CRC32_poly_0x1800063__32_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x1800063__32_lil_refl_False_ (No description metadata provided).

rule CRC32_poly_0x1800063__32_lil_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 63 00 80 01 c6 00 00 03 a5 00 80 02 8c 01 00 06 ef 01 80 07 4a 01 00 05 29 01 80 04 18 03 00 0c 7b 03 80 0d de 03 00 0f bd 03 80 0e 94 02 00 0a f7 02 80 0b 52 02 00 09 31 02 80 08 30 06 00 18 53 06 80 19 f6 06 00 1b 95 06 80 1a bc 07 00 1e df 07 80 1f 7a 07 00 1d 19 07 80 1c 28 05 00 14 4b 05 80 15 ee 05 00 17 8d 05 80 16 a4 04 00 12 c7 04 80 13 62 04 00 11 01 04 80 10 60 0c 00 30 03 0c 80 31 a6 0c 00 33 c5 0c 80 32 ec 0d 00 36 8f 0d 80 37 2a 0d 00 35 49 0d 80 34 78 0f 00 3c 1b 0f 80 3d be 0f 00 3f dd 0f 80 3e f4 0e 00 3a 97 0e 80 3b 32 0e 00 39 51 0e 80 38 50 0a 00 28 33 0a 80 29 96 0a 00 2b f5 0a 80 2a dc 0b 00 2e bf 0b 80 2f 1a 0b 00 2d 79 0b 80 2c 48 09 00 24 2b 09 80 25 8e 09 00 27 ed 09 80 26 c4 08 00 22 a7 08 80 23 02 08 00 21 61 08 80 20 c0 18 00 60 a3 18 80 61 06 18 00 63 65 18 80 62 4c 19 00 66 2f 19 80 67 8a 19 00 65 e9 19 80 64 d8 1b 00 6c bb 1b 80 6d 1e 1b 00 6f 7d 1b 80 6e 54 1a 00 6a 37 1a 80 6b 92 1a 00 69 f1 1a 80 68 f0 1e 00 78 93 1e 80 79 36 1e 00 7b 55 1e 80 7a 7c 1f 00 7e 1f 1f 80 7f ba 1f 00 7d d9 1f 80 7c e8 1d 00 74 8b 1d 80 75 2e 1d 00 77 4d 1d 80 76 64 1c 00 72 07 1c 80 73 a2 1c 00 71 c1 1c 80 70 a0 14 00 50 c3 14 80 51 66 14 00 53 05 14 80 52 2c 15 00 56 4f 15 80 57 ea 15 00 55 89 15 80 54 b8 17 00 5c db 17 80 5d 7e 17 00 5f 1d 17 80 5e 34 16 00 5a 57 16 80 5b f2 16 00 59 91 16 80 58 90 12 00 48 f3 12 80 49 56 12 00 4b 35 12 80 4a 1c 13 00 4e 7f 13 80 4f da 13 00 4d b9 13 80 4c 88 11 00 44 eb 11 80 45 4e 11 00 47 2d 11 80 46 04 10 00 42 67 10 80 43 c2 10 00 41 a1 10 80 40 80 31 00 c0 e3 31 80 c1 46 31 00 c3 25 31 80 c2 0c 30 00 c6 6f 30 80 c7 ca 30 00 c5 a9 30 80 c4 98 32 00 cc fb 32 80 cd 5e 32 00 cf 3d 32 80 ce 14 33 00 ca 77 33 80 cb d2 33 00 c9 b1 33 80 c8 b0 37 00 d8 d3 37 80 d9 76 37 00 db 15 37 80 da 3c 36 00 de 5f 36 80 df fa 36 00 dd 99 36 80 dc a8 34 00 d4 cb 34 80 d5 6e 34 00 d7 0d 34 80 d6 24 35 00 d2 47 35 80 d3 e2 35 00 d1 81 35 80 d0 e0 3d 00 f0 83 3d 80 f1 26 3d 00 f3 45 3d 80 f2 6c 3c 00 f6 0f 3c 80 f7 aa 3c 00 f5 c9 3c 80 f4 f8 3e 00 fc 9b 3e 80 fd 3e 3e 00 ff 5d 3e 80 fe 74 3f 00 fa 17 3f 80 fb b2 3f 00 f9 d1 3f 80 f8 d0 3b 00 e8 b3 3b 80 e9 16 3b 00 eb 75 3b 80 ea 5c 3a 00 ee 3f 3a 80 ef 9a 3a 00 ed f9 3a 80 ec c8 38 00 e4 ab 38 80 e5 0e 38 00 e7 6d 38 80 e6 44 39 00 e2 27 39 80 e3 82 39 00 e1 e1 39 80 e0 40 29 00 a0 23 29 80 a1 86 29 00 a3 e5 29 80 a2 cc 28 00 a6 af 28 80 a7 0a 28 00 a5 69 28 80 a4 58 2a 00 ac 3b 2a 80 ad 9e 2a 00 af fd 2a 80 ae d4 2b 00 aa b7 2b 80 ab 12 2b 00 a9 71 2b 80 a8 70 2f 00 b8 13 2f 80 b9 b6 2f 00 bb d5 2f 80 ba fc 2e 00 be 9f 2e 80 bf 3a 2e 00 bd 59 2e 80 bc 68 2c 00 b4 0b 2c 80 b5 ae 2c 00 b7 cd 2c 80 b6 e4 2d 00 b2 87 2d 80 b3 22 2d 00 b1 41 2d 80 b0 20 25 00 90 43 25 80 91 e6 25 00 93 85 25 80 92 ac 24 00 96 cf 24 80 97 6a 24 00 95 09 24 80 94 38 26 00 9c 5b 26 80 9d fe 26 00 9f 9d 26 80 9e b4 27 00 9a d7 27 80 9b 72 27 00 99 11 27 80 98 10 23 00 88 73 23 80 89 d6 23 00 8b b5 23 80 8a 9c 22 00 8e ff 22 80 8f 5a 22 00 8d 39 22 80 8c 08 20 00 84 6b 20 80 85 ce 20 00 87 ad 20 80 86 84 21 00 82 e7 21 80 83 42 21 00 81 21 21 80 80 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a96d18b9-cf29-46ef-be07-495ad7ad6ced

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion