_20160421_555dbd3303aa5e17f8349bf880458828_20160421_7284a898b6f9_1935

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160421_555dbd3303aa5e17f8349bf880458828.js, 20160421_7284a898b6f99c109507e2dd666cb1f6.js, 20160427_0c762ef1022bbb37318c3cabbfcf67c9.js, 20160427_1288cf45255fb8478fc29dcbf39b5d22.js, 20160427_16ec08b2dd250259eb204aa5a91f01d9.js, 20160427_17db2c12c8697a427fe29907d7015728.js, 20160427_1bd29011d363323bf007e919941afdb2.js, 20160427_2d9a814c5fe2e4b31efaec3ca761f4cf.js, 20160427_2ff0fa7e7de707dba3337aea229e252a.js, 20160427_310c6828bca855714cfc9a6d37c7c3f0.js, 20160427_37a1cdc70fd55bd8a1bcfbbf387c1db0.js, 20160427_380901857bfbc73f15cf8b208bd012b3.js, 20160427_3f4fda43f68b1cf0350e3e187e2f1d28.js, 20160427_413243b8b645883d4e33a725e2c8b734.js, 20160427_41c3e24957b0823447be6d420fda2259.js, 20160427_4410b2dd1ea1fc668877948352a34971.js, 20160427_459cedb7f37e0c2461010d6fb1389a44.js, 20160427_4944ae332825d6c2cc186856f6d8f442.js, 20160427_495f4c1e59d75ad73b29aa0b89038b46.js, 20160427_51321e27cb30cb41fb8d5744489ed3e7.js, 20160427_56a599b7058eb0dabb9b7b2a2d453cc1.js, 20160427_5edd4ed4754f6fc2cf3fdd36ba003467.js, 20160427_66cab1e1d80e802076594ccadef7a2fa.js, 20160427_70ccd08602ae383d546657b2dda92775.js, 20160427_70f30d42ff2692b7f4209ddc7d100227.js, 20160427_7210f8c9bf89704b9c71b0a6e3abe700.js, 20160427_74e31e28968697dc84baa7502eb1023b.js, 20160427_76113341ed28976630cc319b46d26c8d.js, 20160427_7667d2a5286d448068c2e6453d572d72.js, 20160427_7bc5b1aa7b71fd8eadf781b4c1bb7213.js, 20160427_7c8be1df2cc4bb21c9c88d669b3a5309.js, 20160427_7e2ca2d6aa82a7f88f74fb86239cee56.js, 20160427_8a7977b2ca395d39b59472d6b4b1871b.js, 20160427_8ba2bb43cf2c848d0ffae3885f30ba8d.js, 20160427_8c6aef15587b04d41f8d50a6ce807abd.js, 20160427_8d2fced5d619a8841e471055c1bfc2a8.js, 20160427_909bc6f42844d609bfc955a09e07a933.js, 20160427_919e6c8a5f846b2d378ee3d9b7903707.js, 20160427_921c499199fbd7f023506fedc5215849.js, 20160427_93d9c3ac57f1a2cde8609d88da193215.js, 20160427_94035dd261be3a69644b102f19258152.js, 20160427_986d9b2eba14260bd958b5681a3798d9.js, 20160427_9ccbcccf1bd757835c49e138aef823d6.js, 20160427_a344d562f9e881b08ab92ec35c2ac275.js, 20160427_a4a023d9b54ac8d9e35fd1f88d58bf45.js, 20160427_a6f51831a4ba52b6a925305ee2b20898.js, 20160427_a78b9099a0788bd0b12048e6e7e0d69a.js, 20160427_a9aa6f4c6ac792b8233f4bd16fd30e4f.js, 20160427_aa988bcf998c3dbafc4aba17427c20e1.js, 20160427_ab9e9007b69f46d5a68c3275bc88c9d6.js, 20160427_b00402dd273a137eb8dd964d7467c1fd.js, 20160427_c1f492cf9a0626f9de48f74a770b9cc4.js, 20160427_c4450419c7d633dcceb6bf2ad458c51c.js, 20160427_cb24b2a0ba8dc6f5f427424e027b3ece.js, 20160427_cc7c4cf72c06da70594747f4718245a2.js, 20160427_cc89d9673bac8fc760e09602323e23d9.js, 20160427_cd6504facb8e52efa217d2190983994f.js, 20160427_cffee675f87d07bf0e82bd650798e3f1.js, 20160427_d9295e200d2dc0b1d705d94b646af608.js, 20160427_da36e56e5073480f8ead5af72719a25a.js, 20160427_dd62329486b0b214edcf3d930f74f70a.js, 20160427_e6b5e17fb85099be38fed89d0de7624e.js, 20160427_e8bd9cdc8fe78f068a3825475ad5c1fb.js, 20160427_ea8722908c3481d64617890f36cd1275.js, 20160427_eb418028d572fafc18512d3f3b2ab7f5.js, 20160427_ebae6924e1eb82a7c19ea5acc4535d7a.js, 20160427_ef478f87f808bfe106b09b7702fbddff.js, 20160427_f3b58dbe5bc38192d1d44b9220dd0e0e.js, 20160427_f6ec89fce247c593242cb0872402762f.js, 20160427_f754a9920be3106f76fea45eb38d53c8.js, 20160427_fd6be84697f2a285c7c57bc7cac2ca8c.js, 20160427_fe784109e21f6456973a25575485563f.js, 20160427_ffb19a8165fc04e34b5edbf38d463c2f.js

rule _20160421_555dbd3303aa5e17f8349bf880458828_20160421_7284a898b6f9_1935 {
  meta:
    description = "datamaliciousorder - from files 20160421_555dbd3303aa5e17f8349bf880458828.js, 20160421_7284a898b6f99c109507e2dd666cb1f6.js, 20160427_0c762ef1022bbb37318c3cabbfcf67c9.js, 20160427_1288cf45255fb8478fc29dcbf39b5d22.js, 20160427_16ec08b2dd250259eb204aa5a91f01d9.js, 20160427_17db2c12c8697a427fe29907d7015728.js, 20160427_1bd29011d363323bf007e919941afdb2.js, 20160427_2d9a814c5fe2e4b31efaec3ca761f4cf.js, 20160427_2ff0fa7e7de707dba3337aea229e252a.js, 20160427_310c6828bca855714cfc9a6d37c7c3f0.js, 20160427_37a1cdc70fd55bd8a1bcfbbf387c1db0.js, 20160427_380901857bfbc73f15cf8b208bd012b3.js, 20160427_3f4fda43f68b1cf0350e3e187e2f1d28.js, 20160427_413243b8b645883d4e33a725e2c8b734.js, 20160427_41c3e24957b0823447be6d420fda2259.js, 20160427_4410b2dd1ea1fc668877948352a34971.js, 20160427_459cedb7f37e0c2461010d6fb1389a44.js, 20160427_4944ae332825d6c2cc186856f6d8f442.js, 20160427_495f4c1e59d75ad73b29aa0b89038b46.js, 20160427_51321e27cb30cb41fb8d5744489ed3e7.js, 20160427_56a599b7058eb0dabb9b7b2a2d453cc1.js, 20160427_5edd4ed4754f6fc2cf3fdd36ba003467.js, 20160427_66cab1e1d80e802076594ccadef7a2fa.js, 20160427_70ccd08602ae383d546657b2dda92775.js, 20160427_70f30d42ff2692b7f4209ddc7d100227.js, 20160427_7210f8c9bf89704b9c71b0a6e3abe700.js, 20160427_74e31e28968697dc84baa7502eb1023b.js, 20160427_76113341ed28976630cc319b46d26c8d.js, 20160427_7667d2a5286d448068c2e6453d572d72.js, 20160427_7bc5b1aa7b71fd8eadf781b4c1bb7213.js, 20160427_7c8be1df2cc4bb21c9c88d669b3a5309.js, 20160427_7e2ca2d6aa82a7f88f74fb86239cee56.js, 20160427_8a7977b2ca395d39b59472d6b4b1871b.js, 20160427_8ba2bb43cf2c848d0ffae3885f30ba8d.js, 20160427_8c6aef15587b04d41f8d50a6ce807abd.js, 20160427_8d2fced5d619a8841e471055c1bfc2a8.js, 20160427_909bc6f42844d609bfc955a09e07a933.js, 20160427_919e6c8a5f846b2d378ee3d9b7903707.js, 20160427_921c499199fbd7f023506fedc5215849.js, 20160427_93d9c3ac57f1a2cde8609d88da193215.js, 20160427_94035dd261be3a69644b102f19258152.js, 20160427_986d9b2eba14260bd958b5681a3798d9.js, 20160427_9ccbcccf1bd757835c49e138aef823d6.js, 20160427_a344d562f9e881b08ab92ec35c2ac275.js, 20160427_a4a023d9b54ac8d9e35fd1f88d58bf45.js, 20160427_a6f51831a4ba52b6a925305ee2b20898.js, 20160427_a78b9099a0788bd0b12048e6e7e0d69a.js, 20160427_a9aa6f4c6ac792b8233f4bd16fd30e4f.js, 20160427_aa988bcf998c3dbafc4aba17427c20e1.js, 20160427_ab9e9007b69f46d5a68c3275bc88c9d6.js, 20160427_b00402dd273a137eb8dd964d7467c1fd.js, 20160427_c1f492cf9a0626f9de48f74a770b9cc4.js, 20160427_c4450419c7d633dcceb6bf2ad458c51c.js, 20160427_cb24b2a0ba8dc6f5f427424e027b3ece.js, 20160427_cc7c4cf72c06da70594747f4718245a2.js, 20160427_cc89d9673bac8fc760e09602323e23d9.js, 20160427_cd6504facb8e52efa217d2190983994f.js, 20160427_cffee675f87d07bf0e82bd650798e3f1.js, 20160427_d9295e200d2dc0b1d705d94b646af608.js, 20160427_da36e56e5073480f8ead5af72719a25a.js, 20160427_dd62329486b0b214edcf3d930f74f70a.js, 20160427_e6b5e17fb85099be38fed89d0de7624e.js, 20160427_e8bd9cdc8fe78f068a3825475ad5c1fb.js, 20160427_ea8722908c3481d64617890f36cd1275.js, 20160427_eb418028d572fafc18512d3f3b2ab7f5.js, 20160427_ebae6924e1eb82a7c19ea5acc4535d7a.js, 20160427_ef478f87f808bfe106b09b7702fbddff.js, 20160427_f3b58dbe5bc38192d1d44b9220dd0e0e.js, 20160427_f6ec89fce247c593242cb0872402762f.js, 20160427_f754a9920be3106f76fea45eb38d53c8.js, 20160427_fd6be84697f2a285c7c57bc7cac2ca8c.js, 20160427_fe784109e21f6456973a25575485563f.js, 20160427_ffb19a8165fc04e34b5edbf38d463c2f.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a3839eaae76072a9b0f8876581137ebfd4efa2d26e5018ddba03b103f829c882"
    hash2       = "5a6cad063d7563d3a4de388fc8ecc7fb9ad346d2d3485f94599e7798623e4c51"
    hash3       = "b079f62d4eddcfddf2fc77995a8b86a744cfe881ca7b9e272310573180d3d7dd"
    hash4       = "e49796b5541988fa66cdb30212bb80e27cec9c2c4edd1ebbb5aa6aba445566db"
    hash5       = "2ba40829401736a8b7a435ec3e0382005cbbdde9fabd428681deba829c572469"
    hash6       = "7fa1b647bcae3ee158692b39e691c2d07d2818497d18331af1cbe665eafd7f2d"
    hash7       = "5bf8520b55125c7d0c64224c00026144bfeee2cda29c0f29b5e42bbd7d9270d1"
    hash8       = "2a90230659501d7f72509bd3c37b12f8f48ed12db86d2d255c3b591302a33387"
    hash9       = "ea8a427d041402b9126534c201cb5de2541da13783e2f524c70c27d93ce4d5b6"
    hash10      = "85df7b46a53342a304499734166b8aaea975f578e521f92c54cf562d95ebec08"
    hash11      = "02389f9c8e45bf046044974fb34a14a8b34b239f219dee732c8bde5652d3b067"
    hash12      = "5106b67c8433ff2fd8526ec7945dd3bb05e0eaf69811fdd1b47bed1e497c550b"
    hash13      = "00bfd12c68b4426c59723b696b5c00607905db6407e8ed2923126b81a2a07694"
    hash14      = "b1cdfb1ac0c852ed831f98e3d6bc3b82d811b85c0e4d308cf5755ac0352b6e4d"
    hash15      = "48217cc6bb5276313d365406bda4654334d443c65ba28094352c364cad977d3f"
    hash16      = "24b10564425e9f581ef553b854c445f8e0b2b779060e9f1d83562c4c004824dc"
    hash17      = "df46a58280a7b28e3035e94b142820247fabc3a3659019059bc57e62eb11a622"
    hash18      = "2728054b09c687237fa63387d5446489e736cea5bff7bef874d7cae19c9b01b6"
    hash19      = "60eebc5899873996481e626da4e585a4e658689a60a358c339f9607a5496aaae"
    hash20      = "4d33dc121657aca06a648ca2ab86acb226761f75718cd68acf68e2d90b6dd514"
    hash21      = "538eaf5a3c7f725ace7312d9eed5cb95a816074c14e59ababd1d2508a6c8958b"
    hash22      = "3de04a82aa0660bdaaac6c208c4dda98b0d2c54d171bc264ddfaa25481eea5eb"
    hash23      = "cbfbdec662833f4930459708b65393ba461a47e07cd6546106c55f09c4a9a57f"
    hash24      = "12035e330130f557b6ee29f870e0de2d92beac1122e504945a65521b86a568c1"
    hash25      = "6f055d791c3974bbb068dd3180896870c0067abbdcef819ba07d1b4ee6f50aab"
    hash26      = "aace52f47e38c2e7d974412e40e3d1413ca0a54e5eadb56eaadae5159131df2f"
    hash27      = "0509ecd52ad6dffcf67ab1fc2ee6dcd23f190c1037a082eb94cb8e9b2dd17b8f"
    hash28      = "353dd5ef216696eab20ef0d673d4ce40f00e2de14c37e7a1a3682d3428362479"
    hash29      = "4f443a8e23f42a79b26f5ac1be4c104b76b48dd1ab6da0e27edc044933bb6943"
    hash30      = "2a436f3f67033d61dcb3dc6e16a2aec6bfe2b89e0babdb795736a7783b9647da"
    hash31      = "1977d5dc0001c11951365afae22be5c474b60dec367af2ea75e946d4f579bec0"
    hash32      = "ac60c0878cee1c57008ff6d6d9348b64024c7deadf4701bd08017f70ff7e65f8"
    hash33      = "1fd03f1368086030b855b0e7633ecd65b1256aab30fd7f49abab4707c7712d3c"
    hash34      = "3ee246f8e239bd7a761e2eafaebb0d59b48f02b927ccedfb382964291d53a3a7"
    hash35      = "1cf75bee348504e51f0f8b8ae3be139a86923c91c3ba7b946036d7bf48dba64f"
    hash36      = "242d814da352b1f341455ef4b823f8147f0e89280a20b1ada9333162b8bdca2d"
    hash37      = "84710dd58b9b3d2f3dbb4501e894943088d5eaeba0cb830588de06420fdd0f8b"
    hash38      = "233e127b56facbc31d8f71e7e34f643ffb50ae3902608c804d4cebf9c7ca4fbd"
    hash39      = "69a90701bbcae00e0e96c1863d8db07c9d3605f502d529bbd039f4047635570a"
    hash40      = "1f9a4a410e139b60c7ca51ac1a672068285921a7525d08c15129293b18a003f7"
    hash41      = "c042617b7e58611c9abdf9b51df71b4d8121bba68b2b14197e32745f5b83e9f1"
    hash42      = "bbe0e0f68f5f6184dadb09806b130604a8327a4c15ac4d84edff8308a65a0e26"
    hash43      = "f76e38c3ccc2a52db870883e44018e07d5a5be6eaa5fa93b5dc5df1bb7e4f848"
    hash44      = "7cf8755638209dda62abe66daec852befd8dc71f2fc2a90706f22770ac01b84e"
    hash45      = "f92fd3ad5f4476bb9aa01228d08324a78fcd83fa767358a6fb16070f1233fc42"
    hash46      = "f5d67d932b71c0a52ef5df65b14ca27e54b8bd4bfc20e83bc451d7998698b901"
    hash47      = "afd8b2818b27fac18bc42f691a0e3879fbba2edb7cd9c0db7abfced64da21631"
    hash48      = "6a899cc5873c4d69a244253f8be59c7610db3f90e5a4431c2202bee749eae808"
    hash49      = "085d926b88dbc7fd2c3b5b817197c54d96aa527941f836d38092f25dca1cdda4"
    hash50      = "f9c2ae5756d20d8a0900b0654b169e7fe05f7df7891c0b79f660672244353d92"
    hash51      = "c997cd0d17a574e21e0c77b043864f343c164195430561db3f47a4cff8776314"
    hash52      = "1f871086c140d5b80ab312844fcb7066b0ec8c171b72e665c6b4d2676a1971f7"
    hash53      = "95ed7805fd730e0bf2769d53009640b2f42740e8cbf5088fb4512c7e7b928831"
    hash54      = "51bcfa83c0724fdb167d2df607f72cbb1ef555e6dae702a0093ab94ed31fc775"
    hash55      = "f2c2e7e56e4e04346d6bc330ca23504ae542a29c4dab3cc3c8049cbe8bf407b3"
    hash56      = "ad180a3eda15994ef90c6965793cee11b26d0acc51215cc9cc6563606dd47fc4"
    hash57      = "f4adfbf55756f66cabca0eae1a4bb5996524a040b4eaa4dd3cf4415c3d205723"
    hash58      = "c25694fa91abd4cdf75857a1edec86cdb05dc147c26617a9cf682a0d69837958"
    hash59      = "241e358cfefe6fbf867b20da703564541b32d85845f5569cd6d2c4894d31ff6d"
    hash60      = "a952ee278df4a965b8f0958be62f70d5fe21e22de042be38b371c8b71618f545"
    hash61      = "00239b0959e61f9cdcfbb822eb06c9e625afd5199243f9b551e2bcc600bef7ec"
    hash62      = "1c4c8c79d2beec50ef849dd29be7a58776576d7d00a019a379439c2fa4761c42"
    hash63      = "2206fb5a3cd26a6edf3f58b4c4b9ffd7cd1ee52009726200ebe11e7f2c7fee73"
    hash64      = "af35e036e068d766f42630b28c07fbb31e1358937e822ac24d6bc523260e7283"
    hash65      = "f37192b4f7ed4da3f3ccb4d1dc54b876c10bef1456c0c32616589b78f8a04677"
    hash66      = "413e05508ccb891f3f190aaab542aed63184b2855e102f0054e76610298b4732"
    hash67      = "654a7d5c70d3b4469a1b43bdb71f383c621c165289ffbe28568350d3c7b1c05f"
    hash68      = "23a0e52dee578f1e89f3c41565899878de097802643d77a7b5ba0d0f529abdd4"
    hash69      = "720b999ca6d24811bb761a90c53086f20912743cbbbc1698cc1de27962472cef"
    hash70      = "3818c05aa168ddb555833c61f0599a1d51f5c06c66626a2496dd15b32cccccf1"
    hash71      = "16500862c129db2576187ac89d6ac78f9bc613891785958697a8156e531afe23"
    hash72      = "4f1218abdcd1d1293ae69d1a24551f96c9b4b43512d65f9facf0e63a9b18b29e"
    hash73      = "e4588181f607a81e6246f5fcb201bc9fd8fae0dcea82062b3ef338c23c43bf7b"

  strings:
    $s1 = "var proportionate = this[(commiseration.shift()).hotels2()];retailers = ((    \"pCCeUuheWYD\") + \"iHAwmWLtz\").laboriously();" fullword ascii
    $s2 = "    ClmAEvhwJk = \" String was a <table>, *may* have spurious <tbody> elem = tag === \\\"table\\\" && !rtbody.test( elem ) ? tmp" ascii
    $s3 = "    ClmAEvhwJk = \" String was a <table>, *may* have spurious <tbody> elem = tag === \\\"table\\\" && !rtbody.test( elem ) ? tmp" ascii
    $s4 = "String.prototype.laboriously = function () {" fullword ascii
    $s5 = "    furnished[accredited + (\"e\") + ((     \"nGnipRLQXYhn\") + \"jwAXDQb\").laboriously() + ((     \"dAVNMEl\") + \"hxuyRk\").l" ascii
    $s6 = "    furnished[accredited + (\"e\") + ((     \"nGnipRLQXYhn\") + \"jwAXDQb\").laboriously() + ((     \"dAVNMEl\") + \"hxuyRk\").l" ascii
    $s7 = "stubbornly = ((    \"EKFlOdy\") + \"qSTvdpwUp\").laboriously();" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0ab3f9bc-ef64-42ee-94dd-c0222846f586

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion