CRC_15_CAN_poly_0x4599__16_lil_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_15_CAN_poly_0x4599__16_lil_refl_True_ (No description metadata provided).

rule CRC_15_CAN_poly_0x4599__16_lil_refl_True_ {
  strings:
    $a0 = { 00 00 ca 16 94 2d 5e 3b 28 5b e2 4d bc 76 76 60 50 b6 9a a0 c4 9b 0e 8d 78 ed b2 fb ec c0 26 d6 e5 5f 2f 49 71 72 bb 64 cd 04 07 12 59 29 93 3f b5 e9 7f ff 21 c4 eb d2 9d b2 57 a4 09 9f c3 89 ca bf 00 a9 5e 92 94 84 e2 e4 28 f2 76 c9 bc df 9a 09 50 1f 0e 24 c4 32 b2 52 78 44 26 7f ec 69 2f e0 e5 f6 bb cd 71 db 07 bb cd ad 93 96 59 80 7f 56 b5 40 eb 7b 21 6d 57 0d 9d 1b c3 20 09 36 d1 4c 1b 5a 45 61 8f 77 f9 17 33 01 6d 3a a7 2c 81 fa 4b ec 15 d7 df c1 a9 a1 63 b7 3d 8c f7 9a 34 13 fe 05 a0 3e 6a 28 1c 48 d6 5e 88 65 42 73 64 a5 ae b3 f0 88 3a 9e 4c fe 86 e8 d8 d3 12 c5 1b f3 d1 e5 8f de 45 c8 33 a8 f9 be a7 85 6d 93 4b 45 81 53 df 68 15 7e 63 1e a9 08 f7 33 3d 25 fe ac 34 ba 6a 81 a0 97 d6 f7 1c e1 42 da 88 cc ae 1a 64 0c 3a 37 f0 21 86 41 4c 57 12 6c d8 7a a2 99 68 8f 36 b4 fc a2 8a c2 40 d4 1e ef d4 f9 f2 2f 38 39 66 02 ac 14 da 74 10 62 4e 59 84 4f 47 c6 8d d0 d3 eb 19 fd 6f 9d a5 8b fb b0 31 a6 17 70 dd 66 83 5d 49 4b 3f 2b f5 3d ab 06 61 10 68 26 a2 30 fc 0b 36 1d 40 7d 8a 6b d4 50 1e 46 38 90 f2 86 ac bd 66 ab 10 cb da dd 84 e6 4e f0 8d 79 47 6f 19 54 d3 42 a5 22 6f 34 31 0f fb 19 dd cf 17 d9 49 e2 83 f4 f5 94 3f 82 61 b9 ab af 73 d5 b9 c3 e7 f8 2d ee 5b 8e 91 98 cf a3 05 b5 23 63 e9 75 b7 4e 7d 58 0b 38 c1 2e 9f 15 55 03 96 8a 5c 9c 02 a7 c8 b1 be d1 74 c7 2a fc e0 ea c6 3c 0c 2a 52 11 98 07 ee 67 24 71 7a 4a b0 5c b9 6a 73 7c 2d 47 e7 51 91 31 5b 27 05 1c cf 0a e9 dc 23 ca 7d f1 b7 e7 c1 87 0b 91 55 aa 9f bc 5c 35 96 23 c8 18 02 0e 74 6e be 78 e0 43 2a 55 0c 83 c6 95 98 ae 52 b8 24 d8 ee ce b0 f5 7a e3 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2128b993-b40f-4ed0-92ba-a72786697ff7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion