libavcodec_dca_dca_downmix_coeffsflt64_64_big_520_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libavcodec_dca_dca_downmix_coeffs__flt64___64_big_520_ (No description metadata provided).

rule libavcodec_dca_dca_downmix_coeffs__flt64___64_big_520_ {
  strings:
    $a0 = { 3f f0 00 00 00 00 00 00 3f ef a2 3a 19 7d 28 1a 3f ef 17 93 80 7c e6 8a 3f ee 35 bf 27 a2 98 b5 3f ed 5a 53 0f fd 05 71 3f ec 85 20 af fa 0a 4f 3f eb b5 fa d0 0a b2 29 3f ea ec b5 81 0c 24 0c 3f ea 29 26 12 f6 39 b4 3f e9 6b 23 0b cd c4 30 3f e8 b2 84 1e d8 92 a5 3f e7 ff 22 24 11 5d 9b 3f e7 50 d7 0f d9 c6 f1 3f e6 a7 7d ea e8 ab 8b 3f e6 02 f2 ca 73 10 74 3f e5 63 12 c8 8e 01 d0 3f e4 c7 bb fc c7 c6 39 3f e4 30 cd 74 f6 d4 76 3f e3 9e 27 2e 3d 04 f4 3f e3 0f aa 0e 3d 83 f1 3f e2 85 37 dc 84 13 b9 3f e1 fe b3 3c 1c 38 1d 3f e1 7b ff a5 56 f0 51 3f e0 fd 01 5f bd ab dd 3f e0 81 9d 7c 31 32 f0 3f e0 09 b9 cf 33 42 50 3f dc 96 76 c6 fc af 1e 3f d9 7a 96 7f 75 24 ae 3f d6 b5 43 37 bc 3b 5d 3f d4 3d 13 62 48 49 10 3f d2 09 a3 7a ef 44 49 3f d0 13 79 87 dd 70 4c 3f cc a7 d7 67 c0 30 d7 3f c9 8a 13 57 7c 93 c1 3f c6 c3 10 e3 76 9f 34 3f c4 49 60 c5 76 b3 69 3f c2 14 9a 5f ed 24 ca 3f c0 1d 3f 2d 96 84 da 3f bc b9 42 98 ac 6d 0b 3f b9 99 99 99 99 99 9a 3f b6 d0 e6 f3 2e 6e 7a 3f b4 55 b5 a3 0b 03 52 3f b2 1f 97 ef 20 89 4a 3f b0 27 0a c3 f8 a9 e2 3f ab 2e 68 99 2f 79 7e 3f a6 de c5 6b fd 58 ba 3f a3 3e 2d 10 01 a8 69 3f a0 30 dc 4e a0 3a 90 3f 9b 3e ee 5c 9e 8d 0a 3f 96 ec ac 53 00 26 9f 3f 93 49 df 81 75 bf 98 3f 90 3a b3 d1 2b c2 9d 3f 8b 4f 7e 2b 2c 2a 0a 3f 86 fa 9b ad 56 be 89 3f 83 55 99 0f 20 61 37 3f 80 44 91 4f 3c 03 1b 3f 77 08 93 80 24 1c a9 3f 70 4e 74 cc 73 ee a7 3f 67 16 93 d0 8e 67 d5 3f 60 58 5e 4c 78 b1 90 3f 57 24 9c a3 be eb ea 3f 50 62 4d d2 f1 a9 fc 3f 40 6c 43 63 88 6b 41 3f 30 76 3f 01 e8 e8 b5 00 00 00 00 00 00 00 00 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

93b21fe2-a691-4ace-8461-711f7d929967

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion