CRC_15_CAN_poly_0x4599__16_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_15_CAN_poly_0x4599__16_lil_refl_False_ (No description metadata provided).

rule CRC_15_CAN_poly_0x4599__16_lil_refl_False_ {
  strings:
    $a0 = { 00 00 99 45 32 8b ab ce fd 53 64 16 cf d8 56 9d fa a7 63 e2 c8 2c 51 69 07 f4 9e b1 35 7f ac 3a 6d 0a f4 4f 5f 81 c6 c4 90 59 09 1c a2 d2 3b 97 97 ad 0e e8 a5 26 3c 63 6a fe f3 bb 58 75 c1 30 da 14 43 51 e8 9f 71 da 27 47 be 02 15 cc 8c 89 20 b3 b9 f6 12 38 8b 7d dd e0 44 a5 ef 6b 76 2e b7 1e 2e 5b 85 95 1c d0 4a 4d d3 08 78 c6 e1 83 4d b9 d4 fc 7f 32 e6 77 b0 ea 29 af 82 61 1b 24 b4 29 2d 6c 86 a2 1f e7 49 7a d0 3f 7b f1 e2 b4 4e 8e d7 cb 7c 05 e5 40 b3 dd 2a 98 81 56 18 13 d9 23 40 66 eb a8 72 ed 24 70 bd 35 16 fb 8f be 23 84 ba c1 11 0f 88 4a de d7 47 92 ec 5c 75 19 6e 3d f7 78 5c b6 c5 f3 93 6e 0a 2b a1 e5 38 a0 94 9a 0d df a6 11 3f 54 69 c9 f0 8c 5b 42 c2 07 03 37 9a 72 31 bc a8 f9 fe 64 67 21 cc ef 55 aa f9 90 60 d5 cb 1b 52 5e 04 c3 9d 86 36 48 af 0d 68 53 f1 16 5a d8 c3 9d 95 00 0c 45 a7 8b 3e ce 92 f4 0b b1 a0 7f 39 3a 6f a7 f6 e2 5d 2c c4 69 05 59 9c 1c 37 d2 ae 97 f8 0a 61 4f ca 81 53 c4 ff fe 66 bb cd 75 54 30 02 ad 9b e8 30 26 a9 63 b2 47 2b 02 80 cc 19 89 4f 14 d6 51 7d 9f e4 da 48 e0 d1 a5 7a 6b e3 2e b5 b3 2c f6 87 38 1e 7d df 4d 46 08 ed c6 74 83 22 1e bb 5b 10 95 89 d0 25 ea bc af 17 61 8e 24 d8 b9 41 fc ea 32 73 77 dc 7a 45 3f ee f1 77 b4 21 29 b8 6c 13 a2 8a e7 26 dd bf 98 14 56 8d 13 db 8e 42 cb e9 05 70 40 b1 70 28 35 83 fb 1a be 4c 23 d5 66 7e a8 e7 ed 4b d7 d2 92 79 5c e0 19 b6 84 2f c1 84 0f 1d 4a 06 6e 9f 2b 34 e5 ad a0 fb 3d 62 78 c9 b6 50 f3 fc c9 65 8c ce 42 57 07 01 9a 98 df 33 11 aa 54 6b 64 f2 21 59 ef c0 aa 96 37 0f 72 a4 bc 3d f9 91 c3 08 86 a3 48 3a 0d 6c 90 f5 d5 5e 1b c7 5e }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

36ab2e96-9cbf-4cfb-8143-86cb54335327

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion