CRC_12_poly_0x80f__16_lil_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_12_poly_0x80f__16_lil_refl_True_ (No description metadata provided).

rule CRC_12_poly_0x80f__16_lil_refl_True_ {
  strings:
    $a0 = { 00 00 e4 3d c8 7b 2c 46 90 f7 74 ca 58 8c bc b1 01 0f e5 32 c9 74 2d 49 91 f8 75 c5 59 83 bd be 02 1e e6 23 ca 65 2e 58 92 e9 76 d4 5a 92 be af 03 11 e7 2c cb 6a 2f 57 93 e6 77 db 5b 9d bf a0 04 3c e0 01 cc 47 28 7a 94 cb 70 f6 5c b0 b8 8d 05 33 e1 0e cd 48 29 75 95 c4 71 f9 5d bf b9 82 06 22 e2 1f ce 59 2a 64 96 d5 72 e8 5e ae ba 93 07 2d e3 10 cf 56 2b 6b 97 da 73 e7 5f a1 bb 9c 08 78 ec 45 c0 03 24 3e 98 8f 7c b2 50 f4 b4 c9 09 77 ed 4a c1 0c 25 31 99 80 7d bd 51 fb b5 c6 0a 66 ee 5b c2 1d 26 20 9a 91 7e ac 52 ea b6 d7 0b 69 ef 54 c3 12 27 2f 9b 9e 7f a3 53 e5 b7 d8 0c 44 e8 79 c4 3f 20 02 9c b3 78 8e 54 c8 b0 f5 0d 4b e9 76 c5 30 21 0d 9d bc 79 81 55 c7 b1 fa 0e 5a ea 67 c6 21 22 1c 9e ad 7a 90 56 d6 b2 eb 0f 55 eb 68 c7 2e 23 13 9f a2 7b 9f 57 d9 b3 e4 10 f0 f4 cd d8 8b 3c b6 80 07 64 3a 48 7c ac 41 11 ff f5 c2 d9 84 3d b9 81 08 65 35 49 73 ad 4e 12 ee f6 d3 da 95 3e a8 82 19 66 24 4a 62 ae 5f 13 e1 f7 dc db 9a 3f a7 83 16 67 2b 4b 6d af 50 14 cc f0 f1 dc b7 38 8a 84 3b 60 06 4c 40 a8 7d 15 c3 f1 fe dd b8 39 85 85 34 61 09 4d 4f a9 72 16 d2 f2 ef de a9 3a 94 86 25 62 18 4e 5e aa 63 17 dd f3 e0 df a6 3b 9b 87 2a 63 17 4f 51 ab 6c 18 88 fc b5 d0 f3 34 ce 88 7f 6c 42 40 04 a4 39 19 87 fd ba d1 fc 35 c1 89 70 6d 4d 41 0b a5 36 1a 96 fe ab d2 ed 36 d0 8a 61 6e 5c 42 1a a6 27 1b 99 ff a4 d3 e2 37 df 8b 6e 6f 53 43 15 a7 28 1c b4 f8 89 d4 cf 30 f2 8c 43 68 7e 44 38 a0 05 1d bb f9 86 d5 c0 31 fd 8d 4c 69 71 45 37 a1 0a 1e aa fa 97 d6 d1 32 ec 8e 5d 6a 60 46 26 a2 1b 1f a5 fb 98 d7 de 33 e3 8f 52 6b 6f 47 29 a3 14 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4c1aaa7e-98f2-4995-b216-f44ed12ada11

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion