_20160624_035d58ed8df9800800eaacc923943d6e_20160624_0a81eeed58a1_1937

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160624_035d58ed8df9800800eaacc923943d6e.js, 20160624_0a81eeed58a19d6273200781f248a919.js, 20160624_0b59b5ae5575fe1beb26c8251f205044.js, 20160624_0fa19227a0136ffb893bd2f9b86b3f48.js, 20160624_105da93f53edd4406bb34e48a539bea5.js, 20160624_1215ebb20694532a8bdce11f997d5580.js, 20160624_141b1d5ac5af1e993e71905da52d293c.js, 20160624_15cb5aeb0337a9dbf6b455b424a140df.js, 20160624_188bccf398ea98ada27032fef753dc49.js, 20160624_1b87f4f67324fa25a8b99df07fb82516.js, 20160624_1bf66bc2d98b64ecffb4642876a111d3.js, 20160624_1c32ad54b9775c2555fea04c2df657a6.js, 20160624_1f12253c481ccf28fa64846bce75add7.js, 20160624_1f98c29911ea6ed46e12c476e60eead9.js, 20160624_2a21d2298e0bc44732659977d493d258.js, 20160624_2c139d909b012a9e24270bea8f8414ce.js, 20160624_2d4bec0cb4c367b09dbb686f88a41c3c.js, 20160624_321ac0cbce7182d664453d71268f2131.js, 20160624_4a5bbd07c67ec6c9b476fd319ee8bba3.js, 20160624_50fe2db8690a6582c9bb3eead6f68f55.js, 20160624_548c2312f3077a4a4eef73a8ce95c22d.js, 20160624_669bfa210aad9f017a158c5ba6be471a.js, 20160624_677550169b94721e3f7671c0f1f33f40.js, 20160624_68677c8724078c6ebfb007433a4bcb3e.js, 20160624_6eaeadb6d11d45d014520282dc855776.js, 20160624_7298c5cacdf326dcec88fbbbea27351c.js, 20160624_7583103dc87f45f864a49b0127b4b9b9.js, 20160624_7844f5427eb9896324281c15e466b7ed.js, 20160624_7b7b830cedb0b20618ecc0bbb867b3c7.js, 20160624_7fe98cce6571af0a90bf937466c984a6.js, 20160624_82a07617644e2b0ea31affed06d166cd.js, 20160624_9f6f912b65489504637256c52e932601.js, 20160624_b0f4be5d2aec073b8bb9096b0622e599.js, 20160624_ba06ce2eff307072945b0eba68f307a0.js, 20160624_c4e332367eb822cc38f5a73a4f8ecc0e.js, 20160624_ce9e603d2e4e8b9de8591e774cbc8352.js, 20160624_cecdd995223734812cf25838bb311a96.js, 20160624_d1a8f97452ddb3bd92081ba99c6f3cc1.js, 20160624_d333e324e83689a4a522f7b3ebaf462b.js, 20160624_d82e4386ae9b885476f5e7ed3c5403b6.js, 20160624_d9cb32361d54faf4e224b453139646df.js, 20160624_ecd0afb66bfdf0c46ed61d68f28a673b.js, 20160624_f1573e046b0b68661100289d8c26987d.js, 20160624_f60e01983bbee14d0360e117c6f4e479.js, 20160624_fa719c5dab17207f13f3646f658a6a4a.js, 20160624_fa76b9f5d2ca861805e039d246743421.js, 20160627_00687ed0b5021b59f36ed07f2b66f66d.js, 20160627_044bedc886b0d029ec3585a51beaf190.js, 20160627_16c7c52afb19891daf9a1db73390d9a5.js, 20160627_18e5744e8a3c62fd7a002ca1ead88002.js, 20160627_197f37a0232e96f6951cf87c3fdcbd99.js, 20160627_198eb7e06c5d489815e48826a45a5b2e.js, 20160627_1a419b73f0be77af8224a37d6830470a.js, 20160627_1b6e0004ca9bf8765dac690e6f8e1b16.js, 20160627_2b1b6be670fbb90bb673d956f69df06d.js, 20160627_2b60d717c27f23e82bc2124ba48d1021.js, 20160627_3587b08506041aa5b5171ce225892fa9.js, 20160627_411b0a6b7b1a9a1803c5a7639b98345a.js, 20160627_437b38b08c7239e2f78ecf8a7377b867.js, 20160627_4d397964d5576ad751e0d68b31cf71c6.js, 20160627_4eaa677bb74c7c15d3d7704a9af3f203.js, 20160627_5230b382e274bfe46f0c38db2bee4f23.js, 20160627_54b8cbdf2642849dc6e186e646f8f627.js, 20160627_56509203dac3d40c1cf6b8aacd2032a0.js, 20160627_5935e9662bd67bc515ee9ac215f87855.js, 20160627_59e03ed60d9bd17e04ac2ddcb199f70c.js, 20160627_68f56d51bab20470f281c4f89018d683.js, 20160627_748fe2b808ad6714ba82a8e9885c2962.js, 20160627_75b7a64d9ac08cb14d11ca3beeacfde7.js, 20160627_76ffe3568c6e3445568cafef8c94b40c.js, 20160627_7d2119cc031196fb296ca9f6ade46e2c.js, 20160627_826d0179d8d95999de89713e627e5993.js, 20160627_89c86324a4d9bf74176c3e0eaf37d2c6.js, 20160627_95929c91c6209eadcbb1dc439ce51214.js, 20160627_989297efb41ff5e32754fed03f910990.js, 20160627_a1bc4d4421d48212b1d1a6eccb4f3de9.js, 20160627_a2d63feeeedbc2a1a42b73edebd8c5bf.js, 20160627_ab08484589b8a22f1adce2be601c8a2d.js, 20160627_b2a97eea8d82febbd8de25b0445be770.js, 20160627_b97fbde473ca7c138a07288382b1e9f9.js, 20160627_bd201aa34b2c047d13c51443b280eb8d.js, 20160627_bf7ba6b3d493cd73049b22292dfa7496.js, 20160627_c0827510db00c082c5acba634e251447.js, 20160627_c19f05fb46ee291d72d04682e3dedfe5.js, 20160627_c8125b33647ed025857a10f320d92e7f.js, 20160627_c903a4e3ecbe5faf9690184cc285c3dd.js, 20160627_cc5f07ceb883be946758d0767879ca96.js, 20160627_d2cb0e88476090f4332afcf8a413d131.js, 20160627_d59963afe2bfd1ae1ed0a946200e1eb5.js, 20160627_d88d1ea91d179af2ee435fb5f0b0bacb.js, 20160627_dae4b0df20ede51eca98a72f79c1d516.js, 20160627_dc9b13e1d26c7f170a0d8cf164eb2e3b.js, 20160627_e395c0c8ef0c611f1cad9fb7ffa92636.js, 20160627_e5ef85887cbbaa9704913d46347135af.js, 20160627_ea6ab7df993d99c9f7d696b5703b4f6c.js, 20160627_eee7e58d4586e23b5b85c9adeeb0b8d6.js, 20160627_f5a6ea49069cd48052f5dd7af8b60309.js, 20160627_fabc25e1e1667f03b11f6ab7695ad9f7.js, 20160627_fb664925c7b3f94f499a6f5275c4824f.js

rule _20160624_035d58ed8df9800800eaacc923943d6e_20160624_0a81eeed58a1_1937 {
  meta:
    description = "datamaliciousorder - from files 20160624_035d58ed8df9800800eaacc923943d6e.js, 20160624_0a81eeed58a19d6273200781f248a919.js, 20160624_0b59b5ae5575fe1beb26c8251f205044.js, 20160624_0fa19227a0136ffb893bd2f9b86b3f48.js, 20160624_105da93f53edd4406bb34e48a539bea5.js, 20160624_1215ebb20694532a8bdce11f997d5580.js, 20160624_141b1d5ac5af1e993e71905da52d293c.js, 20160624_15cb5aeb0337a9dbf6b455b424a140df.js, 20160624_188bccf398ea98ada27032fef753dc49.js, 20160624_1b87f4f67324fa25a8b99df07fb82516.js, 20160624_1bf66bc2d98b64ecffb4642876a111d3.js, 20160624_1c32ad54b9775c2555fea04c2df657a6.js, 20160624_1f12253c481ccf28fa64846bce75add7.js, 20160624_1f98c29911ea6ed46e12c476e60eead9.js, 20160624_2a21d2298e0bc44732659977d493d258.js, 20160624_2c139d909b012a9e24270bea8f8414ce.js, 20160624_2d4bec0cb4c367b09dbb686f88a41c3c.js, 20160624_321ac0cbce7182d664453d71268f2131.js, 20160624_4a5bbd07c67ec6c9b476fd319ee8bba3.js, 20160624_50fe2db8690a6582c9bb3eead6f68f55.js, 20160624_548c2312f3077a4a4eef73a8ce95c22d.js, 20160624_669bfa210aad9f017a158c5ba6be471a.js, 20160624_677550169b94721e3f7671c0f1f33f40.js, 20160624_68677c8724078c6ebfb007433a4bcb3e.js, 20160624_6eaeadb6d11d45d014520282dc855776.js, 20160624_7298c5cacdf326dcec88fbbbea27351c.js, 20160624_7583103dc87f45f864a49b0127b4b9b9.js, 20160624_7844f5427eb9896324281c15e466b7ed.js, 20160624_7b7b830cedb0b20618ecc0bbb867b3c7.js, 20160624_7fe98cce6571af0a90bf937466c984a6.js, 20160624_82a07617644e2b0ea31affed06d166cd.js, 20160624_9f6f912b65489504637256c52e932601.js, 20160624_b0f4be5d2aec073b8bb9096b0622e599.js, 20160624_ba06ce2eff307072945b0eba68f307a0.js, 20160624_c4e332367eb822cc38f5a73a4f8ecc0e.js, 20160624_ce9e603d2e4e8b9de8591e774cbc8352.js, 20160624_cecdd995223734812cf25838bb311a96.js, 20160624_d1a8f97452ddb3bd92081ba99c6f3cc1.js, 20160624_d333e324e83689a4a522f7b3ebaf462b.js, 20160624_d82e4386ae9b885476f5e7ed3c5403b6.js, 20160624_d9cb32361d54faf4e224b453139646df.js, 20160624_ecd0afb66bfdf0c46ed61d68f28a673b.js, 20160624_f1573e046b0b68661100289d8c26987d.js, 20160624_f60e01983bbee14d0360e117c6f4e479.js, 20160624_fa719c5dab17207f13f3646f658a6a4a.js, 20160624_fa76b9f5d2ca861805e039d246743421.js, 20160627_00687ed0b5021b59f36ed07f2b66f66d.js, 20160627_044bedc886b0d029ec3585a51beaf190.js, 20160627_16c7c52afb19891daf9a1db73390d9a5.js, 20160627_18e5744e8a3c62fd7a002ca1ead88002.js, 20160627_197f37a0232e96f6951cf87c3fdcbd99.js, 20160627_198eb7e06c5d489815e48826a45a5b2e.js, 20160627_1a419b73f0be77af8224a37d6830470a.js, 20160627_1b6e0004ca9bf8765dac690e6f8e1b16.js, 20160627_2b1b6be670fbb90bb673d956f69df06d.js, 20160627_2b60d717c27f23e82bc2124ba48d1021.js, 20160627_3587b08506041aa5b5171ce225892fa9.js, 20160627_411b0a6b7b1a9a1803c5a7639b98345a.js, 20160627_437b38b08c7239e2f78ecf8a7377b867.js, 20160627_4d397964d5576ad751e0d68b31cf71c6.js, 20160627_4eaa677bb74c7c15d3d7704a9af3f203.js, 20160627_5230b382e274bfe46f0c38db2bee4f23.js, 20160627_54b8cbdf2642849dc6e186e646f8f627.js, 20160627_56509203dac3d40c1cf6b8aacd2032a0.js, 20160627_5935e9662bd67bc515ee9ac215f87855.js, 20160627_59e03ed60d9bd17e04ac2ddcb199f70c.js, 20160627_68f56d51bab20470f281c4f89018d683.js, 20160627_748fe2b808ad6714ba82a8e9885c2962.js, 20160627_75b7a64d9ac08cb14d11ca3beeacfde7.js, 20160627_76ffe3568c6e3445568cafef8c94b40c.js, 20160627_7d2119cc031196fb296ca9f6ade46e2c.js, 20160627_826d0179d8d95999de89713e627e5993.js, 20160627_89c86324a4d9bf74176c3e0eaf37d2c6.js, 20160627_95929c91c6209eadcbb1dc439ce51214.js, 20160627_989297efb41ff5e32754fed03f910990.js, 20160627_a1bc4d4421d48212b1d1a6eccb4f3de9.js, 20160627_a2d63feeeedbc2a1a42b73edebd8c5bf.js, 20160627_ab08484589b8a22f1adce2be601c8a2d.js, 20160627_b2a97eea8d82febbd8de25b0445be770.js, 20160627_b97fbde473ca7c138a07288382b1e9f9.js, 20160627_bd201aa34b2c047d13c51443b280eb8d.js, 20160627_bf7ba6b3d493cd73049b22292dfa7496.js, 20160627_c0827510db00c082c5acba634e251447.js, 20160627_c19f05fb46ee291d72d04682e3dedfe5.js, 20160627_c8125b33647ed025857a10f320d92e7f.js, 20160627_c903a4e3ecbe5faf9690184cc285c3dd.js, 20160627_cc5f07ceb883be946758d0767879ca96.js, 20160627_d2cb0e88476090f4332afcf8a413d131.js, 20160627_d59963afe2bfd1ae1ed0a946200e1eb5.js, 20160627_d88d1ea91d179af2ee435fb5f0b0bacb.js, 20160627_dae4b0df20ede51eca98a72f79c1d516.js, 20160627_dc9b13e1d26c7f170a0d8cf164eb2e3b.js, 20160627_e395c0c8ef0c611f1cad9fb7ffa92636.js, 20160627_e5ef85887cbbaa9704913d46347135af.js, 20160627_ea6ab7df993d99c9f7d696b5703b4f6c.js, 20160627_eee7e58d4586e23b5b85c9adeeb0b8d6.js, 20160627_f5a6ea49069cd48052f5dd7af8b60309.js, 20160627_fabc25e1e1667f03b11f6ab7695ad9f7.js, 20160627_fb664925c7b3f94f499a6f5275c4824f.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "591021af36951bee3266243663b791eb9fd6b7c382092558f3c2048aeec520d6"
    hash2       = "d20b756886d5e41319b07c1dc7ba882edfd5edc425208715712b884d3f354109"
    hash3       = "209839852f1e909a12a215fea5c9451fab233864ee843129b1cfc057caa1f7bf"
    hash4       = "75a255c05adb6d1831cfcc82cd2563f739ae69922de909ce256a4f5b68eabc56"
    hash5       = "46c10e0181b3d59a1a328e3a5c94b762e9ea82b5552b3f2c3b5d85a5794f0eca"
    hash6       = "6e52260c5986a44fd2b91f096ac8652c2a64035158d77b2adb017dbce99148aa"
    hash7       = "7a0a082907c1be48022c1463248be860959a94e71615c332527c3c9307f0559a"
    hash8       = "53be5a29f06496cec0a7f08f53f346a779b4a0e2d103021655fdc3daaaa542a9"
    hash9       = "43891eda090e55646d4881703b862ac3b9cf8a7c19a2f39cf4cef51e3ec4c127"
    hash10      = "87bafa36f3768ed0dea4c3478d1736cdf576c0d9c53e80e0779e15b083911d0a"
    hash11      = "54ceeeff233db7a6fceed6df6e6f1b576393db083c1cb42bf9e2a2605374b357"
    hash12      = "5280b1b3315ab9b6e5908cb7e0aca8150590596517a9ca159e7f3e31366fc627"
    hash13      = "7bb1e8e039d222a51a71599af75b56151a878cf8bbe1f9d3ad5be18200b2286b"
    hash14      = "b86c0ec35e950f0a1c58c2444eef3272e3f4bbe4ca57eb23e81d3ae65431e2cc"
    hash15      = "ffc23f9fc025b38861428ed42c89b2c70375b1334265614c6dd18f26888c52bd"
    hash16      = "d859f13888cf8029b141d3a3e24559588da20f1aaa84ad23cf42f91678b328a2"
    hash17      = "a5048c337288f9c04fb9ca4a0f772a2036b975fbfdc0de90764456e835b363dc"
    hash18      = "cf50d9c7e3b8222a580dc3a8f1ef369574c6476832970dd1bd797670f92645eb"
    hash19      = "88c134090c13bfad8633472ebe6e9360940bc53f26611d84165edba9fd5e9231"
    hash20      = "34ccea5776d9755ab97981f6c0c43ebcc3f64c963b22de6b817cac5d3a064b0f"
    hash21      = "58ed7629e79a9748ef7f12de2421420d47876577068f74792be5a1e9034faf70"
    hash22      = "2f6f0b4b25506c39402f33be4ec91c4f2bd55ce6c3477b6ff8ddf739a977bf3a"
    hash23      = "1cb36585e4cd1effb08c02d3479a4161b061691362aeba47f91bad33bcc374b3"
    hash24      = "f3d740475a8b3c230799e254f542822d9866f5d571525ee11e669ecdae9ab59e"
    hash25      = "ea5818cba08c03220fadbc20c8d531f90a95b7cbeb17078221e44c362554d3fc"
    hash26      = "259e69c14ad9ed31e98091ec404eecbf21bef22a8f318d606f20df682f30f757"
    hash27      = "0f525c0a5a246fc71af643acc5875a42bca8e8a6eef88b08422042954c983a87"
    hash28      = "6c1e02f365a689882270e21896790d17bbf068be0c30804d123bfaa6cb073dd2"
    hash29      = "aae04be07a4f0d8288fa16ef43b84b8ed2f2a92cd80d5a1211305e727fb39197"
    hash30      = "909eaa4c7af286148693e7918e12e1cf40ee1fa74aed5c6bfe2064e711fe8fdf"
    hash31      = "2d854456a064ddd97dd4a918d1eeaf51643029f1e673e7c8050d8eba6dec7139"
    hash32      = "133eb7390214d947e1e91c40a926b03ffeb6ee05fdcc40db736137c455f4590c"
    hash33      = "ecb46256a51f9d2c3698c80703e108af2e16eadfd6ba52d24eb089c412a37add"
    hash34      = "7fba27e0038df06dfcec1a3b6956e2332ad0621f811aaaa1506bf68342f21db3"
    hash35      = "132fa04d805537ab0bd8cc089de63c0f740f654e1369bb7405835f8f48680a32"
    hash36      = "aa3c2b0a51d233bc6a1bda43867ea9c4a4bafb8dae21f86ebec47c3ecf4870c2"
    hash37      = "1470ba757ca40fb9c4e481cecccf7d6bd4c6519f05c3e8aa292ce4ce2731a977"
    hash38      = "26becf7c7a7df041224dc41e00b604e767818bebe8d2bdc7ee823dad43f81a6b"
    hash39      = "18e93670bea577be7350b63bd4fcbe0c38d2a95a3fb7bc5aec219618731e132e"
    hash40      = "e8a4e8838b412dd5f2f04173d859577b0f9abc5695dba8f1c671a9f97b47be4d"
    hash41      = "8edce6037f7ac55caa1fa4ef324542c5ed5f385967bb74f2607c5adfa8c90d85"
    hash42      = "9cfecd12532d2b9a9b59f950ea50dafbbcd46974af066aac375e844f626c2115"
    hash43      = "2805944b65b18ec31c794eb3774a01a8cb2411e5f03187a3d15fb564a9d1b70e"
    hash44      = "ffe06a65eeefc8086f48a8fb05e23f3545305df17430391499f4620df871555b"
    hash45      = "2f8fd08a232340487dd4e1d4a0bc626f682c5fd9b267749ba231b1ed2ea97cb0"
    hash46      = "760af22b37b3cc7c978abba7c527cef60b6ebd10c6a47e329ee48281b9ca51ae"
    hash47      = "2bd2802b54a0d69de6f86530a84548aa4d04a4cc2149fad3fe26547c18e964ad"
    hash48      = "64858f9474f93ff6dc4e94887744c94e7cdde043d9e8c65d52857829544ca89c"
    hash49      = "4e98a36a682cb45ca4722ba4392f0dd6577d0c6560b02df363553076ade9072c"
    hash50      = "aa4edb2945cbbd7204ca82695d4852bb0398daaaebec44b193795f304ef84aeb"
    hash51      = "6bd11c0a7b620085bd7bfeddda8667ffeeaf54e04a48751eeda27577d58b4fb3"
    hash52      = "64fcc2cb0d17a7f3aab02dcc07a0325312a17d0a8b03ea048e02c89a320f57c1"
    hash53      = "4866c8693e8e51a71e154cabc7fc85440772411a00f67efaa7d8b61206425166"
    hash54      = "9a8d823be13afaf5037997f9deb05b8ac9743dc5269172b2ffb52ce75729679e"
    hash55      = "03a9a582fc109e9b12874e57a87f3740f1a4a314f4c4890bf38945a6cecf14f2"
    hash56      = "aba5d3efb82f389a309d3fbe6d4caf37d40184e0324893f3e709d610cd11bee0"
    hash57      = "bc6d931dd7e557303467b45ac0cfe6b08ffbbd98fb1058fcd040010fcf0930b8"
    hash58      = "3020fabf28d22855b8f22c10eee899678e6176a8b628a89e23211ea279905255"
    hash59      = "7f43e60e527507815bb5fb5ce08b0e8dda5d7dfd6e18c5a4fa29775eff2e7627"
    hash60      = "929ff027c92a245ffd5f16fbb2db89f949e5299058f68d1aeeb1d7849c0fff85"
    hash61      = "2f2ef255d5c1795b1582e839c8a7491dc3dbac3ebc4531d04b8940f1f0cde7e3"
    hash62      = "a367925ee4e1c3a107450b87907f4cfa08e109bf1e56e753ea0ffc42d891060e"
    hash63      = "cfb880d4e435e35018ba742e068a963f7a169841f110ef7f06f286edb40036aa"
    hash64      = "6aef522c24694dde03c46f77a7ed632fd2b32b5dd72bd884317ae5f679471f5b"
    hash65      = "18f6df370ad87477f919ef7498c0f9edb2c3c666449d0bdb20c455c8a69ea9d5"
    hash66      = "2b836c3b26e95e4ccaedd9b65605b30e253762fa2e2d8dfd0950dcf36eb81ad7"
    hash67      = "d447a235d42efabef6d7db4990a6b4a3f771d970b5b8fc5787a8dcbd15fc5a63"
    hash68      = "e5f86a653e1ec5b97c03024945534b6c373fb7f80a12aca06b741f431e4de119"
    hash69      = "bd0d31e817c1030c98cdf60f7e97fd01e422318ee95cd9114cd31e713072b272"
    hash70      = "fb79da76763f7bce193225f9dff80b234c94566a45ce39d752b156f2cccfdb31"
    hash71      = "dd04b00311cb033beae294bb384825ee7afc1a485567c177d4c30a5e05a198e9"
    hash72      = "9ba5ccb4aa417bba2905c338593bbc70492f7ca2a16b6bd8d3c70496da01d7e8"
    hash73      = "1b17855f25c1899fca485b94866e5d79a2c4975d3dfc4f1c7b5e9228631c926b"
    hash74      = "fa7db2dc16ddfd5bdc1880392d03ae46deab7485b19d412014791b4d8f08e20d"
    hash75      = "640ce6eaddb4082d22125c27ca6aa7f248907df84641eb70cbcf8972b49439a6"
    hash76      = "226b4c96769fa67b47f843344f24c6725ae468cc95fede4e6c53b815f1425756"
    hash77      = "5884413f85028fe7d95cf8ab22db2e01b1eaba288136cc10df76f46005957bea"
    hash78      = "ef727a47649f7a79d3e9600031986a1e173fb9805a0db2523624a930e63499a4"
    hash79      = "e0f844b433511979551a8dcd96e0381817cffe89b1157b3a10bd35115dd05f24"
    hash80      = "6a6a8fb5abf7951300cdadde61122e619db1fe0a13258515cb5a0e82f54fcbf7"
    hash81      = "8585784156634c40bd73100b69bf27bbabbb03d0bda09c6b9865da8949750dfd"
    hash82      = "22a073c52a1cdd57f7ccd15511b245aa68e739fc615856ea7e455b39d933e5d3"
    hash83      = "bd683e3870a7ad24a2d7e209eb9fe5e4a82c9a3e34c5cba5ed37cbd6756f8f5e"
    hash84      = "1d89df827e149be21373f00c690f2d2d9d3fc425db4cca17eaf54d37bff0bca6"
    hash85      = "5d81a2b5974deb83d61465b9ad1cbc913fb470c85b44ab80ce4b6dca9ee4e1dd"
    hash86      = "297e7b935367f673fa432cec66a6ef1526b7e8bade36e9b540b688374268d227"
    hash87      = "db052845cdbae8b7c70daef70e5f9c063f51f929eb76790fce599a61a95e8ab0"
    hash88      = "3bc7ef7a16c79ec5335c74f2420b0d87c9ada9b4867334d78c526910c630b161"
    hash89      = "f97264a35a695de0b2b232c8fcc8de5fbe59a67494148c0e38958f075a49a407"
    hash90      = "ec8abca4f8f9075906c9c0b6ab53699a4f31e074f653014b24676a0e79601a04"
    hash91      = "9ce1686fb520882ae74d310ee8e84fb5a378de7dde471eadad993345ec105bb9"
    hash92      = "d0c4313a126c8ac30bf775443972968fea286ae43f60ab1647d9f19b96336295"
    hash93      = "384c97c19d82b72858bf3160e63aef114ab0f5b571ca1378760fafd7470efe98"
    hash94      = "c61ad240dab57cae096f2603640dbd1b5ad6a19888a832b2b23dd48a92cd0057"
    hash95      = "01c0fd85f30a9af6c4a88a20dbbc6fff4fb3623d32b04a8f1bc2481c83b68cc4"
    hash96      = "eaa667bece74eeb9117f9f5e70a226738cbd5a969f4510346d8e42566f40b0cf"
    hash97      = "05a3775cb9b5858bb735814ea5ea901f33c36af45d70efef640efd88664ccf98"
    hash98      = "15d8aeee5d6fb0a89bd73c03c876f2660bd41c666f55fe3810c44b2bc7af19d4"
    hash99      = "d99e751d366fc107dbda9752f4b501baa8a4dbc4df1eb140c37eee59844d7b76"

  strings:
    $s1 = "var rampart = new logan(terrifying[1]);" fullword ascii
    $s2 = "var selecting = new logan(terrifying[0]);" fullword ascii
    $s3 = "function school(gutter, reverse) {" fullword ascii
    $s4 = "var unlike = { ':': '.','U': 'S','381': 'X'};" fullword ascii
    $s5 = "} catch (fbhBGzsX) {" fullword ascii

  condition:
    (uint16(0) == 0x0a0d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

86a2f31e-2021-4e4f-b08f-44b28aeb2f76

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion