CRC_10_poly_0x331__16_big_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_10_poly_0x331__16_big_refl_True_ (No description metadata provided).

rule CRC_10_poly_0x331__16_big_refl_True_ {
  strings:
    $a0 = { 00 00 8d d9 02 33 8f ea 04 66 89 bf 06 55 8b 8c 08 cc 85 15 0a ff 87 26 0c aa 81 73 0e 99 83 40 11 98 9c 41 13 ab 9e 72 15 fe 98 27 17 cd 9a 14 19 54 94 8d 1b 67 96 be 1d 32 90 eb 1f 01 92 d8 23 30 ae e9 21 03 ac da 27 56 aa 8f 25 65 a8 bc 2b fc a6 25 29 cf a4 16 2f 9a a2 43 2d a9 a0 70 32 a8 bf 71 30 9b bd 42 36 ce bb 17 34 fd b9 24 3a 64 b7 bd 38 57 b5 8e 3e 02 b3 db 3c 31 b1 e8 46 60 cb b9 44 53 c9 8a 42 06 cf df 40 35 cd ec 4e ac c3 75 4c 9f c1 46 4a ca c7 13 48 f9 c5 20 57 f8 da 21 55 cb d8 12 53 9e de 47 51 ad dc 74 5f 34 d2 ed 5d 07 d0 de 5b 52 d6 8b 59 61 d4 b8 65 50 e8 89 67 63 ea ba 61 36 ec ef 63 05 ee dc 6d 9c e0 45 6f af e2 76 69 fa e4 23 6b c9 e6 10 74 c8 f9 11 76 fb fb 22 70 ae fd 77 72 9d ff 44 7c 04 f1 dd 7e 37 f3 ee 78 62 f5 bb 7a 51 f7 88 8c c0 01 19 8e f3 03 2a 88 a6 05 7f 8a 95 07 4c 84 0c 09 d5 86 3f 0b e6 80 6a 0d b3 82 59 0f 80 9d 58 10 81 9f 6b 12 b2 99 3e 14 e7 9b 0d 16 d4 95 94 18 4d 97 a7 1a 7e 91 f2 1c 2b 93 c1 1e 18 af f0 22 29 ad c3 20 1a ab 96 26 4f a9 a5 24 7c a7 3c 2a e5 a5 0f 28 d6 a3 5a 2e 83 a1 69 2c b0 be 68 33 b1 bc 5b 31 82 ba 0e 37 d7 b8 3d 35 e4 b6 a4 3b 7d b4 97 39 4e b2 c2 3f 1b b0 f1 3d 28 ca a0 47 79 c8 93 45 4a ce c6 43 1f cc f5 41 2c c2 6c 4f b5 c0 5f 4d 86 c6 0a 4b d3 c4 39 49 e0 db 38 56 e1 d9 0b 54 d2 df 5e 52 87 dd 6d 50 b4 d3 f4 5e 2d d1 c7 5c 1e d7 92 5a 4b d5 a1 58 78 e9 90 64 49 eb a3 66 7a ed f6 60 2f ef c5 62 1c e1 5c 6c 85 e3 6f 6e b6 e5 3a 68 e3 e7 09 6a d0 f8 08 75 d1 fa 3b 77 e2 fc 6e 71 b7 fe 5d 73 84 f0 c4 7d 1d f2 f7 7f 2e f4 a2 79 7b f6 91 7b 48 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f579908b-62e4-4ff0-ace2-ce6787d7088e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion