_20160318_04030b9fe2f4d78c0d85e15a76c89dde_20160318_047f8bbf1a9d_4093

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160318_04030b9fe2f4d78c0d85e15a76c89dde.js, 20160318_047f8bbf1a9d914de356cfabe44f50c0.js, 20160318_053bd713a3083f83e04afddbef455349.js, 20160318_0851fa2dfda8cb449c0898545a80913a.js, 20160318_0b3b66b96b1dd8019b547370b90640ef.js, 20160318_20d9e3fa9b09c5274baef98dee6c94ff.js, 20160318_25b8280b874d8a90157f39db84ea1e58.js, 20160318_2c6d958f1621a557a6f081bce4c1531a.js, 20160318_2d90eee06edc727bb01cb5478dff3716.js, 20160318_3323d74502d29250351568244e017f57.js, 20160318_3af04f80491951d524734b2dd544ac2e.js, 20160318_3f924b1ae7d6c7f50e8866a3a8c7fd67.js, 20160318_44a0fde30539ac6f79142a8d59ba39ee.js, 20160318_4576eb550310aed1021cf5e4c8929b6c.js, 20160318_5388a7e3504ce29ae67907505dd7a6c4.js, 20160318_54a0a852c27c1a1d7b7044e4c27e62c1.js, 20160318_54d234b44a8fab03eafc481c1297612f.js, 20160318_57051b2993f16ce955a33352a2d3c4a0.js, 20160318_585f4dc7ce6b96a9e4097cc9b15e1a81.js, 20160318_5d1597f79deb6b57f06ce64979546ab1.js, 20160318_5fa49539935f7d340584a6802a7b165c.js, 20160318_5fa7fab5a4a5533dfef0f6a9150e6260.js, 20160318_676efc949c859a46fb7131bec2024362.js, 20160318_712759aebb6c001a3383e43bec552fbc.js, 20160318_80820a9a84ae0756b3247d81d4be94c3.js, 20160318_813d7b81ef1e89a59898be071337542d.js, 20160318_819078c041e2ae0ed2a0e7d24447efd5.js, 20160318_84429c4d0aa495e63b11f4aee364a577.js, 20160318_846d55540cab0d7de364063e2f01e5df.js, 20160318_8898449f3eaca4186dd68b1c60113b84.js, 20160318_89b5c23ff15c933cc2d866681b85181f.js, 20160318_8a4d108417d75b0ac94cf8591a6fcd2f.js, 20160318_8cbaf4da52de462ac92c03f0998dcf16.js, 20160318_8f35e31f2f2f858055d110a3c0d38804.js, 20160318_92412db6aa80850c0d6dce2f2f96ef7a.js, 20160318_951e939c16ab973ddd983a550ee5d8c4.js, 20160318_9e4092f0a55ccfaf876424fe44d6c8f3.js, 20160318_a48f0aa3868e673a5eab85c648069af4.js, 20160318_ac83f94a417544d43d3a05eb0f588536.js, 20160318_b2eda170a69e163840a0fdebf0b0b6ed.js, 20160318_bff61a844225468889928586f8443465.js, 20160318_c069816817916a192a501242b8af4d77.js, 20160318_c522abf8a8561913e07498b00de8fb07.js, 20160318_c5e42c541974ec98fb0e6f334c0da21f.js, 20160318_c7ab768b5cf5bbff46d480183ebdf5f1.js, 20160318_cda64796647c078a9030bc5402c4fa30.js, 20160318_ceb65bbc31a99984839940ab27cc2e3e.js, 20160318_d8e8f772795576a4aa59849c8eb54e02.js, 20160318_dc33008258c2e6ea319d68b4baf7bc73.js, 20160318_efc43c950182bf3a05fdd61067b0c484.js, 20160318_f0f2c75ff09809b53951965840c288f7.js, 20160318_f19d987f1578e090286d53817be20e10.js, 20160318_f1cadac80bf1a23f11e38c09cabda615.js, 20160318_f7eca2fc03fd6f4d9f7b16dbcd3482f0.js, 20160318_f86623df8364b37b77c5811ae84fe3ea.js, 20160319_f5878d0191d46643fd6528d7ad5aecf0.js

rule _20160318_04030b9fe2f4d78c0d85e15a76c89dde_20160318_047f8bbf1a9d_4093 {
  meta:
    description = "datamaliciousorder - from files 20160318_04030b9fe2f4d78c0d85e15a76c89dde.js, 20160318_047f8bbf1a9d914de356cfabe44f50c0.js, 20160318_053bd713a3083f83e04afddbef455349.js, 20160318_0851fa2dfda8cb449c0898545a80913a.js, 20160318_0b3b66b96b1dd8019b547370b90640ef.js, 20160318_20d9e3fa9b09c5274baef98dee6c94ff.js, 20160318_25b8280b874d8a90157f39db84ea1e58.js, 20160318_2c6d958f1621a557a6f081bce4c1531a.js, 20160318_2d90eee06edc727bb01cb5478dff3716.js, 20160318_3323d74502d29250351568244e017f57.js, 20160318_3af04f80491951d524734b2dd544ac2e.js, 20160318_3f924b1ae7d6c7f50e8866a3a8c7fd67.js, 20160318_44a0fde30539ac6f79142a8d59ba39ee.js, 20160318_4576eb550310aed1021cf5e4c8929b6c.js, 20160318_5388a7e3504ce29ae67907505dd7a6c4.js, 20160318_54a0a852c27c1a1d7b7044e4c27e62c1.js, 20160318_54d234b44a8fab03eafc481c1297612f.js, 20160318_57051b2993f16ce955a33352a2d3c4a0.js, 20160318_585f4dc7ce6b96a9e4097cc9b15e1a81.js, 20160318_5d1597f79deb6b57f06ce64979546ab1.js, 20160318_5fa49539935f7d340584a6802a7b165c.js, 20160318_5fa7fab5a4a5533dfef0f6a9150e6260.js, 20160318_676efc949c859a46fb7131bec2024362.js, 20160318_712759aebb6c001a3383e43bec552fbc.js, 20160318_80820a9a84ae0756b3247d81d4be94c3.js, 20160318_813d7b81ef1e89a59898be071337542d.js, 20160318_819078c041e2ae0ed2a0e7d24447efd5.js, 20160318_84429c4d0aa495e63b11f4aee364a577.js, 20160318_846d55540cab0d7de364063e2f01e5df.js, 20160318_8898449f3eaca4186dd68b1c60113b84.js, 20160318_89b5c23ff15c933cc2d866681b85181f.js, 20160318_8a4d108417d75b0ac94cf8591a6fcd2f.js, 20160318_8cbaf4da52de462ac92c03f0998dcf16.js, 20160318_8f35e31f2f2f858055d110a3c0d38804.js, 20160318_92412db6aa80850c0d6dce2f2f96ef7a.js, 20160318_951e939c16ab973ddd983a550ee5d8c4.js, 20160318_9e4092f0a55ccfaf876424fe44d6c8f3.js, 20160318_a48f0aa3868e673a5eab85c648069af4.js, 20160318_ac83f94a417544d43d3a05eb0f588536.js, 20160318_b2eda170a69e163840a0fdebf0b0b6ed.js, 20160318_bff61a844225468889928586f8443465.js, 20160318_c069816817916a192a501242b8af4d77.js, 20160318_c522abf8a8561913e07498b00de8fb07.js, 20160318_c5e42c541974ec98fb0e6f334c0da21f.js, 20160318_c7ab768b5cf5bbff46d480183ebdf5f1.js, 20160318_cda64796647c078a9030bc5402c4fa30.js, 20160318_ceb65bbc31a99984839940ab27cc2e3e.js, 20160318_d8e8f772795576a4aa59849c8eb54e02.js, 20160318_dc33008258c2e6ea319d68b4baf7bc73.js, 20160318_efc43c950182bf3a05fdd61067b0c484.js, 20160318_f0f2c75ff09809b53951965840c288f7.js, 20160318_f19d987f1578e090286d53817be20e10.js, 20160318_f1cadac80bf1a23f11e38c09cabda615.js, 20160318_f7eca2fc03fd6f4d9f7b16dbcd3482f0.js, 20160318_f86623df8364b37b77c5811ae84fe3ea.js, 20160319_f5878d0191d46643fd6528d7ad5aecf0.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "b896b96d2a064274bbf73fb6bc82fb09bc6043179480020da27e3b98dcc0b5c4"
    hash2       = "4c673926849504a709c8c6861880431297c2bfaf42d6c8170bdafeb13ff6ce7e"
    hash3       = "d666dfa0ab58dd3df49f038c962603da4e4292175fd60f02a4c5d44b7652128e"
    hash4       = "224a54f92b0a06f2c079bbd7253af270b7de6a0993c30dba3d3ca687d68c502d"
    hash5       = "c43b44bde6aceffd14cbbce88a5644b7fed6ecdedf08bd7e39283ee1700916ae"
    hash6       = "8412d1bf25a5278089bbe07eef1eb776d3aca0d93f786c2d9cf7327259b5049b"
    hash7       = "b79bcdf8dbceca7193d65a979c0f51cce7cdbe54a20f668b6c0784eb47ed5a62"
    hash8       = "1b4d67fad37ff3708d884b4e66893319921974f6f4ec5a7998cef551385cd1ed"
    hash9       = "3dbf99b592c39b02b0abc349377bb71daf1fd52a86a350cc0e3a9fac3920e9f8"
    hash10      = "ef771c42ffb70d7c0690cad9b6ec6763bb9efe20d86cad425cd44b2a8758fb60"
    hash11      = "78b69b5f5d584fafaf437a100ca59e5e67a388a57de7bd9c89172252bf481a2f"
    hash12      = "78c2e81665f2762b4acdfc05210b8bde107ea64b49381e67d4bcb8c56580cbea"
    hash13      = "1cb82f22131c6fa90b5adce87b36ebb4b274bbe277e14133deff7f9d8cbbd79b"
    hash14      = "fda17c0438bd4f93d96971925304cd85a03710d9c26719d89b5dfb54e62bafb1"
    hash15      = "7491d5272be7daf013f64624e4bfde9c11397a722a384570fff5eabe7be50afd"
    hash16      = "8f7a0a7b356a95dcb04b92b706f6a84ea55cf7b2dec2ea9639c364a3b63bbe98"
    hash17      = "6584cd509a8ae7bab28b6350e3c766a6aa2b115e2cd446ad087c977a32c8b32b"
    hash18      = "a803747ae9783945f999d40e5dfc8cf87db613c05415be873bba7ec30045600b"
    hash19      = "6cabc54f71d1b54842fc25f29ee7390b406ae14408e0d1d8d62922af9b25bbf4"
    hash20      = "c36aaf73c4356ed0132de7df7559f1b7078d441f602980fb35be12ffe30a4565"
    hash21      = "b66dbf356af6fb5e6d212136686e74eb0276371e324d58b594d803b23adf3503"
    hash22      = "9ca262e31107184a666b771834641e2accfcab7b2274ae4c41ddc3fc9027e5bd"
    hash23      = "826b080eaafd84637ce51c8aa1c7a7d2a4373adfd6a68fd9966cd170b04b6fd7"
    hash24      = "39e1334b3af1d2b35a8512745d60b302ed5f125f75026f5ae04be80394caccba"
    hash25      = "6430ba5167b18081c90456fb4693c552cfacc248c4382d5a4aa43e501ace811d"
    hash26      = "dbcfa41ab5e5278502970a496b70b62fcf1a012aebb41c11ee0cb66bb9925d4d"
    hash27      = "0df6cc6d1a8cb0cc3b4bbcc38425a839b577ae1f962335c52a2f50efb1b76fce"
    hash28      = "3e70ab05e1f3210fa0c0ca82e59bacb5c669ab9014feb5905457bdddda14752b"
    hash29      = "ce06b0367a54e5d5d241391885bf92c73a5cf38534ceafaf4ff882fd614c6e1c"
    hash30      = "3ee2bd9d9876eef66d0420e5561939cfc397fc064f6a91379a52c4c90c49c460"
    hash31      = "8b453e973d35eddef760d5a13e10859a7f9b9f5d60be5d82499048906d3b6212"
    hash32      = "549b27eedb7f475ae307b283fdebc4ea8312405f940c823d92a9d69ebc8b84ca"
    hash33      = "81c1c16c39a327875427226bb125caf603f41e12d6c6251a425b961512258d3f"
    hash34      = "fef8046f5f680a782b3cdef048897985019edbf4c4f30100462ebefe22737132"
    hash35      = "144df23ba5e0e2761393ecb3a63f38d08ef3e9401a756637bdeaaddced4ac51b"
    hash36      = "b685c58005288d5eb62611cae885f2511e778e647b865a3a60bf358934004f5d"
    hash37      = "ea1ec0847e1ce2a45b4709dc89ae8a3d48328488978a987b81c9ed7763f66801"
    hash38      = "355c2ab2bbe8e1a1d2bd877f0bbda8577654ff4935be60ce9483e5d4e822c5a0"
    hash39      = "dd929bc0e1417c63ed37c2af0bf5e1cf77cb01b2cf67bd5119f3bf04cd987228"
    hash40      = "3b1d5bc4e916681d028e6dd437377c5ad0bd6a46068fddc06a587809d8967634"
    hash41      = "04b76359610c5de959318b5df9bc4a79bc1e7c7e3dc2009a501bcbbf7276db4b"
    hash42      = "c35e6063dfcbc71ad5d1cacba669e474c2c79087b06b7de533f9dd2e359a55b6"
    hash43      = "42f977d13395a6107ea07ca3fd02e1344f44bb72cfa8dc294c9e0ccca29b2199"
    hash44      = "12e9478ae0ba8bb2cde1cd368ef020081ee2e7857eb91ca33226bcc519624045"
    hash45      = "02bb6c2844ac4fde17c0655383ac0871bfb8ebf56c26dc20c1256e325bf50f14"
    hash46      = "5660e50eb712543a8c1b1ae592f472d9b83b267f267079d85e7313814aa244c6"
    hash47      = "0af763b05f4ed01bf172737389130a77a9e55637e40eb069db44d568b4d57828"
    hash48      = "dabc7ae7e0e2898ac9c0a30a0411ccc108e4a0846b63ab1a189b60b092c2c4cc"
    hash49      = "26bae5796216f8e5cce1ae731011fe159a57247a757fe83b505578bc839a6279"
    hash50      = "a9244921802287a33005b76034b5686043e315acb2ab46670734857977736dea"
    hash51      = "b171df22e34d6a3c33293cc725675cd9fdc0d8b6903ffb81785ea99550675fc4"
    hash52      = "4f0c53cde08bff76b82e1c088ea0654e2e1e24067d694ebcdc62aa416d4a3804"
    hash53      = "f1f37e604cd14106a29b823e7dda319bebcee08c4ce42034b06c3b10264ad327"
    hash54      = "4a7caae077462b934c105c1a6acb64fd241594c7b382a3368cd5cdf3feca82d1"
    hash55      = "2fd0fa7dd2de4d5babd11208c4f6d78893d3128932f8754920a7337e5108e73c"
    hash56      = "81c021c0c8fe52b43f74214e7524108b8329269dd57f120e8d1b7a081a25174c"

  strings:
    $s1 = "( (elem = matcherOut[i]) && (temp = postFinder ? indexOf( seed, elem ) : preMap[i]) > -1 ) {\";" fullword ascii
    $s2 = "er seed elements or outermost context elems = seed || byElement && Expr.find[\\\"TAG\\\"]( \\\"*\\\", outermost ), Use integer d" ascii
    $s3 = "ff this is the outermost matcher dirrunsUnique = (dirruns += contextBackup == null ? 1 : Math.random() || 0.1), len = elems.leng" ascii
    $s4 = "matchedCount = 0, i = \\\"0\\\", unmatched = seed && [], setMatched = [], contextBackup = outermostContext, We must always have " ascii
    $s5 = "Element = elementMatchers.length > 0, superMatcher = function( seed, context, xml, results, outermost ) { var elem, j, matcher, " ascii

  condition:
    ((uint16(0) == 0x6675 or uint16(0) == 0x5765) and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

9539cef0-9286-4950-b89a-c695a3569a50

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion