_20160919_04bac83d40ae28e4938d2a8fe244c611_20160919_057232377f42_2180

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160919_04bac83d40ae28e4938d2a8fe244c611.js, 20160919_057232377f42e6e167d197013eebf706.js, 20160919_08da5c3f02c211aec73ba0c6550a2c72.js, 20160919_1022ebb2685a682cd0d2aa92e67c9157.js, 20160919_1361742f56de46e27928f34168876f49.js, 20160919_158039f1df11dcf800563dee244ced9a.js, 20160919_1801d05ea9bcc0cbb8095a281170d0dc.js, 20160919_1c398fa43d8e209834ef3f40c8353a38.js, 20160919_1e12599949555cc74ad5a8b12bfb528f.js, 20160919_23fc1dd90a615180b363e53bb6568c34.js, 20160919_242b6320da119ce3fa9eeae1e7d821ff.js, 20160919_27a0bd7235a221c6eeede9b2595935b3.js, 20160919_2bb2b5c0edaa899a7ccd97343fa4d1d3.js, 20160919_2d222dd307f0569e6e5ac6f51152f81a.js, 20160919_34293f55ed99f306841a5b91c9124de9.js, 20160919_3ac87cc6ab6df6e1dd2cbf1179f7db59.js, 20160919_3d47f3bfbdabe2c053cdc9d1a105d739.js, 20160919_4126da1c7382bc6c25bfd1ba73d0fc53.js, 20160919_429db6c8fe5253cfd5107009f0795c69.js, 20160919_44471b0fe34fd99bfd93a2e2dd6a07b7.js, 20160919_461872674d35df70c7a8b4bf902215d3.js, 20160919_4d381bf0fe7f385d7c76ae000edb6b80.js, 20160919_4d767b0c30f73c81af0da55d2f9f80eb.js, 20160919_4f9510c7aba6fb2ffb6eec1ee7663456.js, 20160919_5b08a2e9ece93a7940a30277e9c25a72.js, 20160919_5e5d563da255975086a816a47d657caa.js, 20160919_5ee1abf0bedc2bf2a6e98b3e4b1a0913.js, 20160919_6944c112d7fd4661bd19db71139e654e.js, 20160919_6b9c45444266d228b600f9c0b94c56cc.js, 20160919_6d4f3f0b74ca1a484510c096897d2478.js, 20160919_73973fc53d95c20f1db8c3a1a4942436.js, 20160919_77865ef9c039be96227fcae2b1dea4a3.js, 20160919_794a0554f4e66351b539be6b775fb472.js, 20160919_7fe15291ca6d75c2bfaf3ed337a77853.js, 20160919_81712cd1ad64688396a2ad453e946cc0.js, 20160919_8633293b763bc98ce3d1d90c1a5c9957.js, 20160919_873c90f6785e7a310a17a10a348625a6.js, 20160919_87e749fa1e51632d69df0a2da981d2bb.js, 20160919_8c8d57e2604859add6ddde3baacd3cf1.js, 20160919_8d98640fdf98b7eba650c33057d0b6a8.js, 20160919_8de3212cab7b9109321152a1a01ff1fb.js, 20160919_8e19038581ccf1588b705a2f4f91d696.js, 20160919_90cb46d46ac3198dae128f363ce89a70.js, 20160919_93b80c294fb64bac1e2a2d64e4dab410.js, 20160919_9542146e845392a007037066b6a57451.js, 20160919_97c5d07a254bc20b5e70700b911a766b.js, 20160919_995368ab4d4e55d1f6150e5deb633879.js, 20160919_a3c393451a2ddb026a76c999e1ea35e3.js, 20160919_a47b9fc59996500989d4622f3f67d39f.js, 20160919_a60d0e15001d3e9d9de009139e6208bd.js, 20160919_aa082d9e3e132dc721f5c0dfe5cb9525.js, 20160919_ac4eaf6498451b618ff95a91c6e6a780.js, 20160919_ad0c8e3ae86b61cc425bd3181244f5d8.js, 20160919_b0ae99402cc5ba52e7b2d45eac41e5d0.js, 20160919_b93cab14b2d27ccc19e96c48434dad21.js, 20160919_bb19d20c8fa3c5348af32169d43bf7ed.js, 20160919_bdb0ef4924c7f54cf0a4f6b3a555a55b.js, 20160919_bdfc31bc0619cd0e266112758684c79e.js, 20160919_be782342e371d5175f08659877353586.js, 20160919_bf5fd630039b52e37636030cc16baf56.js, 20160919_c3c0ea257445c7802a2bf92534b8518a.js, 20160919_c9f6c28aa7daed8753582e0013c15249.js, 20160919_ce631c82b8d81871646ea4da15788ce8.js, 20160919_cf6914cb3e5d574d060bfd144a837853.js, 20160919_d043edd6ea52a8fdfadc469c1ac1c2f7.js, 20160919_d1fd4897c2ad5d4eca6a633838a7d616.js, 20160919_d2f23e9f709a3aa357cad830de21d0d0.js, 20160919_d3bcc0a71284e003d2810555f658b9fe.js, 20160919_d5c2c5139c5ae6cecef264726a56ed9e.js, 20160919_d6b2fd0f1146dca6c03986c8d8499e69.js, 20160919_d894583fb6190e7e1ba569fcfcc36591.js, 20160919_db003e0ae668c1137834ad6d10d1c18a.js, 20160919_def39a44663a401a845bf7256690d758.js, 20160919_e0bcde6a5e8d40fe327241c87ac7f5af.js, 20160919_e6c7ca89a75a519b6fc84f1f9db80979.js, 20160919_ed1bc5f58cfe90f11fa00a2b88a0f817.js, 20160919_edb58356df73f55d8be9d98ebbe239a9.js, 20160919_f8f64650da491a1bb4befc8f5d71e389.js, 20160919_f97e0353e073f5d6b482da14c5e7032f.js, 20160919_fa708a33b77b67e6f879282827753177.js, 20160919_fccf35cfa4f2896b1622ee53f368fe31.js

rule _20160919_04bac83d40ae28e4938d2a8fe244c611_20160919_057232377f42_2180 {
  meta:
    description = "datamaliciousorder - from files 20160919_04bac83d40ae28e4938d2a8fe244c611.js, 20160919_057232377f42e6e167d197013eebf706.js, 20160919_08da5c3f02c211aec73ba0c6550a2c72.js, 20160919_1022ebb2685a682cd0d2aa92e67c9157.js, 20160919_1361742f56de46e27928f34168876f49.js, 20160919_158039f1df11dcf800563dee244ced9a.js, 20160919_1801d05ea9bcc0cbb8095a281170d0dc.js, 20160919_1c398fa43d8e209834ef3f40c8353a38.js, 20160919_1e12599949555cc74ad5a8b12bfb528f.js, 20160919_23fc1dd90a615180b363e53bb6568c34.js, 20160919_242b6320da119ce3fa9eeae1e7d821ff.js, 20160919_27a0bd7235a221c6eeede9b2595935b3.js, 20160919_2bb2b5c0edaa899a7ccd97343fa4d1d3.js, 20160919_2d222dd307f0569e6e5ac6f51152f81a.js, 20160919_34293f55ed99f306841a5b91c9124de9.js, 20160919_3ac87cc6ab6df6e1dd2cbf1179f7db59.js, 20160919_3d47f3bfbdabe2c053cdc9d1a105d739.js, 20160919_4126da1c7382bc6c25bfd1ba73d0fc53.js, 20160919_429db6c8fe5253cfd5107009f0795c69.js, 20160919_44471b0fe34fd99bfd93a2e2dd6a07b7.js, 20160919_461872674d35df70c7a8b4bf902215d3.js, 20160919_4d381bf0fe7f385d7c76ae000edb6b80.js, 20160919_4d767b0c30f73c81af0da55d2f9f80eb.js, 20160919_4f9510c7aba6fb2ffb6eec1ee7663456.js, 20160919_5b08a2e9ece93a7940a30277e9c25a72.js, 20160919_5e5d563da255975086a816a47d657caa.js, 20160919_5ee1abf0bedc2bf2a6e98b3e4b1a0913.js, 20160919_6944c112d7fd4661bd19db71139e654e.js, 20160919_6b9c45444266d228b600f9c0b94c56cc.js, 20160919_6d4f3f0b74ca1a484510c096897d2478.js, 20160919_73973fc53d95c20f1db8c3a1a4942436.js, 20160919_77865ef9c039be96227fcae2b1dea4a3.js, 20160919_794a0554f4e66351b539be6b775fb472.js, 20160919_7fe15291ca6d75c2bfaf3ed337a77853.js, 20160919_81712cd1ad64688396a2ad453e946cc0.js, 20160919_8633293b763bc98ce3d1d90c1a5c9957.js, 20160919_873c90f6785e7a310a17a10a348625a6.js, 20160919_87e749fa1e51632d69df0a2da981d2bb.js, 20160919_8c8d57e2604859add6ddde3baacd3cf1.js, 20160919_8d98640fdf98b7eba650c33057d0b6a8.js, 20160919_8de3212cab7b9109321152a1a01ff1fb.js, 20160919_8e19038581ccf1588b705a2f4f91d696.js, 20160919_90cb46d46ac3198dae128f363ce89a70.js, 20160919_93b80c294fb64bac1e2a2d64e4dab410.js, 20160919_9542146e845392a007037066b6a57451.js, 20160919_97c5d07a254bc20b5e70700b911a766b.js, 20160919_995368ab4d4e55d1f6150e5deb633879.js, 20160919_a3c393451a2ddb026a76c999e1ea35e3.js, 20160919_a47b9fc59996500989d4622f3f67d39f.js, 20160919_a60d0e15001d3e9d9de009139e6208bd.js, 20160919_aa082d9e3e132dc721f5c0dfe5cb9525.js, 20160919_ac4eaf6498451b618ff95a91c6e6a780.js, 20160919_ad0c8e3ae86b61cc425bd3181244f5d8.js, 20160919_b0ae99402cc5ba52e7b2d45eac41e5d0.js, 20160919_b93cab14b2d27ccc19e96c48434dad21.js, 20160919_bb19d20c8fa3c5348af32169d43bf7ed.js, 20160919_bdb0ef4924c7f54cf0a4f6b3a555a55b.js, 20160919_bdfc31bc0619cd0e266112758684c79e.js, 20160919_be782342e371d5175f08659877353586.js, 20160919_bf5fd630039b52e37636030cc16baf56.js, 20160919_c3c0ea257445c7802a2bf92534b8518a.js, 20160919_c9f6c28aa7daed8753582e0013c15249.js, 20160919_ce631c82b8d81871646ea4da15788ce8.js, 20160919_cf6914cb3e5d574d060bfd144a837853.js, 20160919_d043edd6ea52a8fdfadc469c1ac1c2f7.js, 20160919_d1fd4897c2ad5d4eca6a633838a7d616.js, 20160919_d2f23e9f709a3aa357cad830de21d0d0.js, 20160919_d3bcc0a71284e003d2810555f658b9fe.js, 20160919_d5c2c5139c5ae6cecef264726a56ed9e.js, 20160919_d6b2fd0f1146dca6c03986c8d8499e69.js, 20160919_d894583fb6190e7e1ba569fcfcc36591.js, 20160919_db003e0ae668c1137834ad6d10d1c18a.js, 20160919_def39a44663a401a845bf7256690d758.js, 20160919_e0bcde6a5e8d40fe327241c87ac7f5af.js, 20160919_e6c7ca89a75a519b6fc84f1f9db80979.js, 20160919_ed1bc5f58cfe90f11fa00a2b88a0f817.js, 20160919_edb58356df73f55d8be9d98ebbe239a9.js, 20160919_f8f64650da491a1bb4befc8f5d71e389.js, 20160919_f97e0353e073f5d6b482da14c5e7032f.js, 20160919_fa708a33b77b67e6f879282827753177.js, 20160919_fccf35cfa4f2896b1622ee53f368fe31.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "d270dc520728b5589af3dd0523f407220f47448dda7c2680f4dbfe338701e409"
    hash2       = "342063f3bff5be6bfdd4fd4472a30f53336cc59405f343882b33f92cdddbdd9f"
    hash3       = "6186b245c2fd248686001d19917456ac29e19b296258b2654ad159d07baf1aba"
    hash4       = "ab6a6416df941dc29695876ac0d88510c4701e1989c338aba5ba2cdb03e1089c"
    hash5       = "bfb501a6ff384ee4bf1774362f7ddc4b121d152a47dd79298be75d06d38c8a9a"
    hash6       = "c9594cae4ef65fddba46957a0f01493f0e9d0f8720709ffc0f030a9075113ce7"
    hash7       = "889873de56384aa35c8ab4618bf921076d09d6fdbc5cab049515fd5e9d464340"
    hash8       = "394ad27de43ca95b273198fb9eb1a716582d2c6d1cddbe7d8913c3e16b71d4a6"
    hash9       = "bd224de2f2ae89b5a4a09537337a088f3505790cc05f77bed8007e9cc8bebf03"
    hash10      = "9cdc37fac3d75740d2025e87bc22f56db646b602880c1de178b9e01094db8888"
    hash11      = "bc8d480de9c11545768d86486731161ed430e947e1ff097222d31acd5543e625"
    hash12      = "8525726f6fb24d36d5eef2ffd189e1aa37001eebf19bcda559fc8c3e6f702c7d"
    hash13      = "cc355e022e42af02ceb2baea3f128ebe66ac25e89fce904c3c4aeab5f426ae9e"
    hash14      = "2cd1a7843084a9b7cf9bf134c0d4d336dc37440f364cb29939b065a0717f7386"
    hash15      = "815417151886174e59ac4f81caf122db3db8f4f3812094ee8a800ec4bae683cd"
    hash16      = "fb795bf562b7c699914d8a2e9b5e58ee68dcb01a44d08c771c7ae25f0d32a875"
    hash17      = "eb6ff032a27e0dfe1bcb49ace1ec05c491cef65453ec1d45cb6a8c3dafccdc5a"
    hash18      = "53b3245dba8078c7a7214f8f1a876eb365e91d772aa49d6dcddae860e16a3ebb"
    hash19      = "3e55fac079aa2c9ffcb98f1c76e4ba8bb15b49a18324ae56743a861dcb37f9b5"
    hash20      = "f0763cff32551940570e103990c28edcb5c368921fa0a6b48678b9f34af9bdc2"
    hash21      = "c76b26558e3ca87ba5e8085034a960ba41fc0e26d2f00fb143dfe0ef1782a3cc"
    hash22      = "7aa91b3071ac866908b0c15123b07a8b8a2e6a1168780730f13a5023bc5ef747"
    hash23      = "463c8d973bd086a9f6153a08790883dde03666dae2d5008af1972a78dc5b0e3e"
    hash24      = "8645aae14874c6300d3f88ea55d49e12deb76a1e00c5dfa7202b0e58e913471e"
    hash25      = "684c00d98844e396ef6d3a70246ee661084ac888499637b8a774c64e99065b78"
    hash26      = "9baedb2ec11f4d5ace069995d76eb7b56a378c9a102b0fbb1cbe8cc1b2076493"
    hash27      = "352bcfe61cfc3d09075f263306b782b9e781f946ccf51a95867f969b75094198"
    hash28      = "96aa2e4aba7fa9378b0ed602e5d961466298f82bb699bd7b9090812af0d28d3f"
    hash29      = "7476216adb7596b587e6a276ceda9d69356057bb2129b83502ca34da4b83c1ba"
    hash30      = "bb12e5393ebd03969d803a40b8a6740e04dd69c0de9b9dbc349b0efd21bab34f"
    hash31      = "2a5203f4d658441d807eb89908e7638bd208bcc01fca3fc6dfdd49dbe4a715bb"
    hash32      = "5dd0edcf3a96078de74855a3a691763a4abb13cfe856c4220c9e29a1098728dc"
    hash33      = "4036df6bb80f90131fa28ed6319b1ab4d3ca220ef1beab6d3886ea78f52741cf"
    hash34      = "72fa4aa010d4ae95210d0a6c5834b924d6d345c0e7fcc4bed85ae38b1b01ce2d"
    hash35      = "ddf33b5630b5f8e76859d2a8b4f92ebdf14fbc897865929ff18447bd5bbb2273"
    hash36      = "93ab92a9979f8aee439dff3a95a1cbdbd6d1ce0dea617ce47ca50454401794f2"
    hash37      = "0683604365a9354ff3ce262d27ab6aca830ba4a4a98bbdea5558be4dd62d4ae7"
    hash38      = "43b5046c03c85067797304fd0509bbc532880bf0b361292bf9de2c77acb12090"
    hash39      = "e72bc0e6bda307c2667b7c8aef90daa3f91951e490507c6529b26533558f2d17"
    hash40      = "992461e9f544ff6c9a055dbd1aa13453e1e6fb45e8dec21cd3d53ad7d2778c07"
    hash41      = "2f4b1ee654b7c0ad2eadb17d6dd135a7435e26eb54045781a0d422406e257d48"
    hash42      = "583f4243b90da236942b96aa378eb4be2c8564d50696c973e001f6a543110e10"
    hash43      = "570820896da7aeb4a61547fdb0683463689e162e5e98c6c7876211b7abbd8c8f"
    hash44      = "c068337d64257ead73fe292c5e84c10597dfb40006351f5900069e70c1e78627"
    hash45      = "5e3542d3bd5f9b10da7b84c8e114602716897ee091dcd7c38e865cc162698fae"
    hash46      = "a3bf0f71a5937d74a2a1159419e249aae6c99bea427946fbadb8506239ab4858"
    hash47      = "48c119e4f842f71cc77d104d052b187a0800535ce2b4925b9c4f9421ad687a9c"
    hash48      = "255b81f67b8f79a1c1522731a5e6de6ba4b78297b1998e124b9c2a3b23080a8b"
    hash49      = "c01248b4061c89224351637ebfb5b2339d58ecb0eaf0908b5354650b4b55c0f4"
    hash50      = "ffdb4ce722c92b055012beb79138a6b22fbabb5d52f9b2689cc74ff855663b66"
    hash51      = "1aab9f9ba93e7a83204bb19ae1f421fff5ce300ab5f3d18e30090387bad1f83d"
    hash52      = "14542eee19f3c74d14d588db7ffa83c2b5bc18e8c36ff1dccbaad3d335bb0a88"
    hash53      = "6fc3d2fa95786ed69714c83614defb36453ab4118b459f00dda4ad0a48aaedb4"
    hash54      = "3dc383282615b426b49e0ea0c3094102238cceb9e81b425dbb0748c04c8cefad"
    hash55      = "a9dfae867eb74a22b30f6433bd5e220627ea835321ea6dda5af7450e27f646df"
    hash56      = "541a30f174188877b5d4d780c365fd9b2a0288eaec2b58f0075b5c3b77758751"
    hash57      = "a2188ade7fbdb5c48940efc4bdeaab271a96830d93fa96ead72946a25f4ae382"
    hash58      = "a67fb76c27994cb1a16b679887453b3a3775d82453a33e0f2c243207fead7087"
    hash59      = "382bc5c0e9d1c33712349999448d05188bf6034da01ade4454ef352fc93a6cec"
    hash60      = "819f681f5206008fae6f7e2b8554dcb5553d76e09d419ae249f00f2af67272f2"
    hash61      = "2fed4674b3c3c0068a900bec01ef58a8c01ce208517d0a737ce8e623ce16fdaf"
    hash62      = "2cbede935e4201adb70ce0aa564edc5f072ca336b6638e1efc3555cf558224cd"
    hash63      = "34e2a4d21335111fbbe2d4eba0b4f7e6966e8141ea52df8253ba014fad6ec75c"
    hash64      = "b93864b8ac1bee47c9cfa8c786fbe3132450b5e088ba65892e2c873c9e82981c"
    hash65      = "ad467cac28b725687f40b92d5a9b24be3693639512d0c42fb9e7b42e06ffbff2"
    hash66      = "261f403fc6a7d820ea4adaa1cc4e03fb673bf2719a8f8e3a8aa140e1620b78ac"
    hash67      = "b960e074abc289cc6b67186ce63c352063928de86c94f9ddf316225adb0573f3"
    hash68      = "01faf56eccb8025c4027c4349699014d4800e6970f3d441cda9f75c19b7dc920"
    hash69      = "2366a8a07ffab0ee9c823f8a527fda7aa2483461f3a58405e05afbb7ce01188c"
    hash70      = "bb5379b7891a19c2ee33d3fc220f4b949b4b74b8ca46d2cd7b36713bd046dcef"
    hash71      = "784b19edb42a843ce2e2c39e367a326ecc079781138d056e2ee635e5755bf614"
    hash72      = "c16abd8306dc8e3ed82f7ad118a5e962dba266e60ee7529939800481f23f52e0"
    hash73      = "4b18a3ceb5a3afb49c9eb2f0b5ef992f80a933505ad8e7d35ecfc2fe8619aec3"
    hash74      = "886681e11912a6d0977f068be8817e4a94b353e2a6a4ca3ee96b7307160a4ae7"
    hash75      = "2bebe9880fcfa875fdbff02cfbaffd1b3f042a4b0019106c1aae7858d04486cf"
    hash76      = "3a1ef513764e7b6b615c3f2a2c02136402c0ff915bf313f56c13225c7a4affe9"
    hash77      = "b55f2862caa073d13111e15b34fd72df044da323d6b7083fc3860152393bbb11"
    hash78      = "0b5cbc86fb6fa004a88c46a684a2848308c6fc7619defee8ff8f98d3b34cd994"
    hash79      = "46e2fe8ca8ddc6da125145490a5d97e55229d81402cecc899b6050b8dc6ccd99"
    hash80      = "29e94b5eb64af513d6eed679748fbe2d66b6c97ab778e40320a3a7ad67a5a566"
    hash81      = "f1e5829fe0e2883a32e833886863a75e04a658638bc66e46b46ead945695e85f"

  strings:
    $s1 = "4, (function avast(){return \"7\";})()]], \"MAe\": [3, [4, (function avast(){return \"\\x25\";})()]], \"Ym\": [3, [4, (function " ascii
    $s2 = " \"\\x7c\";})()]], \"JTa\": [3, [4, (function avast(){return \"\\x7b\";})()]], \"Kh\": [3, [4, (function avast(){return \"\\x2f" ascii
    $s3 = "x2a\";})()]], \"JYs\": [3, [4, (function avast(){return \"5\";})()]], \"Hc\": [3, [4, (function avast(){return \"3\";})()]], \"K" ascii
    $s4 = "eturn \"\\x22\";})()]], \"MLp\": [3, [4, (function avast(){return \"\\x20\";})()]], \"Mf\": [3, [4, (function avast(){return \"" ascii
    $s5 = "ction avast(){return \"\\x7d\";})()]], \"Oq\": [3, [4, (function avast(){return \"\\x7a\";})()]], \"Vx\": [3, [4, (function avas" ascii
    $s6 = ", \"Dq\": [3, [4, (function avast(){return \"\\x28\";})()]], \"Yi\": [3, [4, (function avast(){return \"\\x29\";})()]], \"Ay\": " ascii
    $s7 = "\": [3, [4, (function avast(){return \"\\x2d\";})()]], \"BYr\": [3, [4, (function avast(){return \"\\x2e\";})()]], \"GGc\": [3, " ascii
    $s8 = "on avast(){return \"\\x2b\";})()]], \"Hf\": [3, [4, (function avast(){return \"\\x2c\";})()]], \"Sn\": [3, [4, (function avast()" ascii

  condition:
    (uint16(0) == 0x0a0a and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d75b67f1-a054-4858-b7e6-891010258737

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion