_20160915_031b2b2a81760f73383b635c23771175_20160915_0bcc48d7fb02_4100

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160915_031b2b2a81760f73383b635c23771175.js, 20160915_0bcc48d7fb02efaa1bab6e89b146f764.js, 20160915_14b427a7401efd15ad40ab38a0ff0849.js, 20160915_1ab5eea58d67b59b8bf85a14e127cae9.js, 20160915_25453e40d36267aa653c39884dbaf029.js, 20160915_2f9a6bb32c1e3adca1ab551eae40ddc6.js, 20160915_3138739031b0a3053454b4b54fa31d03.js, 20160915_43d1b5992960a365931311fc1ededd9e.js, 20160915_4c4e6c5e00e3fbb2db1ba4cea397d7e0.js, 20160915_542ee961b0e8a41e992c0e6a8e5d6061.js, 20160915_559168ed0abccd0006b29eebf90846e9.js, 20160915_679b639909db09724ceca828b50ef7c9.js, 20160915_69630d6e9a244df7b54992f16f58ddbb.js, 20160915_69e69240c0457ca9e319e312de0d9424.js, 20160915_6ff02bf870ac99f6b1afa3cdb3fb1ca4.js, 20160915_7174a51df35cc59b7d2bec8d9d14fdc4.js, 20160915_75eaa017630ada44eed2960813493f35.js, 20160915_7e973ac6b0539ffc8c93565b1843bd55.js, 20160915_7f10bbf26df5e52edd57ae0f085cec55.js, 20160915_82945f93a0a43f057cfdebd36db0242d.js, 20160915_8d5a66377fb7a4d35283060de78a4825.js, 20160915_93ef39077c6e7ab43365d3b16cbfd471.js, 20160915_99f4f15923c00f81bf562e27722726d5.js, 20160915_a05b912e01b446bf7cef2f2ad9b145cf.js, 20160915_a073be0ac0bd8d151062f5b26271851d.js, 20160915_a27a7b49ee8c19c13cb1a1825e629ed3.js, 20160915_ac595b9c92361ccb910c06f40971de33.js, 20160915_c2afafc149146ec3fe4b2f77630e5b8b.js, 20160915_d53bbc3a7c2dc3f587e616aeba0625d4.js, 20160915_d654a7fe77fd0165161393adff1c29bb.js, 20160915_e473b954e609eadc4b3a7ca7003e0daa.js, 20160915_eef47bf6f9e4747a9b288f146cc9b0be.js, 20160915_efc366d01cc06469e3afc0cd4d772372.js, 20160915_fe2ec371441931018c1083887b29b5c9.js

rule _20160915_031b2b2a81760f73383b635c23771175_20160915_0bcc48d7fb02_4100 {
  meta:
    description = "datamaliciousorder - from files 20160915_031b2b2a81760f73383b635c23771175.js, 20160915_0bcc48d7fb02efaa1bab6e89b146f764.js, 20160915_14b427a7401efd15ad40ab38a0ff0849.js, 20160915_1ab5eea58d67b59b8bf85a14e127cae9.js, 20160915_25453e40d36267aa653c39884dbaf029.js, 20160915_2f9a6bb32c1e3adca1ab551eae40ddc6.js, 20160915_3138739031b0a3053454b4b54fa31d03.js, 20160915_43d1b5992960a365931311fc1ededd9e.js, 20160915_4c4e6c5e00e3fbb2db1ba4cea397d7e0.js, 20160915_542ee961b0e8a41e992c0e6a8e5d6061.js, 20160915_559168ed0abccd0006b29eebf90846e9.js, 20160915_679b639909db09724ceca828b50ef7c9.js, 20160915_69630d6e9a244df7b54992f16f58ddbb.js, 20160915_69e69240c0457ca9e319e312de0d9424.js, 20160915_6ff02bf870ac99f6b1afa3cdb3fb1ca4.js, 20160915_7174a51df35cc59b7d2bec8d9d14fdc4.js, 20160915_75eaa017630ada44eed2960813493f35.js, 20160915_7e973ac6b0539ffc8c93565b1843bd55.js, 20160915_7f10bbf26df5e52edd57ae0f085cec55.js, 20160915_82945f93a0a43f057cfdebd36db0242d.js, 20160915_8d5a66377fb7a4d35283060de78a4825.js, 20160915_93ef39077c6e7ab43365d3b16cbfd471.js, 20160915_99f4f15923c00f81bf562e27722726d5.js, 20160915_a05b912e01b446bf7cef2f2ad9b145cf.js, 20160915_a073be0ac0bd8d151062f5b26271851d.js, 20160915_a27a7b49ee8c19c13cb1a1825e629ed3.js, 20160915_ac595b9c92361ccb910c06f40971de33.js, 20160915_c2afafc149146ec3fe4b2f77630e5b8b.js, 20160915_d53bbc3a7c2dc3f587e616aeba0625d4.js, 20160915_d654a7fe77fd0165161393adff1c29bb.js, 20160915_e473b954e609eadc4b3a7ca7003e0daa.js, 20160915_eef47bf6f9e4747a9b288f146cc9b0be.js, 20160915_efc366d01cc06469e3afc0cd4d772372.js, 20160915_fe2ec371441931018c1083887b29b5c9.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "15e0385b21c2cd45218a9a5a467c524b8a3ad30f0020fb22f91d64e78e303e3b"
    hash2       = "27789f4af47a3d5e11068052c151dbe80d62e6c90a544a49d79ea47157978225"
    hash3       = "a589a0cb92cd37d606bbf0396a3f1edd1268e6af22dc257c0fd2c685018f5193"
    hash4       = "6f48af0b2f44c23dd12e958573c329734c2d5756fa942cde94d8524ebc19a68b"
    hash5       = "741bd6fc6bd5ab5222d3d016b062c090bdfb056460459e286222964b408d9134"
    hash6       = "fbc1c63aa90704b1c6751004031b52ef9f2e060fabe4f93760aeb2cadfc007c6"
    hash7       = "6ec5e6fcb1777af4d0367fd89d5326af3d8cdfdb9490c4c1661eddd17c73e998"
    hash8       = "3d28a083eeb650100b143340e94a574772dcd9cb0a4972e83028257b9db05116"
    hash9       = "096eb5863fb070ce3ba1cc9b25371fea21a893ee2c6efe381bce57b708acb7a8"
    hash10      = "87c4fed5a397906e3a4b4d998e177a50ed9f03fc9e0b3d9c3e3bb9bc78d2e1ff"
    hash11      = "d6ec31156daf1f567ed58c7ce44061ce5b669830a06195447ab779a03d438394"
    hash12      = "29861ae54d2d14f7e70aa90cbf8f745a26b7b7787f418ff5dea7695dcbb174e7"
    hash13      = "50f3fc02dbb4c1a6e46f413a3a9e341645a5a1b62a1c2f69a65db5a01d005aa9"
    hash14      = "67b70abd444ad3b0c8aff4ccbc9172c5c9eee59955fa65e9e1641be62ed0fe65"
    hash15      = "198636334e30cca2d147e4d078faeea68d75d276c38d454766d7fa14fd6f9a9b"
    hash16      = "c423cde4d1486701ce7095e547eabb661d18c4535a298b141a6d8a3ea1e7a17f"
    hash17      = "415aa6e4929b32fb215a63a4fe03b5f21f72edd7468b97770f66f63053d67523"
    hash18      = "83ab6cfdb947f38417b43e792e074a7b53acd62ecb9b2b487f7d5333c8cd34dc"
    hash19      = "27ff1bfb35cdd125d50052c1b5a505486fab787126d36a863cbd513e40b7e5d7"
    hash20      = "f1fb6032ef49bd4fc2871e0a55cb70ae24f8054f28b75af8ded08609501942f1"
    hash21      = "e21547242d74d3f9d692789d171210ee5004abaf7f30235ca02ef9a3f5880c80"
    hash22      = "d86bac27e77f92c98c1a061066dcb9400d37be98776ebf8a4519df82b4d18472"
    hash23      = "0377cd52c543eec3c8ef6972f9f0fa9f9319e0660065962d7ef922177929b2cd"
    hash24      = "bdd56b075b7b18221e1598e3e5f15d13089c9514a9828825f83d5f87f65c31f6"
    hash25      = "b0f8735adbcdd9eba85b907b19756b8f8c984fe7f37b504d040e0a638f58c774"
    hash26      = "5a422b5a01e7266115bd0beb1b1e223f243668264f3a837a2cc537c5094241e7"
    hash27      = "4e382e32cf76ba2b7fb3b65366b603932f9e0ff99fa8434e371ae9bd750b9f1f"
    hash28      = "098412e6ccf57525812cb9432c7f90df5255e6b1e314208cb1592f54b41d7dd4"
    hash29      = "09fef863703972032c264243ffb9f1937f01f2455a80282bff04060c88ac34fb"
    hash30      = "ad80561afa7c481d599d4c16fa12f8c2b4f820694ccf99d005c8b75740bc18b6"
    hash31      = "77e084cb9b3918c049ff58e117ef3d0e18c65c27a0e7d73efb9d43b358560382"
    hash32      = "7b6695c80d2a90b876edcb6c6bb2908c62196464b9ab5c85407deb3ea63d27eb"
    hash33      = "50a99e8196d2850617ad0c7bbba880435a128e50db3a06f020b426770a1db73c"
    hash34      = "ee84ae599a810ad3f82d6160d8fcc5fa2bb3a2062006785490adefd51bf86045"

  strings:
    $s1 = "Wf\": [3, (function f(){return \"\\x46\";})()], \"IVs\": [3, (function f(){return \"\\x47\";})()], \"PXx\": [3, (function f(){re" ascii
    $s2 = "unction f(){return \"\\x3e\";})()], \"SCi\": [3, (function f(){return \"\\x3d\";})()], \"Ln\": [3, (function f(){return \"6\";})" ascii
    $s3 = " \"Jl\": [3, (function f(){return \"\\x0d\";})()], \"Df\": [3, (function f(){return \"\\x09\";})()], \"DEp\": [3, (function f(){" ascii
    $s4 = "urn \"\\x4a\";})()], \"By\": [3, (function f(){return \"\\x4b\";})()], \"Vl\": [3, (function f(){return \"\\x4c\";})()], \"Cz\":" ascii
    $s5 = "f(){return \"\\x3a\";})()], \"WRy\": [3, (function f(){return \"\\x3c\";})()], \"Tg\": [3, (function f(){return \"\\x3b\";})()]," ascii

  condition:
    (uint16(0) == 0x0a0a and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5445c6c8-47af-46db-b3ec-16aed4cd5570

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion