CRC16_poly_0xb005__16_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC16_poly_0xb005__16_lil_refl_False_ (No description metadata provided).

rule CRC16_poly_0xb005__16_lil_refl_False_ {
  strings:
    $a0 = { 00 00 05 b0 0f d0 0a 60 1b 10 1e a0 14 c0 11 70 36 20 33 90 39 f0 3c 40 2d 30 28 80 22 e0 27 50 6c 40 69 f0 63 90 66 20 77 50 72 e0 78 80 7d 30 5a 60 5f d0 55 b0 50 00 41 70 44 c0 4e a0 4b 10 d8 80 dd 30 d7 50 d2 e0 c3 90 c6 20 cc 40 c9 f0 ee a0 eb 10 e1 70 e4 c0 f5 b0 f0 00 fa 60 ff d0 b4 c0 b1 70 bb 10 be a0 af d0 aa 60 a0 00 a5 b0 82 e0 87 50 8d 30 88 80 99 f0 9c 40 96 20 93 90 b5 b1 b0 01 ba 61 bf d1 ae a1 ab 11 a1 71 a4 c1 83 91 86 21 8c 41 89 f1 98 81 9d 31 97 51 92 e1 d9 f1 dc 41 d6 21 d3 91 c2 e1 c7 51 cd 31 c8 81 ef d1 ea 61 e0 01 e5 b1 f4 c1 f1 71 fb 11 fe a1 6d 31 68 81 62 e1 67 51 76 21 73 91 79 f1 7c 41 5b 11 5e a1 54 c1 51 71 40 01 45 b1 4f d1 4a 61 01 71 04 c1 0e a1 0b 11 1a 61 1f d1 15 b1 10 01 37 51 32 e1 38 81 3d 31 2c 41 29 f1 23 91 26 21 6f d3 6a 63 60 03 65 b3 74 c3 71 73 7b 13 7e a3 59 f3 5c 43 56 23 53 93 42 e3 47 53 4d 33 48 83 03 93 06 23 0c 43 09 f3 18 83 1d 33 17 53 12 e3 35 b3 30 03 3a 63 3f d3 2e a3 2b 13 21 73 24 c3 b7 53 b2 e3 b8 83 bd 33 ac 43 a9 f3 a3 93 a6 23 81 73 84 c3 8e a3 8b 13 9a 63 9f d3 95 b3 90 03 db 13 de a3 d4 c3 d1 73 c0 03 c5 b3 cf d3 ca 63 ed 33 e8 83 e2 e3 e7 53 f6 23 f3 93 f9 f3 fc 43 da 62 df d2 d5 b2 d0 02 c1 72 c4 c2 ce a2 cb 12 ec 42 e9 f2 e3 92 e6 22 f7 52 f2 e2 f8 82 fd 32 b6 22 b3 92 b9 f2 bc 42 ad 32 a8 82 a2 e2 a7 52 80 02 85 b2 8f d2 8a 62 9b 12 9e a2 94 c2 91 72 02 e2 07 52 0d 32 08 82 19 f2 1c 42 16 22 13 92 34 c2 31 72 3b 12 3e a2 2f d2 2a 62 20 02 25 b2 6e a2 6b 12 61 72 64 c2 75 b2 70 02 7a 62 7f d2 58 82 5d 32 57 52 52 e2 43 92 46 22 4c 42 49 f2 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

3a76bb73-1d2d-4141-bc2c-5adc249c3c0b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion