libfaad2_Phi_Fract_Qmfflt64_64_lil_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libfaad2_Phi_Fract_Qmf__flt64___64_lil_1024_ (No description metadata provided).

rule libfaad2_Phi_Fract_Qmf__flt64___64_lil_1024_ {
  strings:
    $a0 = { 34 e7 04 60 48 2e ea 3f da ac 01 60 71 66 e2 3f 9f 90 06 c0 4b e3 d0 bf 06 db 01 80 a7 dd ee 3f 1c 2e 03 20 bf e6 ef bf 8e 60 d9 3f e5 15 b4 3f 8f c8 f6 5f 40 56 da bf 62 06 03 40 37 2a ed bf 14 67 00 00 e4 fa e6 3f 7d 16 03 e0 ea 44 e6 bf fa c9 05 60 a4 bc ec 3f 74 a5 06 a0 f6 27 dc 3f 5e 25 00 40 8c 17 bc bf 3d e9 ff 3f 87 ce ef 3f 06 db 01 80 a7 1d ef bf 16 dc 17 a0 89 e1 cd 3f 49 25 04 40 98 91 e1 bf 5b 6f 05 20 ef be ea bf f2 b6 01 80 a4 36 e3 3f d8 c1 f9 3f 04 97 e9 bf 00 b4 fe 3f db 95 ee 3f 92 f6 fe 7f 8e d1 d2 3f 41 40 1e 40 56 1e a8 3f 9b 3a 01 e0 e7 f6 ef 3f 6d 7a ff bf 6b 90 ed bf e3 86 f4 9f e2 7d d8 3f 30 61 fa 7f 51 89 e5 bf d0 57 01 e0 0e ab e7 bf 8c f7 03 e0 8f f2 dd 3f 91 7d 03 e0 ce 47 ec bf 64 a6 02 20 46 ae ef 3f 0d 97 f1 3f 0d 09 c2 3f f7 de 08 20 ef f4 c9 3f 02 97 fe 1f cb 55 ef 3f 46 16 03 00 d4 48 eb bf 72 c2 fb df 4e b8 e0 3f d3 47 fb 3f 49 f9 e8 bf 8b c7 fe df fc 01 e4 bf 94 f5 fa 1f 10 bb d4 3f 07 ae fc bf 54 46 ee bf af 04 02 40 fd fe ef 3f 80 49 51 3f 94 15 90 bf 60 af f9 ff 54 9f d6 3f 92 ae 01 60 28 ef ed 3f 72 29 00 e0 3e 55 e8 bf f8 77 f9 3f 47 c8 e4 3f 97 04 fc 5f d4 cb eb bf 11 46 fd 3f 98 b5 df bf b4 0a f7 df c5 01 c6 3f 7f c0 fc ff 03 86 ef bf 7f c0 fc ff 03 86 ef 3f b4 0a f7 df c5 01 c6 bf 11 46 fd 3f 98 b5 df 3f 97 04 fc 5f d4 cb eb 3f f8 77 f9 3f 47 c8 e4 bf 72 29 00 e0 3e 55 e8 3f 92 ae 01 60 28 ef ed bf 60 af f9 ff 54 9f d6 bf 80 49 51 3f 94 15 90 3f af 04 02 40 fd fe ef bf 07 ae fc bf 54 46 ee 3f 94 f5 fa 1f 10 bb d4 bf 8b c7 fe df fc 01 e4 3f d3 47 fb 3f 49 f9 e8 3f 72 c2 fb df 4e b8 e0 bf 46 16 03 00 d4 48 eb 3f 02 97 fe 1f cb 55 ef bf f7 de 08 20 ef f4 c9 bf 0d 97 f1 3f 0d 09 c2 bf 64 a6 02 20 46 ae ef bf 91 7d 03 e0 ce 47 ec 3f 8c f7 03 e0 8f f2 dd bf d0 57 01 e0 0e ab e7 3f 30 61 fa 7f 51 89 e5 3f e3 86 f4 9f e2 7d d8 bf 6d 7a ff bf 6b 90 ed 3f 9b 3a 01 e0 e7 f6 ef bf 41 40 1e 40 56 1e a8 bf 92 f6 fe 7f 8e d1 d2 bf 00 b4 fe 3f db 95 ee bf d8 c1 f9 3f 04 97 e9 3f f2 b6 01 80 a4 36 e3 bf 5b 6f 05 20 ef be ea 3f 49 25 04 40 98 91 e1 3f 16 dc 17 a0 89 e1 cd bf 06 db 01 80 a7 1d ef 3f 3d e9 ff 3f 87 ce ef bf 5e 25 00 40 8c 17 bc 3f 74 a5 06 a0 f6 27 dc bf fa c9 05 60 a4 bc ec bf 7d 16 03 e0 ea 44 e6 3f 14 67 00 00 e4 fa e6 bf 62 06 03 40 37 2a ed 3f 8f c8 f6 5f 40 56 da 3f 8e 60 d9 3f e5 15 b4 bf 1c 2e 03 20 bf e6 ef 3f 06 db 01 80 a7 dd ee bf 9f 90 06 c0 4b e3 d0 3f da ac 01 60 71 66 e2 bf 34 e7 04 60 48 2e ea bf da ac 01 60 71 66 e2 3f 34 e7 04 60 48 2e ea bf 06 db 01 80 a7 dd ee 3f 9f 90 06 c0 4b e3 d0 3f 8e 60 d9 3f e5 15 b4 3f 1c 2e 03 20 bf e6 ef 3f 62 06 03 40 37 2a ed bf 8f c8 f6 5f 40 56 da 3f 7d 16 03 e0 ea 44 e6 bf 14 67 00 00 e4 fa e6 bf 74 a5 06 a0 f6 27 dc 3f fa c9 05 60 a4 bc ec bf 3d e9 ff 3f 87 ce ef 3f 5e 25 00 40 8c 17 bc 3f 16 dc 17 a0 89 e1 cd 3f 06 db 01 80 a7 1d ef 3f 5b 6f 05 20 ef be ea bf 49 25 04 40 98 91 e1 3f d8 c1 f9 3f 04 97 e9 bf f2 b6 01 80 a4 36 e3 bf 92 f6 fe 7f 8e d1 d2 3f 00 b4 fe 3f db 95 ee bf 9b 3a 01 e0 e7 f6 ef 3f 41 40 1e 40 56 1e a8 bf e3 86 f4 9f e2 7d d8 3f 6d 7a ff bf 6b 90 ed 3f d0 57 01 e0 0e ab e7 bf 30 61 fa 7f 51 89 e5 3f }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ff9ab54c-2b36-435e-91df-4aac51549791

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion