_20160921_50ddf5c101f65dbae1a99b5967b69eaf_20160921_5f0fd6cffcc7_1722
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_50ddf5c101f65dbae1a99b5967b69eaf.js, 20160921_5f0fd6cffcc723799fdcc54a3c2a7ba5.js
rule _20160921_50ddf5c101f65dbae1a99b5967b69eaf_20160921_5f0fd6cffcc7_1722 {
meta:
description = "datamaliciousorder - from files 20160921_50ddf5c101f65dbae1a99b5967b69eaf.js, 20160921_5f0fd6cffcc723799fdcc54a3c2a7ba5.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "4d3df92f56e6b5cba10c96e8cd182f92f3c10aceaabe5a4530b70d3fc5873feb"
hash2 = "f215df78f73f84c8424edec81b4a9e43c0b766f9010caf095301b900f03214fb"
strings:
$s1 = "urn \"PTi\";})(),(function f000(){return \"Lo\";})(),(function f000(){return \"OUx\";})(),(function f000(){return \"Uo\";})(),(f" ascii
$s2 = "ion f000(){return \"Lp\";})(),(function f000(){return \"XTn\";})(),(function f000(){return \"KXg\";})(),(function f000(){return " ascii
$s3 = "(function f000(){return \"KXg\";})(),(function f000(){return \"MDb\";})(),(function f000(){return \"Sj\";})(),(function f000(){r" ascii
$s4 = "j\";})(),(function f000(){return \"OMd\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Vu\";})(),(function" ascii
$s5 = "rn \"WIj\";})(),(function f000(){return \"RPt\";})(),(function f000(){return \"Qj\";})(),(function f000(){return \"KXg\";})(),(f" ascii
$s6 = "eturn \"KXg\";})(),(function f000(){return \"Lp\";})(),(function f000(){return \"Qj\";})(),(function f000(){return \"XTn\";})()," ascii
$s7 = " f000(){return \"WIj\";})(),(function f000(){return \"RPt\";})(),(function f000(){return \"Qj\";})(),(function f000(){return \"L" ascii
$s8 = " \"MDb\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"TKl\";})(),(function f000(){return \"Kw\";})(),(fun" ascii
$s9 = "Ut\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Lp\";})(),(function f000(){return \"GGn\";})(),(functio" ascii
$s10 = "tion f000(){return \"KXg\";})(),(function f000(){return \"Yi\";})(),(function f000(){return \"Yi\";})(),(function f000(){return " ascii
$s11 = "){return \"Go\";})(),(function f000(){return \"SGs\";})(),(function f000(){return \"TRc\";})(),(function f000(){return \"WIj\";}" ascii
condition:
(uint16(0) == 0x2f0a and (8 of them)
) or (all of them)
}