CRC_24_Radix_64_poly_0x864CFB__32_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_24_Radix_64_poly_0x864CFB__32_lil_refl_False_ (No description metadata provided).

rule CRC_24_Radix_64_poly_0x864CFB__32_lil_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 fb 4c 86 00 f6 99 0c 01 0d d5 8a 01 ec 33 19 02 17 7f 9f 02 1a aa 15 03 e1 e6 93 03 d8 67 32 04 23 2b b4 04 2e fe 3e 05 d5 b2 b8 05 34 54 2b 06 cf 18 ad 06 c2 cd 27 07 39 81 a1 07 b0 cf 64 08 4b 83 e2 08 46 56 68 09 bd 1a ee 09 5c fc 7d 0a a7 b0 fb 0a aa 65 71 0b 51 29 f7 0b 68 a8 56 0c 93 e4 d0 0c 9e 31 5a 0d 65 7d dc 0d 84 9b 4f 0e 7f d7 c9 0e 72 02 43 0f 89 4e c5 0f 60 9f c9 10 9b d3 4f 10 96 06 c5 11 6d 4a 43 11 8c ac d0 12 77 e0 56 12 7a 35 dc 13 81 79 5a 13 b8 f8 fb 14 43 b4 7d 14 4e 61 f7 15 b5 2d 71 15 54 cb e2 16 af 87 64 16 a2 52 ee 17 59 1e 68 17 d0 50 ad 18 2b 1c 2b 18 26 c9 a1 19 dd 85 27 19 3c 63 b4 1a c7 2f 32 1a ca fa b8 1b 31 b6 3e 1b 08 37 9f 1c f3 7b 19 1c fe ae 93 1d 05 e2 15 1d e4 04 86 1e 1f 48 00 1e 12 9d 8a 1f e9 d1 0c 1f c0 3e 93 21 3b 72 15 21 36 a7 9f 20 cd eb 19 20 2c 0d 8a 23 d7 41 0c 23 da 94 86 22 21 d8 00 22 18 59 a1 25 e3 15 27 25 ee c0 ad 24 15 8c 2b 24 f4 6a b8 27 0f 26 3e 27 02 f3 b4 26 f9 bf 32 26 70 f1 f7 29 8b bd 71 29 86 68 fb 28 7d 24 7d 28 9c c2 ee 2b 67 8e 68 2b 6a 5b e2 2a 91 17 64 2a a8 96 c5 2d 53 da 43 2d 5e 0f c9 2c a5 43 4f 2c 44 a5 dc 2f bf e9 5a 2f b2 3c d0 2e 49 70 56 2e a0 a1 5a 31 5b ed dc 31 56 38 56 30 ad 74 d0 30 4c 92 43 33 b7 de c5 33 ba 0b 4f 32 41 47 c9 32 78 c6 68 35 83 8a ee 35 8e 5f 64 34 75 13 e2 34 94 f5 71 37 6f b9 f7 37 62 6c 7d 36 99 20 fb 36 10 6e 3e 39 eb 22 b8 39 e6 f7 32 38 1d bb b4 38 fc 5d 27 3b 07 11 a1 3b 0a c4 2b 3a f1 88 ad 3a c8 09 0c 3d 33 45 8a 3d 3e 90 00 3c c5 dc 86 3c 24 3a 15 3f df 76 93 3f d2 a3 19 3e 29 ef 9f 3e 80 7d 26 43 7b 31 a0 43 76 e4 2a 42 8d a8 ac 42 6c 4e 3f 41 97 02 b9 41 9a d7 33 40 61 9b b5 40 58 1a 14 47 a3 56 92 47 ae 83 18 46 55 cf 9e 46 b4 29 0d 45 4f 65 8b 45 42 b0 01 44 b9 fc 87 44 30 b2 42 4b cb fe c4 4b c6 2b 4e 4a 3d 67 c8 4a dc 81 5b 49 27 cd dd 49 2a 18 57 48 d1 54 d1 48 e8 d5 70 4f 13 99 f6 4f 1e 4c 7c 4e e5 00 fa 4e 04 e6 69 4d ff aa ef 4d f2 7f 65 4c 09 33 e3 4c e0 e2 ef 53 1b ae 69 53 16 7b e3 52 ed 37 65 52 0c d1 f6 51 f7 9d 70 51 fa 48 fa 50 01 04 7c 50 38 85 dd 57 c3 c9 5b 57 ce 1c d1 56 35 50 57 56 d4 b6 c4 55 2f fa 42 55 22 2f c8 54 d9 63 4e 54 50 2d 8b 5b ab 61 0d 5b a6 b4 87 5a 5d f8 01 5a bc 1e 92 59 47 52 14 59 4a 87 9e 58 b1 cb 18 58 88 4a b9 5f 73 06 3f 5f 7e d3 b5 5e 85 9f 33 5e 64 79 a0 5d 9f 35 26 5d 92 e0 ac 5c 69 ac 2a 5c 40 43 b5 62 bb 0f 33 62 b6 da b9 63 4d 96 3f 63 ac 70 ac 60 57 3c 2a 60 5a e9 a0 61 a1 a5 26 61 98 24 87 66 63 68 01 66 6e bd 8b 67 95 f1 0d 67 74 17 9e 64 8f 5b 18 64 82 8e 92 65 79 c2 14 65 f0 8c d1 6a 0b c0 57 6a 06 15 dd 6b fd 59 5b 6b 1c bf c8 68 e7 f3 4e 68 ea 26 c4 69 11 6a 42 69 28 eb e3 6e d3 a7 65 6e de 72 ef 6f 25 3e 69 6f c4 d8 fa 6c 3f 94 7c 6c 32 41 f6 6d c9 0d 70 6d 20 dc 7c 72 db 90 fa 72 d6 45 70 73 2d 09 f6 73 cc ef 65 70 37 a3 e3 70 3a 76 69 71 c1 3a ef 71 f8 bb 4e 76 03 f7 c8 76 0e 22 42 77 f5 6e c4 77 14 88 57 74 ef c4 d1 74 e2 11 5b 75 19 5d dd 75 90 13 18 7a 6b 5f 9e 7a 66 8a 14 7b 9d c6 92 7b 7c 20 01 78 87 6c 87 78 8a b9 0d 79 71 f5 8b 79 48 74 2a 7e b3 38 ac 7e be ed 26 7f 45 a1 a0 7f a4 47 33 7c 5f 0b b5 7c 52 de 3f 7d a9 92 b9 7d }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

47f8fc60-4138-4802-94e1-280140701841

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion