_20160916_05d58b71258913d9278a71f4c4c54222_20160916_08a5c91a7a1c_3165

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160916_05d58b71258913d9278a71f4c4c54222.js, 20160916_08a5c91a7a1c78947dbb5adbe9218cb8.js, 20160916_1084c171beefa09f51d0b5be32971af8.js, 20160916_12be352e67cc8093d749c8a9973b1766.js, 20160916_18d74f1cf6895b292debde878c56ec76.js, 20160916_1ea269947496066a9a34a13927ca085d.js, 20160916_25c1d577e08aa7220dc1f9db311139b9.js, 20160916_27673c013020a2a904906837f1498039.js, 20160916_2c373be68060c6c8c773afcfe74c3258.js, 20160916_2fceae521863210138ee294d7cda75ad.js, 20160916_32e4832ffc2ffebd8c84e9ad6813eabc.js, 20160916_3a4aea0421f9ec765476548a8d6a2d39.js, 20160916_4816edf67eebe8a3c102404529f272db.js, 20160916_4d5d5fba50073a1d7fde3fc9b86a7cae.js, 20160916_551aef002c43ccb3091a4e2764a959f0.js, 20160916_552c7c0e9e9655a8dbd2d9cf9d789a2c.js, 20160916_5c77a5be5db7473541088c9d103c54e8.js, 20160916_6006ca437700d5237d180e64c13bacb3.js, 20160916_6cf68307dd06feb17a43c3e388c70e6c.js, 20160916_719483e87d4daf641c0ea77bc08d7311.js, 20160916_75dde64ce1f77bf3ae07b7521499e25e.js, 20160916_78112c69d356c15c5f3a4367ffeffede.js, 20160916_7d5c266be74c403dc10bfb9d0fb4315f.js, 20160916_887d97ca9f3b574a7debae96ad0b50a3.js, 20160916_924125079ab6cb1f4ffb9af35413954e.js, 20160916_9734428e7a8c781d88b42e91dc7f571f.js, 20160916_9dbe9f945fd287d028a4ba66617ebe46.js, 20160916_9eecba1ed927c14ff65c2ee95637160f.js, 20160916_a343568c02e9da92d00d16daafc199d3.js, 20160916_ab729be15ba19190c6350b278d76bc17.js, 20160916_ad9868a17c0a17a57720aa9df9fbd100.js, 20160916_b62188dbcc0171d122ee364f2d5e3420.js, 20160916_b8bbbe4eebfdf8626521736a5af96025.js, 20160916_bdc2e468b2f9cf9dcd99475ccafe22cd.js, 20160916_c53cb15e326d697f63055f205e748b03.js, 20160916_c5658047d49bf5cb1381782e6d9255f2.js, 20160916_ceb00a9866aa580b80862eeba7ae457e.js, 20160916_cf4086c11afa2993a3e4dcef1ef375db.js, 20160916_d032cd46a1deb56094cf6e7d0f68dbc5.js, 20160916_d7a3e912c3351ca69883acbbc95a367b.js, 20160916_dff65c48470f34330a8bb71bcb07d60d.js, 20160916_f20b205c3fd26061a88c922cf1fb3180.js, 20160916_f29100f44e565e9c89a4b3c51ab5dc5d.js, 20160916_f4820419bdce2daa41908be904c1a64e.js, 20160916_f5be9c92c65fac25e19f36e5d6a55893.js, 20160916_f84640c196224459482888ae183495e8.js, 20160916_fab5aef988cbd917441ed0e188a588d0.js

rule _20160916_05d58b71258913d9278a71f4c4c54222_20160916_08a5c91a7a1c_3165 {
  meta:
    description = "datamaliciousorder - from files 20160916_05d58b71258913d9278a71f4c4c54222.js, 20160916_08a5c91a7a1c78947dbb5adbe9218cb8.js, 20160916_1084c171beefa09f51d0b5be32971af8.js, 20160916_12be352e67cc8093d749c8a9973b1766.js, 20160916_18d74f1cf6895b292debde878c56ec76.js, 20160916_1ea269947496066a9a34a13927ca085d.js, 20160916_25c1d577e08aa7220dc1f9db311139b9.js, 20160916_27673c013020a2a904906837f1498039.js, 20160916_2c373be68060c6c8c773afcfe74c3258.js, 20160916_2fceae521863210138ee294d7cda75ad.js, 20160916_32e4832ffc2ffebd8c84e9ad6813eabc.js, 20160916_3a4aea0421f9ec765476548a8d6a2d39.js, 20160916_4816edf67eebe8a3c102404529f272db.js, 20160916_4d5d5fba50073a1d7fde3fc9b86a7cae.js, 20160916_551aef002c43ccb3091a4e2764a959f0.js, 20160916_552c7c0e9e9655a8dbd2d9cf9d789a2c.js, 20160916_5c77a5be5db7473541088c9d103c54e8.js, 20160916_6006ca437700d5237d180e64c13bacb3.js, 20160916_6cf68307dd06feb17a43c3e388c70e6c.js, 20160916_719483e87d4daf641c0ea77bc08d7311.js, 20160916_75dde64ce1f77bf3ae07b7521499e25e.js, 20160916_78112c69d356c15c5f3a4367ffeffede.js, 20160916_7d5c266be74c403dc10bfb9d0fb4315f.js, 20160916_887d97ca9f3b574a7debae96ad0b50a3.js, 20160916_924125079ab6cb1f4ffb9af35413954e.js, 20160916_9734428e7a8c781d88b42e91dc7f571f.js, 20160916_9dbe9f945fd287d028a4ba66617ebe46.js, 20160916_9eecba1ed927c14ff65c2ee95637160f.js, 20160916_a343568c02e9da92d00d16daafc199d3.js, 20160916_ab729be15ba19190c6350b278d76bc17.js, 20160916_ad9868a17c0a17a57720aa9df9fbd100.js, 20160916_b62188dbcc0171d122ee364f2d5e3420.js, 20160916_b8bbbe4eebfdf8626521736a5af96025.js, 20160916_bdc2e468b2f9cf9dcd99475ccafe22cd.js, 20160916_c53cb15e326d697f63055f205e748b03.js, 20160916_c5658047d49bf5cb1381782e6d9255f2.js, 20160916_ceb00a9866aa580b80862eeba7ae457e.js, 20160916_cf4086c11afa2993a3e4dcef1ef375db.js, 20160916_d032cd46a1deb56094cf6e7d0f68dbc5.js, 20160916_d7a3e912c3351ca69883acbbc95a367b.js, 20160916_dff65c48470f34330a8bb71bcb07d60d.js, 20160916_f20b205c3fd26061a88c922cf1fb3180.js, 20160916_f29100f44e565e9c89a4b3c51ab5dc5d.js, 20160916_f4820419bdce2daa41908be904c1a64e.js, 20160916_f5be9c92c65fac25e19f36e5d6a55893.js, 20160916_f84640c196224459482888ae183495e8.js, 20160916_fab5aef988cbd917441ed0e188a588d0.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "27799b37acb93abb76794518b7a5a2d2614d3617af4544fe9cec7f99f111d64a"
    hash2       = "d26c40c674643a69bb828fc8361ce98013844ea1a6dab60d911a303882a360bc"
    hash3       = "0d40aac41fd5706cac5935d841b3e5efcd6bdb16bf08114b987fafcb77901c93"
    hash4       = "5236f614d83a4b6eedd5cec0016aa49a757bcc6a3f89a0c7029eaf9f1d743463"
    hash5       = "7f42f412bf61b25f84324ba31a5ce427cc79d0d4b1a438d54654934e626cfbbf"
    hash6       = "b62cacd29f334f595ef5630af8c593255c63840f467b8a01b6097d5ce9e77b61"
    hash7       = "c236803cbe5ac68409b3e56ef0d4259d524d2ad536697c5d8772cd0bef41f429"
    hash8       = "a307d242a2fb55e722c34ba6cf6557de82169eed45f0e08b1dfa206ecdccf204"
    hash9       = "1ed9eb1abe246e651f748209dcad4cd2808fd85df1724a2f2723b7b3abfd9342"
    hash10      = "2261a1eb91b2d07298d576565654657f661a8c1a75fdb10793af2402b535233c"
    hash11      = "f646d1b2c59aadcbafc84821971b7cebd9b5f7784051e3b41b62b9dfca4e9846"
    hash12      = "320112b345615ca352b57edc922c06d6e8fede70cd63085fd71bd5466aba03a0"
    hash13      = "c022fb2d5c0db6f5c6c80089e67586f18b89132d7d040c1a4a607b2e41cfe104"
    hash14      = "cc5e62eb37a6f788438c34bd2f8e91972c3ebca404a74fd91467c84baf9bb971"
    hash15      = "f3291b69861a9b89c06dbc24d6fee2d41a2012d1bb489673922f2206bac0336e"
    hash16      = "d570e74ebe4c74a362faefe0e372fead1c5df258a51d8c0a626421b6e7b58829"
    hash17      = "30de84aa24751fa03f4334611de9ed7bd647749b7160308ff590ad31ab43578e"
    hash18      = "1c3283f426d9323e09511545c8e1afb293854ec5daad40437d9c4276aa3ee2b8"
    hash19      = "7ac5e3a525167f4edfb1e60b8a82fe7a80040e7f2cf51b6d229defbd6ceab5a9"
    hash20      = "5bd126df6277e6c2f93f553663f54264ce7ea36b914e13ce6ebfb73ce37db034"
    hash21      = "6598ae2f9fad628584288801c44ed7224c06a0302ab0468fa87645983b1d4d3c"
    hash22      = "d39a2ea63cbe351d88903a9bf3c690b07ec3ffc4a74eee1abb7dcbb28dda72d5"
    hash23      = "914bd2ceb0d6d1b15497d9dc0585354a2870fe1e7c33a6729c8ae68fe44f48bd"
    hash24      = "5e8273f8154a52485d7ff87c18270996b5d083e08f95e7f7ab0dddf3b26ae56f"
    hash25      = "293ba63c7610960085556407b75e2a25b4e5228f2762f1996544f592b4714ff2"
    hash26      = "622d6fc89949ead9029f5d41f03fad6f67ca5ff656c513aecc7e77fa71404e55"
    hash27      = "8651d10b7af4e4eedfc17e3f13ba7c90e54202906be86f770dec6350cbefd373"
    hash28      = "02e9b3a4d200b3734689265098ab5eb4fd3cd903d9cd8f003f8e06f066acc5dd"
    hash29      = "1814ef9d5bbc6a421116950206666f71504e4efd017873425343b9603d158e44"
    hash30      = "ce58bb0ecd93281803e3d43b84205946a73c49b704bab8b6216584535bac4fe1"
    hash31      = "d02bca2fef8ec47a47aa158b73aa24ddf68d494844027b409bf0201d71154466"
    hash32      = "1f053b89d0b8a2b886014f5ea751aaf5e07311416d4c4e31b8465ab81211f51a"
    hash33      = "885e3f631a119badaf70efb6e38cf130e82c08a5f6c4d8887acfbe570b15cdf2"
    hash34      = "5a2aea070ac266781d722fc38fefa3761c95464097f7081f960662d7b73bddef"
    hash35      = "a452696138bed2e342f8e5c6bfa94c7af0405d58b2b02e397a1d62943a5e2320"
    hash36      = "b4dc96519f50086473ef8463a986dfd79bc3bb9bfa51b589cc2f43a0ce1f9c99"
    hash37      = "07145a847b77fdb49b6bd906b091680fffec06ac40bab8a86dd8ec1858b829c1"
    hash38      = "9750bfa488394236d65b6d80335f795321af901684a2eca951a6eeb98e45e9ee"
    hash39      = "053b6d5557c2bfe8c576618a679f9c3cab5fec9442f558c1c34203e31497a890"
    hash40      = "8e31947b107f6341eb2367b6d96caecc0437ddcb00fce6b8c35ff11cfbd120cb"
    hash41      = "fd4566670a86c019948be47f6c3aa0ac77192e5105baf4d4d746fe77144c5d85"
    hash42      = "670c8847d8c4a7dd2823c3996fb29ad71f6852c71067881157dbb3d1af530e12"
    hash43      = "cbeb74ff1a7c050ba3f9f6e250b82b2a7510f99ab349ff4e1c3ca888f0d18e55"
    hash44      = "2a7ca203bdabb94ebdb26cef282d4d7b78e2eb6fc1724e6477dce9a097c40fb8"
    hash45      = "18618f8747463b1778b30cd7908c8aecae121c5fc34ddbcd23d5d378f7de10c7"
    hash46      = "37352561bd677fd03eb59be3d9493f43afb80aff510ac267a8a2e408205ffdac"
    hash47      = "fbeb0fab1e5aa80fd7a5a63577ab5edb5477813b1a90e5e6b0cb4a9610cdd57b"

  strings:
    $s1 = "d\": [3, (function f(){return \"\\x20\";})()], \"KZv\": [3, (function f(){return \"\\x21\";})()], \"ISr\": [3, (function f(){ret" ascii
    $s2 = " (function f(){return \"\\x2a\";})()], \"Hb\": [3, (function f(){return \"5\";})()], \"KPu\": [3, (function f(){return \"3\";})(" ascii
    $s3 = "eturn \"\\x7b\";})()], \"Pq\": [3, (function f(){return \"\\x2f\";})()], \"HIs\": [3, (function f(){return \"\\x2d\";})()], \"BH" ascii
    $s4 = "3, (function f(){return \"7\";})()], \"Ox\": [3, (function f(){return \"\\x25\";})()], \"UXf\": [3, (function f(){return \"\\x22" ascii
    $s5 = " \"NIj\": [3, (function f(){return \"\\x0d\";})()], \"JDt\": [3, (function f(){return \"\\x09\";})()], \"DYm\": [3, (function f(" ascii
    $s6 = "ion f(){return \"\\x2e\";})()], \"Fg\": [3, (function f(){return \"\\x2b\";})()], \"Cv\": [3, (function f(){return \"\\x2c\";})(" ascii

  condition:
    (uint16(0) == 0x0a0a and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5070607d-0818-470e-b3a5-6d5cd2dfdd2e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion