_20160510_046c9baf9656c4f7f0c625a53aea863d_20160510_0568eb58eb2e_1628

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160510_046c9baf9656c4f7f0c625a53aea863d.js, 20160510_0568eb58eb2ed0d2b21c50167f7e80b9.js, 20160510_06a9bb6d588f91df8f139df7301b5bca.js, 20160510_15a9076aceaad57a48949243c7617c9c.js, 20160510_1d3335f5112e3a3a95c1d03e03e34e5a.js, 20160510_27bf4e76e5b225662bdeb726ab01dacf.js, 20160510_4b2c8a5b3ccc14d7f551bb565eae2132.js, 20160510_4be94e6b4d3f806774308b217d99090f.js, 20160510_639a53c08cb8a60005d89bbff1d7d770.js, 20160510_65d0b1568e35b38cce1f33430d81934e.js, 20160510_750d228799c5ce5cec5795d1c0370a00.js, 20160510_7570f8125f299803052fb485507bc329.js, 20160510_7c8fcc991803cba4fde8b1324d6a50df.js, 20160510_81202a8b9bf2e0dfa034038f22e31d6e.js, 20160510_b28fff980f77127f185e2aa6c54fe60d.js, 20160510_c530587022176dfcef0609f7e8cec4e6.js, 20160510_c72d549a3083bfb5869e0c63c00a9efe.js, 20160510_d768e39b0da51e0a1cfc0c37ce58d3b1.js, 20160510_e580aafd943430f4fd557a53d7004089.js, 20160510_f169aeaae1e35bd053b65a8256f15927.js, 20160510_f444c2bf3fb3ac96034e19d0bdec4047.js, 20160510_f98f0eb3a4653b5b704f81414fa0327f.js, 20160510_fb098746867a2acf47aa435d5668a809.js, 20160511_03207ce3792cee7b2a0994901362c3b5.js, 20160511_03a72de0f53354fb5cf99a4a0f3f0d10.js, 20160511_03bdd88f8e157e08c09f3958f9da9ede.js, 20160511_0613e11e2e3ba82eace99d0f1517ab83.js, 20160511_0b3ddfca6bcbf3d5fe3fae55e2c30239.js, 20160511_10b61782b78e7ce3ac9ecfd9779b8248.js, 20160511_138c2dc25bbf9af2ffd4094bf815a2b4.js, 20160511_14b4e2fc5a4a3e006f9860230cba84c6.js, 20160511_14c816e3f05f4c104520e5619d43d8bf.js, 20160511_160c080c58efaa91904461b790a54f8c.js, 20160511_1c7963842f6096a96f8d65d561d887b6.js, 20160511_22ba4354aba24d94006a028271fee104.js, 20160511_22e388574591363714493498444a8094.js, 20160511_23fb81ca10427c216f33afb13e1d301a.js, 20160511_28a855374a024e0f7509e61b707da291.js, 20160511_3248e9bd02e61856cb12eb1113010b77.js, 20160511_339cdb6c1442a5b87a2798f423e1d4a3.js, 20160511_37c64d7c2971dfe105f8d0bd94b6148f.js, 20160511_3b03f70d49173841d7836e1afb393f9d.js, 20160511_3c5f723bf1b3a18d92b1dd4b18c59972.js, 20160511_42acc190d620ea84cc15f81af66ae6b8.js, 20160511_43327011d73136c65f8d90f22d7d7784.js, 20160511_474f402f9ea23ae6a0b913bcb54f947c.js, 20160511_49e9b68245c8650549cfe1e64cd9350f.js, 20160511_49f8cc8c56b04f52e1f3bc28af603b83.js, 20160511_4c0b1d63efb7f0d194bb1ab689f79825.js, 20160511_4df766ba537190802d2eb80bec45b214.js, 20160511_4fc7f8d18d6f451c5fea725112c25c6e.js, 20160511_518839a18dc101ede4d24d9929d1db49.js, 20160511_5cbfe23a23ec996d434bf48774af38db.js, 20160511_5d41743ec06bdef399860bf245903e5e.js, 20160511_5d51e7cf6b9d7e94c20ceb86e0a60e15.js, 20160511_5e582da6737457aa87aeec308107f1d3.js, 20160511_637b92f5476c5c78f5070887625d97df.js, 20160511_642d05304db0e495b43b844a08d1779d.js, 20160511_6aa810e5b41382bd697f0c91ab754b5c.js, 20160511_6ef57ae9016e44afa214fabd58058c07.js, 20160511_6efc8a433f76b26c22b2d72e312c67b3.js, 20160511_743f92f35d920cd4c5ec2cc0f0b0f643.js, 20160511_748d9ce801dccdd6128ba21bad989f60.js, 20160511_7b8a0226a3a57399ad69241d884576eb.js, 20160511_80986534d1258d888af41691d0e1aeee.js, 20160511_84e8f56e472c8b6b33d30fbe8779d544.js, 20160511_886bac072906dc58f0261bdf573398a2.js, 20160511_89348f58c8e1070f718b964a9b7e94d3.js, 20160511_89546cdc41e261a3c42830375053833e.js, 20160511_89e15803defca850a7bf3341ed086cba.js, 20160511_8a86a20b864abb58d2a002d1063e076c.js, 20160511_8a9f03fccacc658df542851a784490c1.js, 20160511_91598ad06f25388cd66a63055b1b23af.js, 20160511_924cae4054707d7f8e6f6a96aaab998d.js, 20160511_93154fd26cdc317843c9d47516be0841.js, 20160511_9437875ab7eb7e4f8aaaf470ed4eeb11.js, 20160511_9faff3e7fb7fc469bec6f592ddb35a34.js, 20160511_a12ad257da3a0af2dfdd6c5583b6bff2.js, 20160511_a13ee2534ab322d2db936600d8161753.js, 20160511_ac3114770669a60053863ab294a2daa2.js, 20160511_ad0a8ae547b6ab6e2a0e2b183eabc8c9.js, 20160511_c0873d0b20399b1668dd1d83691fcaaf.js, 20160511_c0c91b478ad3a42416e6b0c1469c6122.js, 20160511_c0f3d79c8f5d841e7d671f7730c41a6f.js, 20160511_c37ee59a1f20d7657862f2b90ec9919c.js, 20160511_c3c6fe048170bf1cc3329016927ff803.js, 20160511_c74918f59752ca2cd382419f758b63c1.js, 20160511_ceddb6550b26f8036ca0c68599331330.js, 20160511_d4706ccd5807f0fc5dc2deb7b66d6dd0.js, 20160511_d4bf3fb0552883ad1bfe49b2818dee67.js, 20160511_d90a274e14bd780b45add4fd5c074fe6.js, 20160511_d978e2d01a43948b3fe4e3340ac4750e.js, 20160511_e20de775901392132ffa82e1756386aa.js, 20160511_e384cc4e5263ba9918f8697281e36fdf.js, 20160511_e67cb8e6ad6f44dfd18319e2276c143f.js, 20160511_e95c86bf688816d9596670b26ed6548e.js, 20160511_ea3c37fe8dab3dd96b0e7d9ebde8a53a.js, 20160511_eccfcb46b5d2522a46c0fe3f877972cd.js, 20160511_eccfe86da9aff5bf903f676d92c7794d.js, 20160511_ef0767e741873836fafef5a113386502.js, 20160511_f5e6767a5b26d782e2e120a6918d9fdc.js, 20160511_f7357017f4fb083bdbb5619a91946d96.js, 20160511_fa50b358ad5c20e479a2adbe3473a461.js, 20160511_fc652c8101728a88b77493924428f6cb.js, 20160511_fdeef35ad85ac6bbd2ff837da03026f0.js

rule _20160510_046c9baf9656c4f7f0c625a53aea863d_20160510_0568eb58eb2e_1628 {
  meta:
    description = "datamaliciousorder - from files 20160510_046c9baf9656c4f7f0c625a53aea863d.js, 20160510_0568eb58eb2ed0d2b21c50167f7e80b9.js, 20160510_06a9bb6d588f91df8f139df7301b5bca.js, 20160510_15a9076aceaad57a48949243c7617c9c.js, 20160510_1d3335f5112e3a3a95c1d03e03e34e5a.js, 20160510_27bf4e76e5b225662bdeb726ab01dacf.js, 20160510_4b2c8a5b3ccc14d7f551bb565eae2132.js, 20160510_4be94e6b4d3f806774308b217d99090f.js, 20160510_639a53c08cb8a60005d89bbff1d7d770.js, 20160510_65d0b1568e35b38cce1f33430d81934e.js, 20160510_750d228799c5ce5cec5795d1c0370a00.js, 20160510_7570f8125f299803052fb485507bc329.js, 20160510_7c8fcc991803cba4fde8b1324d6a50df.js, 20160510_81202a8b9bf2e0dfa034038f22e31d6e.js, 20160510_b28fff980f77127f185e2aa6c54fe60d.js, 20160510_c530587022176dfcef0609f7e8cec4e6.js, 20160510_c72d549a3083bfb5869e0c63c00a9efe.js, 20160510_d768e39b0da51e0a1cfc0c37ce58d3b1.js, 20160510_e580aafd943430f4fd557a53d7004089.js, 20160510_f169aeaae1e35bd053b65a8256f15927.js, 20160510_f444c2bf3fb3ac96034e19d0bdec4047.js, 20160510_f98f0eb3a4653b5b704f81414fa0327f.js, 20160510_fb098746867a2acf47aa435d5668a809.js, 20160511_03207ce3792cee7b2a0994901362c3b5.js, 20160511_03a72de0f53354fb5cf99a4a0f3f0d10.js, 20160511_03bdd88f8e157e08c09f3958f9da9ede.js, 20160511_0613e11e2e3ba82eace99d0f1517ab83.js, 20160511_0b3ddfca6bcbf3d5fe3fae55e2c30239.js, 20160511_10b61782b78e7ce3ac9ecfd9779b8248.js, 20160511_138c2dc25bbf9af2ffd4094bf815a2b4.js, 20160511_14b4e2fc5a4a3e006f9860230cba84c6.js, 20160511_14c816e3f05f4c104520e5619d43d8bf.js, 20160511_160c080c58efaa91904461b790a54f8c.js, 20160511_1c7963842f6096a96f8d65d561d887b6.js, 20160511_22ba4354aba24d94006a028271fee104.js, 20160511_22e388574591363714493498444a8094.js, 20160511_23fb81ca10427c216f33afb13e1d301a.js, 20160511_28a855374a024e0f7509e61b707da291.js, 20160511_3248e9bd02e61856cb12eb1113010b77.js, 20160511_339cdb6c1442a5b87a2798f423e1d4a3.js, 20160511_37c64d7c2971dfe105f8d0bd94b6148f.js, 20160511_3b03f70d49173841d7836e1afb393f9d.js, 20160511_3c5f723bf1b3a18d92b1dd4b18c59972.js, 20160511_42acc190d620ea84cc15f81af66ae6b8.js, 20160511_43327011d73136c65f8d90f22d7d7784.js, 20160511_474f402f9ea23ae6a0b913bcb54f947c.js, 20160511_49e9b68245c8650549cfe1e64cd9350f.js, 20160511_49f8cc8c56b04f52e1f3bc28af603b83.js, 20160511_4c0b1d63efb7f0d194bb1ab689f79825.js, 20160511_4df766ba537190802d2eb80bec45b214.js, 20160511_4fc7f8d18d6f451c5fea725112c25c6e.js, 20160511_518839a18dc101ede4d24d9929d1db49.js, 20160511_5cbfe23a23ec996d434bf48774af38db.js, 20160511_5d41743ec06bdef399860bf245903e5e.js, 20160511_5d51e7cf6b9d7e94c20ceb86e0a60e15.js, 20160511_5e582da6737457aa87aeec308107f1d3.js, 20160511_637b92f5476c5c78f5070887625d97df.js, 20160511_642d05304db0e495b43b844a08d1779d.js, 20160511_6aa810e5b41382bd697f0c91ab754b5c.js, 20160511_6ef57ae9016e44afa214fabd58058c07.js, 20160511_6efc8a433f76b26c22b2d72e312c67b3.js, 20160511_743f92f35d920cd4c5ec2cc0f0b0f643.js, 20160511_748d9ce801dccdd6128ba21bad989f60.js, 20160511_7b8a0226a3a57399ad69241d884576eb.js, 20160511_80986534d1258d888af41691d0e1aeee.js, 20160511_84e8f56e472c8b6b33d30fbe8779d544.js, 20160511_886bac072906dc58f0261bdf573398a2.js, 20160511_89348f58c8e1070f718b964a9b7e94d3.js, 20160511_89546cdc41e261a3c42830375053833e.js, 20160511_89e15803defca850a7bf3341ed086cba.js, 20160511_8a86a20b864abb58d2a002d1063e076c.js, 20160511_8a9f03fccacc658df542851a784490c1.js, 20160511_91598ad06f25388cd66a63055b1b23af.js, 20160511_924cae4054707d7f8e6f6a96aaab998d.js, 20160511_93154fd26cdc317843c9d47516be0841.js, 20160511_9437875ab7eb7e4f8aaaf470ed4eeb11.js, 20160511_9faff3e7fb7fc469bec6f592ddb35a34.js, 20160511_a12ad257da3a0af2dfdd6c5583b6bff2.js, 20160511_a13ee2534ab322d2db936600d8161753.js, 20160511_ac3114770669a60053863ab294a2daa2.js, 20160511_ad0a8ae547b6ab6e2a0e2b183eabc8c9.js, 20160511_c0873d0b20399b1668dd1d83691fcaaf.js, 20160511_c0c91b478ad3a42416e6b0c1469c6122.js, 20160511_c0f3d79c8f5d841e7d671f7730c41a6f.js, 20160511_c37ee59a1f20d7657862f2b90ec9919c.js, 20160511_c3c6fe048170bf1cc3329016927ff803.js, 20160511_c74918f59752ca2cd382419f758b63c1.js, 20160511_ceddb6550b26f8036ca0c68599331330.js, 20160511_d4706ccd5807f0fc5dc2deb7b66d6dd0.js, 20160511_d4bf3fb0552883ad1bfe49b2818dee67.js, 20160511_d90a274e14bd780b45add4fd5c074fe6.js, 20160511_d978e2d01a43948b3fe4e3340ac4750e.js, 20160511_e20de775901392132ffa82e1756386aa.js, 20160511_e384cc4e5263ba9918f8697281e36fdf.js, 20160511_e67cb8e6ad6f44dfd18319e2276c143f.js, 20160511_e95c86bf688816d9596670b26ed6548e.js, 20160511_ea3c37fe8dab3dd96b0e7d9ebde8a53a.js, 20160511_eccfcb46b5d2522a46c0fe3f877972cd.js, 20160511_eccfe86da9aff5bf903f676d92c7794d.js, 20160511_ef0767e741873836fafef5a113386502.js, 20160511_f5e6767a5b26d782e2e120a6918d9fdc.js, 20160511_f7357017f4fb083bdbb5619a91946d96.js, 20160511_fa50b358ad5c20e479a2adbe3473a461.js, 20160511_fc652c8101728a88b77493924428f6cb.js, 20160511_fdeef35ad85ac6bbd2ff837da03026f0.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "ad76c936f36f897f9f54a719de29758306a101abb946578e53ed064be085938c"
    hash2       = "517f76a04b704aedf54620fcc9ce3acf1d2b337df9b775f368812bddc1688e37"
    hash3       = "6fef9cb4e6e76c7f188176fd5ab842dd98b59fc0135b57e46bf94fcebe8f03b5"
    hash4       = "283330c8e3d51310eee81be1c6d11820c46d0704458ef8eb3f0359a2001f2635"
    hash5       = "22173c12b8a5754df124cb69d866d9eef2ab28cf7b83b309cd49b4f1bc8d1e3c"
    hash6       = "e6fb0365364fadf5b495b8954d21cff229a02156db114729a9a38f472da06646"
    hash7       = "565493176205b087c5d4a90c450864a58a98438653d9244b8941580a9076adc8"
    hash8       = "932a78ef30ef38ca77630f21509832ea2d0815aeb1c04d68bdd9416997dba02e"
    hash9       = "472bb5ef17f059ebfb1c2f62766d283ec89293144f069aa0d6ff19bea8113fba"
    hash10      = "bbc7b0c3a1f075ac43452662ed488a0500fbe00fb87dc02ed67bbced19432141"
    hash11      = "e4fb0816b4b380b2eadf6c0aad4d16e1fcda1d9d16dff06b11a0760d12b33e3d"
    hash12      = "f02008615995d5b7b1f291737d087bf30c232086387d2300916bb06ea63f0f37"
    hash13      = "736c80a8d2905264ce3c7c4ea3be5876d327b1b2d5243b20b6e07b3bc31980d3"
    hash14      = "d51b3f60e2474306357128d6ba43870b38e6f05a3246ae529f99c3166c8ae0ca"
    hash15      = "c3eb9d35f5c1aa69f839642644e4b62df7377c01d858fed99faf775406510429"
    hash16      = "837222ac367f78d580de55e73de0934bb5be230189466e3e9b68749f01d6c2f4"
    hash17      = "41c267a150d3bd6a4675ad4e920776374e85a15a07414f39156e831c23480682"
    hash18      = "6c06af949b4258fbe59d453699671c65941bbc5444c4a3bdac528e5d1bc5e853"
    hash19      = "cad2e9593d8b4df99312f1d4164b2d6073be16c3c5d0ad780cf8d706d16b140c"
    hash20      = "e90678006086caf28ae4907aeafdf5286010f81450a0cf9a0363885b5d05fc17"
    hash21      = "435232e79c9317502a598460b0a56d2744266bee0088cb2f15bcc13252a4ed9f"
    hash22      = "020596e59f7e081b954937a9398ec19ded374f4b182021597ca25c12fb8f8290"
    hash23      = "66ac518399109da458ccff4fc3db4e26ee18732d139bd6911555819231055f97"
    hash24      = "7ce2a9650f3e9386dae3ec4b82045e2c70e63a87666fe9b95d640de0287c765f"
    hash25      = "3bd1d93525b8a2efb0b3f25ded8cb682537812314f30a116b2cd4072ac856d45"
    hash26      = "89454bdb421a93bbd1531eef8013e06b55375c86cc1426a791799d3eef9bf284"
    hash27      = "3945ac189294a29a2db7550a31a4c08dcde2f0c4ead0a60f10112d058cc57f01"
    hash28      = "67e208d9e22004a8aed39dcda5b5cc17f8714608af0356151da215ce8edc087f"
    hash29      = "e657d5d0a551c047bfd5b9bdf6a459f7694b9b2bf312af27e9abaaf20337a28e"
    hash30      = "2552e5d9c701d2ac015809e499ab3ca33d43563868aef0b03c576eec4618f7ee"
    hash31      = "54e1c373355c38065594306681f49397fe9bcb6dad50b05b1d99b8f8741ad7d9"
    hash32      = "ec56d5846063d7ac544f5a45e16fd68741a00f8d39c7bdd1ede5d73f45a2ec0f"
    hash33      = "de0fe7d0eb4dada0ae08d54bab0e874e109761727048f4bc76ddcff01c97e820"
    hash34      = "249151c1630a7ff9ad74c3de3582050c2b5bccbe458b5f0b059e5b9580a1a3ce"
    hash35      = "fe1495c0a7ce47e20d08614094af3bf7f6f61528d41e88a9c95be7f938ca4b99"
    hash36      = "1bf4c24ff223306b1cc8872972c64cf35d31082ebd5ad3d11ab6478ba9afaded"
    hash37      = "ac07519673bcb7fb3b265b999bcdf5d4ffa17894d4e8fc827a0e8de6947b8872"
    hash38      = "387281eaa5aae9028c3862c3124f8ca68028a01de22ba4be025daeea58acfae8"
    hash39      = "60fb670ca609f0d9740082d2f9075490674737cc21428e6558d278d83ee26f3d"
    hash40      = "a810107022019724446549fd86a3d3814397eed1e925fb3a02c6e041c237a177"
    hash41      = "914265a7a432e080ee193d1c5ed632ce0c382b151a7f785cce03ee5431718cde"
    hash42      = "b3c598a24aa168e05746e356243a7a30284bb0304ee55360db00a8a4eb063646"
    hash43      = "0d3fb5d5a2214e31211d173c0f34cb898dc91470ce25a7df5b984c6702c6cc4b"
    hash44      = "8b85d074a2b3e50fdeed91b0319ec0981bd8b058f0d1b1544bbab907f151c696"
    hash45      = "9a71e9e69f4dac0a4d3fa09b3631fb17291e5e34312a89e94e0e8c0eecad6051"
    hash46      = "5bd8bcb487ae85c52c5f7472b1b780a0ff61418773c9372dc1b782c3790a6f40"
    hash47      = "870052df54b2b3736878bff1ff2f3236f9ffbfd646e88a13a2c81a4b7ab34d0e"
    hash48      = "23c178146d3faa3456632fa4fa8a92fa835913cfb0eadfc01f08e99328c1b6d3"
    hash49      = "b07c6566c36ac4b45bedb9b30bc761b473561abba64a8aef1b266336c5ed7cf5"
    hash50      = "274b1b52123e2866786050831d5e2871e3ae72f68e6bd99ae28dfe9c1b7b08c0"
    hash51      = "4cefc565abe7e604c8184795e749bb8db318cf872e9aec6c3c902f3d953294c0"
    hash52      = "dd5fed344700ea461c40959174d13c1fcd22eeed2e175b5fe9aee772f1ff9a22"
    hash53      = "cbdc090ce3edb740d1deeca268dab00fdbfd6b0fa304668f17a3f6e3810f33b7"
    hash54      = "c5e3ea81e14657fdbff450a0ac22a5955129beb9c1296942454338bb71ed21ef"
    hash55      = "7784b4973cdf7d0393dc960d0ec9625cbfe9e9311537d6cdf298c67c0d5c2b49"
    hash56      = "d5c6db48d5f7f12e74060eaa2e56855648667a972368c95ddeb6b21b4aa2bb29"
    hash57      = "bbaf2b2bd62b017916ae2ec8bdb4e0ed36dcf5c17c740106d8969e3f7762aa9f"
    hash58      = "154ae4b340d685a28c9ac1c83539e1fb7f946acc463cf5ce72b00edb06446d5a"
    hash59      = "43bed5f688f107198d2eb85a2db564fb3ebb1a3a6bbc06d027c2d45bbf4a77ff"
    hash60      = "e331b61a0b8758de72b7f84535d53eb3da408c229161d3666d585dff316271fb"
    hash61      = "e0fffb04b9e53c9b467d4699e2ceccbfddf7dde09e759dbb178dfa9fa4d2e67d"
    hash62      = "291046bb94a4e2beef0e55fac97152d82d4bfc67b90c84160cd1530f5ef880e7"
    hash63      = "0eb0f0d3a4b0282ded2b075ded08f6f61410e675bb6dd80a6afe4b25170ec477"
    hash64      = "214f157db7c3102c03fb76a18f4aa996d85a0fd974f4de2135a80b3db5fe3686"
    hash65      = "1acf35f5ea5d7c5bd38996c4146eadbd488e76ca51fc0284ace7826f940f2096"
    hash66      = "123884d6065de6da414d05f98aefbda3dc4a45e7249a45bbbeb4f490f986f26b"
    hash67      = "6fe9b1e112c9f8f1cf8f9cf274719e5df8398446075d71422a276dfc48a671a2"
    hash68      = "842369f0a463a2d870c82d680bd3fc1714fe1128665698b73d0b8509ba2e8c33"
    hash69      = "ff2ed92908d3b1b2b3d1e6dba7c9e147effbd7b43fad4ee0cd8248c3092891ca"
    hash70      = "208602fa8db4da54b6e0879a8a60b2182fc9da08fd8ae8bd7caa7e12c42bf8cd"
    hash71      = "71e268af89b3eac9b6990e7135c5b197448b562f1fd1189d263f7b6f2a9cf133"
    hash72      = "d29e5746dd6c9dfd19ee613bd23038e1217357286a44f5228fcf24e12a2ef7be"
    hash73      = "573ab660e879bf29c0ad8baef5e11b406bfa53c277409cc294ec5c62276220a5"
    hash74      = "cf413cf59a572e8715534eac4c19c4dc499563cb659780705772aa15f30ab9da"
    hash75      = "38bbb7c0ee6a97ac6925adc944d84b9b1364f7e37b334135a4db10566f76f5fd"
    hash76      = "ca0773fc6085e0436e9e5c27abfb02dba6bc76ad05f4eb73c4c3785fdf6c89e2"
    hash77      = "704170db7864bfa1356548d1efe4628bbc5f8f008eac9ac75b39d390406da541"
    hash78      = "b538172bd503806b547b17841477689c416c54c4ce19961b1349fd0388264156"
    hash79      = "131f8be7ca5511b5b6da102c566ba9111a29b8f7a852f148dd3b986dea63c275"
    hash80      = "34e2d540c8a437aa49d96b32aa3e7421a3d65d41c48e3d8af5f6b174014914bd"
    hash81      = "0086930c24063a7d85b7aeaf021077c4adc283a16549d9575e802a7a6a46fdb0"
    hash82      = "952773d07a2ce995a9895bdd1190c510c86054d0773556aedca8e407a5037eaf"
    hash83      = "4cf524c0f0bf6c8527cc74aa795d2dd3299b0e58f6a20422b690d4a0856c27bf"
    hash84      = "442265e98947f57231c3ec712b4de155b9357642b72a66b754e91ec161cd9e49"
    hash85      = "0d5958274f58ad1b9e8d82f8dfc18f7ba03a3dd899445cc97db2d95e71bf89e1"
    hash86      = "e1af5fd8dccae9f3388ba9e6df1b0d05d4ac5abe3b89b0fa9b7ff7f13dbff7fe"
    hash87      = "028e322828993d05a4f7a707adabe701ff6786cc97d96bdb1678b047b9b5cb29"
    hash88      = "fc8b9684ee87a68e5849d2dd81566dd9408c2af1b2da442a2a327000a06e3841"
    hash89      = "716ab132f14d51f5d5e81ba302c3ecf41b55234348afd1d1f921da177096254a"
    hash90      = "cfb0e892ee8b82a536a43eda82f89046d245aed8bd00774c7414ae33050d881f"
    hash91      = "dfb89ba9b652a70fc50e289c260e5c737b520523aae4813e7e51715bb50c1c40"
    hash92      = "bcf3ffccc998399705b92b86e53eef2bff97efe24349cb3b61f616a18ae0943b"
    hash93      = "b8b66e3c7a5c8b3abe646ad0fe71526c33eae0264565cdd5051fe563deb27feb"
    hash94      = "f3e6408234c1546f0d90cd705303394e7f44736a4a80496856598b1a679d9e28"
    hash95      = "607d097a9d35beccec7f86a88343c873914c6519f7d9bec74a1ea1655a2f2986"
    hash96      = "39ebdb6f7aa0abc5063acd494a0f76808e1b4d07f8146a630955ec88fb15fdac"
    hash97      = "b4669c92c817ba6f63356a104a45ece915af121cc8c5c28c1f2bb9664cad86d2"
    hash98      = "7c24a4fbd5ba402c094cc2f83c1686f777dc2cb7b7aac9fb37b03f574f6ecb8e"
    hash99      = "d7c213103d65f2eb412300cd3d192edf5e97c7c862d6a9fc6296f832ee7512e2"
    hash100     = "b7d80cda2d7bef6f0962c5e78d16ee0590c52607a5832900fbef731eab5b58e4"
    hash101     = "9afe1d883d673be4907182e949e22a464284440000a8b553b807774770730a6e"
    hash102     = "89a473f3192fda2f8641186cf2893dd3bc9e2872f18dc45d5ca3894edf62f1e1"
    hash103     = "62a4f4772fb24957ec1ef145035b01862e832d00e161832c240e8b6f6d8755fd"
    hash104     = "c3ba6dcc47fec03ad984a8e0e307f3c928663dbdb21dc3a2cbfd8d9bdbbfbc9c"
    hash105     = "eec942bdfe69d873deaf0b54531c45823c57cb381ad83724b70c824c49e470d6"

  strings:
    $s1 = "var inauspicious = steadfastness.pop().split(\"" fullword ascii
    $s2 = "String.prototype.heracks = function() {" fullword ascii
    $s3 = "String.prototype.elongated = function () {" fullword ascii
    $s4 = "var offense = this[steadfastness.shift()];" fullword ascii
    $s5 = "var prelude = leasing[steadfastness.shift()](steadfastness.shift());" fullword ascii

  condition:
    (uint16(0) == 0x6c4b and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1869bbae-bd5e-4680-b0d6-3f7d7cd811a5

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion