CRC32_poly_0x86d3d2d4__32_big_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x86d3d2d4__32_big_refl_True_ (No description metadata provided).

rule CRC32_poly_0x86d3d2d4__32_big_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 0c ae d1 e2 19 5d a3 c4 15 f3 72 26 32 bb 47 88 3e 15 96 6a 2b e6 e4 4c 27 48 35 ae 33 e1 19 d3 3f 4f c8 31 2a bc ba 17 26 12 6b f5 01 5a 5e 5b 0d f4 8f b9 18 07 fd 9f 14 a9 2c 7d 31 55 a5 65 3d fb 74 87 28 08 06 a1 24 a6 d7 43 03 ee e2 ed 0f 40 33 0f 1a b3 41 29 16 1d 90 cb 02 b4 bc b6 0e 1a 6d 54 1b e9 1f 72 17 47 ce 90 30 0f fb 3e 3c a1 2a dc 29 52 58 fa 25 fc 89 18 34 3c dc 09 38 92 0d eb 2d 61 7f cd 21 cf ae 2f 06 87 9b 81 0a 29 4a 63 1f da 38 45 13 74 e9 a7 07 dd c5 da 0b 73 14 38 1e 80 66 1e 12 2e b7 fc 35 66 82 52 39 c8 53 b0 2c 3b 21 96 20 95 f0 74 05 69 79 6c 09 c7 a8 8e 1c 34 da a8 10 9a 0b 4a 37 d2 3e e4 3b 7c ef 06 2e 8f 9d 20 22 21 4c c2 36 88 60 bf 3a 26 b1 5d 2f d5 c3 7b 23 7b 12 99 04 33 27 37 08 9d f6 d5 1d 6e 84 f3 11 c0 55 11 3e ee 2e d1 32 40 ff 33 27 b3 8d 15 2b 1d 5c f7 0c 55 69 59 00 fb b8 bb 15 08 ca 9d 19 a6 1b 7f 0d 0f 37 02 01 a1 e6 e0 14 52 94 c6 18 fc 45 24 3f b4 70 8a 33 1a a1 68 26 e9 d3 4e 2a 47 02 ac 0f bb 8b b4 03 15 5a 56 16 e6 28 70 1a 48 f9 92 3d 00 cc 3c 31 ae 1d de 24 5d 6f f8 28 f3 be 1a 3c 5a 92 67 30 f4 43 85 25 07 31 a3 29 a9 e0 41 0e e1 d5 ef 02 4f 04 0d 17 bc 76 2b 1b 12 a7 c9 0a d2 f2 d8 06 7c 23 3a 13 8f 51 1c 1f 21 80 fe 38 69 b5 50 34 c7 64 b2 21 34 16 94 2d 9a c7 76 39 33 eb 0b 35 9d 3a e9 20 6e 48 cf 2c c0 99 2d 0b 88 ac 83 07 26 7d 61 12 d5 0f 47 1e 7b de a5 3b 87 57 bd 37 29 86 5f 22 da f4 79 2e 74 25 9b 09 3c 10 35 05 92 c1 d7 10 61 b3 f1 1c cf 62 13 08 66 4e 6e 04 c8 9f 8c 11 3b ed aa 1d 95 3c 48 3a dd 09 e6 36 73 d8 04 23 80 aa 22 2f 2e 7b c0 2b 4b cb 61 27 e5 1a 83 32 16 68 a5 3e b8 b9 47 19 f0 8c e9 15 5e 5d 0b 00 ad 2f 2d 0c 03 fe cf 18 aa d2 b2 14 04 03 50 01 f7 71 76 0d 59 a0 94 2a 11 95 3a 26 bf 44 d8 33 4c 36 fe 3f e2 e7 1c 1a 1e 6e 04 16 b0 bf e6 03 43 cd c0 0f ed 1c 22 28 a5 29 8c 24 0b f8 6e 31 f8 8a 48 3d 56 5b aa 29 ff 77 d7 25 51 a6 35 30 a2 d4 13 3c 0c 05 f1 1b 44 30 5f 17 ea e1 bd 02 19 93 9b 0e b7 42 79 1f 77 17 68 13 d9 c6 8a 06 2a b4 ac 0a 84 65 4e 2d cc 50 e0 21 62 81 02 34 91 f3 24 38 3f 22 c6 2c 96 0e bb 20 38 df 59 35 cb ad 7f 39 65 7c 9d 1e 2d 49 33 12 83 98 d1 07 70 ea f7 0b de 3b 15 2e 22 b2 0d 22 8c 63 ef 37 7f 11 c9 3b d1 c0 2b 1c 99 f5 85 10 37 24 67 05 c4 56 41 09 6a 87 a3 1d c3 ab de 11 6d 7a 3c 04 9e 08 1a 08 30 d9 f8 2f 78 ec 56 23 d6 3d b4 36 25 4f 92 3a 8b 9e 70 15 a5 e5 b0 19 0b 34 52 0c f8 46 74 00 56 97 96 27 1e a2 38 2b b0 73 da 3e 43 01 fc 32 ed d0 1e 26 44 fc 63 2a ea 2d 81 3f 19 5f a7 33 b7 8e 45 14 ff bb eb 18 51 6a 09 0d a2 18 2f 01 0c c9 cd 24 f0 40 d5 28 5e 91 37 3d ad e3 11 31 03 32 f3 16 4b 07 5d 1a e5 d6 bf 0f 16 a4 99 03 b8 75 7b 17 11 59 06 1b bf 88 e4 0e 4c fa c2 02 e2 2b 20 25 aa 1e 8e 29 04 cf 6c 3c f7 bd 4a 30 59 6c a8 21 99 39 b9 2d 37 e8 5b 38 c4 9a 7d 34 6a 4b 9f 13 22 7e 31 1f 8c af d3 0a 7f dd f5 06 d1 0c 17 12 78 20 6a 1e d6 f1 88 0b 25 83 ae 07 8b 52 4c 20 c3 67 e2 2c 6d b6 00 39 9e c4 26 35 30 15 c4 10 cc 9c dc 1c 62 4d 3e 09 91 3f 18 05 3f ee fa 22 77 db 54 2e d9 0a b6 3b 2a 78 90 37 84 a9 72 23 2d 85 0f 2f 83 54 ed 3a 70 26 cb 36 de f7 29 11 96 c2 87 1d 38 13 65 08 cb 61 43 04 65 b0 a1 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

dfe5c8f1-3f55-4237-b576-3dc12ed7308d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion