CRC_32CCastagnolipoly_0x05EC76F1__32_big_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_32C__Castagnoli__poly_0x05EC76F1__32_big_refl_True_ (No description metadata provided).

rule CRC_32C__Castagnoli__poly_0x05EC76F1__32_big_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 46 a9 c7 bf 8d 53 8f 7e cb fa 48 c1 04 7b 71 bd 42 d2 b6 02 89 28 fe c3 cf 81 39 7c 08 f6 e3 7a 4e 5f 24 c5 85 a5 6c 04 c3 0c ab bb 0c 8d 92 c7 4a 24 55 78 81 de 1d b9 c7 77 da 06 11 ed c6 f4 57 44 01 4b 9c be 49 8a da 17 8e 35 15 96 b7 49 53 3f 70 f6 98 c5 38 37 de 6c ff 88 19 1b 25 8e 5f b2 e2 31 94 48 aa f0 d2 e1 6d 4f 1d 60 54 33 5b c9 93 8c 90 33 db 4d d6 9a 1c f2 23 db 8d e8 65 72 4a 57 ae 88 02 96 e8 21 c5 29 27 a0 fc 55 61 09 3b ea aa f3 73 2b ec 5a b4 94 2b 2d 6e 92 6d 84 a9 2d a6 7e e1 ec e0 d7 26 53 2f 56 1f 2f 69 ff d8 90 a2 05 90 51 e4 ac 57 ee 32 36 4b 1c 74 9f 8c a3 bf 65 c4 62 f9 cc 03 dd 36 4d 3a a1 70 e4 fd 1e bb 1e b5 df fd b7 72 60 3a c0 a8 66 7c 69 6f d9 b7 93 27 18 f1 3a e0 a7 3e bb d9 db 78 12 1e 64 b3 e8 56 a5 f5 41 91 1a 47 b7 1b d0 01 1e dc 6f ca e4 94 ae 8c 4d 53 11 43 cc 6a 6d 05 65 ad d2 ce 9f e5 13 88 36 22 ac 4f 41 f8 aa 09 e8 3f 15 c2 12 77 d4 84 bb b0 6b 4b 3a 89 17 0d 93 4e a8 c6 69 06 69 80 c0 c1 d6 56 5a dd 24 10 f3 1a 9b db 09 52 5a 9d a0 95 e5 52 21 ac 99 14 88 6b 26 df 72 23 e7 99 db e4 58 5e ac 3e 5e 18 05 f9 e1 d3 ff b1 20 95 56 76 9f 5a d7 4f e3 1c 7e 88 5c d7 84 c0 9d 91 2d 07 22 64 6c 96 38 22 c5 51 87 e9 3f 19 46 af 96 de f9 60 17 e7 85 26 be 20 3a ed 44 68 fb ab ed af 44 6c 9a 75 42 2a 33 b2 fd e1 c9 fa 3c a7 60 3d 83 68 e1 04 ff 2e 48 c3 40 e5 b2 8b 81 a3 1b 4c 3e 75 81 50 cc 33 28 97 73 f8 d2 df b2 be 7b 18 0d 71 fa 21 71 37 53 e6 ce fc a9 ae 0f ba 00 69 b0 7d 77 b3 b6 3b de 74 09 f0 24 3c c8 b6 8d fb 77 79 0c c2 0b 3f a5 05 b4 f4 5f 4d 75 b2 f6 8a ca 8f 6e 37 a0 c9 c7 f0 1f 02 3d b8 de 44 94 7f 61 8b 15 46 1d cd bc 81 a2 06 46 c9 63 40 ef 0e dc 87 98 d4 da c1 31 13 65 0a cb 5b a4 4c 62 9c 1b 83 e3 a5 67 c5 4a 62 d8 0e b0 2a 19 48 19 ed a6 9e 83 f1 54 d8 2a 36 eb 13 d0 7e 2a 55 79 b9 95 9a f8 80 e9 dc 51 47 56 17 ab 0f 97 51 02 c8 28 96 75 12 2e d0 dc d5 91 1b 26 9d 50 5d 8f 5a ef 92 0e 63 93 d4 a7 a4 2c 1f 5d ec ed 59 f4 2b 52 ac b5 ba 48 ea 1c 7d f7 21 e6 35 36 67 4f f2 89 a8 ce cb f5 ee 67 0c 4a 25 9d 44 8b 63 34 83 34 a4 43 59 32 e2 ea 9e 8d 29 10 d6 4c 6f b9 11 f3 a0 38 28 8f e6 91 ef 30 2d 6b a7 f1 6b c2 60 4e bd 58 7c bc fb f1 bb 03 30 0b f3 c2 76 a2 34 7d b9 23 0d 01 ff 8a ca be 34 70 82 7f 72 d9 45 c0 b5 ae 9f c6 f3 07 58 79 38 fd 10 b8 7e 54 d7 07 b1 d5 ee 7b f7 7c 29 c4 3c 86 61 05 7a 2f a6 ba c8 d9 2c 70 8e 70 eb cf 45 8a a3 0e 03 23 64 b1 cc a2 5d cd 8a 0b 9a 72 41 f1 d2 b3 07 58 15 0c c0 2f cf 0a 86 86 08 b5 4d 7c 40 74 0b d5 87 cb c4 54 be b7 82 fd 79 08 49 07 31 c9 0f ae f6 76 d9 34 ea 84 9f 9d 2d 3b 54 67 65 fa 12 ce a2 45 dd 4f 9b 39 9b e6 5c 86 50 1c 14 47 16 b5 d3 f8 d1 c2 09 fe 97 6b ce 41 5c 91 86 80 1a 38 41 3f d5 b9 78 43 93 10 bf fc 58 ea f7 3d 1e 43 30 82 eb 02 a1 98 ad ab 66 27 66 51 2e e6 20 f8 e9 59 ef 79 d0 25 a9 d0 17 9a 62 2a 5f 5b 24 83 98 e4 e3 f4 42 e2 a5 5d 85 5d 6e a7 cd 9c 28 0e 0a 23 e7 8f 33 5f a1 26 f4 e0 6a dc bc 21 2c 75 7b 9e fa ef 67 6c bc 46 a0 d3 77 bc e8 12 31 15 2f ad fe 94 16 d1 b8 3d d1 6e 73 c7 99 af 35 6e 5e 10 f2 19 84 16 b4 b0 43 a9 7f 4a 0b 68 39 e3 cc d7 f6 62 f5 ab b0 cb 32 14 7b 31 7a d5 3d 98 bd 6a }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2e017fcb-6a87-4bd0-9e94-d1ed3387d8c2

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion