libavcodec_aac_codebook_vector10flt32_32_big_2312_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libavcodec_aac_codebook_vector10__flt32___32_big_2312_ (No description metadata provided).

rule libavcodec_aac_codebook_vector10__flt32___32_big_2312_ {
  strings:
    $a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 3f 80 00 00 00 00 00 00 40 21 45 18 00 00 00 00 40 8a 74 ba 00 00 00 00 40 cb 2f f5 00 00 00 00 41 08 cc 4f 00 00 00 00 41 2e 71 8e 00 00 00 00 41 56 3f 90 00 00 00 00 41 80 00 00 00 00 00 00 41 95 c4 1b 00 00 00 00 41 ac 5a d3 00 00 00 00 41 c3 b5 d3 00 00 00 00 41 db c8 ff 00 00 00 00 41 f4 89 ef 00 00 00 00 42 06 f7 cd 00 00 00 00 42 13 f9 04 00 00 00 00 42 80 00 00 3f 80 00 00 00 00 00 00 3f 80 00 00 3f 80 00 00 3f 80 00 00 40 21 45 18 3f 80 00 00 40 8a 74 ba 3f 80 00 00 40 cb 2f f5 3f 80 00 00 41 08 cc 4f 3f 80 00 00 41 2e 71 8e 3f 80 00 00 41 56 3f 90 3f 80 00 00 41 80 00 00 3f 80 00 00 41 95 c4 1b 3f 80 00 00 41 ac 5a d3 3f 80 00 00 41 c3 b5 d3 3f 80 00 00 41 db c8 ff 3f 80 00 00 41 f4 89 ef 3f 80 00 00 42 06 f7 cd 3f 80 00 00 42 13 f9 04 3f 80 00 00 42 80 00 00 40 21 45 18 00 00 00 00 40 21 45 18 3f 80 00 00 40 21 45 18 40 21 45 18 40 21 45 18 40 8a 74 ba 40 21 45 18 40 cb 2f f5 40 21 45 18 41 08 cc 4f 40 21 45 18 41 2e 71 8e 40 21 45 18 41 56 3f 90 40 21 45 18 41 80 00 00 40 21 45 18 41 95 c4 1b 40 21 45 18 41 ac 5a d3 40 21 45 18 41 c3 b5 d3 40 21 45 18 41 db c8 ff 40 21 45 18 41 f4 89 ef 40 21 45 18 42 06 f7 cd 40 21 45 18 42 13 f9 04 40 21 45 18 42 80 00 00 40 8a 74 ba 00 00 00 00 40 8a 74 ba 3f 80 00 00 40 8a 74 ba 40 21 45 18 40 8a 74 ba 40 8a 74 ba 40 8a 74 ba 40 cb 2f f5 40 8a 74 ba 41 08 cc 4f 40 8a 74 ba 41 2e 71 8e 40 8a 74 ba 41 56 3f 90 40 8a 74 ba 41 80 00 00 40 8a 74 ba 41 95 c4 1b 40 8a 74 ba 41 ac 5a d3 40 8a 74 ba 41 c3 b5 d3 40 8a 74 ba 41 db c8 ff 40 8a 74 ba 41 f4 89 ef 40 8a 74 ba 42 06 f7 cd 40 8a 74 ba 42 13 f9 04 40 8a 74 ba 42 80 00 00 40 cb 2f f5 00 00 00 00 40 cb 2f f5 3f 80 00 00 40 cb 2f f5 40 21 45 18 40 cb 2f f5 40 8a 74 ba 40 cb 2f f5 40 cb 2f f5 40 cb 2f f5 41 08 cc 4f 40 cb 2f f5 41 2e 71 8e 40 cb 2f f5 41 56 3f 90 40 cb 2f f5 41 80 00 00 40 cb 2f f5 41 95 c4 1b 40 cb 2f f5 41 ac 5a d3 40 cb 2f f5 41 c3 b5 d3 40 cb 2f f5 41 db c8 ff 40 cb 2f f5 41 f4 89 ef 40 cb 2f f5 42 06 f7 cd 40 cb 2f f5 42 13 f9 04 40 cb 2f f5 42 80 00 00 41 08 cc 4f 00 00 00 00 41 08 cc 4f 3f 80 00 00 41 08 cc 4f 40 21 45 18 41 08 cc 4f 40 8a 74 ba 41 08 cc 4f 40 cb 2f f5 41 08 cc 4f 41 08 cc 4f 41 08 cc 4f 41 2e 71 8e 41 08 cc 4f 41 56 3f 90 41 08 cc 4f 41 80 00 00 41 08 cc 4f 41 95 c4 1b 41 08 cc 4f 41 ac 5a d3 41 08 cc 4f 41 c3 b5 d3 41 08 cc 4f 41 db c8 ff 41 08 cc 4f 41 f4 89 ef 41 08 cc 4f 42 06 f7 cd 41 08 cc 4f 42 13 f9 04 41 08 cc 4f 42 80 00 00 41 2e 71 8e 00 00 00 00 41 2e 71 8e 3f 80 00 00 41 2e 71 8e 40 21 45 18 41 2e 71 8e 40 8a 74 ba 41 2e 71 8e 40 cb 2f f5 41 2e 71 8e 41 08 cc 4f 41 2e 71 8e 41 2e 71 8e 41 2e 71 8e 41 56 3f 90 41 2e 71 8e 41 80 00 00 41 2e 71 8e 41 95 c4 1b 41 2e 71 8e 41 ac 5a d3 41 2e 71 8e 41 c3 b5 d3 41 2e 71 8e 41 db c8 ff 41 2e 71 8e 41 f4 89 ef 41 2e 71 8e 42 06 f7 cd 41 2e 71 8e 42 13 f9 04 41 2e 71 8e 42 80 00 00 41 56 3f 90 00 00 00 00 41 56 3f 90 3f 80 00 00 41 56 3f 90 40 21 45 18 41 56 3f 90 40 8a 74 ba 41 56 3f 90 40 cb 2f f5 41 56 3f 90 41 08 cc 4f 41 56 3f 90 41 2e 71 8e 41 56 3f 90 41 56 3f 90 41 56 3f 90 41 80 00 00 41 56 3f 90 41 95 c4 1b 41 56 3f 90 41 ac 5a d3 41 56 3f 90 41 c3 b5 d3 41 56 3f 90 41 db c8 ff 41 56 3f 90 41 f4 89 ef 41 56 3f 90 42 06 f7 cd 41 56 3f 90 42 13 f9 04 41 56 3f 90 42 80 00 00 41 80 00 00 00 00 00 00 41 80 00 00 3f 80 00 00 41 80 00 00 40 21 45 18 41 80 00 00 40 8a 74 ba 41 80 00 00 40 cb 2f f5 41 80 00 00 41 08 cc 4f 41 80 00 00 41 2e 71 8e 41 80 00 00 41 56 3f 90 41 80 00 00 41 80 00 00 41 80 00 00 41 95 c4 1b 41 80 00 00 41 ac 5a d3 41 80 00 00 41 c3 b5 d3 41 80 00 00 41 db c8 ff 41 80 00 00 41 f4 89 ef 41 80 00 00 42 06 f7 cd 41 80 00 00 42 13 f9 04 41 80 00 00 42 80 00 00 41 95 c4 1b 00 00 00 00 41 95 c4 1b 3f 80 00 00 41 95 c4 1b 40 21 45 18 41 95 c4 1b 40 8a 74 ba 41 95 c4 1b 40 cb 2f f5 41 95 c4 1b 41 08 cc 4f 41 95 c4 1b 41 2e 71 8e 41 95 c4 1b 41 56 3f 90 41 95 c4 1b 41 80 00 00 41 95 c4 1b 41 95 c4 1b 41 95 c4 1b 41 ac 5a d3 41 95 c4 1b 41 c3 b5 d3 41 95 c4 1b 41 db c8 ff 41 95 c4 1b 41 f4 89 ef 41 95 c4 1b 42 06 f7 cd 41 95 c4 1b 42 13 f9 04 41 95 c4 1b 42 80 00 00 41 ac 5a d3 00 00 00 00 41 ac 5a d3 3f 80 00 00 41 ac 5a d3 40 21 45 18 41 ac 5a d3 40 8a 74 ba 41 ac 5a d3 40 cb 2f f5 41 ac 5a d3 41 08 cc 4f 41 ac 5a d3 41 2e 71 8e 41 ac 5a d3 41 56 3f 90 41 ac 5a d3 41 80 00 00 41 ac 5a d3 41 95 c4 1b 41 ac 5a d3 41 ac 5a d3 41 ac 5a d3 41 c3 b5 d3 41 ac 5a d3 41 db c8 ff 41 ac 5a d3 41 f4 89 ef 41 ac 5a d3 42 06 f7 cd 41 ac 5a d3 42 13 f9 04 41 ac 5a d3 42 80 00 00 41 c3 b5 d3 00 00 00 00 41 c3 b5 d3 3f 80 00 00 41 c3 b5 d3 40 21 45 18 41 c3 b5 d3 40 8a 74 ba 41 c3 b5 d3 40 cb 2f f5 41 c3 b5 d3 41 08 cc 4f 41 c3 b5 d3 41 2e 71 8e 41 c3 b5 d3 41 56 3f 90 41 c3 b5 d3 41 80 00 00 41 c3 b5 d3 41 95 c4 1b 41 c3 b5 d3 41 ac 5a d3 41 c3 b5 d3 41 c3 b5 d3 41 c3 b5 d3 41 db c8 ff 41 c3 b5 d3 41 f4 89 ef 41 c3 b5 d3 42 06 f7 cd 41 c3 b5 d3 42 13 f9 04 41 c3 b5 d3 42 80 00 00 41 db c8 ff 00 00 00 00 41 db c8 ff 3f 80 00 00 41 db c8 ff 40 21 45 18 41 db c8 ff 40 8a 74 ba 41 db c8 ff 40 cb 2f f5 41 db c8 ff 41 08 cc 4f 41 db c8 ff 41 2e 71 8e 41 db c8 ff 41 56 3f 90 41 db c8 ff 41 80 00 00 41 db c8 ff 41 95 c4 1b 41 db c8 ff 41 ac 5a d3 41 db c8 ff 41 c3 b5 d3 41 db c8 ff 41 db c8 ff 41 db c8 ff 41 f4 89 ef 41 db c8 ff 42 06 f7 cd 41 db c8 ff 42 13 f9 04 41 db c8 ff 42 80 00 00 41 f4 89 ef 00 00 00 00 41 f4 89 ef 3f 80 00 00 41 f4 89 ef 40 21 45 18 41 f4 89 ef 40 8a 74 ba 41 f4 89 ef 40 cb 2f f5 41 f4 89 ef 41 08 cc 4f 41 f4 89 ef 41 2e 71 8e 41 f4 89 ef 41 56 3f 90 41 f4 89 ef 41 80 00 00 41 f4 89 ef 41 95 c4 1b 41 f4 89 ef 41 ac 5a d3 41 f4 89 ef 41 c3 b5 d3 41 f4 89 ef 41 db c8 ff 41 f4 89 ef 41 f4 89 ef 41 f4 89 ef 42 06 f7 cd 41 f4 89 ef 42 13 f9 04 41 f4 89 ef 42 80 00 00 42 06 f7 cd 00 00 00 00 42 06 f7 cd 3f 80 00 00 42 06 f7 cd 40 21 45 18 42 06 f7 cd 40 8a 74 ba 42 06 f7 cd 40 cb 2f f5 42 06 f7 cd 41 08 cc 4f 42 06 f7 cd 41 2e 71 8e 42 06 f7 cd 41 56 3f 90 42 06 f7 cd 41 80 00 00 42 06 f7 cd 41 95 c4 1b 42 06 f7 cd 41 ac 5a d3 42 06 f7 cd 41 c3 b5 d3 42 06 f7 cd 41 db c8 ff 42 06 f7 cd 41 f4 89 ef 42 06 f7 cd 42 06 f7 cd 42 06 f7 cd 42 13 f9 04 42 06 f7 cd 42 80 00 00 42 13 f9 04 00 00 00 00 42 13 f9 04 3f 80 00 00 42 13 f9 04 40 21 45 18 42 13 f9 04 40 8a 74 ba 42 13 f9 04 40 cb 2f f5 42 13 f9 04 41 08 cc 4f 42 13 f9 04 41 2e 71 8e 42 13 f9 04 41 56 3f 90 42 13 f9 04 41 80 00 00 42 13 f9 04 41 95 c4 1b 42 13 f9 04 41 ac 5a d3 42 13 f9 04 41 c3 b5 d3 42 13 f9 04 41 db c8 ff 42 13 f9 04 41 f4 89 ef 42 13 f9 04 42 06 f7 cd 42 13 f9 04 42 13 f9 04 42 13 f9 04 42 80 00 00 42 80 00 00 00 00 00 00 42 80 00 00 3f 80 00 00 42 80 00 00 40 21 45 18 42 80 00 00 40 8a 74 ba 42 80 00 00 40 cb 2f f5 42 80 00 00 41 08 cc 4f 42 80 00 00 41 2e 71 8e 42 80 00 00 41 56 3f 90 42 80 00 00 41 80 00 00 42 80 00 00 41 95 c4 1b 42 80 00 00 41 ac 5a d3 42 80 00 00 41 c3 b5 d3 42 80 00 00 41 db c8 ff 42 80 00 00 41 f4 89 ef 42 80 00 00 42 06 f7 cd 42 80 00 00 42 13 f9 04 42 80 00 00 42 80 00 00 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5bcf1636-97e7-4af2-8b5b-1a12fa31eeaa

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion