Lame_MP3_window_subband____mdct_routine_winflt64_64_lil_1152_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule Lame_MP3_window_subband____mdct_routine_win__flt64___64_lil_1152_ (No description metadata provided).

rule Lame_MP3_window_subband____mdct_routine_win__flt64___64_lil_1152_ {
  strings:
    $a0 = { 66 42 a4 08 60 c3 50 3d b3 85 7f 7e 99 99 66 3d f1 9b b3 1b c4 89 70 3d 25 ff a6 7a ff be 73 3d 2b 92 e3 f6 8a d3 74 3d 25 ff a6 7a ff be 73 3d f2 9b b3 1b c4 89 70 3d b8 85 7f 7e 99 99 66 3d 70 42 a4 08 60 c3 50 3d fc 13 fe 65 0a ff 97 3d 2c 63 43 bd 3f 75 95 3d 9b 8d 79 35 52 a6 92 3d 8a 31 f9 df 33 50 8f 3d e0 eb 33 d3 bd 23 89 3d 35 a6 6e c6 47 f7 82 3d 14 79 e9 76 ae f5 79 3d 99 45 84 af f0 73 6d 3d 37 7e 5d d3 36 4b 52 3d fc 13 fe 65 0a ff 97 bd 2c 63 43 bd 3f 75 95 bd 9b 8d 79 35 52 a6 92 bd 8a 31 f9 df 33 50 8f bd e2 eb 33 d3 bd 23 89 bd 35 a6 6e c6 47 f7 82 bd 14 79 e9 76 ae f5 79 bd 9a 45 84 af f0 73 6d bd 37 7e 5d d3 36 4b 52 bd 7a 42 a4 08 60 c3 50 bd bc 85 7f 7e 99 99 66 bd f5 9b b3 1b c4 89 70 bd 25 ff a6 7a ff be 73 bd 2b 92 e3 f6 8a d3 74 bd 25 ff a6 7a ff be 73 bd f4 9b b3 1b c4 89 70 bd b9 85 7f 7e 99 99 66 bd 70 42 a4 08 60 c3 50 bd 66 42 a4 08 60 c3 50 3d b3 85 7f 7e 99 99 66 3d f1 9b b3 1b c4 89 70 3d 25 ff a6 7a ff be 73 3d 2b 92 e3 f6 8a d3 74 3d 25 ff a6 7a ff be 73 3d f1 9b b3 1b c4 89 70 3d ba 85 7f 7e 99 99 66 3d 70 42 a4 08 60 c3 50 3d fd 13 fe 65 0a ff 97 3d 2c 63 43 bd 3f 75 95 3d 9b 8d 79 35 52 a6 92 3d 8d 31 f9 df 33 50 8f 3d e0 eb 33 d3 bd 23 89 3d 35 a6 6e c6 47 f7 82 3d 0f 79 e9 76 ae f5 79 3d 9a 45 84 af f0 73 6d 3d 37 7e 5d d3 36 4b 52 3d a8 c6 ce 9b e4 04 98 bd bb 32 18 67 a6 a4 95 bd 3d c2 82 44 3d 1a 93 bd 2a 36 70 68 9c 6a 90 bd 49 01 87 14 ff 35 8b bd 60 d2 60 64 c1 61 85 bd 9f 5e f6 bb 4c 84 7e bd 4a 2c 97 20 39 26 71 bd c0 b4 3c 3e 69 af 53 bd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 46 cf fb 08 12 50 bd 6f 17 3b bb f5 69 5c bd 6c c8 16 96 c0 35 4e bd f7 8b c9 31 fd d9 c0 3f 31 ef fc 99 79 82 da 3f 74 a6 d6 53 f1 8d e8 3f 5f 07 1f e7 ff 75 f1 3f e7 b9 3a d9 02 da f4 3f 62 8f ab 9f 6e 1d f9 3f b6 aa 38 c1 57 bc fe 3f e4 9d 3f 33 4f 50 03 40 36 82 82 18 6d 5f 09 40 0c 12 84 2b f7 0a 12 40 b0 72 ba 5d 0d 62 1e 40 67 c3 d1 2d 5d e7 36 40 17 1c 81 8c 8b 83 ef 3f 1d 16 3c 52 b7 91 e4 3f f7 0b 8a 74 a8 e3 d5 3f 1c 2d 52 42 f6 11 ee 3f 88 73 0b 7e 1a 3a c6 bf 38 50 cf a2 6f 83 e8 bf ab 4c 58 e8 7a b6 eb 3f 00 00 00 00 00 00 e0 3f cc be 6f cd bf 76 e0 bf 5f b6 5d 48 db 30 de bf fd 01 47 4f 60 0e d4 bf ed 1a 85 85 ee 48 c7 bf 59 53 f2 a7 03 36 b8 bf d0 06 82 dd 70 f9 a4 bf c1 a7 59 9d 23 14 8d bf f3 d3 08 c7 68 4f 6e bf 55 93 0f 01 95 70 eb 3f 0c a8 3f fe 3a 37 ec 3f 6f b5 e7 9e 5b 63 ee 3f 5a d1 0d 2a 50 77 ef 3f 5a 0f d3 2d 48 db ef 3f 04 81 1a 90 1f f9 ef 3f 4d e4 db 98 2c ff ef 3f d1 05 28 a5 f1 ff ef 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 46 cf fb 08 12 50 3d 6f 17 3b bb f5 69 5c 3d 6c c8 16 96 c0 35 4e 3d a8 c6 ce 9b e4 04 98 3d bb 32 18 67 a6 a4 95 3d 3d c2 82 44 3d 1a 93 3d 2a 36 70 68 9c 6a 90 3d 49 01 87 14 ff 35 8b 3d 62 d2 60 64 c1 61 85 3d 9f 5e f6 bb 4c 84 7e 3d 4a 2c 97 20 39 26 71 3d c0 b4 3c 3e 69 af 53 3d fd 13 fe 65 0a ff 97 bd 2c 63 43 bd 3f 75 95 bd 9b 8d 79 35 52 a6 92 bd 8d 31 f9 df 33 50 8f bd e0 eb 33 d3 bd 23 89 bd 35 a6 6e c6 47 f7 82 bd 0f 79 e9 76 ae f5 79 bd 9a 45 84 af f0 73 6d bd 37 7e 5d d3 36 4b 52 bd 66 42 a4 08 60 c3 50 bd b3 85 7f 7e 99 99 66 bd f1 9b b3 1b c4 89 70 bd 25 ff a6 7a ff be 73 bd 2b 92 e3 f6 8a d3 74 bd 25 ff a6 7a ff be 73 bd f1 9b b3 1b c4 89 70 bd ba 85 7f 7e 99 99 66 bd 70 42 a4 08 60 c3 50 bd }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

691c2625-90fb-4750-a9da-aa6015822499

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion