, 20160914_60c409929016e46d229a48abe662c1e2.js, 20160914_664e5da91895638de3d1ca98d95f41ed.js, 20160914_67f4767e392cbddd80704ccda891b8ac.js, 20160914_68fc76be16778b378dc398ae06720e44.js, 20160914_69721d885320f45baa749bcc84a9ba4b.js, 20160914_6985f7007ff328615bf2c6b30b8f57eb.js, 20160914_699eb204851b6d73f792eaaad7b2c799.js, 20160914_69f533787f718699acd177e246a15c6e.js, 20160914_6d879208b300bdc5d9328dad8bbd3636.js, 20160914_6fcd18c69e40ecd2e4bb4ea1c2787ee4.js, 20160914_70aea6be88fe8b034f3247625d733774.js, 20160914_71bdffca9d683f85cea993991271f94e.js, 20160914_7201f40923abfd7165cbbdaba2ae3397.js, 20160914_7645352806e19e3b7a88ac1a4978d193.js, 20160914_7cae8d01a36dd6c6f05aa61d2ff5455c.js, 20160914_7fba08249cba92edb00fdb84b5b58ccf.js, 20160914_885a26864b158dd44c011d16c1298d9d.js, 20160914_8a37ad718808fe2265ef9c0ee72f6532.js, 20160914_8af40a67235d08b49d110e366cdcee9b.js, 20160914_8b5b3772bc293aadf880545c91f44928.js, 20160914_8e373522a5035dd0910de4ce8da9a7ba.js, 20160914_8eee4cfc8c73a0e5b91066042ee85e95.js, 20160914_8f894459f7e49b05b9015bb4532b8106.js, 20160914_961baf89f01cd307b72390c8e0597eed.js, 20160914_99f320f2203596adb91fec472dc64682.js, 20160914_9a96f5b24701efaf20485e9cbd7096db.js, 20160914_9db80c2824fee13e94e52f1f86d403ad.js, 20160914_9dd7a2145e86ada17e213b6aca4bebc3.js, 20160914_a12f45d44f3aeb956cddc715235ed69f.js, 20160914_a13ab0124226e8d57c843f306759f7cf.js, 20160914_a53d69c99c1a33d068476d1235c11cda.js, 20160914_a87403d0cb0797b41b1e2587b8e56829.js, 20160914_ac6936b6dcffcfd90672dc2cf10c3abc.js, 20160914_acdcf784e052f4f1e35d74e624ecd347.js, 20160914_ae6b8e37cb6748d4000bc4c571fac8c7.js, 20160914_b5f4fe376878e11d6cc31fb0b486a166.js, 20160914_b933b4876fdc0635192eba814f714e7e.js, 20160914_b9e025801e533d7fad5e21880d6b2554.js, 20160914_ba4edc46a297dc0fe50a20f9455c7e7a.js, 20160914_bb22dabbe56764fada92e964079bee95.js, 20160914_bc0aa7838487fa2a284d8fc078c6bc38.js, 20160914_bdbe9e72d01205d5bf3f6eafd3b48dc4.js, 20160914_bdd1b4eef4f60dfa64b3c06790a1916b.js, 20160914_beb009a86bb7e5611f88d143d300fba6.js, 20160914_c1f67d00bf9bb7fd36a3a8afb72ae177.js, 20160914_c2d78d91978bdf550e71014b2dc310c7.js, 20160914_c35c26b5549cae4542ee053813da978b.js, 20160914_c41f7290ead7e8832133c9783ed7254f.js, 20160914_c89479681552813f1b80069578edcfec.js, 20160914_cf4420448238c4dd53b439c590172448.js,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a1c3c1769c78210ad59fe0fae0dd853725c64bc44adb02a980a65994f427f5b5"
    hash2       = "5e549425c6b30e0949cd56393a37a4abd3aa9dd83ebab7a1aebc847d7302aa64"
    hash3       = "524d131f6aa4b580b538c44d47d7b2923ab216706b06ac67acf8172515d289e4"
    hash4       = "d6fd830bd1bd43429cf06ff5a4d3bfc9c6be12fd842464593b2ece82e03e837e"
    hash5       = "75067603b7a42fdb3d93a3ebf274919ae088118ce0c815d7786854b6e229a84c"
    hash6       = "94b3d60850f7f97ef250712c60aa86544b931a24b55d93a1a5368def50c3183d"
    hash7       = "4fe83005d7ba9e2a2003e5fc4d1c3bab1b15827f486a1307f34b4ae6e42a1ece"
    hash8       = "d95bc7a8be93c6c77914ea9229d4725422565d44df60e7818bd91085ca37f07b"
    hash9       = "e4e2d991d9f9b4cb8e3dbcd0fe37cb06e9428fc6218ee91c822e3723d049aa19"
    hash10      = "25cd81815677ff70221850d9ae8e41fefc529aab7b12e1ddd7d27f983f2c1349"
    hash11      = "28484438db5fc23b523dc4eb705fb71f8d7a311082a9e85a1777f387f36068be"
    hash12      = "e491eec7336b11771c64e2f6b474140bd530d6261296a003202a175881d7df8e"
    hash13      = "d9162c631d9e8ad3acc1add658486bb7175864941f38fe458000272b251f06f7"
    hash14      = "fed71d09700d2956e56c191970a6199e951b90439b6e7b9f54fc392bb314acd0"
    hash15      = "227d167d87b1ea31f2473af5edf5cca8ee2ef941c993ac5c9e945bcf79c9792a"
    hash16      = "b074645a2955c6c0756e2f2abd99b8b2a818b0e74f77899a66c74e0869406b5b"
    hash17      = "85b2d4cfd4c19f018f00d5c563e3b6b3caa4bf2943494d15196811fa0942244c"
    hash18      = "cff4957daf908e0923636873c463ab3bcb0a2cbeed119dbb4be9f14c05751cd0"
    hash19      = "705499dfdb32423a0e6382969adb0dffea7a7d367d91696adae3d30c5ad080e9"
    hash20      = "f386932c2c79df8194b8d9f54a955fbff42982525c558ea1db840c0d30dc01fa"
    hash21      = "b0e5509f3c15ee598e8afcb448703f2b60a8f54dedfd5e678d93579c5023b104"
    hash22      = "45798bfeef5084ad09838f0eb091a8701353a2edc95c6f3242a42e0eb5a1da15"
    hash23      = "c96a8a16ea9560888c62415dbe2b82cf663d12a82648a788d4874846ac2457bb"
    hash24      = "457ab1bba0f1225747198184d4d125ad1a24709a284b6a03a4c2e6c10c70292a"
    hash25      = "00471ce42323e2bdf15ddb806192a24beef83dfb1a7fb377b8dd8df1c069aa80"
    hash26      = "220ecb0df634f731ca536c7efc7ab7a071da08ff3bbaf8151ae6645db21198d6"
    hash27      = "55f20e03a9f3f1f51acbfddcd85a87bb8595e056932509bfa5712b47dbe82704"
    hash28      = "7184c73de237361f6f24c9024bed9ad3c428ea4b6cb5927a3b5a097622dbf977"
    hash29      = "7208f4b207589eec978ff239f4911731fd910afca6de76c88b23f7ac4b7b3dfc"
    hash30      = "8cf5cca2095a1d675808a0c752bb2cfb20452e9ddb4250132614e7de76c14e57"
    hash31      = "db1c2aa418344db6f75b228d1674f629bb0243b41ad78d238f57a8561f94d34e"
    hash32      = "d8f575b62e614337812231b8beb63ba6dc8bf5ab3c5eda6a1f70971aa0d55fde"
    hash33      = "833228c79569b5ea9145f9dad9552d075fe53419db65df7800fd003142444003"
    hash34      = "65d99287d74e0ef397e6cdd6f881afb693312ea9d0b56f55c80925bd33520998"
    hash35      = "1ef12327e481ae99499836acd096f494c606370a18b555cb1a59c23e4b0667dc"
    hash36      = "6df886940c19f2210eee38276f570cf48a685203672aa59885c7299ab791bae9"
    hash37      = "2096502dd69b58f75a28b4a09d5e5c39e87154a60c15930f02a986a911ba85a4"
    hash38      = "a90e82832ea100a785fa7bacfce2384d4b1f5500ac39845bbaf671aeec0f27e1"
    hash39      = "8d9f4b6829aa7de83fc98b47f0afa94ad77f2bc688421d0f35dba0472aeb2cee"
    hash40      = "d42bb5d81e9cc8f96bb6586e19f60fe0d6709f2a555b09e360b58083a61f346f"
    hash41      = "c337635f06ed961bd8e88104b16da1e6740b8934df3e0653f3c694863f19a141"
    hash42      = "b73fc4cf4963c28d644ab7677a7a4755814abadee50c6cd9267970fe21a12750"
    hash43      = "b17e152982dddb146985fb5845f18fa2403b17b43b83435eb25f445c5eafc242"
    hash44      = "532e020add7db06282c48748002cb4a6328fc8fb61266b8926abb856e05112e1"
    hash45      = "c3c753fc2d53c140acf917d7df3c981d8faffba81e4f16ffa0068bc5eb9f934e"
    hash46      = "6dee45bd3884decf2e3214b8aba25db6011c6518af20ae507dcad96152f0c14e"
    hash47      = "3800fab98447fffae7a03da1523a555a64ff3cbcce4499ef9cf33d893d536175"
    hash48      = "816c3ff2eaa144d111a789d906b4ab9cd02b1c0dce2f8439c68ed6cd05debfad"
    hash49      = "5cb72c31bd90ae728d7a9e4cec94e6fdf7a403b59c4e2b6c813ad513524bbad8"
    hash50      = "35f9df2220b57fb0059cb6efe17c87a5f0758fa58588f704b0d5df29932a45b8"
    hash51      = "650a4aea1785949a0e27e05a6868b595e2a87917b6a220e4b3b2c080bfc56baa"
    hash52      = "ae3ed4667c4e3b40afc4d53984a1f2c2c8a95c16da63725700235756d7917def"
    hash53      = "5bf4c80f59cc5ce6b46b47f261b5866ccad8aee9e4ddc04caea4126ccb0fbc85"
    hash54      = "b9f15b930523ce2b6a61c51a764de2d2131d329034c63cfc79ba0eb377bf5de6"
    hash55      = "97548f2012d9e6057802504291220f5f94ce8f21a6ede86c1fd0048c7a6096c9"
    hash56      = "6e41167487b6b62197e9ae6c75ef6dcd7b6430d4aa51b6df3ce8796dbc8e1e28"
    hash57      = "a357a80024a3e9075e78af900ce6b3c8845ebf82d04425416d8ab7d225f8fd93"
    hash58      = "eb1c21cdf42207d4532682decaf1121b8c53683aaad9e09a7362c4e36407924e"
    hash59      = "7a0114312b8ddd4079cd2fcf5065d15b096c071450173dfbab8d9d814357f9a9"
    hash60      = "567cceca43b42910ef745f87f8184b06ea8f4ad03c2cfc678d1c443e55cc8916"
    hash61      = "e54166462327f3a860c017b86719acce1137eac9d00f57718e30c4682efff314"
    hash62      = "f7b5d305f004141340b9d6e5bca5587ff0e2cc24c9cfc7b56eef0d8ff6382568"
    hash63      = "eb0f44e4c4c62284db7baee7616b2609aac4d2a43e38d9e07981fe8358e4960b"
    hash64      = "aab8db084ef70367645d9e29a66531b28d1f990ddac4fc1cc5c323cceaf1227c"
    hash65      = "2314de771e95a3e448ef0a9419fa94ddedb7e12649f7f8ab1f0bf65e9658f288"
    hash66      = "3d137820dedf2dbf664074eb46f3bbd1336346e9391f2022bf9c68133fcdc1b8"
    hash67      = "5b86ac2256fe338e5e4a70e231920afe0becefc54c69e9cb72d9641ec4b5ff23"
    hash68      = "548b21cf7173e469da39e5d04d44f457888768805dce16756b835930951b013f"
    hash69      = "d5c86abfdb20ad8751092da28ee0da0027f4aac0ad119186f9cfa155a6031f57"
    hash70      = "9904236b73d147339d99e71aa7577f35fb0e6a8adad427c96025f4f0edff4f12"
    hash71      = "d3c1485514d8736c02ed75c2a664d9a4336d0482b48148ef9123f84af649143d"
    hash72      = "493159a60ed39b04cb826c5bf93fc15b0495db520729497e74656ecb8ead3928"
    hash73      = "075b7163cb09b7680256300389af46b10d1a4b1ffa01a160c1535a75c4997641"
    hash74      = "1a7a1f0139b4977553c5c6b2ed83c953e4acf56ef7e27afa5d446c8d99b8f8fb"
    hash75      = "0d54403d9dd494af28b39b24f65678da8068cc48f88e7200eb71c324e531b55f"
    hash76      = "c48eca7768d91c2eaf6851f25e38c39fab25a7ebd4e0387d7523df91a0cb43a5"
    hash77      = "414a93f61e458f945105344d19180c0ea6be0ceb9b1617f42a7c4866671a46ba"
    hash78      = "53a2cb9f8ca453f5d7e9287f9fba468c15eb729850b64c0ccf43775cd6e2366a"
    hash79      = "3771c3bd6131e3ec7462fd800dcebf8359c74b0aabb37ba84e31462e04d02fa5"
    hash80      = "775a5bfad6945453ed671a40976fb6cb1653d0fbc35b3865076e66ddaf1fa950"
    hash81      = "0478bb4264fc61fb7f34b21ef84d70d62b061aba0f69209962778d32748997ad"
    hash82      = "068084bbf5d2791706cfc10c9b17863e5876f315cd40889a672ba11f4741c1a7"
    hash83      = "2315f454a4abc8f16d4f35b48bfdf185e157e846b9dc7c8bb71f4c572ed4576e"
    hash84      = "3f21da4884dac67480a800b932eceb9c96a6815bb1034dd8e091c087875860c6"
    hash85      = "b6daec6976aa83e874cb4fe0ed45c664d05ff0778e81a46c3b2ab18cab4474c3"
    hash86      = "4590cdb3c3fa7c672cf08a0d86fdfa12a9df18dae906d28977937f92d5d1dbf1"
    hash87      = "4fd23a6dc7f3270445d05c7a3dcc5f61901b8dc7c8e920afd9980cdd7bc0e3a6"
    hash88      = "c33ed8ffa55bad4a5d0282d62b55fc6e7ced4ab232923e09a5f7f4c36b5b5ba6"
    hash89      = "29bf2d421bd89614f756d8f3829bd56cf943e4ecd6eb6382a05eaae46d5f6ad7"
    hash90      = "7d98b1f64f2e88c37f4b418c8cb8f126523dc94cf9044e3ab2fb1c450f8be2c4"
    hash91      = "9139cc2717989ff41392f140046902e5a8d08ceb0f2de1e5247530b8a45c5a83"
    hash92      = "ac5d658850d941ef82b979ad4ed6ab23adfbaeddf8980d98768dbda86543078f"
    hash93      = "0310c0beeebf060ea8484aec4fc081803dbcc84894383df425538f5444ae99c1"
    hash94      = "71ab1da62c239f1aee1736aa57e8ca106db693616d6559655c0398e018d63816"
    hash95      = "bdd54bf7f33e6a1fef8eadf9a28072ccb337fb1ec85d702c520d5e3c69b42ad6"
    hash96      = "5a21bd691ce72cb6000bd04f68b657160c2eaa2aee5ab354c4a086394d75ca43"
    hash97      = "6ad2e3c27995ee8cddc4ad146b15105ff53d5f8ab9ddebd389c7794e87a29d2e"
    hash98      = "f9d38a6a260633f56d9234719ade3bd0d9abbf482d5434d5dca822ee6a293117"
    hash99      = "1ed2222cc01915b82dce002476e5cea43c3745033c1a070443aa331f7d4c3d66"
    hash100     = "8e5f7801e4b265b4618e94e60dfa0c7a12b524d40e53bc24e1394727ea516e61"
    hash101     = "d316ac883daa76afe47f43aa83ce75f38d9b5ef8b1359ef3c74b525bde194320"
    hash102     = "b9ed10945aa475474b68390c9d720995d97a82c7433a8293f9d82ea03404d58c"
    hash103     = "734da1f8757eb670e145b3bbe48a3f0156f1d5da6dd915f8177f237699decf8e"
    hash104     = "a048f83fde271464a1e84347c01d01b71966f1a3c13b014e0df47d05c6660ea6"
    hash105     = "4f871173d3a78ae930de8e0d727f2be250ba3930af5094f1d83fab1ac637c155"
    hash106     = "a4e70d50bee11a6fabe05d7c90b2df9975c1608893bae3bb0040a58346ed679b"
    hash107     = "fc056ec7bfe24dfd928d1bb800c819486356c4fa5b633d1cba609fc2c3800b65"
    hash108     = "cd7464eebe6a82d98350226b8c10c7ccc2067ce4f55ed25a9c28d51d15684ae9"
    hash109     = "3cac57f6928d983e6b619737d77f9283a68fdd1c1433ab7a458143ce0ede465d"
    hash110     = "c41abd408acbf58d4b65284143efe90ea5ffe5c799cefb15afd0a49c96c3961b"
    hash111     = "0d6f348c77096c22c8c01f2143aec7f0afa0d4cb7f4d8896e5be78ce613b175a"
    hash112     = "9453521795f468c49bf3d3d65a95fec5024ffde9eff5e259c9d960e11ec1976a"
    hash113     = "3b5d66c326b03c04bc26b46ae639cfacc202635f7a5b8e20d5350659d3be4195"
    hash114     = "8140fe242b205dc4366f8362e3b4e12ff4cb20b1cff97011620bc8b229b7ba2c"
    hash115     = "0d32e14f5859e7ff38eda8779cc866b0e75bb9d1e265862e674629a244801375"
    hash116     = "8c175955cd667d7a1aaa02a1b46c0ec6f796586d28c6190ea3f9c98e5e09dc8d"
    hash117     = "db70b03e23896141d91407805205691141268cf000d5866a6d71746a5a4e3508"
    hash118     = "aeb251ecd6ddbec7e53c40ff8da48436f7326ca466e4cbba3a7a92d15b52d9d3"
    hash119     = "f6c1ce319953abf0c085b85f0cfa4c41c978368381e15de7079fc44714f3ac39"
    hash120     = "7bd0be13814cb49807b0fd72b659f020319c4a145db265cef22d081aaf546885"
    hash121     = "7f302852c49a5c054d4786119643bc51c86a7c7c37612ad9ef318ea53a70aa47"
    hash122     = "9b04f2c000f6a3a100cd6d1d07240315e9f8afc5f90dd0841d189e86de4a4b7a"
    hash123     = "7d9c242ba5664b83fdb723590e82533dd5739afa4fc7322b6bbc189be4692320"
    hash124     = "9112664451ec90dfca1b51e5e50dc93e32779a1ce8348462eee36e384bf9bf32"
    hash125     = "9d35d8667470081074a7bd3880fef732c40c058a4d51ab66e528176e45466c7b"
    hash126     = "7ee8bdf1a6458bb446956c7698a6a91cd78f0eefec0a74db9f85bbae1fb8b26f"
    hash127     = "c546ab2ca870828eeabb0f21479c3e9677e745c02e970ad93c9028165dd34cb5"
    hash128     = "e0cadc08700ea72890c2b0e9912c189f0e4d9da5ce8e83a4eef53a71c9d9b543"
    hash129     = "0e4265485d6f739a6ae137c32f933b80a85b3771073472daf622e07f8fe30421"
    hash130     = "d8b2d74c874c6805c6d99176b784918942ff6e40c0ead0177fe1222987da8695"
    hash131     = "c86ace0d93aecc22d0234297ae46635a010d676f4db9af6648a3ce7037e06bb3"
    hash132     = "05518e265e1d3ae8fc8202f1ee4d439ec45c06ca59d2c3a0f0f7506e45fbd952"
    hash133     = "da5482a261697ec028622c9747d5b746f06b7ab5c9315932d5043c5cdc1465bf"
    hash134     = "35f99d9abdd8738bc9c05262837c39f44a33c1911c1e3f76e4fe0788de9edd8d"
    hash135     = "29f6624d3041c3c350831c153e6b3e694b925069e843a947a4ecc5f942f777cd"
    hash136     = "d44e8298056275331132b9920b65520a84e633921dbb7ad0d1abd65812fc8331"
    hash137     = "330c2d4ecc225e2abfcd250084c7d09b1bd791835d73ab0b60415e6587b7b222"
    hash138     = "2afc2feac7e4b48dc1d426d8675ca9ea2ffdd599a81ac91cce21de8379edee24"
    hash139     = "b57d58645258e7850fda1449085c52d86eaf4c8795e771c9fb14e3668c2f2435"
    hash140     = "8012bbc9d53c9443c615b991f96c704be2210636b200bf3621937aada7f6719c"
    hash141     = "61114f6fbfafd1f3fe3b11fcdb3e3697046e7c9ad083ff06b71fd0f1e051b4c3"
    hash142     = "b0dbfd21076f8d2db209993796d2a41d36e979f25f2fe6dd934d6831e869329e"
    hash143     = "a878b3e651da9451f2e85737f600e685c0aee29d85f544128faf8a13b6210e23"
    hash144     = "fb6c186fdb807c6436e573fd916c01b85cf019b32d2c7e926155e027d359c194"
    hash145     = "ebb0c34a0882b29548d0f5aa656c6f941bdc7a9b5202ae7cbb6a4b919074dcc7"
    hash146     = "ee9152ba4230655e4b1c527ea07055bbff0e4ae5b296b2061eb5937be3e0ca17"
    hash147     = "e34e7ada7c314deeea1352cdbc4fe6ec2e7b7891a42ea8639d27d6e5c4ba046c"
    hash148     = "ddeaec5d0772b260d9e0525477ae326d7b61be63b3b929c5bd92fc856fcfbb20"
    hash149     = "f76c1c544405f57d10f43974afeaac6e503dec1e733ab20c3fa768ab3e65edd8"
    hash150     = "a476db62da8d52eff32c691a4ce7ad2f1da553f54bf3d1607669fe2c3d7455c1"
    hash151     = "4bbe889013b67b2ff32c55c1068e30ba22190bf6d19da107e21bde0a00d2ebb1"
    hash152     = "e50ed08e0b3b2fbeae09213595f568c9bb0a03ee9896878e981476bfafc39b04"
    hash153     = "c522f9ccfceae0121885747cd4d534f49b09a40cb04bf34c82bc18e9d4d15be7"
    hash154     = "703ffcabcd728780429b74c21386505761b840a8d22c40e2a2b937cb3d6b22f4"
    hash155     = "56fde4d575e70e40155a071d2e63707621227ac0771713f045b62bd45976a24b"
    hash156     = "0829e2df04f4280551ddb00c252e39952578b7a3585d9acc2f29fe48ed4c0f5d"
    hash157     = "35173606e408e9ad0eefd6f48e28b8a64cde0e488e38b9402e00af119b5c9865"
    hash158     = "273eda164117c58bb4d85a31c3d6735741b95734ead968cea9d0b641c3f42b67"
    hash159     = "c9785994101c7a031e08d3c1d45bdc7e69f18850304a2fedc97c8de4a25c14a1"
    hash160     = "97d4f50ffcb16cb5486a53af15474df90eaa1027e5b3c44383f60174e2c9dabf"
    hash161     = "fc61804b86bcb129eef386c69e45ae0269b67383b9f71653ef95f968778198a5"
    hash162     = "88dcc6028d6262ccb476e3f7f119354df56357ec572bdeeb518fb137186fd4a9"
    hash163     = "d0f7c57125a3b238ed091501bb64a225d25db68b3544322ec08223ffc5b3a315"
    hash164     = "2b46208fc96bc1a9b66a114f9660269d801b7894f95c918746a670844ed93552"
    hash165     = "0b6f2f698531da618aee5d6dc0d12634b6d29cbe8c43e232b1195915f24ce4ec"
    hash166     = "d9ff49362b39740c4ed51930fe66deda72eacb69b817e1c4c582c586981e454f"
    hash167     = "b9726a46a408e2c175d279139e506a3ad829dfa2fc5d4b61dd928917a843ca97"
    hash168     = "db421ffded43625d2b39f35ac85ab0103a90f35c372034f6a113ae1b45a1e2bb"
    hash169     = "a2e40436a87963fc654df432e36dad46b13dd44e1b6a1157ed8913e98369d024"
    hash170     = "61bc0e9aaf048606dce8d3996ccfbb9ee942de5001c0dfac9e2b4640f5557df0"
    hash171     = "dc8f0fdc08dc0efd0f64a979363fc467c8f4712cf94c5d52e7716ea6094bef96"
    hash172     = "cc54c8fe6ab1bb853d1d08c53997b261a54b9c83aa069b10c41d941b940d6287"
    hash173     = "5a9ed2ca51990c5e5872622b19bbd0137d4b7feb45b55ee706b459db396ee901"
    hash174     = "9117d9276bfd4ee70e65ea26f9a22e6e27e68ab85618796ace79dc8597e72ae9"
    hash175     = "db998f950341534a608fea021860ad059e8d1fdf09c92e208c8013be1146e917"
    hash176     = "ef69e4b0aa746a64937c3238ae3f43c8865a2fdb86c9448601a202a70342a0af"
    hash177     = "5b75a3d355934e3ad09c35a3177bc06b92279fac0eeddc1c02ebcf5e0ab7bcd2"
    hash178     = "7223aa55219f8cec665454595ea7c6944b67b0b7ae55d4ac7eec7c9e30f784a9"
    hash179     = "7348f7497e2c2a3945fd328627fc4a2a83058354e9d67b3123e36809fad605ce"
    hash180     = "47938acc386e01eb069439c2b74a40ed7f6d740abb3c82972ad38ccbf02eaaf6"

  strings:
    $s1 = "function ProcessFolder(chickaPath)" fullword ascii
    $s2 = "      Echo(e.description + \"\\n\" + chicka.Path);" fullword ascii
    $s3 = "path = chickaPath + \"\\\\\" + maskArr[i];" fullword ascii
    $s4 = "  var subFolders = new Enumerator(chicka.SubFolders);" fullword ascii
    $s5 = "try { fsoObj.DeleteFile(path); } catch (e) {}" fullword ascii

  condition:
    ((uint16(0) == 0x683c or uint16(0) == 0x0a0d) and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d5223ceb-856f-4137-8c2d-c8dbff9ba96c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion