CRC32_poly_0x5005713c__32_lil_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x5005713c__32_lil_refl_True_ (No description metadata provided).

rule CRC32_poly_0x5005713c__32_lil_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 45 38 da 1f 8a 70 b4 3f cf 48 6e 20 01 a1 75 06 44 99 af 19 8b d1 c1 39 ce e9 1b 26 02 42 eb 0c 47 7a 31 13 88 32 5f 33 cd 0a 85 2c 03 e3 9e 0a 46 db 44 15 89 93 2a 35 cc ab f0 2a 04 84 d6 19 41 bc 0c 06 8e f4 62 26 cb cc b8 39 05 25 a3 1f 40 1d 79 00 8f 55 17 20 ca 6d cd 3f 06 c6 3d 15 43 fe e7 0a 8c b6 89 2a c9 8e 53 35 07 67 48 13 42 5f 92 0c 8d 17 fc 2c c8 2f 26 33 08 08 ad 33 4d 30 77 2c 82 78 19 0c c7 40 c3 13 09 a9 d8 35 4c 91 02 2a 83 d9 6c 0a c6 e1 b6 15 0a 4a 46 3f 4f 72 9c 20 80 3a f2 00 c5 02 28 1f 0b eb 33 39 4e d3 e9 26 81 9b 87 06 c4 a3 5d 19 0c 8c 7b 2a 49 b4 a1 35 86 fc cf 15 c3 c4 15 0a 0d 2d 0e 2c 48 15 d4 33 87 5d ba 13 c2 65 60 0c 0e ce 90 26 4b f6 4a 39 84 be 24 19 c1 86 fe 06 0f 6f e5 20 4a 57 3f 3f 85 1f 51 1f c0 27 8b 00 05 50 47 1e 40 68 9d 01 8f 20 f3 21 ca 18 29 3e 04 f1 32 18 41 c9 e8 07 8e 81 86 27 cb b9 5c 38 07 12 ac 12 42 2a 76 0d 8d 62 18 2d c8 5a c2 32 06 b3 d9 14 43 8b 03 0b 8c c3 6d 2b c9 fb b7 34 01 d4 91 07 44 ec 4b 18 8b a4 25 38 ce 9c ff 27 00 75 e4 01 45 4d 3e 1e 8a 05 50 3e cf 3d 8a 21 03 96 7a 0b 46 ae a0 14 89 e6 ce 34 cc de 14 2b 02 37 0f 0d 47 0f d5 12 88 47 bb 32 cd 7f 61 2d 0d 58 ea 2d 48 60 30 32 87 28 5e 12 c2 10 84 0d 0c f9 9f 2b 49 c1 45 34 86 89 2b 14 c3 b1 f1 0b 0f 1a 01 21 4a 22 db 3e 85 6a b5 1e c0 52 6f 01 0e bb 74 27 4b 83 ae 38 84 cb c0 18 c1 f3 1a 07 09 dc 3c 34 4c e4 e6 2b 83 ac 88 0b c6 94 52 14 08 7d 49 32 4d 45 93 2d 82 0d fd 0d c7 35 27 12 0b 9e d7 38 4e a6 0d 27 81 ee 63 07 c4 d6 b9 18 0a 3f a2 3e 4f 07 78 21 80 4f 16 01 c5 77 cc 1e 0a a0 8e 3c 4f 98 54 23 80 d0 3a 03 c5 e8 e0 1c 0b 01 fb 3a 4e 39 21 25 81 71 4f 05 c4 49 95 1a 08 e2 65 30 4d da bf 2f 82 92 d1 0f c7 aa 0b 10 09 43 10 36 4c 7b ca 29 83 33 a4 09 c6 0b 7e 16 0e 24 58 25 4b 1c 82 3a 84 54 ec 1a c1 6c 36 05 0f 85 2d 23 4a bd f7 3c 85 f5 99 1c c0 cd 43 03 0c 66 b3 29 49 5e 69 36 86 16 07 16 c3 2e dd 09 0d c7 c6 2f 48 ff 1c 30 87 b7 72 10 c2 8f a8 0f 02 a8 23 0f 47 90 f9 10 88 d8 97 30 cd e0 4d 2f 03 09 56 09 46 31 8c 16 89 79 e2 36 cc 41 38 29 00 ea c8 03 45 d2 12 1c 8a 9a 7c 3c cf a2 a6 23 01 4b bd 05 44 73 67 1a 8b 3b 09 3a ce 03 d3 25 06 2c f5 16 43 14 2f 09 8c 5c 41 29 c9 64 9b 36 07 8d 80 10 42 b5 5a 0f 8d fd 34 2f c8 c5 ee 30 04 6e 1e 1a 41 56 c4 05 8e 1e aa 25 cb 26 70 3a 05 cf 6b 1c 40 f7 b1 03 8f bf df 23 ca 87 05 3c 0f f0 c9 22 4a c8 13 3d 85 80 7d 1d c0 b8 a7 02 0e 51 bc 24 4b 69 66 3b 84 21 08 1b c1 19 d2 04 0d b2 22 2e 48 8a f8 31 87 c2 96 11 c2 fa 4c 0e 0c 13 57 28 49 2b 8d 37 86 63 e3 17 c3 5b 39 08 0b 74 1f 3b 4e 4c c5 24 81 04 ab 04 c4 3c 71 1b 0a d5 6a 3d 4f ed b0 22 80 a5 de 02 c5 9d 04 1d 09 36 f4 37 4c 0e 2e 28 83 46 40 08 c6 7e 9a 17 08 97 81 31 4d af 5b 2e 82 e7 35 0e c7 df ef 11 07 f8 64 11 42 c0 be 0e 8d 88 d0 2e c8 b0 0a 31 06 59 11 17 43 61 cb 08 8c 29 a5 28 c9 11 7f 37 05 ba 8f 1d 40 82 55 02 8f ca 3b 22 ca f2 e1 3d 04 1b fa 1b 41 23 20 04 8e 6b 4e 24 cb 53 94 3b 03 7c b2 08 46 44 68 17 89 0c 06 37 cc 34 dc 28 02 dd c7 0e 47 e5 1d 11 88 ad 73 31 cd 95 a9 2e 01 3e 59 04 44 06 83 1b 8b 4e ed 3b ce 76 37 24 00 9f 2c 02 45 a7 f6 1d 8a ef 98 3d cf d7 42 22 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c685d4c2-3428-4d4f-ad08-3f772cad3d35

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion