libfaad2_Phi_Fract_Qmfflt64_64_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libfaad2_Phi_Fract_Qmf__flt64___64_big_1024_ (No description metadata provided).

rule libfaad2_Phi_Fract_Qmf__flt64___64_big_1024_ {
  strings:
    $a0 = { 3f ea 2e 48 60 04 e7 34 3f e2 66 71 60 01 ac da bf d0 e3 4b c0 06 90 9f 3f ee dd a7 80 01 db 06 bf ef e6 bf 20 03 2e 1c 3f b4 15 e5 3f d9 60 8e bf da 56 40 5f f6 c8 8f bf ed 2a 37 40 03 06 62 3f e6 fa e4 00 00 67 14 bf e6 44 ea e0 03 16 7d 3f ec bc a4 60 05 c9 fa 3f dc 27 f6 a0 06 a5 74 bf bc 17 8c 40 00 25 5e 3f ef ce 87 3f ff e9 3d bf ef 1d a7 80 01 db 06 3f cd e1 89 a0 17 dc 16 bf e1 91 98 40 04 25 49 bf ea be ef 20 05 6f 5b 3f e3 36 a4 80 01 b6 f2 bf e9 97 04 3f f9 c1 d8 3f ee 95 db 3f fe b4 00 3f d2 d1 8e 7f fe f6 92 3f a8 1e 56 40 1e 40 41 3f ef f6 e7 e0 01 3a 9b bf ed 90 6b bf ff 7a 6d 3f d8 7d e2 9f f4 86 e3 bf e5 89 51 7f fa 61 30 bf e7 ab 0e e0 01 57 d0 3f dd f2 8f e0 03 f7 8c bf ec 47 ce e0 03 7d 91 3f ef ae 46 20 02 a6 64 3f c2 09 0d 3f f1 97 0d 3f c9 f4 ef 20 08 de f7 3f ef 55 cb 1f fe 97 02 bf eb 48 d4 00 03 16 46 3f e0 b8 4e df fb c2 72 bf e8 f9 49 3f fb 47 d3 bf e4 01 fc df fe c7 8b 3f d4 bb 10 1f fa f5 94 bf ee 46 54 bf fc ae 07 3f ef fe fd 40 02 04 af bf 90 15 94 3f 51 49 80 3f d6 9f 54 ff f9 af 60 3f ed ef 28 60 01 ae 92 bf e8 55 3e e0 00 29 72 3f e4 c8 47 3f f9 77 f8 bf eb cb d4 5f fc 04 97 bf df b5 98 3f fd 46 11 3f c6 01 c5 df f7 0a b4 bf ef 86 03 ff fc c0 7f 3f ef 86 03 ff fc c0 7f bf c6 01 c5 df f7 0a b4 3f df b5 98 3f fd 46 11 3f eb cb d4 5f fc 04 97 bf e4 c8 47 3f f9 77 f8 3f e8 55 3e e0 00 29 72 bf ed ef 28 60 01 ae 92 bf d6 9f 54 ff f9 af 60 3f 90 15 94 3f 51 49 80 bf ef fe fd 40 02 04 af 3f ee 46 54 bf fc ae 07 bf d4 bb 10 1f fa f5 94 3f e4 01 fc df fe c7 8b 3f e8 f9 49 3f fb 47 d3 bf e0 b8 4e df fb c2 72 3f eb 48 d4 00 03 16 46 bf ef 55 cb 1f fe 97 02 bf c9 f4 ef 20 08 de f7 bf c2 09 0d 3f f1 97 0d bf ef ae 46 20 02 a6 64 3f ec 47 ce e0 03 7d 91 bf dd f2 8f e0 03 f7 8c 3f e7 ab 0e e0 01 57 d0 3f e5 89 51 7f fa 61 30 bf d8 7d e2 9f f4 86 e3 3f ed 90 6b bf ff 7a 6d bf ef f6 e7 e0 01 3a 9b bf a8 1e 56 40 1e 40 41 bf d2 d1 8e 7f fe f6 92 bf ee 95 db 3f fe b4 00 3f e9 97 04 3f f9 c1 d8 bf e3 36 a4 80 01 b6 f2 3f ea be ef 20 05 6f 5b 3f e1 91 98 40 04 25 49 bf cd e1 89 a0 17 dc 16 3f ef 1d a7 80 01 db 06 bf ef ce 87 3f ff e9 3d 3f bc 17 8c 40 00 25 5e bf dc 27 f6 a0 06 a5 74 bf ec bc a4 60 05 c9 fa 3f e6 44 ea e0 03 16 7d bf e6 fa e4 00 00 67 14 3f ed 2a 37 40 03 06 62 3f da 56 40 5f f6 c8 8f bf b4 15 e5 3f d9 60 8e 3f ef e6 bf 20 03 2e 1c bf ee dd a7 80 01 db 06 3f d0 e3 4b c0 06 90 9f bf e2 66 71 60 01 ac da bf ea 2e 48 60 04 e7 34 3f e2 66 71 60 01 ac da bf ea 2e 48 60 04 e7 34 3f ee dd a7 80 01 db 06 3f d0 e3 4b c0 06 90 9f 3f b4 15 e5 3f d9 60 8e 3f ef e6 bf 20 03 2e 1c bf ed 2a 37 40 03 06 62 3f da 56 40 5f f6 c8 8f bf e6 44 ea e0 03 16 7d bf e6 fa e4 00 00 67 14 3f dc 27 f6 a0 06 a5 74 bf ec bc a4 60 05 c9 fa 3f ef ce 87 3f ff e9 3d 3f bc 17 8c 40 00 25 5e 3f cd e1 89 a0 17 dc 16 3f ef 1d a7 80 01 db 06 bf ea be ef 20 05 6f 5b 3f e1 91 98 40 04 25 49 bf e9 97 04 3f f9 c1 d8 bf e3 36 a4 80 01 b6 f2 3f d2 d1 8e 7f fe f6 92 bf ee 95 db 3f fe b4 00 3f ef f6 e7 e0 01 3a 9b bf a8 1e 56 40 1e 40 41 3f d8 7d e2 9f f4 86 e3 3f ed 90 6b bf ff 7a 6d bf e7 ab 0e e0 01 57 d0 3f e5 89 51 7f fa 61 30 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

da907b60-cc06-44f0-beaa-c29302bdfe0c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion