MD5_digest__32_lil_AND_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule MD5_digest__32_lil_AND_ (No description metadata provided).

rule MD5_digest__32_lil_AND_ {
  strings:
    $a0 = { 01 23 45 67 [0-20] 89 ab cd ef [0-20] fe dc ba 98 [0-20] 76 54 32 10 [0-20] 78 a4 6a d7 [0-20] 56 b7 c7 e8 [0-20] db 70 20 24 [0-20] ee ce bd c1 [0-20] af 0f 7c f5 [0-20] 2a c6 87 47 [0-20] 13 46 30 a8 [0-20] 01 95 46 fd [0-20] d8 98 80 69 [0-20] af f7 44 8b [0-20] b1 5b ff ff [0-20] be d7 5c 89 [0-20] 22 11 90 6b [0-20] 93 71 98 fd [0-20] 8e 43 79 a6 [0-20] 21 08 b4 49 [0-20] 62 25 1e f6 [0-20] 40 b3 40 c0 [0-20] 51 5a 5e 26 [0-20] aa c7 b6 e9 [0-20] 5d 10 2f d6 [0-20] 53 14 44 02 [0-20] 81 e6 a1 d8 [0-20] c8 fb d3 e7 [0-20] e6 cd e1 21 [0-20] d6 07 37 c3 [0-20] 87 0d d5 f4 [0-20] ed 14 5a 45 [0-20] 05 e9 e3 a9 [0-20] f8 a3 ef fc [0-20] d9 02 6f 67 [0-20] 8a 4c 2a 8d [0-20] 42 39 fa ff [0-20] 81 f6 71 87 [0-20] 22 61 9d 6d [0-20] 0c 38 e5 fd [0-20] 44 ea be a4 [0-20] a9 cf de 4b [0-20] 60 4b bb f6 [0-20] 70 bc bf be [0-20] c6 7e 9b 28 [0-20] fa 27 a1 ea [0-20] 85 30 ef d4 [0-20] 05 1d 88 04 [0-20] 39 d0 d4 d9 [0-20] e5 99 db e6 [0-20] f8 7c a2 1f [0-20] 65 56 ac c4 [0-20] 44 22 29 f4 [0-20] 97 ff 2a 43 [0-20] a7 23 94 ab [0-20] 39 a0 93 fc [0-20] c3 59 5b 65 [0-20] 92 cc 0c 8f [0-20] 7d f4 ef ff [0-20] d1 5d 84 85 [0-20] 4f 7e a8 6f [0-20] e0 e6 2c fe [0-20] 14 43 01 a3 [0-20] a1 11 08 4e [0-20] 82 7e 53 f7 [0-20] 35 f2 3a bd [0-20] bb d2 d7 2a [0-20] 91 d3 86 eb }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1a5a8d6f-be9c-4201-81e7-22df5b9d43ba

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion