CRC32_poly_0xbdbdf21c__32_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0xbdbdf21c__32_lil_refl_False_ (No description metadata provided).

rule CRC32_poly_0xbdbdf21c__32_lil_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 1c f2 bd bd 24 16 c6 c6 38 e4 7b 7b 54 de 31 30 48 2c 8c 8d 70 c8 f7 f6 6c 3a 4a 4b a8 bc 63 60 b4 4e de dd 8c aa a5 a6 90 58 18 1b fc 62 52 50 e0 90 ef ed d8 74 94 96 c4 86 29 2b 50 79 c7 c0 4c 8b 7a 7d 74 6f 01 06 68 9d bc bb 04 a7 f6 f0 18 55 4b 4d 20 b1 30 36 3c 43 8d 8b f8 c5 a4 a0 e4 37 19 1d dc d3 62 66 c0 21 df db ac 1b 95 90 b0 e9 28 2d 88 0d 53 56 94 ff ee eb bc 00 33 3c a0 f2 8e 81 98 16 f5 fa 84 e4 48 47 e8 de 02 0c f4 2c bf b1 cc c8 c4 ca d0 3a 79 77 14 bc 50 5c 08 4e ed e1 30 aa 96 9a 2c 58 2b 27 40 62 61 6c 5c 90 dc d1 64 74 a7 aa 78 86 1a 17 ec 79 f4 fc f0 8b 49 41 c8 6f 32 3a d4 9d 8f 87 b8 a7 c5 cc a4 55 78 71 9c b1 03 0a 80 43 be b7 44 c5 97 9c 58 37 2a 21 60 d3 51 5a 7c 21 ec e7 10 1b a6 ac 0c e9 1b 11 34 0d 60 6a 28 ff dd d7 78 01 66 78 64 f3 db c5 5c 17 a0 be 40 e5 1d 03 2c df 57 48 30 2d ea f5 08 c9 91 8e 14 3b 2c 33 d0 bd 05 18 cc 4f b8 a5 f4 ab c3 de e8 59 7e 63 84 63 34 28 98 91 89 95 a0 75 f2 ee bc 87 4f 53 28 78 a1 b8 34 8a 1c 05 0c 6e 67 7e 10 9c da c3 7c a6 90 88 60 54 2d 35 58 b0 56 4e 44 42 eb f3 80 c4 c2 d8 9c 36 7f 65 a4 d2 04 1e b8 20 b9 a3 d4 1a f3 e8 c8 e8 4e 55 f0 0c 35 2e ec fe 88 93 c4 01 55 44 d8 f3 e8 f9 e0 17 93 82 fc e5 2e 3f 90 df 64 74 8c 2d d9 c9 b4 c9 a2 b2 a8 3b 1f 0f 6c bd 36 24 70 4f 8b 99 48 ab f0 e2 54 59 4d 5f 38 63 07 14 24 91 ba a9 1c 75 c1 d2 00 87 7c 6f 94 78 92 84 88 8a 2f 39 b0 6e 54 42 ac 9c e9 ff c0 a6 a3 b4 dc 54 1e 09 e4 b0 65 72 f8 42 d8 cf 3c c4 f1 e4 20 36 4c 59 18 d2 37 22 04 20 8a 9f 68 1a c0 d4 74 e8 7d 69 4c 0c 06 12 50 fe bb af f0 02 cc f0 ec f0 71 4d d4 14 0a 36 c8 e6 b7 8b a4 dc fd c0 b8 2e 40 7d 80 ca 3b 06 9c 38 86 bb 58 be af 90 44 4c 12 2d 7c a8 69 56 60 5a d4 eb 0c 60 9e a0 10 92 23 1d 28 76 58 66 34 84 e5 db a0 7b 0b 30 bc 89 b6 8d 84 6d cd f6 98 9f 70 4b f4 a5 3a 00 e8 57 87 bd d0 b3 fc c6 cc 41 41 7b 08 c7 68 50 14 35 d5 ed 2c d1 ae 96 30 23 13 2b 5c 19 59 60 40 eb e4 dd 78 0f 9f a6 64 fd 22 1b 4c 02 ff cc 50 f0 42 71 68 14 39 0a 74 e6 84 b7 18 dc ce fc 04 2e 73 41 3c ca 08 3a 20 38 b5 87 e4 be 9c ac f8 4c 21 11 c0 a8 5a 6a dc 5a e7 d7 b0 60 ad 9c ac 92 10 21 94 76 6b 5a 88 84 d6 e7 1c 7b 38 0c 00 89 85 b1 38 6d fe ca 24 9f 43 77 48 a5 09 3c 54 57 b4 81 6c b3 cf fa 70 41 72 47 b4 c7 5b 6c a8 35 e6 d1 90 d1 9d aa 8c 23 20 17 e0 19 6a 5c fc eb d7 e1 c4 0f ac 9a d8 fd 11 27 88 03 aa 88 94 f1 17 35 ac 15 6c 4e b0 e7 d1 f3 dc dd 9b b8 c0 2f 26 05 f8 cb 5d 7e e4 39 e0 c3 20 bf c9 e8 3c 4d 74 55 04 a9 0f 2e 18 5b b2 93 74 61 f8 d8 68 93 45 65 50 77 3e 1e 4c 85 83 a3 d8 7a 6d 48 c4 88 d0 f5 fc 6c ab 8e e0 9e 16 33 8c a4 5c 78 90 56 e1 c5 a8 b2 9a be b4 40 27 03 70 c6 0e 28 6c 34 b3 95 54 d0 c8 ee 48 22 75 53 24 18 3f 18 38 ea 82 a5 00 0e f9 de 1c fc 44 63 34 03 99 b4 28 f1 24 09 10 15 5f 72 0c e7 e2 cf 60 dd a8 84 7c 2f 15 39 44 cb 6e 42 58 39 d3 ff 9c bf fa d4 80 4d 47 69 b8 a9 3c 12 a4 5b 81 af c8 61 cb e4 d4 93 76 59 ec 77 0d 22 f0 85 b0 9f 64 7a 5e 74 78 88 e3 c9 40 6c 98 b2 5c 9e 25 0f 30 a4 6f 44 2c 56 d2 f9 14 b2 a9 82 08 40 14 3f cc c6 3d 14 d0 34 80 a9 e8 d0 fb d2 f4 22 46 6f 98 18 0c 24 84 ea b1 99 bc 0e ca e2 a0 fc 77 5f }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4dfd781b-81b9-4567-a857-7ac98732573e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion