CRC32_poly_0x3b6e20c8__32_lil_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x3b6e20c8__32_lil_refl_True_ (No description metadata provided).

rule CRC32_poly_0x3b6e20c8__32_lil_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 5e 91 31 1d 05 cf 6b 1c 5b 5e 5a 01 b3 73 df 1e ed e2 ee 03 b6 bc b4 02 e8 2d 85 1f df 0a b6 1b 81 9b 87 06 da c5 dd 07 84 54 ec 1a 6c 79 69 05 32 e8 58 18 69 b6 02 19 37 27 33 04 07 f8 64 11 59 69 55 0c 02 37 0f 0d 5c a6 3e 10 b4 8b bb 0f ea 1a 8a 12 b1 44 d0 13 ef d5 e1 0e d8 f2 d2 0a 86 63 e3 17 dd 3d b9 16 83 ac 88 0b 6b 81 0d 14 35 10 3c 09 6e 4e 66 08 30 df 57 15 b7 1d c1 04 e9 8c f0 19 b2 d2 aa 18 ec 43 9b 05 04 6e 1e 1a 5a ff 2f 07 01 a1 75 06 5f 30 44 1b 68 17 77 1f 36 86 46 02 6d d8 1c 03 33 49 2d 1e db 64 a8 01 85 f5 99 1c de ab c3 1d 80 3a f2 00 b0 e5 a5 15 ee 74 94 08 b5 2a ce 09 eb bb ff 14 03 96 7a 0b 5d 07 4b 16 06 59 11 17 58 c8 20 0a 6f ef 13 0e 31 7e 22 13 6a 20 78 12 34 b1 49 0f dc 9c cc 10 82 0d fd 0d d9 53 a7 0c 87 c2 96 11 6e 3b 82 09 30 aa b3 14 6b f4 e9 15 35 65 d8 08 dd 48 5d 17 83 d9 6c 0a d8 87 36 0b 86 16 07 16 b1 31 34 12 ef a0 05 0f b4 fe 5f 0e ea 6f 6e 13 02 42 eb 0c 5c d3 da 11 07 8d 80 10 59 1c b1 0d 69 c3 e6 18 37 52 d7 05 6c 0c 8d 04 32 9d bc 19 da b0 39 06 84 21 08 1b df 7f 52 1a 81 ee 63 07 b6 c9 50 03 e8 58 61 1e b3 06 3b 1f ed 97 0a 02 05 ba 8f 1d 5b 2b be 00 00 75 e4 01 5e e4 d5 1c d9 26 43 0d 87 b7 72 10 dc e9 28 11 82 78 19 0c 6a 55 9c 13 34 c4 ad 0e 6f 9a f7 0f 31 0b c6 12 06 2c f5 16 58 bd c4 0b 03 e3 9e 0a 5d 72 af 17 b5 5f 2a 08 eb ce 1b 15 b0 90 41 14 ee 01 70 09 de de 27 1c 80 4f 16 01 db 11 4c 00 85 80 7d 1d 6d ad f8 02 33 3c c9 1f 68 62 93 1e 36 f3 a2 03 01 d4 91 07 5f 45 a0 1a 04 1b fa 1b 5a 8a cb 06 b2 a7 4e 19 ec 36 7f 04 b7 68 25 05 e9 f9 14 18 dc 76 04 13 82 e7 35 0e d9 b9 6f 0f 87 28 5e 12 6f 05 db 0d 31 94 ea 10 6a ca b0 11 34 5b 81 0c 03 7c b2 08 5d ed 83 15 06 b3 d9 14 58 22 e8 09 b0 0f 6d 16 ee 9e 5c 0b b5 c0 06 0a eb 51 37 17 db 8e 60 02 85 1f 51 1f de 41 0b 1e 80 d0 3a 03 68 fd bf 1c 36 6c 8e 01 6d 32 d4 00 33 a3 e5 1d 04 84 d6 19 5a 15 e7 04 01 4b bd 05 5f da 8c 18 b7 f7 09 07 e9 66 38 1a b2 38 62 1b ec a9 53 06 6b 6b c5 17 35 fa f4 0a 6e a4 ae 0b 30 35 9f 16 d8 18 1a 09 86 89 2b 14 dd d7 71 15 83 46 40 08 b4 61 73 0c ea f0 42 11 b1 ae 18 10 ef 3f 29 0d 07 12 ac 12 59 83 9d 0f 02 dd c7 0e 5c 4c f6 13 6c 93 a1 06 32 02 90 1b 69 5c ca 1a 37 cd fb 07 df e0 7e 18 81 71 4f 05 da 2f 15 04 84 be 24 19 b3 99 17 1d ed 08 26 00 b6 56 7c 01 e8 c7 4d 1c 00 ea c8 03 5e 7b f9 1e 05 25 a3 1f 5b b4 92 02 b2 4d 86 1a ec dc b7 07 b7 82 ed 06 e9 13 dc 1b 01 3e 59 04 5f af 68 19 04 f1 32 18 5a 60 03 05 6d 47 30 01 33 d6 01 1c 68 88 5b 1d 36 19 6a 00 de 34 ef 1f 80 a5 de 02 db fb 84 03 85 6a b5 1e b5 b5 e2 0b eb 24 d3 16 b0 7a 89 17 ee eb b8 0a 06 c6 3d 15 58 57 0c 08 03 09 56 09 5d 98 67 14 6a bf 54 10 34 2e 65 0d 6f 70 3f 0c 31 e1 0e 11 d9 cc 8b 0e 87 5d ba 13 dc 03 e0 12 82 92 d1 0f 05 50 47 1e 5b c1 76 03 00 9f 2c 02 5e 0e 1d 1f b6 23 98 00 e8 b2 a9 1d b3 ec f3 1c ed 7d c2 01 da 5a f1 05 84 cb c0 18 df 95 9a 19 81 04 ab 04 69 29 2e 1b 37 b8 1f 06 6c e6 45 07 32 77 74 1a 02 a8 23 0f 5c 39 12 12 07 67 48 13 59 f6 79 0e b1 db fc 11 ef 4a cd 0c b4 14 97 0d ea 85 a6 10 dd a2 95 14 83 33 a4 09 d8 6d fe 08 86 fc cf 15 6e d1 4a 0a 30 40 7b 17 6b 1e 21 16 35 8f 10 0b }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c4766532-1578-43bf-8954-09fb0d5a5923

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion