CRC32_poly_0xcb61b38c__32_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0xcb61b38c__32_lil_refl_False_ (No description metadata provided).

rule CRC32_poly_0xcb61b38c__32_lil_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 8c b3 61 cb 94 d4 a2 5d 18 67 c3 96 28 a9 45 bb a4 1a 24 70 bc 7d e7 e6 30 ce 86 2d dc e1 ea bd 50 52 8b 76 48 35 48 e0 c4 86 29 2b f4 48 af 06 78 fb ce cd 60 9c 0d 5b ec 2f 6c 90 34 70 b4 b0 b8 c3 d5 7b a0 a4 16 ed 2c 17 77 26 1c d9 f1 0b 90 6a 90 c0 88 0d 53 56 04 be 32 9d e8 91 5e 0d 64 22 3f c6 7c 45 fc 50 f0 f6 9d 9b c0 38 1b b6 4c 8b 7a 7d 54 ec b9 eb d8 5f d8 20 e4 53 09 aa 68 e0 68 61 70 87 ab f7 fc 34 ca 3c cc fa 4c 11 40 49 2d da 58 2e ee 4c d4 9d 8f 87 38 b2 e3 17 b4 01 82 dc ac 66 41 4a 20 d5 20 81 10 1b a6 ac 9c a8 c7 67 84 cf 04 f1 08 7c 65 3a d0 23 bd 1a 5c 90 dc d1 44 f7 1f 47 c8 44 7e 8c f8 8a f8 a1 74 39 99 6a 6c 5e 5a fc e0 ed 3b 37 0c c2 57 a7 80 71 36 6c 98 16 f5 fa 14 a5 94 31 24 6b 12 1c a8 d8 73 d7 b0 bf b0 41 3c 0c d1 8a 44 14 73 9f c8 a7 12 54 d0 c0 d1 c2 5c 73 b0 09 6c bd 36 24 e0 0e 57 ef f8 69 94 79 74 da f5 b2 98 f5 99 22 14 46 f8 e9 0c 21 3b 7f 80 92 5a b4 b0 5c dc 99 3c ef bd 52 24 88 7e c4 a8 3b 1f 0f 70 64 c7 2f fc d7 a6 e4 e4 b0 65 72 68 03 04 b9 58 cd 82 94 d4 7e e3 5f cc 19 20 c9 40 aa 41 02 ac 85 2d 92 20 36 4c 59 38 51 8f cf b4 e2 ee 04 84 2c 68 29 08 9f 09 e2 10 f8 ca 74 9c 4b ab bf a0 47 7a 35 2c f4 1b fe 34 93 d8 68 b8 20 b9 a3 88 ee 3f 8e 04 5d 5e 45 1c 3a 9d d3 90 89 fc 18 7c a6 90 88 f0 15 f1 43 e8 72 32 d5 64 c1 53 1e 54 0f d5 33 d8 bc b4 f8 c0 db 77 6e 4c 68 16 a5 94 37 ce 85 18 84 af 4e 00 e3 6c d8 8c 50 0d 13 bc 9e 8b 3e 30 2d ea f5 28 4a 29 63 a4 f9 48 a8 48 d6 24 38 c4 65 45 f3 dc 02 86 65 50 b1 e7 ae 60 7f 61 83 ec cc 00 48 f4 ab c3 de 78 18 a2 15 04 9b 87 f5 88 28 e6 3e 90 4f 25 a8 1c fc 44 63 2c 32 c2 4e a0 81 a3 85 b8 e6 60 13 34 55 01 d8 d8 7a 6d 48 54 c9 0c 83 4c ae cf 15 c0 1d ae de f0 d3 28 f3 7c 60 49 38 64 07 8a ae e8 b4 eb 65 30 eb 33 45 bc 58 52 8e a4 3f 91 18 28 8c f0 d3 18 42 76 fe 94 f1 17 35 8c 96 d4 a3 00 25 b5 68 ec 0a d9 f8 60 b9 b8 33 78 de 7b a5 f4 6d 1a 6e c4 a3 9c 43 48 10 fd 88 50 77 3e 1e dc c4 5f d5 e0 c8 8e 5f 6c 7b ef 94 74 1c 2c 02 f8 af 4d c9 c8 61 cb e4 44 d2 aa 2f 5c b5 69 b9 d0 06 08 72 3c 29 64 e2 b0 9a 05 29 a8 fd c6 bf 24 4e a7 74 14 80 21 59 98 33 40 92 80 54 83 04 0c e7 e2 cf d4 b8 3a ef 58 0b 5b 24 40 6c 98 b2 cc df f9 79 fc 11 7f 54 70 a2 1e 9f 68 c5 dd 09 e4 76 bc c2 08 59 d0 52 84 ea b1 99 9c 8d 72 0f 10 3e 13 c4 20 f0 95 e9 ac 43 f4 22 b4 24 37 b4 38 97 56 7f 40 8f f4 6a cc 3c 95 a1 d4 5b 56 37 58 e8 37 fc 68 26 b1 d1 e4 95 d0 1a fc f2 13 8c 70 41 72 47 9c 6e 1e d7 10 dd 7f 1c 08 ba bc 8a 84 09 dd 41 b4 c7 5b 6c 38 74 3a a7 20 13 f9 31 ac a0 98 fa 74 ff 40 da f8 4c 21 11 e0 2b e2 87 6c 98 83 4c 5c 56 05 61 d0 e5 64 aa c8 82 a7 3c 44 31 c6 f7 a8 1e aa 67 24 ad cb ac 3c ca 08 3a b0 79 69 f1 80 b7 ef dc 0c 04 8e 17 14 63 4d 81 98 d0 2c 4a a4 dc fd c0 28 6f 9c 0b 30 08 5f 9d bc bb 3e 56 8c 75 b8 7b 00 c6 d9 b0 18 a1 1a 26 94 12 7b ed 78 3d 17 7d f4 8e 76 b6 ec e9 b5 20 60 5a d4 eb 50 94 52 c6 dc 27 33 0d c4 40 f0 9b 48 f3 91 50 90 ac 49 70 1c 1f 28 bb 04 78 eb 2d 88 cb 8a e6 b8 05 0c cb 34 b6 6d 00 2c d1 ae 96 a0 62 cf 5d 4c 4d a3 cd c0 fe c2 06 d8 99 01 90 54 2a 60 5b 64 e4 e6 76 e8 57 87 bd f0 30 44 2b 7c 83 25 e0 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1cefe41e-d895-44e1-8abb-227a3a4b49de

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion