_20160921_05de6ed1bba9a99cad4c92bf9ce97005_20160921_0ff0e00bae26_3240

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160921_05de6ed1bba9a99cad4c92bf9ce97005.js, 20160921_0ff0e00bae268a8e48b8e6fc134c3779.js, 20160921_13c992e435ed245b1977cea0df2db815.js, 20160921_1b3a88384cf704def4ce92e01728a1df.js, 20160921_1c5a439961f0eccee5312fdbb892fb0e.js, 20160921_2a4c1d98d0b8022ca5527a8e6d96e6e7.js, 20160921_37b7533d4596284ad0b05a77fca64e04.js, 20160921_3a185c9392a67b927e245520858a0afc.js, 20160921_3b3df29e27c35ab2e50a3446fa67bf66.js, 20160921_3bce2f31e98c152d025886ed17309773.js, 20160921_570295874daef65ccf11d909395ae377.js, 20160921_5ac6ab74e4b06b9e82f957e9e7bf6669.js, 20160921_5d475fd55c4e461509ccd87876cf56f7.js, 20160921_634707cedb68c58923df5bdbd700c1bc.js, 20160921_6ad2178e7d047e60c71f9fe1ca457b74.js, 20160921_77c9e00128c9a883c23909fbb2c12569.js, 20160921_7ffe38e0972c323071684bfa98cafbdf.js, 20160921_802181e3d75c3e2d045cebba97849683.js, 20160921_80e6ac924bf190eef40e43ba5d57f11b.js, 20160921_87f13d652177c2ccba1196dd341efb6d.js, 20160921_8c33029db61426a234eddfae1623641b.js, 20160921_939d60f07d4171a5bae4c0b4ca33f3d9.js, 20160921_93e612a2f44e1198dfe3c296cb4f7b79.js, 20160921_98f234a378a6dd4e51c1730a4a700647.js, 20160921_b04df6930d827daddc0cb4f32f5a0ac7.js, 20160921_b132808f30a4f3b5c484e9734dc93fcc.js, 20160921_b71168af39c5eec1d403d381eea7ffe1.js, 20160921_cab66b13ccb843c90a2a068a082cd4ec.js, 20160921_cb6c4de61b30cd204129d0942321058c.js, 20160921_d4a195112732d8d5ebb1bdc900a52d50.js, 20160921_d53637406b068b7f313912a4769e371e.js, 20160921_e1c974d7750547ace34afdda5a06de15.js, 20160921_edb059fcf68869f74200cd1e68a29bc4.js, 20160922_2bdee31da941689170d6b7da303eeff6.js, 20160922_9d6af27348126e594fbe29c3cf568591.js

rule _20160921_05de6ed1bba9a99cad4c92bf9ce97005_20160921_0ff0e00bae26_3240 {
  meta:
    description = "datamaliciousorder - from files 20160921_05de6ed1bba9a99cad4c92bf9ce97005.js, 20160921_0ff0e00bae268a8e48b8e6fc134c3779.js, 20160921_13c992e435ed245b1977cea0df2db815.js, 20160921_1b3a88384cf704def4ce92e01728a1df.js, 20160921_1c5a439961f0eccee5312fdbb892fb0e.js, 20160921_2a4c1d98d0b8022ca5527a8e6d96e6e7.js, 20160921_37b7533d4596284ad0b05a77fca64e04.js, 20160921_3a185c9392a67b927e245520858a0afc.js, 20160921_3b3df29e27c35ab2e50a3446fa67bf66.js, 20160921_3bce2f31e98c152d025886ed17309773.js, 20160921_570295874daef65ccf11d909395ae377.js, 20160921_5ac6ab74e4b06b9e82f957e9e7bf6669.js, 20160921_5d475fd55c4e461509ccd87876cf56f7.js, 20160921_634707cedb68c58923df5bdbd700c1bc.js, 20160921_6ad2178e7d047e60c71f9fe1ca457b74.js, 20160921_77c9e00128c9a883c23909fbb2c12569.js, 20160921_7ffe38e0972c323071684bfa98cafbdf.js, 20160921_802181e3d75c3e2d045cebba97849683.js, 20160921_80e6ac924bf190eef40e43ba5d57f11b.js, 20160921_87f13d652177c2ccba1196dd341efb6d.js, 20160921_8c33029db61426a234eddfae1623641b.js, 20160921_939d60f07d4171a5bae4c0b4ca33f3d9.js, 20160921_93e612a2f44e1198dfe3c296cb4f7b79.js, 20160921_98f234a378a6dd4e51c1730a4a700647.js, 20160921_b04df6930d827daddc0cb4f32f5a0ac7.js, 20160921_b132808f30a4f3b5c484e9734dc93fcc.js, 20160921_b71168af39c5eec1d403d381eea7ffe1.js, 20160921_cab66b13ccb843c90a2a068a082cd4ec.js, 20160921_cb6c4de61b30cd204129d0942321058c.js, 20160921_d4a195112732d8d5ebb1bdc900a52d50.js, 20160921_d53637406b068b7f313912a4769e371e.js, 20160921_e1c974d7750547ace34afdda5a06de15.js, 20160921_edb059fcf68869f74200cd1e68a29bc4.js, 20160922_2bdee31da941689170d6b7da303eeff6.js, 20160922_9d6af27348126e594fbe29c3cf568591.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "cc9a1bb338cbe502eae2d8092d1b4369f9be8a107f4db340bf51a1640991e960"
    hash2       = "4f9f30b45066ff23899a854b2ef766240b2becea05223ad11c6bf5cde97c3048"
    hash3       = "289da9cff140ea3b4e35a1aa721314733c057d085ff9e8b5fc3ed7e10f75341b"
    hash4       = "dc931c610cc8536a2b67001c5b7c93e6dc26026d0daa00576bf3e92b3bd564a7"
    hash5       = "3fbb744f5c370c0fc7398db52f2d758d4ee9e8aaf91430daa5c6bada9598710f"
    hash6       = "65be7c1c5efef8255d7094d95251c12de72303024061cff2152d54a244a049f0"
    hash7       = "61b41be208c77057ce2b56a866ae0e936c6372d0c3a92f126a1cf5090fe0a5e7"
    hash8       = "a5201f237db515e70a3934feb4ff64c4cccf728f340d6e9e46fbe4217f988165"
    hash9       = "dd15d322a8169ff9edb922ead245c93109f14c5fa4f31811eb58601888323ad2"
    hash10      = "9a668f4a1c8cd764f3d7afa71030b8b37f7ec8d0b0b42b9a93aa82346b5ae616"
    hash11      = "a5b27b9fc0152c3186c53a02507be373440217ec70f24fc85249bdaebbeb5494"
    hash12      = "50225d12c51a2decb97015971f8ce72487a24a69e64ec1d12fd7f720f2320cf3"
    hash13      = "dc4e4001f0f2e1f28098f6ad190b918a7ffe075d590fb142a508fdad546d9816"
    hash14      = "152351bec2365a464c735883af22dfe66d59686fad11d1304e9e19accdb6f596"
    hash15      = "2e126f3a35c3e15739f44a3b15bf991678bc6c232e213be738a2521187bf8173"
    hash16      = "95544bd07dbc8b2550e3a6bb328d49a808c8749bb3ced90cbb8f5f90782625a1"
    hash17      = "4bc751383d4c72f88b3f59d9fde1f38f09a81b77ee4df0498bec1df7cd088bc7"
    hash18      = "ab42f16384f05ce6299f1ffd60f980af6ecf1fa2d23befc951797d1d52915400"
    hash19      = "e240b858e2fac9be9a3fc0f8611c4c05e6f217dd1e13ac43649aa6d7597ee450"
    hash20      = "52cce778f06a6477b6f4a6a9f48328a81d874164235533c2925fdd358b6279c3"
    hash21      = "8a7c2a5271a5dc64c200145fa7252ff19d736174b3556eb436f9ac8941daec71"
    hash22      = "c23bfef986de7a073bbcd781aa45ad15287fb2c448d110b92a01e652f22ff335"
    hash23      = "e88aa94cf06df033312260c4a58f453654133758e66e1d2df4f11f9de9bfec7c"
    hash24      = "67d0e50d586bb8bcc6b12ccab848f1a72b3a329ddaa0c7f45ea3661082887c8d"
    hash25      = "20f05e81e91c6d1996527f4c971330eb9446dbb6ad0d88c4d97a9739264f79ba"
    hash26      = "03f070dd06dae48f7c253ddc9a238e441aaac22f9de6e238ba5d3ffa0b9220b4"
    hash27      = "c8811edeb74999e8dd226f7fa9d7963ccfc998904ecb9474d036376253dc6fde"
    hash28      = "ce3b033b39aaca0b7c9abd0fc5eeb09d24d7096d0a399cebd99f7bd8d574f0d1"
    hash29      = "db98233c2508e4a2167ee46a334ce9052faa726615e89838f4fdb36b74fc5353"
    hash30      = "679537ccc73765d47769657cc000499c86fa227678df5b0d4690ca0e2cf6325c"
    hash31      = "cafcf490b9e4364e16ee46f82e53896038b46a0b37f3fd7a33a363316965b400"
    hash32      = "bed4e8c71e09f1ca8c800564bc43d4e103353ec558d1f0869c85d3e8f8c43b01"
    hash33      = "9851e93d2e92fdd3882a14c4f00aface7bdc1495b43f7a98040092131f600e38"
    hash34      = "70ee088e40fb9f7bd2cc1514b94af7f28ef9fd68444cdbd3859858840ae0e498"
    hash35      = "3634189c93f3a76e0a4df72e631f0715b4b71427c157ca5fe116252ca00f1d9b"

  strings:
    $s1 = "\"Mt\";})(),(function f000(){return \"UEg\";})(),(function f000(){return \"Uo\";})(),(function f000(){return \"Um\";})(),(functi" ascii
    $s2 = "tion f000(){return \"KIc\";})(),(function f000(){return \"Tn\";})(),(function f000(){return \"SGs\";})(),(function f000(){return" ascii
    $s3 = "return \"Yi\";})(),(function f000(){return \"KXg\";})(),(function f000(){return \"Ml\";})(),(function f000(){return \"Oe\";})()," ascii
    $s4 = "function f000(){return \"KIc\";})(),(function f000(){return \"KIc\";})(),(function f000(){return \"MBb\";})(),(function f000(){r" ascii
    $s5 = "n f000(){return \"NBs\";})(),(function f000(){return \"Oe\";})(),(function f000(){return \"Br\";})(),(function f000(){return \"G" ascii
    $s6 = ";})(),(function f000(){return \"YTp\";})(),(function f000(){return \"BQb\";})(),(function f000(){return \"BQb\";})(),(function f" ascii

  condition:
    (uint16(0) == 0x2f0a and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1199913b-f7d2-4784-8c6a-5408615d5b36

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion