_20160921_034dbd5881bc0324f5773d7774d981c4_20160921_063094039ef7_2616
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_034dbd5881bc0324f5773d7774d981c4.js, 20160921_063094039ef79437a260d3dde960797a.js, 20160921_0e1bfa63bcb2804e89834c330285643e.js, 20160921_17c44cf20b688f3f5be613056d39409e.js, 20160921_4f1da2d661fb97b4733f3fbf35efff6c.js, 20160921_70b567ca258b3c505e14f3c712366f09.js, 20160921_ad1fccc6910bd9c4a47aa9bd3e9239da.js, 20160921_cda776f6c5cb6eec510c00d5294fbfae.js, 20160921_e39622eeb1da8fbbf03ca86989251a47.js
rule _20160921_034dbd5881bc0324f5773d7774d981c4_20160921_063094039ef7_2616 {
meta:
description = "datamaliciousorder - from files 20160921_034dbd5881bc0324f5773d7774d981c4.js, 20160921_063094039ef79437a260d3dde960797a.js, 20160921_0e1bfa63bcb2804e89834c330285643e.js, 20160921_17c44cf20b688f3f5be613056d39409e.js, 20160921_4f1da2d661fb97b4733f3fbf35efff6c.js, 20160921_70b567ca258b3c505e14f3c712366f09.js, 20160921_ad1fccc6910bd9c4a47aa9bd3e9239da.js, 20160921_cda776f6c5cb6eec510c00d5294fbfae.js, 20160921_e39622eeb1da8fbbf03ca86989251a47.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "82795298a84df6fa0b0e45225727206f9a173f55589db6b76ab8df4198dc55c7"
hash2 = "ce1eb4a08b98ec71f6759f87657e36ddf82182025b3e317c586fb55c186b9e6c"
hash3 = "d58b57cb825244d35e22402fcf08c9ababcc51eb72a7913c47dbb2143171df32"
hash4 = "0a10c81cc5c3cc9eb38f73af3b77ed314fed047818a2410613c91431eee6bee1"
hash5 = "57198460b755f2336c23ed27d26f09514db08ab180e216293a853489286f4ff2"
hash6 = "8cf06551c554a2db81fe1bf37b069b40e558f931913e7d2572bdd18b36f57c73"
hash7 = "a49fc1cb85eaa58b7c63197e9fd25224f63dcb6c86b906933f698898634ead3e"
hash8 = "064df16cff12584bccc68fb79fe80908e6edeb4ccf32c3c0b6a79b8b0424820c"
hash9 = "e0b1660f1c95284f1a0f8062a1f16e26aa3d58e3fa4cf47fc04824d02b754a56"
strings:
$s1 = "\"IPu\";})(),(function fuck(){return \"Oh\";})(),(function fuck(){return \"XHj\";})(),(function fuck(){return \"FJs\";})(),(func" ascii
$s2 = "return \"Jg\";})(),(function fuck(){return \"Ar\";})(),(function fuck(){return \"Fv\";})(),(function fuck(){return \"Ik\";})(),(" ascii
$s3 = "n \"QTc\";})(),(function fuck(){return \"Dc\";})(),(function fuck(){return \"YAv\";})(),(function fuck(){return \"Xg\";})(),(fun" ascii
$s4 = "a\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"Ik\";})(),(function fuck(){return \"KVh\";})(),(function " ascii
$s5 = "ck(){return \"IPu\";})(),(function fuck(){return \"OQr\";})(),(function fuck(){return \"Vf\";})(),(function fuck(){return \"ZLd" ascii
$s6 = "function fuck(){return \"Sx\";})(),(function fuck(){return \"UOe\";})(),(function fuck(){return \"Pc\";})(),(function fuck(){ret" ascii
$s7 = " fuck(){return \"Fv\";})(),(function fuck(){return \"Xg\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"Yb" ascii
condition:
(uint16(0) == 0x2f0a and (all of them)
) or (all of them)
}