_20160921_016aab466e10a29b831eb85b27664027_20160921_539bde925d7d_2596
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_016aab466e10a29b831eb85b27664027.js, 20160921_539bde925d7d117e6c387c1b32dd397b.js, 20160921_7ffe38e0972c323071684bfa98cafbdf.js, 20160921_9388afe79f2f7fe198cc289c492b310f.js, 20160921_9ed8ba5d12b4be06b54bbeb7c9325180.js, 20160921_b132808f30a4f3b5c484e9734dc93fcc.js, 20160921_d6071fc0b387420da4f4d56c9cc4f29c.js, 20160921_e1c974d7750547ace34afdda5a06de15.js, 20160921_f0a3d5a403f0d7386ada786b887a464d.js
rule _20160921_016aab466e10a29b831eb85b27664027_20160921_539bde925d7d_2596 {
meta:
description = "datamaliciousorder - from files 20160921_016aab466e10a29b831eb85b27664027.js, 20160921_539bde925d7d117e6c387c1b32dd397b.js, 20160921_7ffe38e0972c323071684bfa98cafbdf.js, 20160921_9388afe79f2f7fe198cc289c492b310f.js, 20160921_9ed8ba5d12b4be06b54bbeb7c9325180.js, 20160921_b132808f30a4f3b5c484e9734dc93fcc.js, 20160921_d6071fc0b387420da4f4d56c9cc4f29c.js, 20160921_e1c974d7750547ace34afdda5a06de15.js, 20160921_f0a3d5a403f0d7386ada786b887a464d.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "d6a541dd7e97eedc43f6bcf89f007176352c81c1d1240a76218e73cf5bb3b171"
hash2 = "9ff498e6534ca553e55771f7eceb4682e639590da978950f1c8683f05f448427"
hash3 = "4bc751383d4c72f88b3f59d9fde1f38f09a81b77ee4df0498bec1df7cd088bc7"
hash4 = "fd51f1b0a7122eb391698c985377ffff7f055696d2ab09fca71851b63308ba93"
hash5 = "19b8471b5bf67286e6bfe340e23abef1def848daa18c886f2eddc2eeaa160df7"
hash6 = "03f070dd06dae48f7c253ddc9a238e441aaac22f9de6e238ba5d3ffa0b9220b4"
hash7 = "3582ec61c8d16a4dd7e6b8ba69c238b2abf1b60a1d05ebc8f672103586bdfd47"
hash8 = "bed4e8c71e09f1ca8c800564bc43d4e103353ec558d1f0869c85d3e8f8c43b01"
hash9 = "77a7ef76313303139cf36ae2953c6c901152f97fe8ddc013a16c1d4b69e5357c"
strings:
$s1 = "urn \"Mt\";})(),(function f000(){return \"UEg\";})(),(function f000(){return \"Wy\";})(),(function f000(){return \"Yz\";})(),(fu" ascii
$s2 = "tion f000(){return \"MJq\";})(),(function f000(){return \"TKl\";})(),(function f000(){return \"Ml\";})(),(function f000(){return" ascii
$s3 = "000(){return \"Wy\";})(),(function f000(){return \"Oe\";})(),(function f000(){return \"GGn\";})(),(function f000(){return \"UOt" ascii
$s4 = "Km\";})(),(function f000(){return \"Iq\";})(),(function f000(){return \"BQb\";})(),(function f000(){return \"Oe\";})(),(function" ascii
$s5 = "})(),(function f000(){return \"Oe\";})(),(function f000(){return \"Yz\";})(),(function f000(){return \"YTp\";})(),(function f000" ascii
$s6 = "GGn\";})(),(function f000(){return \"Uo\";})(),(function f000(){return \"MBb\";})(),(function f000(){return \"Rh\";})(),(functio" ascii
$s7 = "{return \"GGn\";})(),(function f000(){return \"QDg\";})(),(function f000(){return \"Go\";})(),(function f000(){return \"HJm\";})" ascii
condition:
(uint16(0) == 0x2f0a and (all of them)
) or (all of them)
}