Blowfish_ks3_table__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule Blowfish_ks3_table__32_big_1024_ (No description metadata provided).

rule Blowfish_ks3_table__32_big_1024_ {
  strings:
    $a0 = { 3a 39 ce 37 d3 fa f5 cf ab c2 77 37 5a c5 2d 1b 5c b0 67 9e 4f a3 37 42 d3 82 27 40 99 bc 9b be d5 11 8e 9d bf 0f 73 15 d6 2d 1c 7e c7 00 c4 7b b7 8c 1b 6b 21 a1 90 45 b2 6e b1 be 6a 36 6e b4 57 48 ab 2f bc 94 6e 79 c6 a3 76 d2 65 49 c2 c8 53 0f f8 ee 46 8d de 7d d5 73 0a 1d 4c d0 4d c6 29 39 bb db a9 ba 46 50 ac 95 26 e8 be 5e e3 04 a1 fa d5 f0 6a 2d 51 9a 63 ef 8c e2 9a 86 ee 22 c0 89 c2 b8 43 24 2e f6 a5 1e 03 aa 9c f2 d0 a4 83 c0 61 ba 9b e9 6a 4d 8f e5 15 50 ba 64 5b d6 28 26 a2 f9 a7 3a 3a e1 4b a9 95 86 ef 55 62 e9 c7 2f ef d3 f7 52 f7 da 3f 04 6f 69 77 fa 0a 59 80 e4 a9 15 87 b0 86 01 9b 09 e6 ad 3b 3e e5 93 e9 90 fd 5a 9e 34 d7 97 2c f0 b7 d9 02 2b 8b 51 96 d5 ac 3a 01 7d a6 7d d1 cf 3e d6 7c 7d 2d 28 1f 9f 25 cf ad f2 b8 9b 5a d6 b4 72 5a 88 f5 4c e0 29 ac 71 e0 19 a5 e6 47 b0 ac fd ed 93 fa 9b e8 d3 c4 8d 28 3b 57 cc f8 d5 66 29 79 13 2e 28 78 5f 01 91 ed 75 60 55 f7 96 0e 44 e3 d3 5e 8c 15 05 6d d4 88 f4 6d ba 03 a1 61 25 05 64 f0 bd c3 eb 9e 15 3c 90 57 a2 97 27 1a ec a9 3a 07 2a 1b 3f 6d 9b 1e 63 21 f5 f5 9c 66 fb 26 dc f3 19 75 33 d9 28 b1 55 fd f5 03 56 34 82 8a ba 3c bb 28 51 77 11 c2 0a d9 f8 ab cc 51 67 cc ad 92 5f 4d e8 17 51 38 30 dc 8e 37 9d 58 62 93 20 f9 91 ea 7a 90 c2 fb 3e 7b ce 51 21 ce 64 77 4f be 32 a8 b6 e3 7e c3 29 3d 46 48 de 53 69 64 13 e6 80 a2 ae 08 10 dd 6d b2 24 69 85 2d fd 09 07 21 66 b3 9a 46 0a 64 45 c0 dd 58 6c de cf 1c 20 c8 ae 5b be f7 dd 1b 58 8d 40 cc d2 01 7f 6b b4 e3 bb dd a2 6a 7e 3a 59 ff 45 3e 35 0a 44 bc b4 cd d5 72 ea ce a8 fa 64 84 bb 8d 66 12 ae bf 3c 6f 47 d2 9b e4 63 54 2f 5d 9e ae c2 77 1b f6 4e 63 70 74 0e 0d 8d e7 5b 13 57 f8 72 16 71 af 53 7d 5d 40 40 cb 08 4e b4 e2 cc 34 d2 46 6a 01 15 af 84 e1 b0 04 28 95 98 3a 1d 06 b8 9f b4 ce 6e a0 48 6f 3f 3b 82 35 20 ab 82 01 1a 1d 4b 27 72 27 f8 61 15 60 b1 e7 93 3f dc bb 3a 79 2b 34 45 25 bd a0 88 39 e1 51 ce 79 4b 2f 32 c9 b7 a0 1f ba c9 e0 1c c8 7e bc c7 d1 f6 cf 01 11 c3 a1 e8 aa c7 1a 90 87 49 d4 4f bd 9a d0 da de cb d5 0a da 38 03 39 c3 2a c6 91 36 67 8d f9 31 7c e0 b1 2b 4f f7 9e 59 b7 43 f5 bb 3a f2 d5 19 ff 27 d9 45 9c bf 97 22 2c 15 e6 fc 2a 0f 91 fc 71 9b 94 15 25 fa e5 93 61 ce b6 9c eb c2 a8 64 59 12 ba a8 d1 b6 c1 07 5e e3 05 6a 0c 10 d2 50 65 cb 03 a4 42 e0 ec 6e 0e 16 98 db 3b 4c 98 a0 be 32 78 e9 64 9f 1f 95 32 e0 d3 92 df d3 a0 34 2b 89 71 f2 1e 1b 0a 74 41 4b a3 34 8c c5 be 71 20 c3 76 32 d8 df 35 9f 8d 9b 99 2f 2e e6 0b 6f 47 0f e3 f1 1d e5 4c da 54 1e da d8 91 ce 62 79 cf cd 3e 7e 6f 16 18 b1 66 fd 2c 1d 05 84 8f d2 c5 f6 fb 22 99 f5 23 f3 57 a6 32 76 23 93 a8 35 31 56 cc cd 02 ac f0 81 62 5a 75 eb b5 6e 16 36 97 88 d2 73 cc de 96 62 92 81 b9 49 d0 4c 50 90 1b 71 c6 56 14 e6 c6 c7 bd 32 7a 14 0a 45 e1 d0 06 c3 f2 7b 9a c9 aa 53 fd 62 a8 0f 00 bb 25 bf e2 35 bd d2 f6 71 12 69 05 b2 04 02 22 b6 cb cf 7c cd 76 9c 2b 53 11 3e c0 16 40 e3 d3 38 ab bd 60 25 47 ad f0 ba 38 20 9c f7 46 ce 76 77 af a1 c5 20 75 60 60 85 cb fe 4e 8a e8 8d d8 7a aa f9 b0 4c f9 aa 7e 19 48 c2 5c 02 fb 8a 8c 01 c3 6a e4 d6 eb e1 f9 90 d4 f8 69 a6 5c de a0 3f 09 25 2d c2 08 e6 9f b7 4e 61 32 ce 77 e2 5b 57 8f df e3 3a c3 72 e6 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

fc13ee6a-d608-4e3e-bddf-1be0120d77fb

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion