CRC32_poly_0x1db71064__32_big_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x1db71064__32_big_refl_True_ (No description metadata provided).

rule CRC32_poly_0x1db71064__32_big_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 1e 0b 41 de 3c 16 83 bc 22 1d c2 62 34 3c dc 09 2a 37 9d d7 08 2a 5f b5 16 21 1e 6b 24 68 63 63 3a 63 22 bd 18 7e e0 df 06 75 a1 01 10 54 bf 6a 0e 5f fe b4 2c 42 3c d6 32 49 7d 08 04 c1 1d b7 1a ca 5c 69 38 d7 9e 0b 26 dc df d5 30 fd c1 be 2e f6 80 60 0c eb 42 02 12 e0 03 dc 20 a9 7e d4 3e a2 3f 0a 1c bf fd 68 02 b4 bc b6 14 95 a2 dd 0a 9e e3 03 28 83 21 61 36 88 60 bf 09 82 3b 6e 17 89 7a b0 35 94 b8 d2 2b 9f f9 0c 3d be e7 67 23 b5 a6 b9 01 a8 64 db 1f a3 25 05 2d ea 58 0d 33 e1 19 d3 11 fc db b1 0f f7 9a 6f 19 d6 84 04 07 dd c5 da 25 c0 07 b8 3b cb 46 66 0d 43 26 d9 13 48 67 07 31 55 a5 65 2f 5e e4 bb 39 7f fa d0 27 74 bb 0e 05 69 79 6c 1b 62 38 b2 29 2b 45 ba 37 20 04 64 15 3d c6 06 0b 36 87 d8 1d 17 99 b3 03 1c d8 6d 21 01 1a 0f 3f 0a 5b d1 13 04 76 dc 0d 0f 37 02 2f 12 f5 60 31 19 b4 be 27 38 aa d5 39 33 eb 0b 1b 2e 29 69 05 25 68 b7 37 6c 15 bf 29 67 54 61 0b 7a 96 03 15 71 d7 dd 03 50 c9 b6 1d 5b 88 68 3f 46 4a 0a 21 4d 0b d4 17 c5 6b 6b 09 ce 2a b5 2b d3 e8 d7 35 d8 a9 09 23 f9 b7 62 3d f2 f6 bc 1f ef 34 de 01 e4 75 00 33 ad 08 08 2d a6 49 d6 0f bb 8b b4 11 b0 ca 6a 07 91 d4 01 19 9a 95 df 3b 87 57 bd 25 8c 16 63 1a 86 4d b2 04 8d 0c 6c 26 90 ce 0e 38 9b 8f d0 2e ba 91 bb 30 b1 d0 65 12 ac 12 07 0c a7 53 d9 3e ee 2e d1 20 e5 6f 0f 02 f8 ad 6d 1c f3 ec b3 0a d2 f2 d8 14 d9 b3 06 36 c4 71 64 28 cf 30 ba 1e 47 50 05 00 4c 11 db 22 51 d3 b9 3c 5a 92 67 2a 7b 8c 0c 34 70 cd d2 16 6d 0f b0 08 66 4e 6e 3a 2f 33 66 24 24 72 b8 06 39 b0 da 18 32 f1 04 0e 13 ef 6f 10 18 ae b1 32 05 6c d3 2c 0e 2d 0d 26 08 ed b8 38 03 ac 66 1a 1e 6e 04 04 15 2f da 12 34 31 b1 0c 3f 70 6f 2e 22 b2 0d 30 29 f3 d3 02 60 8e db 1c 6b cf 05 3e 76 0d 67 20 7d 4c b9 36 5c 52 d2 28 57 13 0c 0a 4a d1 6e 14 41 90 b0 22 c9 f0 0f 3c c2 b1 d1 1e df 73 b3 00 d4 32 6d 16 f5 2c 06 08 fe 6d d8 2a e3 af ba 34 e8 ee 64 06 a1 93 6c 18 aa d2 b2 3a b7 10 d0 24 bc 51 0e 32 9d 4f 65 2c 96 0e bb 0e 8b cc d9 10 80 8d 07 2f 8a d6 d6 31 81 97 08 13 9c 55 6a 0d 97 14 b4 1b b6 0a df 05 bd 4b 01 27 a0 89 63 39 ab c8 bd 0b e2 b5 b5 15 e9 f4 6b 37 f4 36 09 29 ff 77 d7 3f de 69 bc 21 d5 28 62 03 c8 ea 00 1d c3 ab de 2b 4b cb 61 35 40 8a bf 17 5d 48 dd 09 56 09 03 1f 77 17 68 01 7c 56 b6 23 61 94 d4 3d 6a d5 0a 0f 23 a8 02 11 28 e9 dc 33 35 2b be 2d 3e 6a 60 3b 1f 74 0b 25 14 35 d5 07 09 f7 b7 19 02 b6 69 35 0c 9b 64 2b 07 da ba 09 1a 18 d8 17 11 59 06 01 30 47 6d 1f 3b 06 b3 3d 26 c4 d1 23 2d 85 0f 11 64 f8 07 0f 6f b9 d9 2d 72 7b bb 33 79 3a 65 25 58 24 0e 3b 53 65 d0 19 4e a7 b2 07 45 e6 6c 31 cd 86 d3 2f c6 c7 0d 0d db 05 6f 13 d0 44 b1 05 f1 5a da 1b fa 1b 04 39 e7 d9 66 27 ec 98 b8 15 a5 e5 b0 0b ae a4 6e 29 b3 66 0c 37 b8 27 d2 21 99 39 b9 3f 92 78 67 1d 8f ba 05 03 84 fb db 3c 8e a0 0a 22 85 e1 d4 00 98 23 b6 1e 93 62 68 08 b2 7c 03 16 b9 3d dd 34 a4 ff bf 2a af be 61 18 e6 c3 69 06 ed 82 b7 24 f0 40 d5 3a fb 01 0b 2c da 1f 60 32 d1 5e be 10 cc 9c dc 0e c7 dd 02 38 4f bd bd 26 44 fc 63 04 59 3e 01 1a 52 7f df 0c 73 61 b4 12 78 20 6a 30 65 e2 08 2e 6e a3 d6 1c 27 de de 02 2c 9f 00 20 31 5d 62 3e 3a 1c bc 28 1b 02 d7 36 10 43 09 14 0d 81 6b 0a 06 c0 b5 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

3199965a-6293-4c16-96be-dbc959bc9b86

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion