_20160519_0c7768b626b96e062da0298f09170164_20160519_2ef3aa676abe_1755

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160519_0c7768b626b96e062da0298f09170164.js, 20160519_2ef3aa676abe7d5ff47b748e72b7ce81.js, 20160519_480a2b44cf7132751d866a5d903b204d.js, 20160519_4aa65d2d90cc980408d90f57f1ecd483.js, 20160519_4d069be1b56b7c9a993e49331d260855.js, 20160519_5a972958bcb8905dd30ba3d890f27244.js, 20160519_6edfe2a5643265a8722928dba1c063ee.js, 20160519_7034e44abec95d161000dc812623475f.js, 20160519_7d631fc19885a4668de8f1ba791af9a2.js, 20160519_818f2dac789e1a5d69dabaac0264293c.js, 20160519_86a07e1f69079aa1ca95a10443c1cdcd.js, 20160519_8a2833e4083a494469635c9db3432fd5.js, 20160519_98646d40140f9faf8cc64c1d56d5af81.js, 20160519_9c5df6ed6a40ea1927b01ff6805e8454.js, 20160519_b772da9dfc9b3226e658178b447ba7a2.js, 20160519_d9f9edab9c1395c004c52abdcee50c3f.js, 20160519_e9014d3cdadb43370e0956e366efa0bf.js, 20160520_0369fcca7643daeea86495db08a120bc.js, 20160520_03b3176fc15d133c1d79d647766927ec.js, 20160520_05ea29643e68b713f5089dfbfa76a5c4.js, 20160520_07c54cef0ad508a6caecf211f76b7f9e.js, 20160520_0bcd172f1a8301fda9fd0fb1c280bdca.js, 20160520_113c244285130b23b32a17de816c2404.js, 20160520_12b55a24d4d442867bed1f1ca3fee8ba.js, 20160520_1f79cc635b95c9218485772f2cd79fb8.js, 20160520_212c2bdcca6163ff9520696ddf71281d.js, 20160520_22c9d3991d55b58a2df77061dcac3c9c.js, 20160520_3dc672c91fcb544cb773cf5b5d95b21c.js, 20160520_3f9d39199f0438cfdb37d7ba6894adf3.js, 20160520_417e8ae3de9dcb9aa3332cf545e8711d.js, 20160520_41aef68b7d968760db92b7d5d03d2b1b.js, 20160520_477303521038bf4da1d4e42b7b7bfb6d.js, 20160520_49c5f9c466bd349b2c2cb1f5163031f7.js, 20160520_57ee48b6c56a36281c95a7341c60f36c.js, 20160520_680ce4ea288a2cce53791f55452e7c01.js, 20160520_6d8c59443c9745239781c1966ecf26a9.js, 20160520_8fd61fd5df6df33b94b1417fd999ac4b.js, 20160520_976131621886721413c199915a22368a.js, 20160520_a255f23bc1439c5390ce87a174231d04.js, 20160520_aa6170d9f70806420fdb07e8213f0b44.js, 20160520_b98158edcfdf2a61d715e80d51c1ee07.js, 20160520_d5692e6bdbc2f60a27663505a8fa39ae.js, 20160520_d8a791b6a9eb0bf39f74dd302ce22ea4.js, 20160520_dc6a05df9376e131b6edf22bdd3ed1ca.js, 20160520_e2e61815143b32ff54e177e4968b731a.js, 20160520_e596c5ba16295c123317b88f8f3f2481.js, 20160520_f21b7ae73069c3ea15ccdbb9e142475a.js

rule _20160519_0c7768b626b96e062da0298f09170164_20160519_2ef3aa676abe_1755 {
  meta:
    description = "datamaliciousorder - from files 20160519_0c7768b626b96e062da0298f09170164.js, 20160519_2ef3aa676abe7d5ff47b748e72b7ce81.js, 20160519_480a2b44cf7132751d866a5d903b204d.js, 20160519_4aa65d2d90cc980408d90f57f1ecd483.js, 20160519_4d069be1b56b7c9a993e49331d260855.js, 20160519_5a972958bcb8905dd30ba3d890f27244.js, 20160519_6edfe2a5643265a8722928dba1c063ee.js, 20160519_7034e44abec95d161000dc812623475f.js, 20160519_7d631fc19885a4668de8f1ba791af9a2.js, 20160519_818f2dac789e1a5d69dabaac0264293c.js, 20160519_86a07e1f69079aa1ca95a10443c1cdcd.js, 20160519_8a2833e4083a494469635c9db3432fd5.js, 20160519_98646d40140f9faf8cc64c1d56d5af81.js, 20160519_9c5df6ed6a40ea1927b01ff6805e8454.js, 20160519_b772da9dfc9b3226e658178b447ba7a2.js, 20160519_d9f9edab9c1395c004c52abdcee50c3f.js, 20160519_e9014d3cdadb43370e0956e366efa0bf.js, 20160520_0369fcca7643daeea86495db08a120bc.js, 20160520_03b3176fc15d133c1d79d647766927ec.js, 20160520_05ea29643e68b713f5089dfbfa76a5c4.js, 20160520_07c54cef0ad508a6caecf211f76b7f9e.js, 20160520_0bcd172f1a8301fda9fd0fb1c280bdca.js, 20160520_113c244285130b23b32a17de816c2404.js, 20160520_12b55a24d4d442867bed1f1ca3fee8ba.js, 20160520_1f79cc635b95c9218485772f2cd79fb8.js, 20160520_212c2bdcca6163ff9520696ddf71281d.js, 20160520_22c9d3991d55b58a2df77061dcac3c9c.js, 20160520_3dc672c91fcb544cb773cf5b5d95b21c.js, 20160520_3f9d39199f0438cfdb37d7ba6894adf3.js, 20160520_417e8ae3de9dcb9aa3332cf545e8711d.js, 20160520_41aef68b7d968760db92b7d5d03d2b1b.js, 20160520_477303521038bf4da1d4e42b7b7bfb6d.js, 20160520_49c5f9c466bd349b2c2cb1f5163031f7.js, 20160520_57ee48b6c56a36281c95a7341c60f36c.js, 20160520_680ce4ea288a2cce53791f55452e7c01.js, 20160520_6d8c59443c9745239781c1966ecf26a9.js, 20160520_8fd61fd5df6df33b94b1417fd999ac4b.js, 20160520_976131621886721413c199915a22368a.js, 20160520_a255f23bc1439c5390ce87a174231d04.js, 20160520_aa6170d9f70806420fdb07e8213f0b44.js, 20160520_b98158edcfdf2a61d715e80d51c1ee07.js, 20160520_d5692e6bdbc2f60a27663505a8fa39ae.js, 20160520_d8a791b6a9eb0bf39f74dd302ce22ea4.js, 20160520_dc6a05df9376e131b6edf22bdd3ed1ca.js, 20160520_e2e61815143b32ff54e177e4968b731a.js, 20160520_e596c5ba16295c123317b88f8f3f2481.js, 20160520_f21b7ae73069c3ea15ccdbb9e142475a.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "978ddda8e8b34276b3453d03a593fc2c60473b41df5a1e90ea59edb2321b0055"
    hash2       = "bffeeca36fdfc77bb64ad80db0dc3a31688425ea19de4367544a1938913666cf"
    hash3       = "acca6b14b6f765530fc7ef9a8dbbb0bc0d649de98bdf77e03492c9a1e86f31b6"
    hash4       = "59f0a60ca57b47525eb0c611ffa22e15d17b4c557d7c47dab2683318315d2f5b"
    hash5       = "bda556937a2a2bfa98c5b05a671a10cbf1ac2ce6e59825be4a26c87d70790c70"
    hash6       = "3d5161d0478faff8800ee60b0fc4e34714a7af4b32bed7e9c0fb761387008723"
    hash7       = "493e8b1fa3426b766ea7233f481c909f5077a748d33647f7ea81f26f08140873"
    hash8       = "7b4dcb34e6f587230dc30677fe5c7741c4927fb572b7c2f436b17432baee5182"
    hash9       = "01912353c4fce53048e82e0cbaa56926c3718fa19dbc6c66ae99de584448a0e8"
    hash10      = "4eb01ecd8ec3b604526b8a96c6460a357352ebab4e424762fca260d080036412"
    hash11      = "6f4e3f2c1b1d5e3186e392a608364f3aeded4d11974b1643b0801e6ee99cef0a"
    hash12      = "f788519ffe1b377c93966560a7c00391475d32f98dc7a1d67b1d591c6567f19d"
    hash13      = "651e19b36e51877e6c76a0c209244f5d40fff49d5693cd4858497d7ef15dc058"
    hash14      = "184e2c29bf1ba163c28837c2837641a72d5f8475ed4877eb6171924f141f8008"
    hash15      = "c897602c8de8dfa50e80ecc9cd06b9097a3fa26d16dc873cb3390207dd5e8421"
    hash16      = "90c4ac4d978d01d5942ca55d25e3c2ddfa82a860fa4b693b3ab79507eebb0283"
    hash17      = "7e82e7ebd079e6fcadc1b1904fea41f6243649487feae1085294bb239eb096df"
    hash18      = "f635f1925cb743e087acb25faaa7902c9e6fdc4e189f4f18f3cdd208cf8693b1"
    hash19      = "a8c4c9bfe7a92097d8b44457771dc0d92c897fcdae60ebae34a03d1be7ad5dd9"
    hash20      = "0d33409a4aceba85d9f25dd90edd96e6c27c332457ca3904d3cfb5b2d17751de"
    hash21      = "36cc3caab48c48ff1811b6e98a8a2d88b6002321736d335669d2a16581acc28e"
    hash22      = "d8ad670f6e437258f28bca0301fa6f4b14f9c186ef90bcf4958f61e4daeb511b"
    hash23      = "c8b402d4577d8b007ecb09339f4f096d743fb3b3adcf910187f1e12d4029c3d3"
    hash24      = "ff1558d33aa4bf73d5cdb9e53c1c404403d836f8c6a104a0d65decdfdb8e83ab"
    hash25      = "27880246f02800a3b46ee8ca4b85c632dfe081e7c569ee1fe8dbf552167deb46"
    hash26      = "842b56e4ce282b43d52ed060a25a3f1556c54198bb34f53dc16ac374d0e87a96"
    hash27      = "c711218380751d23b596525338a9e444bf060d57b128f88704c05441387e30a9"
    hash28      = "6f1a2f538eadc87b17eaf5005bf33b95682721a63cfaeb4f864a06aea0df31b8"
    hash29      = "1dde3a38dbba464da2f2aff8d418d1eda0e4611584ac3adffe95c30ea3f4db2f"
    hash30      = "10446bfdcb91524fb376b34afb198e20204bea1c712e951458068fb40f8f66c2"
    hash31      = "3d81e70ddedb12fe58c216a48d61fffbf95b1cbe34bf008676107886651dc171"
    hash32      = "91c8bb68795607b18c9bd614ca33ec04ca21f81bb6a579d1cc7965654eb94ae6"
    hash33      = "f845647cfce59a992d58905c156961de178d327e38df0de81324fd69269f8f04"
    hash34      = "7f80d4983efead5eadec8fe4f2b307bbdb41f3bd349d2c9d65c7383e9816d3f0"
    hash35      = "8cf7effe9b918f82f8c4f696ed818c39ab61e61da138a80aa481733ffbed5ff5"
    hash36      = "ecb2bb16edd9301efa896fa6b782bacda585d871141bb035767ca391e745b8bd"
    hash37      = "b1cf50b9149d6c8d5b3daec22d025c24923b7647031ecb80cbc22feb3b36ffe2"
    hash38      = "e2a38f552fd1e809b2a37c5f93fe13d87505d21f7fef39679e739ffab540eeb5"
    hash39      = "f58665eec31640e2b77ad4692f3e8031d51f5bb53773777cdf7194bbb8b510ae"
    hash40      = "4399347d6ee683a3ec035b5db6e31469e605785267429f6e77dbc1baca0f876b"
    hash41      = "23c38db6adcacbdbd500c86c7454dcf15265b2ef004fba09715c6ef4e5f0e919"
    hash42      = "ebf789f4cdcbf791ddd21816625ff5b6054c017296ba7d8d3a0d7897913828c7"
    hash43      = "6153c5bf57790d4854618e40dbd3bdaddb88db4efed8c40d6d9996199ef47015"
    hash44      = "25ae6b76ec12c5cb7cdda338c036d025a67eb97b374e929b33e1898585e66470"
    hash45      = "205b3bff9ecc6e218ec044d2644ce14e68f974ab63313ae7c9fc10f974d6fa33"
    hash46      = "6fab40e6996f59c5f9c7a99847de2ced7fbaf8cf64338ad324edd607a26e9c4e"
    hash47      = "37c9c83ab7dc8da0f43fc80e24c9eac6b7048b33e4381dd8037d82f2b49fa623"

  strings:
    $s1 = "var protect = options.protect;" fullword ascii
    $s2 = "var object = initialize || legacy;" fullword ascii
    $s3 = "var afterImplement = options.afterImplement || function(){};" fullword ascii
    $s4 = "var legacy = options.legacy;" fullword ascii
    $s5 = "generics = (generics !== false);" fullword ascii
    $s6 = "var name = options.name;" fullword ascii
    $s7 = "var initialize = options.initialize;" fullword ascii

  condition:
    (uint16(0) == 0x6176 and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

dac2f31a-1f7b-41d8-b915-d08fdd42afb9

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion