CRC_12_poly_0xf01__16_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_12_poly_0xf01__16_lil_refl_False_ (No description metadata provided).

rule CRC_12_poly_0xf01__16_lil_refl_False_ {
  strings:
    $a0 = { 00 00 01 0f 02 1e 03 11 04 3c 05 33 06 22 07 2d 08 78 09 77 0a 66 0b 69 0c 44 0d 4b 0e 5a 0f 55 10 f0 11 ff 12 ee 13 e1 14 cc 15 c3 16 d2 17 dd 18 88 19 87 1a 96 1b 99 1c b4 1d bb 1e aa 1f a5 21 ef 20 e0 23 f1 22 fe 25 d3 24 dc 27 cd 26 c2 29 97 28 98 2b 89 2a 86 2d ab 2c a4 2f b5 2e ba 31 1f 30 10 33 01 32 0e 35 23 34 2c 37 3d 36 32 39 67 38 68 3b 79 3a 76 3d 5b 3c 54 3f 45 3e 4a 43 d1 42 de 41 cf 40 c0 47 ed 46 e2 45 f3 44 fc 4b a9 4a a6 49 b7 48 b8 4f 95 4e 9a 4d 8b 4c 84 53 21 52 2e 51 3f 50 30 57 1d 56 12 55 03 54 0c 5b 59 5a 56 59 47 58 48 5f 65 5e 6a 5d 7b 5c 74 62 3e 63 31 60 20 61 2f 66 02 67 0d 64 1c 65 13 6a 46 6b 49 68 58 69 57 6e 7a 6f 75 6c 64 6d 6b 72 ce 73 c1 70 d0 71 df 76 f2 77 fd 74 ec 75 e3 7a b6 7b b9 78 a8 79 a7 7e 8a 7f 85 7c 94 7d 9b 87 ad 86 a2 85 b3 84 bc 83 91 82 9e 81 8f 80 80 8f d5 8e da 8d cb 8c c4 8b e9 8a e6 89 f7 88 f8 97 5d 96 52 95 43 94 4c 93 61 92 6e 91 7f 90 70 9f 25 9e 2a 9d 3b 9c 34 9b 19 9a 16 99 07 98 08 a6 42 a7 4d a4 5c a5 53 a2 7e a3 71 a0 60 a1 6f ae 3a af 35 ac 24 ad 2b aa 06 ab 09 a8 18 a9 17 b6 b2 b7 bd b4 ac b5 a3 b2 8e b3 81 b0 90 b1 9f be ca bf c5 bc d4 bd db ba f6 bb f9 b8 e8 b9 e7 c4 7c c5 73 c6 62 c7 6d c0 40 c1 4f c2 5e c3 51 cc 04 cd 0b ce 1a cf 15 c8 38 c9 37 ca 26 cb 29 d4 8c d5 83 d6 92 d7 9d d0 b0 d1 bf d2 ae d3 a1 dc f4 dd fb de ea df e5 d8 c8 d9 c7 da d6 db d9 e5 93 e4 9c e7 8d e6 82 e1 af e0 a0 e3 b1 e2 be ed eb ec e4 ef f5 ee fa e9 d7 e8 d8 eb c9 ea c6 f5 63 f4 6c f7 7d f6 72 f1 5f f0 50 f3 41 f2 4e fd 1b fc 14 ff 05 fe 0a f9 27 f8 28 fb 39 fa 36 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5f9c7c65-e16c-45dc-943e-15f9942dafe4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion