_20160915_14b427a7401efd15ad40ab38a0ff0849_20160915_1ab5eea58d67_4101

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files 20160915_14b427a7401efd15ad40ab38a0ff0849.js, 20160915_1ab5eea58d67b59b8bf85a14e127cae9.js, 20160915_1ad28d5610071216ac29ddcaa056880d.js, 20160915_25453e40d36267aa653c39884dbaf029.js, 20160915_2d7493b430a6a7ded0ec7bb2829875df.js, 20160915_2dac283017b473810bd9995ccd419291.js, 20160915_2f3e4aa77572ae4fe510d497cb691053.js, 20160915_2f9a6bb32c1e3adca1ab551eae40ddc6.js, 20160915_3887a6f0c7611768b2610637f181ccba.js, 20160915_38b42036e244dad74594138f28e607c4.js, 20160915_39df74c32a70a1d59f4668d879424c64.js, 20160915_3ac599a2656c8a574bb03414b42722d1.js, 20160915_3e7b051bbda45e65bf88bf42689e8f14.js, 20160915_3f4927acac117aec9d450b559f618f0e.js, 20160915_43d1b5992960a365931311fc1ededd9e.js, 20160915_4733e2adf91cd7e98c4c4cf8a7a36fc8.js, 20160915_4bd4bee0075033a2133576b18c2529a8.js, 20160915_4e6a9e8159606cd19174d31dbeadf180.js, 20160915_542ee961b0e8a41e992c0e6a8e5d6061.js, 20160915_5b5e33f74cdc72151481d69a447456c0.js, 20160915_5bb501fc0bd2c7d01a83e881e436aeac.js, 20160915_5dbd71728039527f585cb0dc9aa1ba12.js, 20160915_5ebb373f7417c0d8a71ae91f55f0b640.js, 20160915_66e4778283750d86c62e075946c7088a.js, 20160915_6ba7c0e817ee7dc592ca1bf53361fd2a.js, 20160915_6ce12dc0d31c66ca0662de60890a3642.js, 20160915_6ce34221d9d4beed8d28eb68dcf8b9a8.js, 20160915_6ff02bf870ac99f6b1afa3cdb3fb1ca4.js, 20160915_7174a51df35cc59b7d2bec8d9d14fdc4.js, 20160915_75eaa017630ada44eed2960813493f35.js, 20160915_76291509f5d2d8000b416d69e2acd901.js, 20160915_76402afc437d41c49a73fbcd62fcabee.js, 20160915_7baa49c55174103eee457eaa548806ef.js, 20160915_82945f93a0a43f057cfdebd36db0242d.js, 20160915_8cc5b00c512f7d9e15ce63ffd187378b.js, 20160915_8d5a66377fb7a4d35283060de78a4825.js, 20160915_95ce916c57b26b66605e108f2092ec35.js, 20160915_a073be0ac0bd8d151062f5b26271851d.js, 20160915_a20dd98b9cf755472f84d89cede170c0.js, 20160915_a27a7b49ee8c19c13cb1a1825e629ed3.js, 20160915_a526b370039c444e5a32f1daef4748ef.js, 20160915_a53ba98efd6399432401026406a0fa5e.js, 20160915_a6e2117eabfad705f1de54bb6abd3a04.js, 20160915_a845624b0c6d2174b6431378698cf353.js, 20160915_aa44c7754f7742e2c5e8249bd72d031d.js, 20160915_ac595b9c92361ccb910c06f40971de33.js, 20160915_af1e760fb21931d32c4ebdfa010abfe7.js, 20160915_b29b6fec8831ed435dcc1449502f6ce7.js, 20160915_c5850254453b8d3c32118ce424274c89.js, 20160915_d253c2fb05fa8fd44c3718e3ba26c33a.js, 20160915_d53bbc3a7c2dc3f587e616aeba0625d4.js, 20160915_d654a7fe77fd0165161393adff1c29bb.js, 20160915_d7130e40f654774dba0478485fd16e14.js, 20160915_dd6e83782ed59ba4795315a24f6f6899.js, 20160915_e42c656dd1d7d7c6298e27e335dcbdc5.js, 20160915_e78ad8958dd4f4b470bd04ddd121e638.js, 20160915_e797fc954b8ecef8b20dcc8c48394ff8.js, 20160915_ebd88fb6b0efc4a100027a7a3a1aad21.js, 20160915_ebf8eaea31192c428485aa82e55bcf9d.js, 20160915_eef47bf6f9e4747a9b288f146cc9b0be.js, 20160915_f51d9dbac555aa0a9c962b8ad93cb045.js, 20160915_f73d7eada3663c6b75e7ce034ea4079f.js, 20160915_fb1dbdd2869c79c3a6ac0451857c24d0.js, 20160915_fbaec4782542d82d23019ff2d00933b0.js, 20160915_fc6b9b57605c6a3970086275e9d7f1e1.js, 20160916_18cac1f2bbd13eb67df67ad0a2e0b305.js

rule _20160915_14b427a7401efd15ad40ab38a0ff0849_20160915_1ab5eea58d67_4101 {
  meta:
    description = "datamaliciousorder - from files 20160915_14b427a7401efd15ad40ab38a0ff0849.js, 20160915_1ab5eea58d67b59b8bf85a14e127cae9.js, 20160915_1ad28d5610071216ac29ddcaa056880d.js, 20160915_25453e40d36267aa653c39884dbaf029.js, 20160915_2d7493b430a6a7ded0ec7bb2829875df.js, 20160915_2dac283017b473810bd9995ccd419291.js, 20160915_2f3e4aa77572ae4fe510d497cb691053.js, 20160915_2f9a6bb32c1e3adca1ab551eae40ddc6.js, 20160915_3887a6f0c7611768b2610637f181ccba.js, 20160915_38b42036e244dad74594138f28e607c4.js, 20160915_39df74c32a70a1d59f4668d879424c64.js, 20160915_3ac599a2656c8a574bb03414b42722d1.js, 20160915_3e7b051bbda45e65bf88bf42689e8f14.js, 20160915_3f4927acac117aec9d450b559f618f0e.js, 20160915_43d1b5992960a365931311fc1ededd9e.js, 20160915_4733e2adf91cd7e98c4c4cf8a7a36fc8.js, 20160915_4bd4bee0075033a2133576b18c2529a8.js, 20160915_4e6a9e8159606cd19174d31dbeadf180.js, 20160915_542ee961b0e8a41e992c0e6a8e5d6061.js, 20160915_5b5e33f74cdc72151481d69a447456c0.js, 20160915_5bb501fc0bd2c7d01a83e881e436aeac.js, 20160915_5dbd71728039527f585cb0dc9aa1ba12.js, 20160915_5ebb373f7417c0d8a71ae91f55f0b640.js, 20160915_66e4778283750d86c62e075946c7088a.js, 20160915_6ba7c0e817ee7dc592ca1bf53361fd2a.js, 20160915_6ce12dc0d31c66ca0662de60890a3642.js, 20160915_6ce34221d9d4beed8d28eb68dcf8b9a8.js, 20160915_6ff02bf870ac99f6b1afa3cdb3fb1ca4.js, 20160915_7174a51df35cc59b7d2bec8d9d14fdc4.js, 20160915_75eaa017630ada44eed2960813493f35.js, 20160915_76291509f5d2d8000b416d69e2acd901.js, 20160915_76402afc437d41c49a73fbcd62fcabee.js, 20160915_7baa49c55174103eee457eaa548806ef.js, 20160915_82945f93a0a43f057cfdebd36db0242d.js, 20160915_8cc5b00c512f7d9e15ce63ffd187378b.js, 20160915_8d5a66377fb7a4d35283060de78a4825.js, 20160915_95ce916c57b26b66605e108f2092ec35.js, 20160915_a073be0ac0bd8d151062f5b26271851d.js, 20160915_a20dd98b9cf755472f84d89cede170c0.js, 20160915_a27a7b49ee8c19c13cb1a1825e629ed3.js, 20160915_a526b370039c444e5a32f1daef4748ef.js, 20160915_a53ba98efd6399432401026406a0fa5e.js, 20160915_a6e2117eabfad705f1de54bb6abd3a04.js, 20160915_a845624b0c6d2174b6431378698cf353.js, 20160915_aa44c7754f7742e2c5e8249bd72d031d.js, 20160915_ac595b9c92361ccb910c06f40971de33.js, 20160915_af1e760fb21931d32c4ebdfa010abfe7.js, 20160915_b29b6fec8831ed435dcc1449502f6ce7.js, 20160915_c5850254453b8d3c32118ce424274c89.js, 20160915_d253c2fb05fa8fd44c3718e3ba26c33a.js, 20160915_d53bbc3a7c2dc3f587e616aeba0625d4.js, 20160915_d654a7fe77fd0165161393adff1c29bb.js, 20160915_d7130e40f654774dba0478485fd16e14.js, 20160915_dd6e83782ed59ba4795315a24f6f6899.js, 20160915_e42c656dd1d7d7c6298e27e335dcbdc5.js, 20160915_e78ad8958dd4f4b470bd04ddd121e638.js, 20160915_e797fc954b8ecef8b20dcc8c48394ff8.js, 20160915_ebd88fb6b0efc4a100027a7a3a1aad21.js, 20160915_ebf8eaea31192c428485aa82e55bcf9d.js, 20160915_eef47bf6f9e4747a9b288f146cc9b0be.js, 20160915_f51d9dbac555aa0a9c962b8ad93cb045.js, 20160915_f73d7eada3663c6b75e7ce034ea4079f.js, 20160915_fb1dbdd2869c79c3a6ac0451857c24d0.js, 20160915_fbaec4782542d82d23019ff2d00933b0.js, 20160915_fc6b9b57605c6a3970086275e9d7f1e1.js, 20160916_18cac1f2bbd13eb67df67ad0a2e0b305.js"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a589a0cb92cd37d606bbf0396a3f1edd1268e6af22dc257c0fd2c685018f5193"
    hash2       = "6f48af0b2f44c23dd12e958573c329734c2d5756fa942cde94d8524ebc19a68b"
    hash3       = "115386d0685a70c037c3f632de838675b8091b065273f90dbe61abf168862948"
    hash4       = "741bd6fc6bd5ab5222d3d016b062c090bdfb056460459e286222964b408d9134"
    hash5       = "1d3b60973b7c92b1a7102eb9c7d0b1445fefcc98e430b69cd75c2112096add36"
    hash6       = "04869f367178b89d4a2f1336c13f9d3f0988bb9cf99f55815095ec3fd31a1d5f"
    hash7       = "cb451d09347ca035d37375cd3d5dd82d7d12a6ab59574677849ee8b9a4fb12b1"
    hash8       = "fbc1c63aa90704b1c6751004031b52ef9f2e060fabe4f93760aeb2cadfc007c6"
    hash9       = "c73f148ce1d8b576ea5c9869097f12d084ee825f50c5eb74e88ebef55079eee2"
    hash10      = "46ecffd88b49b36d4b5a6d1a330c9b4f7cba8538e89f668d79484f8a653ce03d"
    hash11      = "5a72b875619e81a2768c8a6a3d5802f933e4c29052cebf0a7f9ef5eec03f2cb2"
    hash12      = "c9fc1d7fa5e3853d10a9a4fe89d7a809b019e4e7961b894be69dbe855683e166"
    hash13      = "464f0b45d0702701dca92c9b759dda355f0d13eeabfa8b940c16ebb845340dc1"
    hash14      = "7c74fdf82b9b048ac82b2662f1fac570487f8fe119227b3c86943b692250cf08"
    hash15      = "3d28a083eeb650100b143340e94a574772dcd9cb0a4972e83028257b9db05116"
    hash16      = "82c28e1db99881f0b755d10971d49e2de59b2c8f7b03d621f85087db74c1b161"
    hash17      = "24f6c1f343ed252e3a74eb3a9276e5bc81b424656ca8b69bc2ebda8e26550a81"
    hash18      = "9153428a1f2143f90e170bc795f9bc9754e40af95dde0a2938aa46f46d63d364"
    hash19      = "87c4fed5a397906e3a4b4d998e177a50ed9f03fc9e0b3d9c3e3bb9bc78d2e1ff"
    hash20      = "4306e80d19a91b60d1c427d6c74979f9908a7e7d5dc853549028dc3fc8e7cad0"
    hash21      = "6b210a5fb676dc333a3cae28bdf31a6c6e41e7ca60efb72674465dceab4a23ba"
    hash22      = "7d14c804054de0f26cba2649cf729df8368af9111c35834c2c76202b5b1b296e"
    hash23      = "f9a675a240629587d3b72eacd12f171c2a99a730c564d160194aa4f7b72a03bc"
    hash24      = "fb44e75988d27d06cbfd2fc31c5d65a488669279617188a65ba14c2a30a67e51"
    hash25      = "3245cf99876e45110604d80cf0bcf3f59cebfae20ee5f1544afca0c2c058cb56"
    hash26      = "c09e951e6d1819d9f8b18939a1e4967b6a644b7515b38c8d3b79cd32783e7de5"
    hash27      = "b13b91158f09e6304f716d8c8b43a470e1db6aef870a363797cd57d50d406d39"
    hash28      = "198636334e30cca2d147e4d078faeea68d75d276c38d454766d7fa14fd6f9a9b"
    hash29      = "c423cde4d1486701ce7095e547eabb661d18c4535a298b141a6d8a3ea1e7a17f"
    hash30      = "415aa6e4929b32fb215a63a4fe03b5f21f72edd7468b97770f66f63053d67523"
    hash31      = "26d65a2bf1e34b8aa9eac2debf211c9c6f9a7d4f492cf63307307915f98d3505"
    hash32      = "9e90bfb61fcc1556c65924909301a0dc9743b6d282789ad54b8fa46c3bfda617"
    hash33      = "0ee4fe6082543b0c51d0569a665e778214874dcbb07a18f07a67e854f0de28ab"
    hash34      = "f1fb6032ef49bd4fc2871e0a55cb70ae24f8054f28b75af8ded08609501942f1"
    hash35      = "cb119b87ec19275f64dc652c28781f6ad2fa5f4a625aea5fef44fcf0c0342188"
    hash36      = "e21547242d74d3f9d692789d171210ee5004abaf7f30235ca02ef9a3f5880c80"
    hash37      = "11b51b57cdd5e07545aba338c073f44ba0515cb819d30573c79240c0d2e0fc1d"
    hash38      = "b0f8735adbcdd9eba85b907b19756b8f8c984fe7f37b504d040e0a638f58c774"
    hash39      = "0eed3a417bfb6ba83ea3e2c610f579ad812fe9fe36ed3dd10a3de4cc58855ee5"
    hash40      = "5a422b5a01e7266115bd0beb1b1e223f243668264f3a837a2cc537c5094241e7"
    hash41      = "805609c14c200c05a84d3bcf2c70aad2533cbbd5e050f6e3836ffc76d2ec23c2"
    hash42      = "8450d3dbd1d2c5fbf5ab143b5fcc60235227173aae7d0f77c0a3e871b60eb866"
    hash43      = "87788a74c1ea745574766906f06533d37dd6bf7827ff8e9cbbf8e51a2d0294a6"
    hash44      = "ce4f7d23b5140d1b6dd05abaa1dacaf6ba6225f4490e16a4b2ec9a5dea9c845c"
    hash45      = "54707fc6955e657ad57e6396feeb2db89e7288d1ded34dd1592f0b768a396b8e"
    hash46      = "4e382e32cf76ba2b7fb3b65366b603932f9e0ff99fa8434e371ae9bd750b9f1f"
    hash47      = "42766f623180ab3960e289ebf1930178134a8b8df1bd4b89e24f8a712201ff2f"
    hash48      = "4a2ab74804b8626b9c2be13ee349a6fe78f2f807b056d8f301682cbc08361d9e"
    hash49      = "9a0b0fab91042fd9c5dc36cd325229f49c8de1c172e48dbac2dee3f791fae7de"
    hash50      = "1cc8b975751abef40095c8ce9f60143975acab1b0e00950cf1d8e42a857ef02b"
    hash51      = "09fef863703972032c264243ffb9f1937f01f2455a80282bff04060c88ac34fb"
    hash52      = "ad80561afa7c481d599d4c16fa12f8c2b4f820694ccf99d005c8b75740bc18b6"
    hash53      = "7f17f704e95a751f7d586a6610d9e86023b44245400e604c469d16a9706ddaef"
    hash54      = "1bde7a95fdab97a86bb5832559414989faa0a8769fbb597e78e52904b8326833"
    hash55      = "b295fbc72cf4d74feb5d68c4d95eb31a3dc4ec8711f6be53293d7c43fa59f1f4"
    hash56      = "fa976ebbbce36040ad26d4a36da3714803e861a99f66a8422be5324d18303ec7"
    hash57      = "6d89a2bc17e53e82e8751d57d6dad47827a9506241f44418268f9369b72fc35a"
    hash58      = "972adbbb0d1f95c8747b2d81551bc8e30068ac60eec86997add8c77990417a35"
    hash59      = "02f064aa636a54b816790b475e8c45e1c807c9361147bf5c5a583ba8ad726a07"
    hash60      = "7b6695c80d2a90b876edcb6c6bb2908c62196464b9ab5c85407deb3ea63d27eb"
    hash61      = "661a69970437124406524cf7d99ac46dad57fefb3fcf89141db58bc9b2d50c89"
    hash62      = "a2739942cde9e2eae955edc1f8e1534c23d7a1761521a953eefeae953140735a"
    hash63      = "65914b357c8115e948377de35c838e2e6987c54d76a7f9785e144738d4b57e96"
    hash64      = "f21088406b50d76c14cd9b595c19822fec99e4be863279c82d6406fe45eb4782"
    hash65      = "92c201f716a975c788f9814d10f844b97c87d37f9c82ff8ee22eea300751be07"
    hash66      = "eac6222fa429120210709f2f65ab4d5533f0876019e93dddad26643737babc79"

  strings:
    $s1 = ": [3, (function f(){return \"\\x20\";})()], \"FDa\": [3, (function f(){return \"\\x21\";})()], \"Bn\": [3, (function f(){return " ascii
    $s2 = "f(){return \"\\x2e\";})()], \"XLc\": [3, (function f(){return \"\\x2b\";})()], \"Wg\": [3, (function f(){return \"\\x2c\";})()]," ascii
    $s3 = "unction f(){return \"\\x2a\";})()], \"GVx\": [3, (function f(){return \"5\";})()], \"Nl\": [3, (function f(){return \"3\";})()]," ascii
    $s4 = "rn \"\\x7b\";})()], \"Sc\": [3, (function f(){return \"\\x2f\";})()], \"CKa\": [3, (function f(){return \"\\x2d\";})()], \"Ql\":" ascii
    $s5 = "(function f(){return \"7\";})()], \"YBn\": [3, (function f(){return \"\\x25\";})()], \"Sv\": [3, (function f(){return \"\\x22\";" ascii

  condition:
    (uint16(0) == 0x0a0a and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

84f4310d-a0c4-4495-a824-c7b1ef8ba1c6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion