CRC32_poly_0xd6d6a3e8__32_big_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0xd6d6a3e8__32_big_refl_False_ (No description metadata provided).

rule CRC32_poly_0xd6d6a3e8__32_big_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 d6 d6 a3 e8 7b 7b e4 38 ad ad 47 d0 f6 f7 c8 70 20 21 6b 98 8d 8c 2c 48 5b 5a 8f a0 3b 39 33 08 ed ef 90 e0 40 42 d7 30 96 94 74 d8 cd ce fb 78 1b 18 58 90 b6 b5 1f 40 60 63 bc a8 76 72 66 10 a0 a4 c5 f8 0d 09 82 28 db df 21 c0 80 85 ae 60 56 53 0d 88 fb fe 4a 58 2d 28 e9 b0 4d 4b 55 18 9b 9d f6 f0 36 30 b1 20 e0 e6 12 c8 bb bc 9d 68 6d 6a 3e 80 c0 c7 79 50 16 11 da b8 ec e4 cc 20 3a 32 6f c8 97 9f 28 18 41 49 8b f0 1a 13 04 50 cc c5 a7 b8 61 68 e0 68 b7 be 43 80 d7 dd ff 28 01 0b 5c c0 ac a6 1b 10 7a 70 b8 f8 21 2a 37 58 f7 fc 94 b0 5a 51 d3 60 8c 87 70 88 9a 96 aa 30 4c 40 09 d8 e1 ed 4e 08 37 3b ed e0 6c 61 62 40 ba b7 c1 a8 17 1a 86 78 c1 cc 25 90 a1 af 99 38 77 79 3a d0 da d4 7d 00 0c 02 de e8 57 58 51 48 81 8e f2 a0 2c 23 b5 70 fa f5 16 98 0f 1f 3b a8 d9 c9 98 40 74 64 df 90 a2 b2 7c 78 f9 e8 f3 d8 2f 3e 50 30 82 93 17 e0 54 45 b4 08 34 26 08 a0 e2 f0 ab 48 4f 5d ec 98 99 8b 4f 70 c2 d1 c0 d0 14 07 63 38 b9 aa 24 e8 6f 7c 87 00 79 6d 5d b8 af bb fe 50 02 16 b9 80 d4 c0 1a 68 8f 9a 95 c8 59 4c 36 20 f4 e1 71 f0 22 37 d2 18 42 54 6e b0 94 82 cd 58 39 2f 8a 88 ef f9 29 60 b4 a3 a6 c0 62 75 05 28 cf d8 42 f8 19 0e e1 10 e3 fb f7 88 35 2d 54 60 98 80 13 b0 4e 56 b0 58 15 0c 3f f8 c3 da 9c 10 6e 77 db c0 b8 a1 78 28 d8 c2 c4 80 0e 14 67 68 a3 b9 20 b8 75 6f 83 50 2e 35 0c f0 f8 e3 af 18 55 4e e8 c8 83 98 4b 20 95 89 91 98 43 5f 32 70 ee f2 75 a0 38 24 d6 48 63 7e 59 e8 b5 a8 fa 00 18 05 bd d0 ce d3 1e 38 ae b0 a2 90 78 66 01 78 d5 cb 46 a8 03 1d e5 40 58 47 6a e0 8e 91 c9 08 23 3c 8e d8 f5 ea 2d 30 1e 3e 77 50 c8 e8 d4 b8 65 45 93 68 b3 93 30 80 e8 c9 bf 20 3e 1f 1c c8 93 b2 5b 18 45 64 f8 f0 25 07 44 58 f3 d1 e7 b0 5e 7c a0 60 88 aa 03 88 d3 f0 8c 28 05 26 2f c0 a8 8b 68 10 7e 5d cb f8 68 4c 11 40 be 9a b2 a8 13 37 f5 78 c5 e1 56 90 9e bb d9 30 48 6d 7a d8 e5 c0 3d 08 33 16 9e e0 53 75 22 48 85 a3 81 a0 28 0e c6 70 fe d8 65 98 a5 82 ea 38 73 54 49 d0 de f9 0e 00 08 2f ad e8 f2 da bb 70 24 0c 18 98 89 a1 5f 48 5f 77 fc a0 04 2d 73 00 d2 fb d0 e8 7f 56 97 38 a9 80 34 d0 c9 e3 88 78 1f 35 2b 90 b2 98 6c 40 64 4e cf a8 3f 14 40 08 e9 c2 e3 e0 44 6f a4 30 92 b9 07 d8 84 a8 dd 60 52 7e 7e 88 ff d3 39 58 29 05 9a b0 72 5f 15 10 a4 89 b6 f8 09 24 f1 28 df f2 52 c0 bf 91 ee 68 69 47 4d 80 c4 ea 0a 50 12 3c a9 b8 49 66 26 18 9f b0 85 f0 32 1d c2 20 e4 cb 61 c8 11 21 4c f8 c7 f7 ef 10 6a 5a a8 c0 bc 8c 0b 28 e7 d6 84 88 31 00 27 60 9c ad 60 b0 4a 7b c3 58 2a 18 7f f0 fc ce dc 18 51 63 9b c8 87 b5 38 20 dc ef b7 80 0a 39 14 68 a7 94 53 b8 71 42 f0 50 67 53 2a e8 b1 85 89 00 1c 28 ce d0 ca fe 6d 38 91 a4 e2 98 47 72 41 70 ea df 06 a0 3c 09 a5 48 5c 6a 19 e0 8a bc ba 08 27 11 fd d8 f1 c7 5e 30 aa 9d d1 90 7c 4b 72 78 d1 e6 35 a8 07 30 96 40 fd c5 80 d8 2b 13 23 30 86 be 64 e0 50 68 c7 08 0b 32 48 a8 dd e4 eb 40 70 49 ac 90 a6 9f 0f 78 c6 fc b3 d0 10 2a 10 38 bd 87 57 e8 6b 51 f4 00 30 0b 7b a0 e6 dd d8 48 4b 70 9f 98 9d a6 3c 70 8b b7 e6 c8 5d 61 45 20 f0 cc 02 f0 26 1a a1 18 7d 40 2e b8 ab 96 8d 50 06 3b ca 80 d0 ed 69 68 b0 8e d5 c0 66 58 76 28 cb f5 31 f8 1d 23 92 10 46 79 1d b0 90 af be 58 3d 02 f9 88 eb d4 5a 60 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

af7e0696-09c2-43f3-8dfb-b5ae58e86a28

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion