_20160921_034dbd5881bc0324f5773d7774d981c4_20160921_164a257da283_1948

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160921_034dbd5881bc0324f5773d7774d981c4.js, 20160921_164a257da283d5c859dcaffb21bf752c.js, 20160921_17c44cf20b688f3f5be613056d39409e.js, 20160921_1d5a5ba6420732e8f626755a81334ad4.js, 20160921_2c106cc001daa2dffdfde7e2aa5c908b.js, 20160921_2e85dfa9a5ea92be677fa9eceee4f8b1.js, 20160921_3a888f864f15e69e777cbaaa06f962e5.js, 20160921_3b7ec37cdbfac434e32c8743c60228af.js, 20160921_3bd7e22bf0147340b20eeb7a825cb9a1.js, 20160921_4f1da2d661fb97b4733f3fbf35efff6c.js, 20160921_5143fd2835d058f3854ef7b166166de4.js, 20160921_56567a449e5ae44cd4a4e62bb55e63f3.js, 20160921_57d7efd4078096b801e379ee02f0feec.js, 20160921_5e9244484429cd897ec88fe97140c29c.js, 20160921_62f4f68c59540f36d255485f0f0e37c9.js, 20160921_64060d97e498db57bf68dbb08be86bba.js, 20160921_6c49e33f1abb3ca2b0ff12a4878e38c8.js, 20160921_8acd2bde0828f30802ece6249f9b9483.js, 20160921_8be5b3aac0a2f47acb168b56c6f880bf.js, 20160921_8dce9d2aa0d1e296bbcc31a437e35a45.js, 20160921_a0b892850e7511a70b7c95d4603de0d8.js, 20160921_b04f9fe7316d0e86c0046e130e905e37.js, 20160921_bfdb187f27d136f64e05f0dcf2ee4914.js, 20160921_cda776f6c5cb6eec510c00d5294fbfae.js, 20160921_d0ae6acc5cc4f52f8d5df0b47ef8659a.js, 20160921_e01bb59eb24d1686f9e2aeb1c9237853.js, 20160921_e63dc8126cee826e8d941c1665ea92b4.js, 20160921_ecd98b74e6a52b1227b09228f92cb495.js, 20160921_f2abfe62ed227fb547869419a6d3af3c.js, 20160921_fa89d54bd5a7a27defe09d5a56b5a881.js, 20160921_fb2ccc1a635114bc23ea8a0a8413b110.js, 20160921_fc08be0621d4ffbced0eaca2b2622b07.js

rule _20160921_034dbd5881bc0324f5773d7774d981c4_20160921_164a257da283_1948 {
  meta:
    description = "datamaliciousorder - from files 20160921_034dbd5881bc0324f5773d7774d981c4.js, 20160921_164a257da283d5c859dcaffb21bf752c.js, 20160921_17c44cf20b688f3f5be613056d39409e.js, 20160921_1d5a5ba6420732e8f626755a81334ad4.js, 20160921_2c106cc001daa2dffdfde7e2aa5c908b.js, 20160921_2e85dfa9a5ea92be677fa9eceee4f8b1.js, 20160921_3a888f864f15e69e777cbaaa06f962e5.js, 20160921_3b7ec37cdbfac434e32c8743c60228af.js, 20160921_3bd7e22bf0147340b20eeb7a825cb9a1.js, 20160921_4f1da2d661fb97b4733f3fbf35efff6c.js, 20160921_5143fd2835d058f3854ef7b166166de4.js, 20160921_56567a449e5ae44cd4a4e62bb55e63f3.js, 20160921_57d7efd4078096b801e379ee02f0feec.js, 20160921_5e9244484429cd897ec88fe97140c29c.js, 20160921_62f4f68c59540f36d255485f0f0e37c9.js, 20160921_64060d97e498db57bf68dbb08be86bba.js, 20160921_6c49e33f1abb3ca2b0ff12a4878e38c8.js, 20160921_8acd2bde0828f30802ece6249f9b9483.js, 20160921_8be5b3aac0a2f47acb168b56c6f880bf.js, 20160921_8dce9d2aa0d1e296bbcc31a437e35a45.js, 20160921_a0b892850e7511a70b7c95d4603de0d8.js, 20160921_b04f9fe7316d0e86c0046e130e905e37.js, 20160921_bfdb187f27d136f64e05f0dcf2ee4914.js, 20160921_cda776f6c5cb6eec510c00d5294fbfae.js, 20160921_d0ae6acc5cc4f52f8d5df0b47ef8659a.js, 20160921_e01bb59eb24d1686f9e2aeb1c9237853.js, 20160921_e63dc8126cee826e8d941c1665ea92b4.js, 20160921_ecd98b74e6a52b1227b09228f92cb495.js, 20160921_f2abfe62ed227fb547869419a6d3af3c.js, 20160921_fa89d54bd5a7a27defe09d5a56b5a881.js, 20160921_fb2ccc1a635114bc23ea8a0a8413b110.js, 20160921_fc08be0621d4ffbced0eaca2b2622b07.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "82795298a84df6fa0b0e45225727206f9a173f55589db6b76ab8df4198dc55c7"
    hash2       = "36edb416a5f8703ead3fb8f8fbb7a0fb98ac21c559eb20558b33460ba9dfc9a0"
    hash3       = "0a10c81cc5c3cc9eb38f73af3b77ed314fed047818a2410613c91431eee6bee1"
    hash4       = "47a1fbd3f8785b259468283f9d6611b34da6b0170d66a933ade09c56548f89b4"
    hash5       = "ca5356b92abf859d45d843749f45e5e06c7d045b4e7ea5d215ab87cdb8c8f66b"
    hash6       = "fd958e388f97aa8b73e103ada622a36250446b5740c2e70d0bf844240c0968c2"
    hash7       = "65826487c59973db0339cbaf1f8e99201516dc26d5bdf1991855fafe9cbc5da1"
    hash8       = "86390741cf6e610c2e526db749631548b514c268decade5a5870edfebb141d4b"
    hash9       = "fabcf64721727f8848bd26426a6a8b0fdf115e6416d2ce71dfa09efadb821690"
    hash10      = "57198460b755f2336c23ed27d26f09514db08ab180e216293a853489286f4ff2"
    hash11      = "0824c6197846b6efc3bea2626d4bc5983302ec11dd40189770e6572811d3d42c"
    hash12      = "e0950a0ccf96b116ed17c3fbaa99325e34f0b717e3e354bd1f926eee8465c6a7"
    hash13      = "e568760a55d343665c530313749711c3424bfd35c792b1a8b1d5ad6fa004c9a6"
    hash14      = "002e6ee9d0d9e7f54ead7f8981f20be210819f7a75c52e3d1e91de2fd03ada17"
    hash15      = "4e9c7d3504791445d99c11b26a2aad12b3de66c6ef81ae8c7032e0310dda3d06"
    hash16      = "30a02b9f75ed0112affe2c698cfdbe2ec2a5bc4d8248ac34ebe13e072bd212f0"
    hash17      = "b2c5f6e5a1ebce2cb0eb54f0d28ea21ab88b07dc646376bb3fc5ce29af1615aa"
    hash18      = "9cf59fc7ffd1ec7428d01db709ab365cf4dfe41d386ebb308b8bad860ff941b1"
    hash19      = "344d7dd8865545f9f4c1045a85547b4140c66621aeedeb02bf60ff4598ff6930"
    hash20      = "26c784fc7a8e4ee1608e66a82f1ba134972418c5968433b39f54392e7f3de0f2"
    hash21      = "0b5459eb728a278a131a764184d1d333fcd3fc212087b66d9cedce792b1a2d7a"
    hash22      = "58df336ac7568c9f52fedec5d0b900480491f3e65f56c23426010ec745a6bddd"
    hash23      = "cbf2173e7b067de6ce6bf189ba38c78f3f0d97a7e6685c0191e08885badfeb3e"
    hash24      = "064df16cff12584bccc68fb79fe80908e6edeb4ccf32c3c0b6a79b8b0424820c"
    hash25      = "8cde265a6a44d9e9f86f351959c030a86800d101b5b5ca057ac1cdc5c5a1e38d"
    hash26      = "6f5c056ecbe8fe7bc86b4862d32e261ec2bc26cff4b18206988fdb1c7059557c"
    hash27      = "b87ae77185b5925bd9480daa9d4b74b2291cc670108bf85e0379579434ebff34"
    hash28      = "8930637b40db8c97df91bff2cf5b4021d0bcb2f6a204f27249176fe3d6d4120e"
    hash29      = "843cfa29e93bfa9adfe4410735aacbf939d01a404dc3c507c0562f478b65086f"
    hash30      = "30f2a7c2562ef79254c8129be50246b9c41eb24f000c8cfbd0f4f8c28b49b00f"
    hash31      = "c85e7d8e5c1682f21f2d8c9a0e1f6039d583d7eda8276ca9ed3ed381fbde9a7e"
    hash32      = "1641412d2cba74b5cd1b4c4619c995601c42039d472339eb7cb10d97e1d47339"

  strings:
    $s1 = "n \"Oh\";})(),(function fuck(){return \"XCr\";})(),(function fuck(){return \"Oh\";})(),(function fuck(){return \"UOe\";})(),(fun" ascii
    $s2 = "(),(function fuck(){return \"XHj\";})(),(function fuck(){return \"Jg\";})(),(function fuck(){return \"Ar\";})(),(function fuck()" ascii
    $s3 = "),(function fuck(){return \"Xw\";})(),(function fuck(){return \"LLv\";})(),(function fuck(){return \"XHj\";})(),(function fuck()" ascii
    $s4 = "){return \"Pc\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"Na\";})(),(function fuck(){return \"Xg\";})()" ascii
    $s5 = "n \"Jg\";})(),(function fuck(){return \"Ar\";})(),(function fuck(){return \"Fv\";})(),(function fuck(){return \"Xg\";})(),(funct" ascii
    $s6 = "v\";})(),(function fuck(){return \"YAv\";})(),(function fuck(){return \"USf\";})(),(function fuck(){return \"LGo\";})(),(functio" ascii
    $s7 = "(){return \"Sx\";})(),(function fuck(){return \"To\";})(),(function fuck(){return \"Mw\";})(),(function fuck(){return \"Mw\";})(" ascii
    $s8 = "ction fuck(){return \"EHo\";})(),(function fuck(){return \"UXf\";})(),(function fuck(){return \"KVh\";})(),(function fuck(){retu" ascii
    $s9 = "ion fuck(){return \"Fv\";})(),(function fuck(){return \"LLv\";})(),(function fuck(){return \"Wn\";})(),(function fuck(){return " ascii

  condition:
    (uint16(0) == 0x2f0a and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f28abe7d-b528-42be-baab-b7d40ac37183

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion