libavcodec_ff_wma_lsp_codebookflt32_32_lil_544_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libavcodec_ff_wma_lsp_codebook__flt32___32_lil_544_ (No description metadata provided).

rule libavcodec_ff_wma_lsp_codebook__flt32___32_lil_544_ {
  strings:
    $a0 = { ca 60 fe 3f 77 5e fd 3f a5 63 fc 3f a8 36 fb 3f 2d a6 f9 3f 61 78 f7 3f e1 1e f4 3f 34 53 ee 3f 28 7e fc 3f 88 fc fa 3f e5 93 f9 3f 67 12 f8 3f d8 6b f6 3f 39 7e f4 3f a6 37 f2 3f 40 8d ef 3f 33 3e ec 3f 69 23 e8 3f 8b 5a e3 3f 90 c7 dd 3f 0c ec d6 3f 12 07 ce 3f dc 0f c1 3f df 64 aa 3f f4 56 f3 3f 90 b2 ee 3f f5 c6 ea 3f 99 9d e6 3f b6 1c e2 3f 74 34 dd 3f f7 ae d7 3f c0 95 d1 3f cc e1 ca 3f 3f 4c c2 3f 08 e9 b7 3f ed 74 ab 3f 0f f2 9e 3f 98 b1 8f 3f dd ad 77 3f 45 90 3d 3f f7 7c e2 3f 11 d0 d6 3f 3a bb cc 3f bb 8e c4 3f 3b c3 bc 3f bf bf b4 3f 16 2c ac 3f 9c fe a2 3f 79 b5 98 3f da 7f 8c 3f d6 f9 7c 3f 3e 55 5f 3f 95 62 3e 3f ad 01 19 3f fd 05 dd 3e af 15 38 3e 9a 96 b7 3f 54 02 a9 3f 8e f9 9a 3f 32 8a 8d 3f 13 b8 80 3f 8d 42 67 3f 83 eb 4d 3f 4a 04 35 3f b3 b1 1a 3f 45 0c ff 3e 39 2b c5 3e 6d c9 8a 3e 2d 88 13 3e c7 1e 10 3b f4 43 2b be de 1c bd be a3 bb 7f 3f 8e 85 57 3f 2c 21 35 3f ab 3d 14 3f ab ec f0 3e 57 45 bd 3e 39 5a 89 3e c5 c0 2f 3e bc a0 93 3d 6c ea fa bc 74 3f b3 bf 0a a9 80 be 0d 89 be be ef c0 02 bf ae 1c 26 bf ac 96 4d bf 1c c2 87 3e 31 4d 81 3d 40 b3 b5 bd af 19 58 be a6 13 9f be cb 29 cb be c0 c8 f1 be f9 aa 0a bf 6d 4c 1d bf b6 7e 30 bf 9b 0b 44 bf 11 09 5a bf a4 f0 73 bf bd 56 88 bf f3 40 9a bf 95 26 b0 bf 51 16 0a bf 84 da 3c bf 20 5e 62 bf 53 6e 81 bf 56 23 91 bf ae 57 a2 bf 51 d0 b5 bf 46 67 cf bf d7 00 8d bf d6 22 95 bf 1c df 9d bf 31 ee a6 bf 84 35 b0 bf 11 f9 bb bf d2 c2 c9 bf b5 9f d5 bf 69 a4 c5 be 4a 62 0f bf 05 77 2b bf 05 a2 42 bf 5b a5 56 bf 4f 9f 68 bf e2 5d 79 bf c4 ba 84 bf 97 dd c7 bf 8a 68 d4 bf f5 0a dd bf 6d a8 e3 bf 48 38 e9 bf 98 5c ee bf 41 90 f3 bf c6 5e f9 bf }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6a7bf717-22ea-4a07-a09d-0c97e586ecdf

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion