_20160428_00cd550e80fb3bd454bf47f7c7e16392_20160428_032b2274eaa6_1936

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160428_00cd550e80fb3bd454bf47f7c7e16392.js, 20160428_032b2274eaa6ffe6cf8777d338b07c4c.js, 20160428_0a6401511d723332fd1b0c7b61fa8b7c.js, 20160428_0b06bdd2cf581e4e26d46ec7a8546969.js, 20160428_0daa805e05c1b8fc28083441e077f3ab.js, 20160428_0df0fe638c1cdd7ef42205eed51a6d6a.js, 20160428_0fca56842036a99db4f38dff917caeb6.js, 20160428_11400d83760def4d8943c08c860e9364.js, 20160428_182868cad5bcb428e1b2fbdb5a440e2d.js, 20160428_1aca1e5fa1cb547f7714f6f2b129eeda.js, 20160428_1b50fdc1ae27452c5b6ff1c0fc19c1ef.js, 20160428_1e9b9d3a1d857866293b9f07a6d2fb16.js, 20160428_2480b3a7fea7b60cd0c571de0fc75e9c.js, 20160428_2d9f2940579cf90d595277a285454fdf.js, 20160428_30732d83206b3a46742e3ececfe3cf7e.js, 20160428_326c8a7fc04f011627d760cf359ead3e.js, 20160428_379a37be4b67e2146bb5dcdf84f4f8ca.js, 20160428_39f3407232c2af924be6f6725106c1b4.js, 20160428_3eb7c8a4428588c81f5f64cb73d73831.js, 20160428_40cfc063560974c916c508cadd65e592.js, 20160428_425de5e55401a736f81d5ce4358b56d8.js, 20160428_486b3cdcde7d14ed9f0f37c9ac60dd67.js, 20160428_4a3af9babc62b83ea795f454618a1c46.js, 20160428_4d826d44ddd2253487b473925d8bf245.js, 20160428_4e75cfa16b112346c66b9210e4f1ac11.js, 20160428_4ec46cc3eccbc3253e60d9ef31d49ce7.js, 20160428_552a61e9db580170f92bd08770a0350c.js, 20160428_579547429b6b9f6846bb1dddc71c2c5f.js, 20160428_5c8f766660b5441ad5682f98fb4a016c.js, 20160428_62fa0fb7538ddb6d39db29121ec2179a.js, 20160428_63794a7dc0a1ca5abf6f13077ab9745b.js, 20160428_63a45a96f506effa35b0af8432a66eaa.js, 20160428_681d188c19190c7df8090972f746158f.js, 20160428_701cdf5f1a9f8f2c7310d622f99477b9.js, 20160428_731eee074d05252f4a9b239e75721d5c.js, 20160428_758a9ae5554c8edd7cedbd4983bbb5dd.js, 20160428_7b01768c84622c209ce05f37ef5da790.js, 20160428_7cad62cb5fdbc9b54072c42ab09d4676.js, 20160428_7d90d6a20ead1b85d9a8636b5ccc969b.js, 20160428_7e1a7c40eae8439bd22b8ad98004c919.js, 20160428_85172380929a334e08e6203bf77e8818.js, 20160428_856c3480ae03248a7d5754924b773793.js, 20160428_8795ce0bb42cff12832c526ebae2a964.js, 20160428_8f1fa411d8c137294ef9ded51a985027.js, 20160428_909b4bda48a99d9f909b3696b813f15a.js, 20160428_90d7ac5c4cfae206f957c451c790b4db.js, 20160428_9a28fdbfba78f91de5701477a0fe0bad.js, 20160428_9d119cc38a065a6f9f48ffc53d3c42fc.js, 20160428_9eeb4c95007f908c5aad44d52d6f3204.js, 20160428_9f0635fb2b581d5e0f7d4bb964d693f0.js, 20160428_a00e6ae5aa5256ffc15fdb9207989e83.js, 20160428_a1b6312893fa75a0bf02ba0de2b3abc7.js, 20160428_a1c11b96e7d1a6ba69bc8bc29bdb30a4.js, 20160428_a8d3655f038f61e925a6403046535196.js, 20160428_aa086b0be78e22359a25c58ea416cc25.js, 20160428_aaae0a20c3a356a4f075153b6183f08c.js, 20160428_aec174e754a7ea5e655f58a487149e89.js, 20160428_b051c36b2915d9988908c991037309a7.js, 20160428_b38bb64deb4ebc37e373be108f0faf54.js, 20160428_bbe48bc299909583eae3bb758ab2070a.js, 20160428_c0c45192cf4fe5b38f0109291bccd859.js, 20160428_c24cba97f1a6039ea07fcbd20476d394.js, 20160428_c5f19a864a50c87c0c440a55b8c926c3.js, 20160428_cbfc22154e2a0df77d186b57a34aa052.js, 20160428_cc9ca27fc74d7e26b01cb75e29f3e5e4.js, 20160428_ccc08af5381e7f896409e8a83a5fc07d.js, 20160428_ccea1abd6e840a213d6fd5117f092f94.js, 20160428_cd00aec5d724f65f7fe5eb8b0cca620c.js, 20160428_d7e1bd335bd4e7888d050e29a40eb82e.js, 20160428_d99d639ba9051f97b7da1fd25a2da695.js, 20160428_e4f91080d2bf7fd4362c3666d7546d22.js, 20160428_ecc611e1b85ec08e4d8bd4ca4cd2a21c.js, 20160428_ef05ccb2bea29e2eb39cb147b72f9722.js, 20160428_ef12b00a0ea33372cbfb93b7c3986756.js, 20160428_f026622a65ff8f878bb4f025e7c78b07.js, 20160428_f1b7a238ff2eca640f2362118a2d7ac6.js, 20160428_f5d2a2c5ebf3c56701eff0a0afdb6356.js, 20160428_f67de5e854aa83cfcd6e2eed62b76859.js, 20160428_fd84c4a94df221f8c22120dbd2414a31.js, 20160428_fda418dbd713109c3c8f4df94836b839.js

rule _20160428_00cd550e80fb3bd454bf47f7c7e16392_20160428_032b2274eaa6_1936 {
  meta:
    description = "datamaliciousorder - from files 20160428_00cd550e80fb3bd454bf47f7c7e16392.js, 20160428_032b2274eaa6ffe6cf8777d338b07c4c.js, 20160428_0a6401511d723332fd1b0c7b61fa8b7c.js, 20160428_0b06bdd2cf581e4e26d46ec7a8546969.js, 20160428_0daa805e05c1b8fc28083441e077f3ab.js, 20160428_0df0fe638c1cdd7ef42205eed51a6d6a.js, 20160428_0fca56842036a99db4f38dff917caeb6.js, 20160428_11400d83760def4d8943c08c860e9364.js, 20160428_182868cad5bcb428e1b2fbdb5a440e2d.js, 20160428_1aca1e5fa1cb547f7714f6f2b129eeda.js, 20160428_1b50fdc1ae27452c5b6ff1c0fc19c1ef.js, 20160428_1e9b9d3a1d857866293b9f07a6d2fb16.js, 20160428_2480b3a7fea7b60cd0c571de0fc75e9c.js, 20160428_2d9f2940579cf90d595277a285454fdf.js, 20160428_30732d83206b3a46742e3ececfe3cf7e.js, 20160428_326c8a7fc04f011627d760cf359ead3e.js, 20160428_379a37be4b67e2146bb5dcdf84f4f8ca.js, 20160428_39f3407232c2af924be6f6725106c1b4.js, 20160428_3eb7c8a4428588c81f5f64cb73d73831.js, 20160428_40cfc063560974c916c508cadd65e592.js, 20160428_425de5e55401a736f81d5ce4358b56d8.js, 20160428_486b3cdcde7d14ed9f0f37c9ac60dd67.js, 20160428_4a3af9babc62b83ea795f454618a1c46.js, 20160428_4d826d44ddd2253487b473925d8bf245.js, 20160428_4e75cfa16b112346c66b9210e4f1ac11.js, 20160428_4ec46cc3eccbc3253e60d9ef31d49ce7.js, 20160428_552a61e9db580170f92bd08770a0350c.js, 20160428_579547429b6b9f6846bb1dddc71c2c5f.js, 20160428_5c8f766660b5441ad5682f98fb4a016c.js, 20160428_62fa0fb7538ddb6d39db29121ec2179a.js, 20160428_63794a7dc0a1ca5abf6f13077ab9745b.js, 20160428_63a45a96f506effa35b0af8432a66eaa.js, 20160428_681d188c19190c7df8090972f746158f.js, 20160428_701cdf5f1a9f8f2c7310d622f99477b9.js, 20160428_731eee074d05252f4a9b239e75721d5c.js, 20160428_758a9ae5554c8edd7cedbd4983bbb5dd.js, 20160428_7b01768c84622c209ce05f37ef5da790.js, 20160428_7cad62cb5fdbc9b54072c42ab09d4676.js, 20160428_7d90d6a20ead1b85d9a8636b5ccc969b.js, 20160428_7e1a7c40eae8439bd22b8ad98004c919.js, 20160428_85172380929a334e08e6203bf77e8818.js, 20160428_856c3480ae03248a7d5754924b773793.js, 20160428_8795ce0bb42cff12832c526ebae2a964.js, 20160428_8f1fa411d8c137294ef9ded51a985027.js, 20160428_909b4bda48a99d9f909b3696b813f15a.js, 20160428_90d7ac5c4cfae206f957c451c790b4db.js, 20160428_9a28fdbfba78f91de5701477a0fe0bad.js, 20160428_9d119cc38a065a6f9f48ffc53d3c42fc.js, 20160428_9eeb4c95007f908c5aad44d52d6f3204.js, 20160428_9f0635fb2b581d5e0f7d4bb964d693f0.js, 20160428_a00e6ae5aa5256ffc15fdb9207989e83.js, 20160428_a1b6312893fa75a0bf02ba0de2b3abc7.js, 20160428_a1c11b96e7d1a6ba69bc8bc29bdb30a4.js, 20160428_a8d3655f038f61e925a6403046535196.js, 20160428_aa086b0be78e22359a25c58ea416cc25.js, 20160428_aaae0a20c3a356a4f075153b6183f08c.js, 20160428_aec174e754a7ea5e655f58a487149e89.js, 20160428_b051c36b2915d9988908c991037309a7.js, 20160428_b38bb64deb4ebc37e373be108f0faf54.js, 20160428_bbe48bc299909583eae3bb758ab2070a.js, 20160428_c0c45192cf4fe5b38f0109291bccd859.js, 20160428_c24cba97f1a6039ea07fcbd20476d394.js, 20160428_c5f19a864a50c87c0c440a55b8c926c3.js, 20160428_cbfc22154e2a0df77d186b57a34aa052.js, 20160428_cc9ca27fc74d7e26b01cb75e29f3e5e4.js, 20160428_ccc08af5381e7f896409e8a83a5fc07d.js, 20160428_ccea1abd6e840a213d6fd5117f092f94.js, 20160428_cd00aec5d724f65f7fe5eb8b0cca620c.js, 20160428_d7e1bd335bd4e7888d050e29a40eb82e.js, 20160428_d99d639ba9051f97b7da1fd25a2da695.js, 20160428_e4f91080d2bf7fd4362c3666d7546d22.js, 20160428_ecc611e1b85ec08e4d8bd4ca4cd2a21c.js, 20160428_ef05ccb2bea29e2eb39cb147b72f9722.js, 20160428_ef12b00a0ea33372cbfb93b7c3986756.js, 20160428_f026622a65ff8f878bb4f025e7c78b07.js, 20160428_f1b7a238ff2eca640f2362118a2d7ac6.js, 20160428_f5d2a2c5ebf3c56701eff0a0afdb6356.js, 20160428_f67de5e854aa83cfcd6e2eed62b76859.js, 20160428_fd84c4a94df221f8c22120dbd2414a31.js, 20160428_fda418dbd713109c3c8f4df94836b839.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "fe9f366e9962f1434169020be3619983ddde9202dc71c33f6ebd4641f3e4a50d"
    hash2       = "8679a5796532035698b4be6a5f842ee5fb322754f1caac34d796d2364211e942"
    hash3       = "a7c8930951b1d060d8cca295e8f9c141c383a6d107e66cf913e0fd85d3b9d112"
    hash4       = "ad54190ed1367b8b5d7dfe0d58ab2fc0ddac69368e71a12b6eec56725ab2c95f"
    hash5       = "776e40c28bdbd075566f60b57a8fa6ce66684d9ebeaeca869e05d44ae371ff0d"
    hash6       = "2046cc154ab7af2bbffced254b29a5e7803069db457987863cdd548a58a7827d"
    hash7       = "79d2a237b6ad7823dff9453c5c0e9b952eb7f06652fe7df6aaccd6d39b5ac544"
    hash8       = "06dbe9884e5078ef55cde428476bccf4524f68863bb2f790e96d9d45f1150dad"
    hash9       = "025cbfd53a6b4f587ba88424bad36590d7bdd20647061fd2f8adf3aba5c6e839"
    hash10      = "1dd2e1e99e4f3d9073cae3631d339b58c6bb00d11ae84dce24919eaef700120e"
    hash11      = "e6d039a79b868790afe8a9dadaa10404a89de3cff04f28c239b6e5e120d4cb6e"
    hash12      = "5b1f14bcd9efaf019b813f99ee867a95f1e99d74dc027e4f619db015d0907869"
    hash13      = "3f4cc010fbc6f23fce02f1b43aab8969f70937c6a5318b0ffbe901dbbd429298"
    hash14      = "6df79e1aaaf6d0f696652f2b6a0990bf0773092a9d8c60d2e7bdab10b76fcdd7"
    hash15      = "3943cf0330f3f59ea32c0cfa982071d31e3c2d870a5e8175107305a5b94de869"
    hash16      = "041c1988ce7e47c0942c9d200a90914be84a8150523e8e308a586ae80209766a"
    hash17      = "30b7f273a360f94106e548f0716be14db895f5bc2d2f4609418c59b0752e4cdb"
    hash18      = "cbeb41d7be5a3992da00f16e9bccf7e6ec10d569de307f01bf7ca7e8add7601c"
    hash19      = "e364f1f0c43c851744d24765750e5735ae2ebc4aff97af948b8024c4b98f34db"
    hash20      = "a840d59c7ae84f440e8abfc1477f0ffd75900a9689820141d9dfe98e274e82ea"
    hash21      = "3ca0d4e46683a9f02d833eb760a2eb17612f938bc4baee23dcee39fd2c18b95a"
    hash22      = "e96a285ce2c62d1b9532e36501b128d1d11564a8cf8349bf4480db2a2bcd1c76"
    hash23      = "75fd4e42d443fbea1e6e0c173c6c8db8fdc5ba9b64fb4d01e9e49bbc8aa435a3"
    hash24      = "7fe379a09ac994927d9229a2fb873754871ba10fe6d578edf713b341f51b4b60"
    hash25      = "719250931bbf5adcab9560e91b6d05f533fabe3fc631f2a71f5f3f1387ee4256"
    hash26      = "984a7fce4294a11b1a3badbd80e4b5b099a2d87ae680cb21d10f282a0249f7dd"
    hash27      = "07520f799a385e0898b520c6ce43368332c20ce6cb7f96d5b375ef9b36df8bf4"
    hash28      = "10e623965b6ee1aee86658ab70b23e07ed91cc8204c72cdc43b90225933f3c22"
    hash29      = "1ea69405ad38cad8e091db4792cc75fe56b09f6b7f4f82ce5148911eca4fec21"
    hash30      = "376f6e955827ea199e210cb369a2569f3d99f5383e3f78fe9cb9e4b8ccda1441"
    hash31      = "2deb044e6862a15fdcdca66fea0a65b9f47c15be8787a6afc8afe5fe2668ea98"
    hash32      = "717cc2366019e4ec7cc44b66432ba6424e85955c589dd297ba2c5636845d80a0"
    hash33      = "12679eda90f0a0211e1c96fcc2a0fc86ac130df6a36485e197dcf7044df76a72"
    hash34      = "67c63249ad720d16a5f26a18ab5a909dcbcf6811afcadd72c55485bc09300718"
    hash35      = "43eb58f799f06ca6715cb684c0ac18f2db14273b4eab793978a8eb4629bd06aa"
    hash36      = "4f04e0b39616a1505cac58cc2c89fa99d61ec2e34eb7f662fa906a5d87c885ec"
    hash37      = "bd3eee8d16601da6300fc09640e07831069c7e983f6d416d95e9fcc66a9b2157"
    hash38      = "4f89bd32a15753ed8c3527ac6bd32844fbc9c6e599a3fc2974efeff3174ac173"
    hash39      = "a9a1bdec8e8410ef6cf9813c685f099ada35c7ba7e2e2385e785ea73063dfa8c"
    hash40      = "441f8fb795ff48e8ca05f092c27376aa9b60fbc980e23d7f73023cac435d3fd5"
    hash41      = "c34bee1a8a9349274400390b9266696eca1a338bb5368464f0dfda73ffd3cb4b"
    hash42      = "ed43f2bcce6f57730223fdbadde00ed4e23955d1cbd2ea115f19f08e2bdfc81e"
    hash43      = "4838996362cbf6bd53b574b0bf7e192a2f76160d618a70208ad85fc91aa82df9"
    hash44      = "2635c678f58bc0d25c1f68f58d74f075b6079961bde5e71da0d1352cb376af63"
    hash45      = "8cd21235cf4427489fc1be788033a74fb4872a522adc0bf6ecf0a34a1f8c72bd"
    hash46      = "656acbcc7c0c9d1301bff339a33bf94d6f2719770fb4b71ef400ea7822914452"
    hash47      = "30913cfadf629705afca03247b6741ad07b64d4ae02b10def08bfcf6947f5235"
    hash48      = "79df3c810abdff91a4a9efae4d14efa6ca1bb8b639b4620749ed431cb02059ca"
    hash49      = "9e088a541cb368524ae76de8b4fba8c672bde115a940fdbae8323033dafc4d38"
    hash50      = "dfc7ca3b45be101d2bcee3d4f46f70ea41878258e2e75f69083683c46f0372dd"
    hash51      = "066c7c85a6e6d64807e991071593463184263991aa86acc880fd788a510eb72d"
    hash52      = "1207a69359bc35ea5fcec7620162c0cfe901c780f61754a06c1f122f88fe2e07"
    hash53      = "2cf021a93dfe867c4255e9c2cadcd97d74f438f89624dc88835545a1b070402b"
    hash54      = "5929c905977b10115ea7bf59095c91d7f29fda8bbacf1b2446a7d64753adc014"
    hash55      = "27f0b64d822edc39adf9ce3b69fbc7d5cff1eb8a19f7b6084d5fc19df38c188f"
    hash56      = "de8f8f936d98bc0d0b4d3fd3174b55c8d6f232f927d751ff2f9cf60d855ae232"
    hash57      = "dfebdd225f3c0204f07212cabf3621dc1d7bce42e8911a0ebdedc9e6b54577a7"
    hash58      = "287dbfd89200683dd1a55d8cb50821447f38d90bdc759aca654a6aca23e97584"
    hash59      = "a87facc99a7fce2203e0f860b6e2ad9f8304d1af09e49fc621649cda0dd18965"
    hash60      = "d56fbb3ec839b4962ddb584d189e3eee81bef1176d60d566d15a238756329495"
    hash61      = "f997f5ebcf8e8e39568e80f72b70f5c10e9d891a742630dc82630ba8630a16ff"
    hash62      = "5c7632864b8f7dad69d99f37258da66cd9f48acb46d85e1abc03a7c87a5edaaf"
    hash63      = "0083abf8df60a15dc99b0b67d9a90429c60a26e8f6b3ae78362d027b194f8f52"
    hash64      = "8b06f3c544a9b2257a81b99068fe2f2df81fefbfc5269e31a246826565ee5b4b"
    hash65      = "80d16d3d47ef1c904b34d6aa063b3e7ea67c36f94637d91d9dd7e66d20647177"
    hash66      = "e2b3f3ff2f3c1cffb0cd0cce0feebeb66ad0e8ca9fb9280db3ef1c4084ee94c3"
    hash67      = "268caed7177b286964a6abcbd38eab3326d03934fc3e342cbc8acf86aded9375"
    hash68      = "6bb92b37bf2ac9ce042891d4a150c528cff7b5626864bc15bc170d7de94445ee"
    hash69      = "a077a08c7f158824936e6eff83dce0e9996b2c7ede6db0fb8f158b7165008357"
    hash70      = "9ec97c04652dee8bdf971924c265a7bfe92294661a4bb46d942ed9177f9980b9"
    hash71      = "420cc90fff574f7c1c7382c98fbbd4f804a13065a411c42075ca757c8358afd5"
    hash72      = "24389d67c60887fbc0cb9f86c6c0ff2c8e8768a92ad578a338fed73049bdf517"
    hash73      = "ce1fec8dcf685decd7048cc22055d0e2100e0026badf1e583b439e269abb3df4"
    hash74      = "3ab658d70cc329cfee15dc3d207eb9a8a7ed2451655b46ee534a50476ae7e306"
    hash75      = "6b575e972099593241e5394756a9bda9b2dc60f90c504411b8a6960f96bfbaae"
    hash76      = "eda654a47310c3971c5025a7f63602cdd0523431076687237e3d340fd399dd8f"
    hash77      = "b43919c050f00ca8ee610c9f3270f502cabc19d892c8ba0e3c253b2c264f6af4"
    hash78      = "ed2d37ccbde43b9582163df9a9abe703048007bf26b4e1d52ad560a1604aaaf7"
    hash79      = "d40c5e9e6e49205e1f07c05921004dea68c810936a5ed84f277eea76c423b93c"
    hash80      = "274877393abbda5927f45a035ff5b9f6d453f74733f9279fcf59a790611d6292"

  strings:
    $s1 = "    tempooo.defcond = tempooo.pushthe[(![]+[]).charAt(!+[]+!![]+!![])+\"ubftring\".replace((![]+[]).charAt(+[]), SLETTER.toLower" ascii
    $s2 = "String.prototype.katdetc = function () {" fullword ascii
    $s3 = "se())](slothful, lll);" fullword ascii
    $s4 = "stubbornly = ((    \"EKFlOdy\") + \"qSTvdpwUp\").katdetc();" fullword ascii
    $s5 = "    furnished[accredited + (\"e\") + ((     \"nGnipRLQXYhn\") + \"jwAXDQb\").katdetc() + ((     \"dAVNMEl\") + \"hxuyRk\").katde" ascii

  condition:
    (uint16(0) == 0x0a0d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0cf1b446-fa8e-41b7-b11d-16a00988ccbb

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion