CRC32_poly_0x4db26158__32_lil_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x4db26158__32_lil_refl_True_ (No description metadata provided).

rule CRC32_poly_0x4db26158__32_lil_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 2c 64 10 05 58 c8 20 0a 74 ac 30 0f b0 90 41 14 9c f4 51 11 e8 58 61 1e c4 3c 71 1b 05 ba 8f 1d 29 de 9f 18 5d 72 af 17 71 16 bf 12 b5 2a ce 09 99 4e de 0c ed e2 ee 03 c1 86 fe 06 6f ef 13 0e 43 8b 03 0b 37 27 33 04 1b 43 23 01 df 7f 52 1a f3 1b 42 1f 87 b7 72 10 ab d3 62 15 6a 55 9c 13 46 31 8c 16 32 9d bc 19 1e f9 ac 1c da c5 dd 07 f6 a1 cd 02 82 0d fd 0d ae 69 ed 08 de de 27 1c f2 ba 37 19 86 16 07 16 aa 72 17 13 6e 4e 66 08 42 2a 76 0d 36 86 46 02 1a e2 56 07 db 64 a8 01 f7 00 b8 04 83 ac 88 0b af c8 98 0e 6b f4 e9 15 47 90 f9 10 33 3c c9 1f 1f 58 d9 1a b1 31 34 12 9d 55 24 17 e9 f9 14 18 c5 9d 04 1d 01 a1 75 06 2d c5 65 03 59 69 55 0c 75 0d 45 09 b4 8b bb 0f 98 ef ab 0a ec 43 9b 05 c0 27 8b 00 04 1b fa 1b 28 7f ea 1e 5c d3 da 11 70 b7 ca 14 d9 26 43 0d f5 42 53 08 81 ee 63 07 ad 8a 73 02 69 b6 02 19 45 d2 12 1c 31 7e 22 13 1d 1a 32 16 dc 9c cc 10 f0 f8 dc 15 84 54 ec 1a a8 30 fc 1f 6c 0c 8d 04 40 68 9d 01 34 c4 ad 0e 18 a0 bd 0b b6 c9 50 03 9a ad 40 06 ee 01 70 09 c2 65 60 0c 06 59 11 17 2a 3d 01 12 5e 91 31 1d 72 f5 21 18 b3 73 df 1e 9f 17 cf 1b eb bb ff 14 c7 df ef 11 03 e3 9e 0a 2f 87 8e 0f 5b 2b be 00 77 4f ae 05 07 f8 64 11 2b 9c 74 14 5f 30 44 1b 73 54 54 1e b7 68 25 05 9b 0c 35 00 ef a0 05 0f c3 c4 15 0a 02 42 eb 0c 2e 26 fb 09 5a 8a cb 06 76 ee db 03 b2 d2 aa 18 9e b6 ba 1d ea 1a 8a 12 c6 7e 9a 17 68 17 77 1f 44 73 67 1a 30 df 57 15 1c bb 47 10 d8 87 36 0b f4 e3 26 0e 80 4f 16 01 ac 2b 06 04 6d ad f8 02 41 c9 e8 07 35 65 d8 08 19 01 c8 0d dd 3d b9 16 f1 59 a9 13 85 f5 99 1c a9 91 89 19 b2 4d 86 1a 9e 29 96 1f ea 85 a6 10 c6 e1 b6 15 02 dd c7 0e 2e b9 d7 0b 5a 15 e7 04 76 71 f7 01 b7 f7 09 07 9b 93 19 02 ef 3f 29 0d c3 5b 39 08 07 67 48 13 2b 03 58 16 5f af 68 19 73 cb 78 1c dd a2 95 14 f1 c6 85 11 85 6a b5 1e a9 0e a5 1b 6d 32 d4 00 41 56 c4 05 35 fa f4 0a 19 9e e4 0f d8 18 1a 09 f4 7c 0a 0c 80 d0 3a 03 ac b4 2a 06 68 88 5b 1d 44 ec 4b 18 30 40 7b 17 1c 24 6b 12 6c 93 a1 06 40 f7 b1 03 34 5b 81 0c 18 3f 91 09 dc 03 e0 12 f0 67 f0 17 84 cb c0 18 a8 af d0 1d 69 29 2e 1b 45 4d 3e 1e 31 e1 0e 11 1d 85 1e 14 d9 b9 6f 0f f5 dd 7f 0a 81 71 4f 05 ad 15 5f 00 03 7c b2 08 2f 18 a2 0d 5b b4 92 02 77 d0 82 07 b3 ec f3 1c 9f 88 e3 19 eb 24 d3 16 c7 40 c3 13 06 c6 3d 15 2a a2 2d 10 5e 0e 1d 1f 72 6a 0d 1a b6 56 7c 01 9a 32 6c 04 ee 9e 5c 0b c2 fa 4c 0e 6b 6b c5 17 47 0f d5 12 33 a3 e5 1d 1f c7 f5 18 db fb 84 03 f7 9f 94 06 83 33 a4 09 af 57 b4 0c 6e d1 4a 0a 42 b5 5a 0f 36 19 6a 00 1a 7d 7a 05 de 41 0b 1e f2 25 1b 1b 86 89 2b 14 aa ed 3b 11 04 84 d6 19 28 e0 c6 1c 5c 4c f6 13 70 28 e6 16 b4 14 97 0d 98 70 87 08 ec dc b7 07 c0 b8 a7 02 01 3e 59 04 2d 5a 49 01 59 f6 79 0e 75 92 69 0b b1 ae 18 10 9d ca 08 15 e9 66 38 1a c5 02 28 1f b5 b5 e2 0b 99 d1 f2 0e ed 7d c2 01 c1 19 d2 04 05 25 a3 1f 29 41 b3 1a 5d ed 83 15 71 89 93 10 b0 0f 6d 16 9c 6b 7d 13 e8 c7 4d 1c c4 a3 5d 19 00 9f 2c 02 2c fb 3c 07 58 57 0c 08 74 33 1c 0d da 5a f1 05 f6 3e e1 00 82 92 d1 0f ae f6 c1 0a 6a ca b0 11 46 ae a0 14 32 02 90 1b 1e 66 80 1e df e0 7e 18 f3 84 6e 1d 87 28 5e 12 ab 4c 4e 17 6f 70 3f 0c 43 14 2f 09 37 b8 1f 06 1b dc 0f 03 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

52961fa5-c4f6-43a6-b1e5-df12af83d217

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion