_20160921_4357cd536e8c7d04b6d87c9010da5db8_20160921_92203c861b27_2059
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_4357cd536e8c7d04b6d87c9010da5db8.js, 20160921_92203c861b27f106aadc39fdc2b4c6b7.js, 20160921_c6543124cf4219fa4e40c0a11c36d211.js, 20160921_ca70c2e5223139fb829c45d71c694e10.js, 20160921_e30a7fc515c8c3fe0dd9b1892df8c5ac.js, 20160921_fb6312e3d81966654b016b9b32d471ac.js, 20160922_0d54e6d044b32b4a5cb86183b32db7ff.js, 20160922_9b3b116ccafe79961f3e5b8baaf2ade1.js
rule _20160921_4357cd536e8c7d04b6d87c9010da5db8_20160921_92203c861b27_2059 {
meta:
description = "datamaliciousorder - from files 20160921_4357cd536e8c7d04b6d87c9010da5db8.js, 20160921_92203c861b27f106aadc39fdc2b4c6b7.js, 20160921_c6543124cf4219fa4e40c0a11c36d211.js, 20160921_ca70c2e5223139fb829c45d71c694e10.js, 20160921_e30a7fc515c8c3fe0dd9b1892df8c5ac.js, 20160921_fb6312e3d81966654b016b9b32d471ac.js, 20160922_0d54e6d044b32b4a5cb86183b32db7ff.js, 20160922_9b3b116ccafe79961f3e5b8baaf2ade1.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "aa03b8f8bd18b6425bd0435f38ca6501c2932bd998eaa0c2be7420c50212affb"
hash2 = "307c62eb5d0e72645486ed8ab490a017889f28cb40d74f607fae031e9ef250fb"
hash3 = "2e6e6772ef9133726c2b17ebda7c01433c0b60252b2e9446e3c8a2e6595d981c"
hash4 = "06efdd8c0262a51372ea085744e30220d9e93e45b2bf9ef29d7e71b27174d2fc"
hash5 = "2db3499efc418559f17a0414ed3156ee8f0a83f7ca0cb04fe1e2d403c9f22306"
hash6 = "e9183fcae238e67df02c94cc13c7f9ce436709e3bd1fdaee8caa1fb15e4c0f81"
hash7 = "bdad94d3c22138ff9e5f70b983cbfbfaee137dc676cd8889f048ac4db0e3e1de"
hash8 = "3e53e6ba6e3163cbf17f110b2b7e3a79966fc578ec4ae1ed2de13f0fac0de834"
strings:
$s1 = "),(function f000(){return \"WIj\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"KXg\";})(),(function f000(" ascii
$s2 = "rn \"Yi\";})(),(function f000(){return \"KXg\";})(),(function f000(){return \"Kw\";})(),(function f000(){return \"GGn\";})(),(fu" ascii
$s3 = "rn \"GGn\";})(),(function f000(){return \"WIj\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Do\";})(),(f" ascii
$s4 = "UOt\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"RPt\";})(),(function f000(){return \"Do\";})(),(functi" ascii
$s5 = "000(){return \"Mu\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"KXg\";})(),(function f000(){return \"Yi" ascii
$s6 = "000(){return \"XTn\";})(),(function f000(){return \"Qz\";})(),(function f000(){return \"Yi\";})(),(function f000(){return \"DIa" ascii
$s7 = "n f000(){return \"GGn\";})(),(function f000(){return \"QDg\";})(),(function f000(){return \"Mu\";})(),(function f000(){return \"" ascii
$s8 = "ction f000(){return \"Qp\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Do\";})(),(function f000(){return" ascii
$s9 = "turn \"Yz\";})(),(function f000(){return \"TKl\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"MDb\";})()," ascii
condition:
(uint16(0) == 0x2f0a and (all of them)
) or (all of them)
}