_20160915_031b2b2a81760f73383b635c23771175_20160915_09cc9049dcb7_1756

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160915_031b2b2a81760f73383b635c23771175.js, 20160915_09cc9049dcb7854af521f329071bc356.js, 20160915_0bcc48d7fb02efaa1bab6e89b146f764.js, 20160915_0cbc5e3cde8dfafdcf5f9a80ee549c4d.js, 20160915_14b427a7401efd15ad40ab38a0ff0849.js, 20160915_1ab5eea58d67b59b8bf85a14e127cae9.js, 20160915_1ad28d5610071216ac29ddcaa056880d.js, 20160915_25453e40d36267aa653c39884dbaf029.js, 20160915_2d7493b430a6a7ded0ec7bb2829875df.js, 20160915_2dac283017b473810bd9995ccd419291.js, 20160915_2f3e4aa77572ae4fe510d497cb691053.js, 20160915_2f9a6bb32c1e3adca1ab551eae40ddc6.js, 20160915_3138739031b0a3053454b4b54fa31d03.js, 20160915_35fff4dd7710d00d440aa73d31a44612.js, 20160915_3887a6f0c7611768b2610637f181ccba.js, 20160915_38b42036e244dad74594138f28e607c4.js, 20160915_39df74c32a70a1d59f4668d879424c64.js, 20160915_3ac599a2656c8a574bb03414b42722d1.js, 20160915_3e7b051bbda45e65bf88bf42689e8f14.js, 20160915_3f4927acac117aec9d450b559f618f0e.js, 20160915_43d1b5992960a365931311fc1ededd9e.js, 20160915_46b86e8cbb6ae8010af5549b34417ce2.js, 20160915_4733e2adf91cd7e98c4c4cf8a7a36fc8.js, 20160915_4bd4bee0075033a2133576b18c2529a8.js, 20160915_4c4e6c5e00e3fbb2db1ba4cea397d7e0.js, 20160915_4e6a9e8159606cd19174d31dbeadf180.js, 20160915_542ee961b0e8a41e992c0e6a8e5d6061.js, 20160915_54664743d64bd834a37e27e50f7bd091.js, 20160915_559168ed0abccd0006b29eebf90846e9.js, 20160915_5b5e33f74cdc72151481d69a447456c0.js, 20160915_5bb501fc0bd2c7d01a83e881e436aeac.js, 20160915_5dbd71728039527f585cb0dc9aa1ba12.js, 20160915_5ebb373f7417c0d8a71ae91f55f0b640.js, 20160915_652dd2f63e47b715beab470e06f5d476.js, 20160915_66e4778283750d86c62e075946c7088a.js, 20160915_679b639909db09724ceca828b50ef7c9.js, 20160915_69630d6e9a244df7b54992f16f58ddbb.js, 20160915_69e69240c0457ca9e319e312de0d9424.js, 20160915_6ba7c0e817ee7dc592ca1bf53361fd2a.js, 20160915_6ce12dc0d31c66ca0662de60890a3642.js, 20160915_6ce34221d9d4beed8d28eb68dcf8b9a8.js, 20160915_6ff02bf870ac99f6b1afa3cdb3fb1ca4.js, 20160915_7174a51df35cc59b7d2bec8d9d14fdc4.js, 20160915_75eaa017630ada44eed2960813493f35.js, 20160915_76291509f5d2d8000b416d69e2acd901.js, 20160915_76402afc437d41c49a73fbcd62fcabee.js, 20160915_7baa49c55174103eee457eaa548806ef.js, 20160915_7e973ac6b0539ffc8c93565b1843bd55.js, 20160915_7f10bbf26df5e52edd57ae0f085cec55.js, 20160915_82945f93a0a43f057cfdebd36db0242d.js, 20160915_8cc5b00c512f7d9e15ce63ffd187378b.js, 20160915_8d5a66377fb7a4d35283060de78a4825.js, 20160915_8e5f16477164da6b7c40d59b72bd4ab5.js, 20160915_8e7ba82d8eeb3ba926b3548f8014d431.js, 20160915_93ef39077c6e7ab43365d3b16cbfd471.js, 20160915_95ce916c57b26b66605e108f2092ec35.js, 20160915_99f4f15923c00f81bf562e27722726d5.js, 20160915_9c849e8c126714a84218d4d8a1d9bea5.js, 20160915_a05b912e01b446bf7cef2f2ad9b145cf.js, 20160915_a073be0ac0bd8d151062f5b26271851d.js, 20160915_a20dd98b9cf755472f84d89cede170c0.js, 20160915_a27a7b49ee8c19c13cb1a1825e629ed3.js, 20160915_a526b370039c444e5a32f1daef4748ef.js, 20160915_a53ba98efd6399432401026406a0fa5e.js, 20160915_a6e2117eabfad705f1de54bb6abd3a04.js, 20160915_a845624b0c6d2174b6431378698cf353.js, 20160915_aa44c7754f7742e2c5e8249bd72d031d.js, 20160915_ac595b9c92361ccb910c06f40971de33.js, 20160915_af1e760fb21931d32c4ebdfa010abfe7.js, 20160915_b29b6fec8831ed435dcc1449502f6ce7.js, 20160915_c2afafc149146ec3fe4b2f77630e5b8b.js, 20160915_c5850254453b8d3c32118ce424274c89.js, 20160915_d253c2fb05fa8fd44c3718e3ba26c33a.js, 20160915_d53bbc3a7c2dc3f587e616aeba0625d4.js, 20160915_d654a7fe77fd0165161393adff1c29bb.js, 20160915_d7130e40f654774dba0478485fd16e14.js, 20160915_dd6e83782ed59ba4795315a24f6f6899.js, 20160915_e42c656dd1d7d7c6298e27e335dcbdc5.js, 20160915_e473b954e609eadc4b3a7ca7003e0daa.js, 20160915_e78ad8958dd4f4b470bd04ddd121e638.js, 20160915_e797fc954b8ecef8b20dcc8c48394ff8.js, 20160915_ebd88fb6b0efc4a100027a7a3a1aad21.js, 20160915_ebf8eaea31192c428485aa82e55bcf9d.js, 20160915_eef47bf6f9e4747a9b288f146cc9b0be.js, 20160915_efc366d01cc06469e3afc0cd4d772372.js, 20160915_f46fac34f62b4590c34a26b187912130.js, 20160915_f51d9dbac555aa0a9c962b8ad93cb045.js, 20160915_f73d7eada3663c6b75e7ce034ea4079f.js, 20160915_fb1dbdd2869c79c3a6ac0451857c24d0.js, 20160915_fbaec4782542d82d23019ff2d00933b0.js, 20160915_fc6b9b57605c6a3970086275e9d7f1e1.js, 20160915_fe2ec371441931018c1083887b29b5c9.js, 20160916_18cac1f2bbd13eb67df67ad0a2e0b305.js

rule _20160915_031b2b2a81760f73383b635c23771175_20160915_09cc9049dcb7_1756 {
  meta:
    description = "datamaliciousorder - from files 20160915_031b2b2a81760f73383b635c23771175.js, 20160915_09cc9049dcb7854af521f329071bc356.js, 20160915_0bcc48d7fb02efaa1bab6e89b146f764.js, 20160915_0cbc5e3cde8dfafdcf5f9a80ee549c4d.js, 20160915_14b427a7401efd15ad40ab38a0ff0849.js, 20160915_1ab5eea58d67b59b8bf85a14e127cae9.js, 20160915_1ad28d5610071216ac29ddcaa056880d.js, 20160915_25453e40d36267aa653c39884dbaf029.js, 20160915_2d7493b430a6a7ded0ec7bb2829875df.js, 20160915_2dac283017b473810bd9995ccd419291.js, 20160915_2f3e4aa77572ae4fe510d497cb691053.js, 20160915_2f9a6bb32c1e3adca1ab551eae40ddc6.js, 20160915_3138739031b0a3053454b4b54fa31d03.js, 20160915_35fff4dd7710d00d440aa73d31a44612.js, 20160915_3887a6f0c7611768b2610637f181ccba.js, 20160915_38b42036e244dad74594138f28e607c4.js, 20160915_39df74c32a70a1d59f4668d879424c64.js, 20160915_3ac599a2656c8a574bb03414b42722d1.js, 20160915_3e7b051bbda45e65bf88bf42689e8f14.js, 20160915_3f4927acac117aec9d450b559f618f0e.js, 20160915_43d1b5992960a365931311fc1ededd9e.js, 20160915_46b86e8cbb6ae8010af5549b34417ce2.js, 20160915_4733e2adf91cd7e98c4c4cf8a7a36fc8.js, 20160915_4bd4bee0075033a2133576b18c2529a8.js, 20160915_4c4e6c5e00e3fbb2db1ba4cea397d7e0.js, 20160915_4e6a9e8159606cd19174d31dbeadf180.js, 20160915_542ee961b0e8a41e992c0e6a8e5d6061.js, 20160915_54664743d64bd834a37e27e50f7bd091.js, 20160915_559168ed0abccd0006b29eebf90846e9.js, 20160915_5b5e33f74cdc72151481d69a447456c0.js, 20160915_5bb501fc0bd2c7d01a83e881e436aeac.js, 20160915_5dbd71728039527f585cb0dc9aa1ba12.js, 20160915_5ebb373f7417c0d8a71ae91f55f0b640.js, 20160915_652dd2f63e47b715beab470e06f5d476.js, 20160915_66e4778283750d86c62e075946c7088a.js, 20160915_679b639909db09724ceca828b50ef7c9.js, 20160915_69630d6e9a244df7b54992f16f58ddbb.js, 20160915_69e69240c0457ca9e319e312de0d9424.js, 20160915_6ba7c0e817ee7dc592ca1bf53361fd2a.js, 20160915_6ce12dc0d31c66ca0662de60890a3642.js, 20160915_6ce34221d9d4beed8d28eb68dcf8b9a8.js, 20160915_6ff02bf870ac99f6b1afa3cdb3fb1ca4.js, 20160915_7174a51df35cc59b7d2bec8d9d14fdc4.js, 20160915_75eaa017630ada44eed2960813493f35.js, 20160915_76291509f5d2d8000b416d69e2acd901.js, 20160915_76402afc437d41c49a73fbcd62fcabee.js, 20160915_7baa49c55174103eee457eaa548806ef.js, 20160915_7e973ac6b0539ffc8c93565b1843bd55.js, 20160915_7f10bbf26df5e52edd57ae0f085cec55.js, 20160915_82945f93a0a43f057cfdebd36db0242d.js, 20160915_8cc5b00c512f7d9e15ce63ffd187378b.js, 20160915_8d5a66377fb7a4d35283060de78a4825.js, 20160915_8e5f16477164da6b7c40d59b72bd4ab5.js, 20160915_8e7ba82d8eeb3ba926b3548f8014d431.js, 20160915_93ef39077c6e7ab43365d3b16cbfd471.js, 20160915_95ce916c57b26b66605e108f2092ec35.js, 20160915_99f4f15923c00f81bf562e27722726d5.js, 20160915_9c849e8c126714a84218d4d8a1d9bea5.js, 20160915_a05b912e01b446bf7cef2f2ad9b145cf.js, 20160915_a073be0ac0bd8d151062f5b26271851d.js, 20160915_a20dd98b9cf755472f84d89cede170c0.js, 20160915_a27a7b49ee8c19c13cb1a1825e629ed3.js, 20160915_a526b370039c444e5a32f1daef4748ef.js, 20160915_a53ba98efd6399432401026406a0fa5e.js, 20160915_a6e2117eabfad705f1de54bb6abd3a04.js, 20160915_a845624b0c6d2174b6431378698cf353.js, 20160915_aa44c7754f7742e2c5e8249bd72d031d.js, 20160915_ac595b9c92361ccb910c06f40971de33.js, 20160915_af1e760fb21931d32c4ebdfa010abfe7.js, 20160915_b29b6fec8831ed435dcc1449502f6ce7.js, 20160915_c2afafc149146ec3fe4b2f77630e5b8b.js, 20160915_c5850254453b8d3c32118ce424274c89.js, 20160915_d253c2fb05fa8fd44c3718e3ba26c33a.js, 20160915_d53bbc3a7c2dc3f587e616aeba0625d4.js, 20160915_d654a7fe77fd0165161393adff1c29bb.js, 20160915_d7130e40f654774dba0478485fd16e14.js, 20160915_dd6e83782ed59ba4795315a24f6f6899.js, 20160915_e42c656dd1d7d7c6298e27e335dcbdc5.js, 20160915_e473b954e609eadc4b3a7ca7003e0daa.js, 20160915_e78ad8958dd4f4b470bd04ddd121e638.js, 20160915_e797fc954b8ecef8b20dcc8c48394ff8.js, 20160915_ebd88fb6b0efc4a100027a7a3a1aad21.js, 20160915_ebf8eaea31192c428485aa82e55bcf9d.js, 20160915_eef47bf6f9e4747a9b288f146cc9b0be.js, 20160915_efc366d01cc06469e3afc0cd4d772372.js, 20160915_f46fac34f62b4590c34a26b187912130.js, 20160915_f51d9dbac555aa0a9c962b8ad93cb045.js, 20160915_f73d7eada3663c6b75e7ce034ea4079f.js, 20160915_fb1dbdd2869c79c3a6ac0451857c24d0.js, 20160915_fbaec4782542d82d23019ff2d00933b0.js, 20160915_fc6b9b57605c6a3970086275e9d7f1e1.js, 20160915_fe2ec371441931018c1083887b29b5c9.js, 20160916_18cac1f2bbd13eb67df67ad0a2e0b305.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "15e0385b21c2cd45218a9a5a467c524b8a3ad30f0020fb22f91d64e78e303e3b"
    hash2       = "5ebd63c877cfb6f94ed785b780f02c7fae3b6ab52bb4c9ec8bd76b0d6a2d6656"
    hash3       = "27789f4af47a3d5e11068052c151dbe80d62e6c90a544a49d79ea47157978225"
    hash4       = "1ba91d27d5a5780bc846855b630ab72ad4e326b67c703716ebdff64e75f15086"
    hash5       = "a589a0cb92cd37d606bbf0396a3f1edd1268e6af22dc257c0fd2c685018f5193"
    hash6       = "6f48af0b2f44c23dd12e958573c329734c2d5756fa942cde94d8524ebc19a68b"
    hash7       = "115386d0685a70c037c3f632de838675b8091b065273f90dbe61abf168862948"
    hash8       = "741bd6fc6bd5ab5222d3d016b062c090bdfb056460459e286222964b408d9134"
    hash9       = "1d3b60973b7c92b1a7102eb9c7d0b1445fefcc98e430b69cd75c2112096add36"
    hash10      = "04869f367178b89d4a2f1336c13f9d3f0988bb9cf99f55815095ec3fd31a1d5f"
    hash11      = "cb451d09347ca035d37375cd3d5dd82d7d12a6ab59574677849ee8b9a4fb12b1"
    hash12      = "fbc1c63aa90704b1c6751004031b52ef9f2e060fabe4f93760aeb2cadfc007c6"
    hash13      = "6ec5e6fcb1777af4d0367fd89d5326af3d8cdfdb9490c4c1661eddd17c73e998"
    hash14      = "87ccb580dd44abd3a81ce023b03f8a644f930c5ed00179b1636d3c4936c64975"
    hash15      = "c73f148ce1d8b576ea5c9869097f12d084ee825f50c5eb74e88ebef55079eee2"
    hash16      = "46ecffd88b49b36d4b5a6d1a330c9b4f7cba8538e89f668d79484f8a653ce03d"
    hash17      = "5a72b875619e81a2768c8a6a3d5802f933e4c29052cebf0a7f9ef5eec03f2cb2"
    hash18      = "c9fc1d7fa5e3853d10a9a4fe89d7a809b019e4e7961b894be69dbe855683e166"
    hash19      = "464f0b45d0702701dca92c9b759dda355f0d13eeabfa8b940c16ebb845340dc1"
    hash20      = "7c74fdf82b9b048ac82b2662f1fac570487f8fe119227b3c86943b692250cf08"
    hash21      = "3d28a083eeb650100b143340e94a574772dcd9cb0a4972e83028257b9db05116"
    hash22      = "c82f75429ab5aa898b0dfa6583eae77cb06d77343428b56b75647207de7ba738"
    hash23      = "82c28e1db99881f0b755d10971d49e2de59b2c8f7b03d621f85087db74c1b161"
    hash24      = "24f6c1f343ed252e3a74eb3a9276e5bc81b424656ca8b69bc2ebda8e26550a81"
    hash25      = "096eb5863fb070ce3ba1cc9b25371fea21a893ee2c6efe381bce57b708acb7a8"
    hash26      = "9153428a1f2143f90e170bc795f9bc9754e40af95dde0a2938aa46f46d63d364"
    hash27      = "87c4fed5a397906e3a4b4d998e177a50ed9f03fc9e0b3d9c3e3bb9bc78d2e1ff"
    hash28      = "0dcf7d3d471056e1dfa450bf1cfd00caa64ed716c3e7ca2bbebed8c2af55d76b"
    hash29      = "d6ec31156daf1f567ed58c7ce44061ce5b669830a06195447ab779a03d438394"
    hash30      = "4306e80d19a91b60d1c427d6c74979f9908a7e7d5dc853549028dc3fc8e7cad0"
    hash31      = "6b210a5fb676dc333a3cae28bdf31a6c6e41e7ca60efb72674465dceab4a23ba"
    hash32      = "7d14c804054de0f26cba2649cf729df8368af9111c35834c2c76202b5b1b296e"
    hash33      = "f9a675a240629587d3b72eacd12f171c2a99a730c564d160194aa4f7b72a03bc"
    hash34      = "41e31358cf3e540e3b6d1249937bd0bfedb1116a4ca865f6becbe83bacb84762"
    hash35      = "fb44e75988d27d06cbfd2fc31c5d65a488669279617188a65ba14c2a30a67e51"
    hash36      = "29861ae54d2d14f7e70aa90cbf8f745a26b7b7787f418ff5dea7695dcbb174e7"
    hash37      = "50f3fc02dbb4c1a6e46f413a3a9e341645a5a1b62a1c2f69a65db5a01d005aa9"
    hash38      = "67b70abd444ad3b0c8aff4ccbc9172c5c9eee59955fa65e9e1641be62ed0fe65"
    hash39      = "3245cf99876e45110604d80cf0bcf3f59cebfae20ee5f1544afca0c2c058cb56"
    hash40      = "c09e951e6d1819d9f8b18939a1e4967b6a644b7515b38c8d3b79cd32783e7de5"
    hash41      = "b13b91158f09e6304f716d8c8b43a470e1db6aef870a363797cd57d50d406d39"
    hash42      = "198636334e30cca2d147e4d078faeea68d75d276c38d454766d7fa14fd6f9a9b"
    hash43      = "c423cde4d1486701ce7095e547eabb661d18c4535a298b141a6d8a3ea1e7a17f"
    hash44      = "415aa6e4929b32fb215a63a4fe03b5f21f72edd7468b97770f66f63053d67523"
    hash45      = "26d65a2bf1e34b8aa9eac2debf211c9c6f9a7d4f492cf63307307915f98d3505"
    hash46      = "9e90bfb61fcc1556c65924909301a0dc9743b6d282789ad54b8fa46c3bfda617"
    hash47      = "0ee4fe6082543b0c51d0569a665e778214874dcbb07a18f07a67e854f0de28ab"
    hash48      = "83ab6cfdb947f38417b43e792e074a7b53acd62ecb9b2b487f7d5333c8cd34dc"
    hash49      = "27ff1bfb35cdd125d50052c1b5a505486fab787126d36a863cbd513e40b7e5d7"
    hash50      = "f1fb6032ef49bd4fc2871e0a55cb70ae24f8054f28b75af8ded08609501942f1"
    hash51      = "cb119b87ec19275f64dc652c28781f6ad2fa5f4a625aea5fef44fcf0c0342188"
    hash52      = "e21547242d74d3f9d692789d171210ee5004abaf7f30235ca02ef9a3f5880c80"
    hash53      = "2f623051680e1b84dc907f3d770610cd7d4669d88b81f24b2ed157bc30aee594"
    hash54      = "f2fef6489726c250b3783580187a87e0de536e25b50ddb5cf67815b5982f66d9"
    hash55      = "d86bac27e77f92c98c1a061066dcb9400d37be98776ebf8a4519df82b4d18472"
    hash56      = "11b51b57cdd5e07545aba338c073f44ba0515cb819d30573c79240c0d2e0fc1d"
    hash57      = "0377cd52c543eec3c8ef6972f9f0fa9f9319e0660065962d7ef922177929b2cd"
    hash58      = "db26f4f1dcd37addcf8047761d50f1fb475d379e6952219549fc4b3bc2247fb7"
    hash59      = "bdd56b075b7b18221e1598e3e5f15d13089c9514a9828825f83d5f87f65c31f6"
    hash60      = "b0f8735adbcdd9eba85b907b19756b8f8c984fe7f37b504d040e0a638f58c774"
    hash61      = "0eed3a417bfb6ba83ea3e2c610f579ad812fe9fe36ed3dd10a3de4cc58855ee5"
    hash62      = "5a422b5a01e7266115bd0beb1b1e223f243668264f3a837a2cc537c5094241e7"
    hash63      = "805609c14c200c05a84d3bcf2c70aad2533cbbd5e050f6e3836ffc76d2ec23c2"
    hash64      = "8450d3dbd1d2c5fbf5ab143b5fcc60235227173aae7d0f77c0a3e871b60eb866"
    hash65      = "87788a74c1ea745574766906f06533d37dd6bf7827ff8e9cbbf8e51a2d0294a6"
    hash66      = "ce4f7d23b5140d1b6dd05abaa1dacaf6ba6225f4490e16a4b2ec9a5dea9c845c"
    hash67      = "54707fc6955e657ad57e6396feeb2db89e7288d1ded34dd1592f0b768a396b8e"
    hash68      = "4e382e32cf76ba2b7fb3b65366b603932f9e0ff99fa8434e371ae9bd750b9f1f"
    hash69      = "42766f623180ab3960e289ebf1930178134a8b8df1bd4b89e24f8a712201ff2f"
    hash70      = "4a2ab74804b8626b9c2be13ee349a6fe78f2f807b056d8f301682cbc08361d9e"
    hash71      = "098412e6ccf57525812cb9432c7f90df5255e6b1e314208cb1592f54b41d7dd4"
    hash72      = "9a0b0fab91042fd9c5dc36cd325229f49c8de1c172e48dbac2dee3f791fae7de"
    hash73      = "1cc8b975751abef40095c8ce9f60143975acab1b0e00950cf1d8e42a857ef02b"
    hash74      = "09fef863703972032c264243ffb9f1937f01f2455a80282bff04060c88ac34fb"
    hash75      = "ad80561afa7c481d599d4c16fa12f8c2b4f820694ccf99d005c8b75740bc18b6"
    hash76      = "7f17f704e95a751f7d586a6610d9e86023b44245400e604c469d16a9706ddaef"
    hash77      = "1bde7a95fdab97a86bb5832559414989faa0a8769fbb597e78e52904b8326833"
    hash78      = "b295fbc72cf4d74feb5d68c4d95eb31a3dc4ec8711f6be53293d7c43fa59f1f4"
    hash79      = "77e084cb9b3918c049ff58e117ef3d0e18c65c27a0e7d73efb9d43b358560382"
    hash80      = "fa976ebbbce36040ad26d4a36da3714803e861a99f66a8422be5324d18303ec7"
    hash81      = "6d89a2bc17e53e82e8751d57d6dad47827a9506241f44418268f9369b72fc35a"
    hash82      = "972adbbb0d1f95c8747b2d81551bc8e30068ac60eec86997add8c77990417a35"
    hash83      = "02f064aa636a54b816790b475e8c45e1c807c9361147bf5c5a583ba8ad726a07"
    hash84      = "7b6695c80d2a90b876edcb6c6bb2908c62196464b9ab5c85407deb3ea63d27eb"
    hash85      = "50a99e8196d2850617ad0c7bbba880435a128e50db3a06f020b426770a1db73c"
    hash86      = "24e1e81e81dca595b52b9328c0f6dfea068fe18ca2b65a37fa2295c69173c351"
    hash87      = "661a69970437124406524cf7d99ac46dad57fefb3fcf89141db58bc9b2d50c89"
    hash88      = "a2739942cde9e2eae955edc1f8e1534c23d7a1761521a953eefeae953140735a"
    hash89      = "65914b357c8115e948377de35c838e2e6987c54d76a7f9785e144738d4b57e96"
    hash90      = "f21088406b50d76c14cd9b595c19822fec99e4be863279c82d6406fe45eb4782"
    hash91      = "92c201f716a975c788f9814d10f844b97c87d37f9c82ff8ee22eea300751be07"
    hash92      = "ee84ae599a810ad3f82d6160d8fcc5fa2bb3a2062006785490adefd51bf86045"
    hash93      = "eac6222fa429120210709f2f65ab4d5533f0876019e93dddad26643737babc79"

  strings:
    $s1 = "LFv\": [3, (function f(){return \"\\x51\";})()], \"WLj\": [3, (function f(){return \"\\x50\";})()], \"Qq\": [3, (function f(){re" ascii
    $s2 = "on f(){return \"\\x77\";})()], \"BNg\": [3, (function f(){return \"\\x76\";})()], \"Ao\": [3, (function f(){return \"\\x71\";})(" ascii
    $s3 = ";})()], \"Du\": [3, (function f(){return \"\\x58\";})()], \"DBk\": [3, (function f(){return \"1\";})()], \"Pe\": [3, (function f" ascii
    $s4 = "n f(){return \"\\x57\";})()], \"PBq\": [3, (function f(){return \"\\x56\";})()], \"Nc0\": [3, (function f(){return \"\\x55\";})(" ascii
    $s5 = "{return \"\\x6d\";})()], \"KHz\": [3, (function f(){return \"\\x6e\";})()], \"NXi\": [3, (function f(){return \"9\";})()], \"IPa" ascii

  condition:
    (uint16(0) == 0x0a0a and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

48925a4b-e65f-4606-b7f0-f56693079a70

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion