_20160921_4809ff2679793c2b9af03e18ec3702ef_20160921_a8b3df7e98e8_2929
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_4809ff2679793c2b9af03e18ec3702ef.js, 20160921_a8b3df7e98e8a886568b517b6d357d72.js, 20160921_ac32e5db1761db7bcee12f6443e4be71.js, 20160921_ad0fbcfca87e48302530672c4ceab093.js, 20160921_b9eadd20f28216849138290cb6dac4de.js, 20160921_e24d9e7aa16c031b748aba6965b02dcb.js, 20160921_e71c0801261b54c695ea1dac03e838bb.js, 20160921_eb8df0d94f3c78c9cec0bde62ab2e57e.js
rule _20160921_4809ff2679793c2b9af03e18ec3702ef_20160921_a8b3df7e98e8_2929 {
meta:
description = "datamaliciousorder - from files 20160921_4809ff2679793c2b9af03e18ec3702ef.js, 20160921_a8b3df7e98e8a886568b517b6d357d72.js, 20160921_ac32e5db1761db7bcee12f6443e4be71.js, 20160921_ad0fbcfca87e48302530672c4ceab093.js, 20160921_b9eadd20f28216849138290cb6dac4de.js, 20160921_e24d9e7aa16c031b748aba6965b02dcb.js, 20160921_e71c0801261b54c695ea1dac03e838bb.js, 20160921_eb8df0d94f3c78c9cec0bde62ab2e57e.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "2c2d464143196a0237396460d274213cf5b3de772f4205aee0525b67ca1bfd6c"
hash2 = "0652be8fe8ee502a5c45d7c0d1b7f5ea93bd8633350801afbb4709b88afc93e2"
hash3 = "c720e572402df240156cf5af93a10b135edc995ca3aaedbfe6a9673216f7c930"
hash4 = "481451a3850055fd2d398d5707171f67d2aa3cd019214d6b67f539efc81ca7bb"
hash5 = "4859166acfe74b9a623acc55b045aff7a4c46e4f5c457bb304c5169c6e7fb4a9"
hash6 = "c005836c702d4e1615fb302fc6f799ca097db41daa5b8cf6a66e8874a454d65b"
hash7 = "c36b557af1bcfc43e39bfaabcd74048c39fc37b5ac0e9561b161a6d3d2e54e76"
hash8 = "768a9ba5aee8702bd0d4c71ccae6016847556423c2ece30b15169aaa7731f27b"
strings:
$s1 = "fuck(){return \"Xg\";})(),(function fuck(){return \"OQr\";})(),(function fuck(){return \"Ve\";})(),(function fuck(){return \"Yk" ascii
$s2 = "function fuck(){return \"Wo0\";})(),(function fuck(){return \"MOj\";})(),(function fuck(){return \"NKq\";})(),(function fuck(){r" ascii
$s3 = "turn \"Fv\";})(),(function fuck(){return \"Ug\";})(),(function fuck(){return \"Dc\";})(),(function fuck(){return \"YAv\";})(),(f" ascii
$s4 = "(){return \"Nm\";})(),(function fuck(){return \"MUs\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"MBg\";" ascii
$s5 = "g\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"Nm\";})(),(function fuck(){return \"MUs\";})(),(function" ascii
$s6 = "\";})(),(function fuck(){return \"Pc\";})(),(function fuck(){return \"Ve\";})(),(function fuck(){return \"Xg\";})(),(function fu" ascii
$s7 = "nction fuck(){return \"Nm\";})(),(function fuck(){return \"Wo0\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){retu" ascii
condition:
(uint16(0) == 0x2f0a and (all of them)
) or (all of them)
}