_20160921_214342143d6b7e971a1c8d2679379cb7_20160921_41f7b3abc606_1554
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_214342143d6b7e971a1c8d2679379cb7.js, 20160921_41f7b3abc606ff1ddad7593361eaa449.js, 20160921_8acd2bde0828f30802ece6249f9b9483.js, 20160921_c42fb5c75aea2648513013ad2eed9aaf.js, 20160921_dc1ff053e9dd688459c33dc98e88d636.js, 20160921_e6b8063519cd61bbba9375bf86215501.js
rule _20160921_214342143d6b7e971a1c8d2679379cb7_20160921_41f7b3abc606_1554 {
meta:
description = "datamaliciousorder - from files 20160921_214342143d6b7e971a1c8d2679379cb7.js, 20160921_41f7b3abc606ff1ddad7593361eaa449.js, 20160921_8acd2bde0828f30802ece6249f9b9483.js, 20160921_c42fb5c75aea2648513013ad2eed9aaf.js, 20160921_dc1ff053e9dd688459c33dc98e88d636.js, 20160921_e6b8063519cd61bbba9375bf86215501.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "8dcc208c118a95c2f88df14e844ed832ee1e06bdf992329e8a721bd7aaa936e8"
hash2 = "53e06a7234c6522ba26a61e46d13312e1063594b0e33bec9fae49d2dc4b77c28"
hash3 = "9cf59fc7ffd1ec7428d01db709ab365cf4dfe41d386ebb308b8bad860ff941b1"
hash4 = "5c8cdf3dbb94e197c36e5744084d12e198ecdab7243d67654934aa1cc9bf7ae9"
hash5 = "18a890096a5714e518b28d3f50f6487cfbc4164418daae1842b7d724e2c26bd6"
hash6 = "70ad2f9c8f844d4c80b1d4ce0f71f62f74e64671ae11d2d3af8e6ec764993403"
strings:
$s1 = "{return \"Yk\";})(),(function fuck(){return \"GJx\";})(),(function fuck(){return \"ZVi\";})(),(function fuck(){return \"Np\";})(" ascii
$s2 = "ion fuck(){return \"IRn\";})(),(function fuck(){return \"OQr\";})(),(function fuck(){return \"Xw\";})(),(function fuck(){return " ascii
$s3 = "k(){return \"Bz\";})(),(function fuck(){return \"CTm\";})(),(function fuck(){return \"Ve\";})(),(function fuck(){return \"UXf\";" ascii
$s4 = "nction fuck(){return \"LGo\";})(),(function fuck(){return \"MBg\";})(),(function fuck(){return \"Qh\";})(),(function fuck(){retu" ascii
$s5 = "\"IPu\";})(),(function fuck(){return \"Ve\";})(),(function fuck(){return \"UXf\";})(),(function fuck(){return \"LGo\";})(),(func" ascii
$s6 = " \"CTm\";})(),(function fuck(){return \"Qh\";})(),(function fuck(){return \"DWe\";})(),(function fuck(){return \"Dc\";})(),(func" ascii
$s7 = "return \"UXf\";})(),(function fuck(){return \"DAa\";})(),(function fuck(){return \"TTs\";})(),(function fuck(){return \"YQt\";})" ascii
$s8 = "eturn \"CCb\";})(),(function fuck(){return \"EHo\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"DRx\";})(" ascii
$s9 = "tion fuck(){return \"XFd\";})(),(function fuck(){return \"Wo0\";})(),(function fuck(){return \"Jo\";})(),(function fuck(){return" ascii
$s10 = "ion fuck(){return \"IPu\";})(),(function fuck(){return \"Ug\";})(),(function fuck(){return \"Zy\";})(),(function fuck(){return " ascii
$s11 = "e\";})(),(function fuck(){return \"Dc\";})(),(function fuck(){return \"LGo\";})(),(function fuck(){return \"TTs\";})(),(function" ascii
$s12 = "Nm\";})(),(function fuck(){return \"Bz\";})()];" fullword ascii
condition:
(uint16(0) == 0x2f0a and (8 of them)
) or (all of them)
}