_20160921_48288731baa006b25b4e98b12520da2b_20160921_5c25506bc44b_1713
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_48288731baa006b25b4e98b12520da2b.js, 20160921_5c25506bc44b50a0c8028dec6521139d.js, 20160921_fc08be0621d4ffbced0eaca2b2622b07.js
rule _20160921_48288731baa006b25b4e98b12520da2b_20160921_5c25506bc44b_1713 {
meta:
description = "datamaliciousorder - from files 20160921_48288731baa006b25b4e98b12520da2b.js, 20160921_5c25506bc44b50a0c8028dec6521139d.js, 20160921_fc08be0621d4ffbced0eaca2b2622b07.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "ce917015afcf31459cc47b8864f85394a756701f6338f6a2cbe079779c3ecd43"
hash2 = "b6178db9a292199c6992547ad654bf7056fa7f33310f29988e468f0cad5ed707"
hash3 = "1641412d2cba74b5cd1b4c4619c995601c42039d472339eb7cb10d97e1d47339"
strings:
$s1 = "ion fuck(){return \"IPu\";})(),(function fuck(){return \"Nm\";})(),(function fuck(){return \"MUs\";})(),(function fuck(){return " ascii
$s2 = "\"Xg\";})(),(function fuck(){return \"OQr\";})(),(function fuck(){return \"Ve\";})(),(function fuck(){return \"Yk\";})(),(functi" ascii
$s3 = "ction fuck(){return \"Xg\";})(),(function fuck(){return \"NKq\";})(),(function fuck(){return \"GNm\";})(),(function fuck(){retur" ascii
$s4 = "return \"Nm\";})(),(function fuck(){return \"Wo0\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MBg\";})(" ascii
$s5 = ",(function fuck(){return \"LGo\";})(),(function fuck(){return \"Jo\";})(),(function fuck(){return \"MOj\";})(),(function fuck(){" ascii
$s6 = ",(function fuck(){return \"CTm\";})(),(function fuck(){return \"Oh\";})(),(function fuck(){return \"Jh\";})(),(function fuck(){r" ascii
$s7 = "n fuck(){return \"Ve\";})(),(function fuck(){return \"Yk\";})(),(function fuck(){return \"Wo0\";})(),(function fuck(){return \"O" ascii
$s8 = "Bz\";})(),(function fuck(){return \"CTm\";})(),(function fuck(){return \"CTm\";})(),(function fuck(){return \"GNm\";})(),(functi" ascii
$s9 = ",(function fuck(){return \"Ug\";})(),(function fuck(){return \"Dc\";})(),(function fuck(){return \"YAv\";})(),(function fuck(){r" ascii
$s10 = "on fuck(){return \"Pc\";})(),(function fuck(){return \"Ve\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"F" ascii
$s11 = "){return \"Wo0\";})(),(function fuck(){return \"MOj\";})(),(function fuck(){return \"NKq\";})(),(function fuck(){return \"GNm\";" ascii
condition:
(uint16(0) == 0x2f0a and (8 of them)
) or (all of them)
}