_20160921_0393cc83501a7f5f46bdb6e7b413461e_20160921_073115e7f89d_2203

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160921_0393cc83501a7f5f46bdb6e7b413461e.js, 20160921_073115e7f89d0b69957e5f4053125e5f.js, 20160921_0ff0e00bae268a8e48b8e6fc134c3779.js, 20160921_14f99bec2c2ed0c000bf0acbf6c2260c.js, 20160921_1b3a88384cf704def4ce92e01728a1df.js, 20160921_1f7d568f432abb102bc2d5dbd6c68c22.js, 20160921_22314dccf19b7c672f3deae2294f4b16.js, 20160921_24cca85b9483630d2e2e50bdd8aa5013.js, 20160921_3bce2f31e98c152d025886ed17309773.js, 20160921_3d472332b6f7d53a9f60478e1312ea58.js, 20160921_3e524aa8d0a18c87370a789c7bba4fc5.js, 20160921_50ddf5c101f65dbae1a99b5967b69eaf.js, 20160921_56d2e5a83b597694b265cf7813cc5cf0.js, 20160921_570295874daef65ccf11d909395ae377.js, 20160921_5ac6ab74e4b06b9e82f957e9e7bf6669.js, 20160921_634707cedb68c58923df5bdbd700c1bc.js, 20160921_66566a9bbc7830091a244fa6674b709b.js, 20160921_69015d5cf863b10983b8aa49b42d835e.js, 20160921_6b34f0b83cb5d89ac574db511a389f02.js, 20160921_6d9213179dbb863530a638df47003a46.js, 20160921_74aa1eb054c4d9cf85bcad2468e8404a.js, 20160921_85b0b94900915170fd854268d8d17fd4.js, 20160921_989b05bf7416ad8ff0b583666028a2c1.js, 20160921_9c9fcc818a7064d7449eec45fbad08d9.js, 20160921_a3beeaf5374452a126fde6e8bd845f1d.js, 20160921_a4213841acc34547cdaa9cab58f8e2d8.js, 20160921_a56de0614f7815cff3fcb9f56233dbb4.js, 20160921_a864250b4ae6162ed0d7a2f3ed785d46.js, 20160921_b04df6930d827daddc0cb4f32f5a0ac7.js, 20160921_b132808f30a4f3b5c484e9734dc93fcc.js, 20160921_b4c84c92954782bcf19013150a359ec6.js, 20160921_b5e2b5a2e8f104e719b3c6631c08f1f7.js, 20160921_b71168af39c5eec1d403d381eea7ffe1.js, 20160921_c05dd34a09358454c56b9c248f1d0304.js, 20160921_c54afc417f4f2e6afc93a834c28784f2.js, 20160921_d29f521c8121911a610a80bcc76b94bf.js, 20160921_ded524cdc972424d0fa8254648795d71.js, 20160921_e0e06f5c94b0cde962f3e4c452e69af8.js, 20160921_e1bc53e337e27af13c4323bd3332a33c.js, 20160921_e1c974d7750547ace34afdda5a06de15.js, 20160921_e2594cbf75233509eaea515aa1a7a2f1.js, 20160921_e985c90f8141417e484ad0056c9b809c.js, 20160921_ea3000546b29aee563be9d58318d1857.js, 20160921_ebd0ee36b6a55e4cbf431d8fa9a2aea3.js, 20160921_ec2541ade561a4750092fda52be6f269.js, 20160921_edb059fcf68869f74200cd1e68a29bc4.js, 20160921_f1aea308b2000a8d722d0f21c756fabf.js, 20160921_f1b8df0ab75abc0c2b3be738559f2ab3.js, 20160921_fa11dbc1cb358c8446ac1ba033c8a4c7.js, 20160922_7e0b1e5964974c7e845016e40a3ad891.js, 20160922_b9c8ae1e2648708b7b599ba2ac6333c1.js

rule _20160921_0393cc83501a7f5f46bdb6e7b413461e_20160921_073115e7f89d_2203 {
  meta:
    description = "datamaliciousorder - from files 20160921_0393cc83501a7f5f46bdb6e7b413461e.js, 20160921_073115e7f89d0b69957e5f4053125e5f.js, 20160921_0ff0e00bae268a8e48b8e6fc134c3779.js, 20160921_14f99bec2c2ed0c000bf0acbf6c2260c.js, 20160921_1b3a88384cf704def4ce92e01728a1df.js, 20160921_1f7d568f432abb102bc2d5dbd6c68c22.js, 20160921_22314dccf19b7c672f3deae2294f4b16.js, 20160921_24cca85b9483630d2e2e50bdd8aa5013.js, 20160921_3bce2f31e98c152d025886ed17309773.js, 20160921_3d472332b6f7d53a9f60478e1312ea58.js, 20160921_3e524aa8d0a18c87370a789c7bba4fc5.js, 20160921_50ddf5c101f65dbae1a99b5967b69eaf.js, 20160921_56d2e5a83b597694b265cf7813cc5cf0.js, 20160921_570295874daef65ccf11d909395ae377.js, 20160921_5ac6ab74e4b06b9e82f957e9e7bf6669.js, 20160921_634707cedb68c58923df5bdbd700c1bc.js, 20160921_66566a9bbc7830091a244fa6674b709b.js, 20160921_69015d5cf863b10983b8aa49b42d835e.js, 20160921_6b34f0b83cb5d89ac574db511a389f02.js, 20160921_6d9213179dbb863530a638df47003a46.js, 20160921_74aa1eb054c4d9cf85bcad2468e8404a.js, 20160921_85b0b94900915170fd854268d8d17fd4.js, 20160921_989b05bf7416ad8ff0b583666028a2c1.js, 20160921_9c9fcc818a7064d7449eec45fbad08d9.js, 20160921_a3beeaf5374452a126fde6e8bd845f1d.js, 20160921_a4213841acc34547cdaa9cab58f8e2d8.js, 20160921_a56de0614f7815cff3fcb9f56233dbb4.js, 20160921_a864250b4ae6162ed0d7a2f3ed785d46.js, 20160921_b04df6930d827daddc0cb4f32f5a0ac7.js, 20160921_b132808f30a4f3b5c484e9734dc93fcc.js, 20160921_b4c84c92954782bcf19013150a359ec6.js, 20160921_b5e2b5a2e8f104e719b3c6631c08f1f7.js, 20160921_b71168af39c5eec1d403d381eea7ffe1.js, 20160921_c05dd34a09358454c56b9c248f1d0304.js, 20160921_c54afc417f4f2e6afc93a834c28784f2.js, 20160921_d29f521c8121911a610a80bcc76b94bf.js, 20160921_ded524cdc972424d0fa8254648795d71.js, 20160921_e0e06f5c94b0cde962f3e4c452e69af8.js, 20160921_e1bc53e337e27af13c4323bd3332a33c.js, 20160921_e1c974d7750547ace34afdda5a06de15.js, 20160921_e2594cbf75233509eaea515aa1a7a2f1.js, 20160921_e985c90f8141417e484ad0056c9b809c.js, 20160921_ea3000546b29aee563be9d58318d1857.js, 20160921_ebd0ee36b6a55e4cbf431d8fa9a2aea3.js, 20160921_ec2541ade561a4750092fda52be6f269.js, 20160921_edb059fcf68869f74200cd1e68a29bc4.js, 20160921_f1aea308b2000a8d722d0f21c756fabf.js, 20160921_f1b8df0ab75abc0c2b3be738559f2ab3.js, 20160921_fa11dbc1cb358c8446ac1ba033c8a4c7.js, 20160922_7e0b1e5964974c7e845016e40a3ad891.js, 20160922_b9c8ae1e2648708b7b599ba2ac6333c1.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "89c5611205911dc22a002122b9f40afc236a2afc8f46d1c947520bc93cc73857"
    hash2       = "e1c8736261480d3d6df844d8e7fb92f64f1dc2bf84561d1b707e82daa456fef1"
    hash3       = "4f9f30b45066ff23899a854b2ef766240b2becea05223ad11c6bf5cde97c3048"
    hash4       = "224106b166fc0a998ec1d58e5d4a78c585bdeb76194d93210753d7d0f558c06b"
    hash5       = "dc931c610cc8536a2b67001c5b7c93e6dc26026d0daa00576bf3e92b3bd564a7"
    hash6       = "193a02aff0ca7f757ef6d01358baac9c7338cd556144a08982dce9382eff6344"
    hash7       = "9361b0d332b84592c527454959eb22d4191bb17c4d1acc962c192e90e96fc83e"
    hash8       = "59d00368c1188c6d6bc66f675b72e99608dc018c3528d523610abc2745ea88cd"
    hash9       = "9a668f4a1c8cd764f3d7afa71030b8b37f7ec8d0b0b42b9a93aa82346b5ae616"
    hash10      = "afa09723c03c97cb533583268f8fb586a7ccfc3438d793acc59eedb90be55b5b"
    hash11      = "71a83b86275cb43222066a6d27dfb98cdd9fc8283b2b007f9262c38686262b9a"
    hash12      = "4d3df92f56e6b5cba10c96e8cd182f92f3c10aceaabe5a4530b70d3fc5873feb"
    hash13      = "b300925c1fcfafa296560c761acd7f9f31acb743cbc98bed4f8a0053b68560eb"
    hash14      = "a5b27b9fc0152c3186c53a02507be373440217ec70f24fc85249bdaebbeb5494"
    hash15      = "50225d12c51a2decb97015971f8ce72487a24a69e64ec1d12fd7f720f2320cf3"
    hash16      = "152351bec2365a464c735883af22dfe66d59686fad11d1304e9e19accdb6f596"
    hash17      = "154f7ca38a058d2590f40ec43ada530305244e5c7e86bbedd19aa9c0e1ca02aa"
    hash18      = "797bada2609e8fc67a8ede267e9fcce2fc817f630e6fe62c7953cc722eea6d2c"
    hash19      = "2483c88a0836510cd8b6af7b5d26f30c64147663cbbe75188bd12c828f642afa"
    hash20      = "34dd6eef77156ff6a8475b4f23b98a3d4a6110228a40cb85c7d0c36dd8cb71c1"
    hash21      = "74bb8f886c1de9aea157cf5ee2e1b8c02b30df1117e95e18ef3a2d5dc44277ad"
    hash22      = "02801a1fe1d3c30ef8c10eab40eabc26c88f8bc28e76e3aecbbb89d0981b21af"
    hash23      = "c3c2ebe9b3cb36288422e9757d55c015e9201e8ed349ea0a4f3fb5c4042fbfb3"
    hash24      = "988df854145081fce0af79178c78ce75ca8d89b6666ec2e052b7f8de43bb1101"
    hash25      = "b85118fedd76dd449fd30cfd693681aa77891d92c19c3fa0e9dd14f034e867bb"
    hash26      = "3bdfe74e5399936e0bca26e7caeb97bfdab7631164f7ae885438865cb52fa076"
    hash27      = "fa71b33b4ef1bf0fefff91c2876915e8ca80c82d473862703c383c6da0ad0186"
    hash28      = "f64f9f9fd1a5e4b096281bd9733f52c453683cc9032801264dd73f202b17964f"
    hash29      = "20f05e81e91c6d1996527f4c971330eb9446dbb6ad0d88c4d97a9739264f79ba"
    hash30      = "03f070dd06dae48f7c253ddc9a238e441aaac22f9de6e238ba5d3ffa0b9220b4"
    hash31      = "deac288c0b80bcd19eff4e9a4bb55e7bdc0f08b0110094a0693c671b47cda285"
    hash32      = "8495e7e7fc77026b5e5681ac973eefb0561cb5cce78632996de59641ce00258e"
    hash33      = "c8811edeb74999e8dd226f7fa9d7963ccfc998904ecb9474d036376253dc6fde"
    hash34      = "e330ec83e6ac964ffd679e6589494a6108e1995f570c539dee7b1be30953f8a3"
    hash35      = "20ec6b05e6f9287e0487d83e2fe14d9d0ca6d013f0a0ee7abade9f2b0b6268d5"
    hash36      = "e80237660128a774d0b2338e2d9c1fb4921908fa1f5ccbf74a87c0a04d0a8667"
    hash37      = "09c4ea683259322d1696083646a9b96190b4796e8b3fdf91ba2bf4f6296afaa9"
    hash38      = "c9140c7affc44d690abfb95dc146d3e298e2cfddacedfee85549119f368d56d1"
    hash39      = "7561e1bb060dd07ca80dc6e0b089a853d0081d60c7843d73299f7dabb92efaea"
    hash40      = "bed4e8c71e09f1ca8c800564bc43d4e103353ec558d1f0869c85d3e8f8c43b01"
    hash41      = "9bcadd89dbaf0700ab19bcb2d52d99cb9fdc4145fae40ae3eb529de8d9ada04c"
    hash42      = "513b80dc65238dcfcb80f0e8e4f456645bf345b2dde46805b001c07bc579d4c9"
    hash43      = "eb46ac22bc2e86a5bacf6fbfffe3a746600369a5d28c84d095b1269bcdfe9cc6"
    hash44      = "f2f666db493211ee6edb824e429f601fccdbf25cd3cc08bc16ad31fdf23c4636"
    hash45      = "1db7ed5a240fde30e4fca12eca866b9b96b56836ae50ea4c0fcf2d28b08be3b5"
    hash46      = "9851e93d2e92fdd3882a14c4f00aface7bdc1495b43f7a98040092131f600e38"
    hash47      = "3175e432bce3be89acef4ff7215de666ea47cac857c8c07ff649c1cdd5484103"
    hash48      = "dfdf24fc382cd60cf8d9c01ff0bca33ee060801ad2bd963895209ac610525301"
    hash49      = "27a60061641d8c44f2b882fcd06e72ca5721eaecb40ea10ad0b87c0c5f3c236f"
    hash50      = "de6271315a5e75cb84cc0796ab51f8e68b1d166a3e7393cc14d81a37883277cd"
    hash51      = "e2b244eea80e558d4ae468572be8ba3fade8163b0f8751b10ba6ca2263421085"

  strings:
    $s1 = "\"WIj\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"OMd\";})(),(func" ascii
    $s2 = "f000(){return \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"MBb\";})(),(function f000(){return \"BQ" ascii
    $s3 = ";})(),(function f000(){return \"YTp\";})(),(function f000(){return \"XTn\";})(),(function f000(){return \"GGn\";})(),(function f" ascii
    $s4 = "){return \"ZGq\";})(),(function f000(){return \"DYx\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"WIj\";" ascii
    $s5 = "0(){return \"Nx\";})(),(function f000(){return \"EZu\";})(),(function f000(){return \"Oe\";})(),(function f000(){return \"Br\";}" ascii
    $s6 = "ion f000(){return \"GGn\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"GGn\";})(),(function f000(){return " ascii
    $s7 = "rn \"Nv\";})(),(function f000(){return \"DYs\";})(),(function f000(){return \"NYh\";})(),(function f000(){return \"Kw\";})(),(fu" ascii
    $s8 = "on f000(){return \"KXg\";})(),(function f000(){return \"Yi\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"" ascii

  condition:
    (uint16(0) == 0x2f0a and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5e8add87-ac32-4f33-a865-6a4248e4a750

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion