libaf_front_opposite_side___30_degree_flt64_64_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libaf_front_opposite_side___30_degree___flt64___64_big_1024_ (No description metadata provided).

rule libaf_front_opposite_side___30_degree___flt64___64_big_1024_ {
  strings:
    $a0 = { be ec 41 03 93 23 80 72 bf 15 18 f6 80 98 ad 7b 3f 07 07 d1 5c 05 f0 82 be f2 cd 81 18 79 d8 82 bf 02 3b 5e 3e 30 b0 87 bf 19 1a 7e 95 ee 65 06 3f 24 6b 19 fb 7a b2 9f bf 28 91 11 a3 58 62 ee 3f 31 60 0c ff 75 71 ce bf 23 04 e2 0b 2f 20 5b bf 15 a9 5c a3 d7 06 d3 3f 45 41 0e b0 d5 a2 44 bf 51 6b 22 ca 4f a0 22 3f 65 c4 8d 12 16 4a 45 3f 57 3b 2d a5 00 b2 ce 3f 79 87 68 52 ff 10 4f bf 80 c8 18 1a f0 90 48 bf 7a e7 13 f8 a5 54 53 3f 83 89 0e a8 04 d9 a2 3f 89 35 8f fe 32 18 c1 3f bf 94 f0 69 ec 96 a0 3f a7 a2 d9 1a 7d 5d c8 bf ba 2f 7c 2b 05 c3 29 3f a4 b9 62 78 27 05 0d bf 68 4c 0d f7 93 b9 31 bf b2 11 7f 62 45 09 9d 3f b4 eb ad 5b cc dd 84 3f b6 5d 8b ed 23 29 98 3f aa 23 8d c8 cf 2e 92 3f bd c3 fd 05 85 0b fd 3f ca 84 d6 73 8a 7b 17 3f b8 00 08 c2 8e 46 d1 bf b9 0c 49 96 a5 e6 db bf 85 7d a7 5f 2b c5 a2 3f ab 34 1a 88 d1 c9 ea bf ba 00 c8 50 b1 9d e3 bf c4 d1 65 f1 53 67 44 bf ab a8 fe 67 71 af 72 bf 9c 19 53 72 07 9a 47 bf b9 3e 07 f9 69 42 25 bf b1 83 e4 48 f2 e1 e0 bf 72 29 fd 00 51 c4 fc bf 41 1d 16 0c c1 ae 40 bf 79 86 99 e3 41 97 3d 3f 8d 83 32 da e2 bc 46 3f a9 03 b7 f1 89 b3 76 3f a6 55 4f c3 9b b8 db 3f a1 67 6a f5 bb e7 12 3f a9 66 94 2d f2 43 9b 3f a4 d3 20 01 09 e3 d1 3f 80 14 00 12 c7 b0 7e 3f 72 b2 29 a8 7a 75 84 3f 97 1c df 82 87 9e da 3f 80 c2 a9 f5 88 dc ec bf 8e 8a f5 50 63 64 c6 bf 93 22 68 1a 56 79 07 bf 91 e0 58 89 23 c6 a4 bf 97 d4 8e 15 98 ef 0f bf a3 0f df d2 60 42 47 bf a6 e8 14 d3 2e 1c 83 bf a5 d6 61 77 25 e4 65 bf a3 19 02 34 c2 aa f5 bf 9d bc 85 89 55 8b 2a bf 93 4d a4 c7 72 0a 06 bf 88 b8 d3 71 73 3d b9 bf 7b c5 22 e6 23 91 84 bf 5f a0 c1 6f 8a 4c c1 3e fe e2 a7 2f f5 04 50 3f 56 a5 af a8 3e d3 1d 3f 58 3f 34 54 f4 91 70 3f 2b 1b ba cb ad 7f 59 3f 62 3b 10 61 70 71 a3 3f 75 11 b9 e9 1e dc 32 3f 5e 71 3e 83 28 b3 13 bf 5f d3 df d7 67 c4 46 bf 57 b2 a8 b2 13 1b 0f bf 6c 34 83 09 41 0c c3 bf 83 d9 cc 03 95 c2 f8 bf 88 3f 96 a2 eb e0 c5 bf 85 f2 89 78 81 c2 59 bf 8a 80 3a 81 d1 35 72 bf 88 f4 43 12 7e 93 a4 bf 79 63 9a 10 65 81 93 bf 62 fe 9b b7 b8 ee 67 bf 65 f4 19 97 9b 56 48 bf 69 47 da 9c 85 c4 f3 bf 59 bd 17 f6 78 2b 1c bf 4a b2 9c 41 5b 35 2a bf 54 4a 77 b1 6a 9a ff bf 41 14 e0 d4 ae a0 e5 3f 5d 03 18 ca 3e 9d 35 3f 55 b5 2b ad fd 24 4c bf 5b e4 3c e7 f9 bd ad bf 72 7a 03 8f 21 59 0e bf 76 35 8a d0 83 60 19 bf 70 2c c1 77 13 f7 8e bf 75 b1 41 08 c5 59 04 bf 79 ca f3 b1 5f 48 df bf 73 31 58 a8 c6 2c 43 bf 73 b1 36 0b 24 4b de bf 78 7d 4b 28 be 4e b7 bf 78 49 01 a1 e6 39 13 bf 71 27 20 1c 9d 2d b0 bf 6a 54 3f 0e 4c b0 21 bf 66 fe 6e d8 cd d8 82 bf 51 d7 79 0d bc 65 d9 3f 35 79 6a 0d 29 88 ab bf 55 52 e3 bd 68 24 36 bf 6a 47 c4 f1 fe fe 1c bf 64 93 10 6d 28 ed 6c bf 56 96 eb 3b 3a 57 8a bf 5d f2 ce 0f b7 9b c1 bf 65 38 a3 51 f2 e5 48 bf 60 f7 aa d0 d5 9d 38 bf 65 a5 8f 21 09 ec f4 bf 70 51 37 2e 1f 36 a3 bf 71 0d ce 37 4e 9a 0f bf 71 d6 c8 67 3e 26 e0 bf 71 d1 b8 5a db ca d1 bf 6e 0f 24 23 ad ac 5a bf 6b bd c3 47 30 d1 e4 bf 70 45 8a 47 44 fe cb bf 71 be c8 d0 b0 c6 c1 bf 65 b2 de 71 d4 b3 80 bf 56 ae a3 01 33 d9 07 bf 52 9a 20 35 a6 a2 d8 bf 56 7d 36 79 db 25 93 bf 60 72 0e c2 f2 c9 5b }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c6f8b87e-002a-4c34-9d24-4e19716460ad

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion