CRC32_poly_0x6b6b51f4__32_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x6b6b51f4__32_lil_refl_False_ (No description metadata provided).

rule CRC32_poly_0x6b6b51f4__32_lil_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 f4 51 6b 6b e8 a3 d6 d6 1c f2 bd bd 24 16 c6 c6 d0 47 ad ad cc b5 10 10 38 e4 7b 7b bc 7d e7 e6 48 2c 8c 8d 54 de 31 30 a0 8f 5a 5b 98 6b 21 20 6c 3a 4a 4b 70 c8 f7 f6 84 99 9c 9d 8c aa a5 a6 78 fb ce cd 64 09 73 70 90 58 18 1b a8 bc 63 60 5c ed 08 0b 40 1f b5 b6 b4 4e de dd 30 d7 42 40 c4 86 29 2b d8 74 94 96 2c 25 ff fd 14 c1 84 86 e0 90 ef ed fc 62 52 50 08 33 39 3b ec 04 20 26 18 55 4b 4d 04 a7 f6 f0 f0 f6 9d 9b c8 12 e6 e0 3c 43 8d 8b 20 b1 30 36 d4 e0 5b 5d 50 79 c7 c0 a4 28 ac ab b8 da 11 16 4c 8b 7a 7d 74 6f 01 06 80 3e 6a 6d 9c cc d7 d0 68 9d bc bb 60 ae 85 80 94 ff ee eb 88 0d 53 56 7c 5c 38 3d 44 b8 43 46 b0 e9 28 2d ac 1b 95 90 58 4a fe fb dc d3 62 66 28 82 09 0d 34 70 b4 b0 c0 21 df db f8 c5 a4 a0 0c 94 cf cb 10 66 72 76 e4 37 19 1d d8 09 40 4c 2c 58 2b 27 30 aa 96 9a c4 fb fd f1 fc 1f 86 8a 08 4e ed e1 14 bc 50 5c e0 ed 3b 37 64 74 a7 aa 90 25 cc c1 8c d7 71 7c 78 86 1a 17 40 62 61 6c b4 33 0a 07 a8 c1 b7 ba 5c 90 dc d1 54 a3 e5 ea a0 f2 8e 81 bc 00 33 3c 48 51 58 57 70 b5 23 2c 84 e4 48 47 98 16 f5 fa 6c 47 9e 91 e8 de 02 0c 1c 8f 69 67 00 7d d4 da f4 2c bf b1 cc c8 c4 ca 38 99 af a1 24 6b 12 1c d0 3a 79 77 34 0d 60 6a c0 5c 0b 01 dc ae b6 bc 28 ff dd d7 10 1b a6 ac e4 4a cd c7 f8 b8 70 7a 0c e9 1b 11 88 70 87 8c 7c 21 ec e7 60 d3 51 5a 94 82 3a 31 ac 66 41 4a 58 37 2a 21 44 c5 97 9c b0 94 fc f7 b8 a7 c5 cc 4c f6 ae a7 50 04 13 1a a4 55 78 71 9c b1 03 0a 68 e0 68 61 74 12 d5 dc 80 43 be b7 04 da 22 2a f0 8b 49 41 ec 79 f4 fc 18 28 9f 97 20 cc e4 ec d4 9d 8f 87 c8 6f 32 3a 3c 3e 59 51 b0 13 80 98 44 42 eb f3 58 b0 56 4e ac e1 3d 25 94 05 46 5e 60 54 2d 35 7c a6 90 88 88 f7 fb e3 0c 6e 67 7e f8 3f 0c 15 e4 cd b1 a8 10 9c da c3 28 78 a1 b8 dc 29 ca d3 c0 db 77 6e 34 8a 1c 05 3c b9 25 3e c8 e8 4e 55 d4 1a f3 e8 20 4b 98 83 18 af e3 f8 ec fe 88 93 f0 0c 35 2e 04 5d 5e 45 80 c4 c2 d8 74 95 a9 b3 68 67 14 0e 9c 36 7f 65 a4 d2 04 1e 50 83 6f 75 4c 71 d2 c8 b8 20 b9 a3 5c 17 a0 be a8 46 cb d5 b4 b4 76 68 40 e5 1d 03 78 01 66 78 8c 50 0d 13 90 a2 b0 ae 64 f3 db c5 e0 6a 47 58 14 3b 2c 33 08 c9 91 8e fc 98 fa e5 c4 7c 81 9e 30 2d ea f5 2c df 57 48 d8 8e 3c 23 d0 bd 05 18 24 ec 6e 73 38 1e d3 ce cc 4f b8 a5 f4 ab c3 de 00 fa a8 b5 1c 08 15 08 e8 59 7e 63 6c c0 e2 fe 98 91 89 95 84 63 34 28 70 32 5f 43 48 d6 24 38 bc 87 4f 53 a0 75 f2 ee 54 24 99 85 68 1a c0 d4 9c 4b ab bf 80 b9 16 02 74 e8 7d 69 4c 0c 06 12 b8 5d 6d 79 a4 af d0 c4 50 fe bb af d4 67 27 32 20 36 4c 59 3c c4 f1 e4 c8 95 9a 8f f0 71 e1 f4 04 20 8a 9f 18 d2 37 22 ec 83 5c 49 e4 b0 65 72 10 e1 0e 19 0c 13 b3 a4 f8 42 d8 cf c0 a6 a3 b4 34 f7 c8 df 28 05 75 62 dc 54 1e 09 58 cd 82 94 ac 9c e9 ff b0 6e 54 42 44 3f 3f 29 7c db 44 52 88 8a 2f 39 94 78 92 84 60 29 f9 ef 84 1e e0 f2 70 4f 8b 99 6c bd 36 24 98 ec 5d 4f a0 08 26 34 54 59 4d 5f 48 ab f0 e2 bc fa 9b 89 38 63 07 14 cc 32 6c 7f d0 c0 d1 c2 24 91 ba a9 1c 75 c1 d2 e8 24 aa b9 f4 d6 17 04 00 87 7c 6f 08 b4 45 54 fc e5 2e 3f e0 17 93 82 14 46 f8 e9 2c a2 83 92 d8 f3 e8 f9 c4 01 55 44 30 50 3e 2f b4 c9 a2 b2 40 98 c9 d9 5c 6a 74 64 a8 3b 1f 0f 90 df 64 74 64 8e 0f 1f 78 7c b2 a2 8c 2d d9 c9 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f75ff024-c717-41b8-b35f-d7d2fcfe32a4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion