_20160921_0d3dee472bd7a0a1e2c48044e2c47f0b_20160921_1766f5c818d6_1970
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_0d3dee472bd7a0a1e2c48044e2c47f0b.js, 20160921_1766f5c818d6371cb36488c98158ccd2.js, 20160921_54ac484c468ac2ca7fe6c7210ca717bb.js, 20160921_66566a9bbc7830091a244fa6674b709b.js, 20160921_86f41d8c83240a68770674107f15f162.js
rule _20160921_0d3dee472bd7a0a1e2c48044e2c47f0b_20160921_1766f5c818d6_1970 {
meta:
description = "datamaliciousorder - from files 20160921_0d3dee472bd7a0a1e2c48044e2c47f0b.js, 20160921_1766f5c818d6371cb36488c98158ccd2.js, 20160921_54ac484c468ac2ca7fe6c7210ca717bb.js, 20160921_66566a9bbc7830091a244fa6674b709b.js, 20160921_86f41d8c83240a68770674107f15f162.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "9ffda0cd0cd96558031ec49484507d0af3efe8f0ec6fee33e947b4b9515ab24f"
hash2 = "4d8985b767534ef1312401b6a38570477e0c87ed4ef37c945eee55179929c0a4"
hash3 = "5b883334540a4216b3582d1f2fa0a27f21b9c64a87944c8e58d9fab0f609eef3"
hash4 = "154f7ca38a058d2590f40ec43ada530305244e5c7e86bbedd19aa9c0e1ca02aa"
hash5 = "56a4c0b8742284d9e8907df1b8d73d9c73ee82bc9595e88d869c555afd77312d"
strings:
$s1 = "on f000(){return \"GGn\";})(),(function f000(){return \"QDg\";})(),(function f000(){return \"UEg\";})(),(function f000(){return " ascii
$s2 = "urn \"KXg\";})(),(function f000(){return \"Qj\";})(),(function f000(){return \"XTn\";})(),(function f000(){return \"DIa\";})(),(" ascii
$s3 = "UEg\";})(),(function f000(){return \"OUx\";})(),(function f000(){return \"Yi\";})(),(function f000(){return \"XTn\";})(),(functi" ascii
$s4 = "turn \"WIj\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"QDg\";})(),(function f000(){return \"TKl\";})()" ascii
$s5 = "),(function f000(){return \"OUx\";})(),(function f000(){return \"KXg\";})(),(function f000(){return \"TRc\";})(),(function f000(" ascii
$s6 = "){return \"KXg\";})(),(function f000(){return \"TKl\";})(),(function f000(){return \"Qj\";})(),(function f000(){return \"Zj\";})" ascii
$s7 = "on f000(){return \"Lp\";})(),(function f000(){return \"TKl\";})(),(function f000(){return \"XTn\";})(),(function f000(){return " ascii
$s8 = "eturn \"GGn\";})(),(function f000(){return \"Tn\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";})()" ascii
$s9 = "rn \"GGn\";})(),(function f000(){return \"Fs\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Yi\";})(),(fu" ascii
condition:
(uint16(0) == 0x2f0a and (all of them)
) or (all of them)
}