libavcodec_inverse_table__32_lil_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libavcodec_inverse_table__32_lil_1024_ (No description metadata provided).

rule libavcodec_inverse_table__32_lil_1024_ {
  strings:
    $a0 = { 00 00 00 00 ff ff ff ff 00 00 00 80 56 55 55 55 00 00 00 40 34 33 33 33 ab aa aa 2a 25 49 92 24 00 00 00 20 1d c7 71 1c 9a 99 99 19 75 d1 45 17 56 55 55 15 14 3b b1 13 93 24 49 12 12 11 11 11 00 00 00 10 10 0f 0f 0f 8f e3 38 0e 5f 43 79 0d cd cc cc 0c 0d c3 30 0c bb e8 a2 0b 2d 64 21 0b ab aa aa 0a a4 70 3d 0a 8a 9d d8 09 5f 42 7b 09 4a 92 24 09 b1 dc d3 08 89 88 88 08 85 10 42 08 00 00 00 08 7d f0 c1 07 88 87 87 07 08 75 50 07 c8 71 1c 07 46 3e eb 06 b0 a1 bc 06 07 69 90 06 67 66 66 06 64 70 3e 06 87 61 18 06 d1 17 f4 05 5e 74 d1 05 06 5b b0 05 17 b2 90 05 0b 62 72 05 56 55 55 05 2a 78 39 05 52 b8 1e 05 06 05 05 05 c5 4e ec 04 3f 87 d4 04 30 a1 bd 04 4b 90 a7 04 25 49 92 04 20 c1 7d 04 59 ee 69 04 98 c7 56 04 45 44 44 04 54 5c 32 04 43 08 21 04 05 41 10 04 00 00 00 04 04 3f f0 03 3f f8 e0 03 36 26 d2 03 c4 c3 c3 03 0f cc b5 03 84 3a a8 03 d2 0a 9b 03 e4 38 8e 03 e1 c0 81 03 23 9f 75 03 37 d0 69 03 d8 50 5e 03 ed 1d 53 03 84 34 48 03 d3 91 3d 03 34 33 33 03 20 16 29 03 32 38 1f 03 22 97 15 03 c4 30 0c 03 04 03 03 03 e9 0b fa 02 91 49 f1 02 2f ba e8 02 0c 5c e0 02 83 2d d8 02 03 2d d0 02 0c 59 c8 02 2d b0 c0 02 06 31 b9 02 47 da b1 02 ab aa aa 02 fe a0 a3 02 15 bc 9c 02 d5 fa 95 02 29 5c 8f 02 0d df 88 02 83 82 82 02 98 45 7c 02 63 27 76 02 03 27 70 02 a0 43 6a 02 6a 7c 64 02 98 d0 5e 02 6a 3f 59 02 26 c8 53 02 18 6a 4e 02 93 24 49 02 f1 f6 43 02 90 e0 3e 02 d6 e0 39 02 2d f7 34 02 03 23 30 02 cc 63 2b 02 03 b9 26 02 23 22 22 02 ae 9e 1d 02 2a 2e 19 02 22 d0 14 02 22 84 10 02 bb 49 0c 02 83 20 08 02 11 08 04 02 00 00 00 02 f1 07 fc 01 82 1f f8 01 5a 46 f4 01 20 7c f0 01 7c c0 ec 01 1b 13 e9 01 ad 73 e5 01 e2 e1 e1 01 6f 5d de 01 08 e6 da 01 66 7b d7 01 42 1d d4 01 59 cb d0 01 69 85 cd 01 31 4b ca 01 72 1c c7 01 f1 f8 c3 01 71 e0 c0 01 b9 d2 bd 01 92 cf ba 01 c4 d6 b7 01 1c e8 b4 01 65 03 b2 01 6c 28 af 01 02 57 ac 01 f7 8e a9 01 1b d0 a6 01 42 1a a4 01 40 6d a1 01 ea c8 9e 01 15 2d 9c 01 9a 99 99 01 50 0e 97 01 10 8b 94 01 b5 0f 92 01 19 9c 8f 01 19 30 8d 01 91 cb 8a 01 60 6e 88 01 62 18 86 01 78 c9 83 01 82 81 81 01 60 40 7f 01 f5 05 7d 01 21 d2 7a 01 c9 a4 78 01 cf 7d 76 01 18 5d 74 01 88 42 72 01 06 2e 70 01 77 1f 6e 01 c2 16 6c 01 ce 13 6a 01 82 16 68 01 c7 1e 66 01 86 2c 64 01 a8 3f 62 01 17 58 60 01 bc 75 5e 01 83 98 5c 01 57 c0 5a 01 24 ed 58 01 d4 1e 57 01 56 55 55 01 95 90 53 01 7f d0 51 01 02 15 50 01 0b 5e 4e 01 89 ab 4c 01 6b fd 4a 01 9f 53 49 01 15 ae 47 01 bd 0c 46 01 87 6f 44 01 63 d6 42 01 42 41 41 01 14 b0 3f 01 cc 22 3e 01 5b 99 3c 01 b2 13 3b 01 c3 91 39 01 82 13 38 01 e0 98 36 01 d0 21 35 01 46 ae 33 01 35 3e 32 01 91 d1 30 01 4c 68 2f 01 5d 02 2e 01 b5 9f 2c 01 4b 40 2b 01 13 e4 29 01 02 8b 28 01 0c 35 27 01 28 e2 25 01 4a 92 24 01 68 45 23 01 79 fb 21 01 71 b4 20 01 48 70 1f 01 f4 2e 1e 01 6b f0 1c 01 a5 b4 1b 01 97 7b 1a 01 39 45 19 01 82 11 18 01 69 e0 16 01 e6 b1 15 01 f1 85 14 01 82 5c 13 01 8f 35 12 01 12 11 11 01 02 ef 0f 01 57 cf 0e 01 0b b2 0d 01 15 97 0c 01 6f 7e 0b 01 11 68 0a 01 f4 53 09 01 11 42 08 01 61 32 07 01 de 24 06 01 80 19 05 01 42 10 04 01 1c 09 03 01 09 04 02 01 02 01 01 01 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f8cdb2fc-a08c-485c-81cd-c59de2ea84fd

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion