Blowfish_ks1_table__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule Blowfish_ks1_table__32_big_1024_ (No description metadata provided).

rule Blowfish_ks1_table__32_big_1024_ {
  strings:
    $a0 = { 4b 7a 70 e9 b5 b3 29 44 db 75 09 2e c4 19 26 23 ad 6e a6 b0 49 a7 df 7d 9c ee 60 b8 8f ed b2 66 ec aa 8c 71 69 9a 17 ff 56 64 52 6c c2 b1 9e e1 19 36 02 a5 75 09 4c 29 a0 59 13 40 e4 18 3a 3e 3f 54 98 9a 5b 42 9d 65 6b 8f e4 d6 99 f7 3f d6 a1 d2 9c 07 ef e8 30 f5 4d 2d 38 e6 f0 25 5d c1 4c dd 20 86 84 70 eb 26 63 82 e9 c6 02 1e cc 5e 09 68 6b 3f 3e ba ef c9 3c 97 18 14 6b 6a 70 a1 68 7f 35 84 52 a0 e2 86 b7 9c 53 05 aa 50 07 37 3e 07 84 1c 7f de ae 5c 8e 7d 44 ec 57 16 f2 b8 b0 3a da 37 f0 50 0c 0d f0 1c 1f 04 02 00 b3 ff ae 0c f5 1a 3c b5 74 b2 25 83 7a 58 dc 09 21 bd d1 91 13 f9 7c a9 2f f6 94 32 47 73 22 f5 47 01 3a e5 e5 81 37 c2 da dc c8 b5 76 34 9a f3 dd a7 a9 44 61 46 0f d0 03 0e ec c8 c7 3e a4 75 1e 41 e2 38 cd 99 3b ea 0e 2f 32 80 bb a1 18 3e b3 31 4e 54 8b 38 4f 6d b9 08 6f 42 0d 03 f6 0a 04 bf 2c b8 12 90 24 97 7c 79 56 79 b0 72 bc af 89 af de 9a 77 1f d9 93 08 10 b3 8b ae 12 dc cf 3f 2e 55 12 72 1f 2e 6b 71 24 50 1a dd e6 9f 84 cd 87 7a 58 47 18 74 08 da 17 bc 9f 9a bc e9 4b 7d 8c ec 7a ec 3a db 85 1d fa 63 09 43 66 c4 64 c3 d2 ef 1c 18 47 32 15 d9 08 dd 43 3b 37 24 c2 ba 16 12 a1 4d 43 2a 65 c4 51 50 94 00 02 13 3a e4 dd 71 df f8 9e 10 31 4e 55 81 ac 77 d6 5f 11 19 9b 04 35 56 f1 d7 a3 c7 6b 3c 11 18 3b 59 24 a5 09 f2 8f e6 ed 97 f1 fb fa 9e ba bf 2c 1e 15 3c 6e 86 e3 45 70 ea e9 6f b1 86 0e 5e 0a 5a 3e 2a b3 77 1f e7 1c 4e 3d 06 fa 29 65 dc b9 99 e7 1d 0f 80 3e 89 d6 52 66 c8 25 2e 4c c9 78 9c 10 b3 6a c6 15 0e ba 94 e2 ea 78 a5 fc 3c 53 1e 0a 2d f4 f2 f7 4e a7 36 1d 2b 3d 19 39 26 0f 19 c2 79 60 52 23 a7 08 f7 13 12 b6 eb ad fe 6e ea c3 1f 66 e3 bc 45 95 a6 7b c8 83 b1 7f 37 d1 01 8c ff 28 c3 32 dd ef be 6c 5a a5 65 58 21 85 68 ab 98 02 ee ce a5 0f db 2f 95 3b 2a ef 7d ad 5b 6e 2f 84 15 21 b6 28 29 07 61 70 ec dd 47 75 61 9f 15 10 13 cc a8 30 eb 61 bd 96 03 34 fe 1e aa 03 63 cf b5 73 5c 90 4c 70 a2 39 d5 9e 9e 0b cb aa de 14 ee cc 86 bc 60 62 2c a7 9c ab 5c ab b2 f3 84 6e 64 8b 1e af 19 bd f0 ca a0 23 69 b9 65 5a bb 50 40 68 5a 32 3c 2a b4 b3 31 9e e9 d5 c0 21 b8 f7 9b 54 0b 19 87 5f a0 99 95 f7 99 7e 62 3d 7d a8 f8 37 88 9a 97 e3 2d 77 11 ed 93 5f 16 68 12 81 0e 35 88 29 c7 e6 1f d6 96 de df a1 78 58 ba 99 57 f5 84 a5 1b 22 72 63 9b 83 c3 ff 1a c2 46 96 cd b3 0a eb 53 2e 30 54 8f d9 48 e4 6d bc 31 28 58 eb f2 ef 34 c6 ff ea fe 28 ed 61 ee 7c 3c 73 5d 4a 14 d9 e8 64 b7 e3 42 10 5d 14 20 3e 13 e0 45 ee e2 b6 a3 aa ab ea db 6c 4f 15 fa cb 4f d0 c7 42 f4 42 ef 6a bb b5 65 4f 3b 1d 41 cd 21 05 d8 1e 79 9e 86 85 4d c7 e4 4b 47 6a 3d 81 62 50 cf 62 a1 f2 5b 8d 26 46 fc 88 83 a0 c1 c7 b6 a3 7f 15 24 c3 69 cb 74 92 47 84 8a 0b 56 92 b2 85 09 5b bf 00 ad 19 48 9d 14 62 b1 74 23 82 0e 00 58 42 8d 2a 0c 55 f5 ea 1d ad f4 3e 23 3f 70 61 33 72 f0 92 8d 93 7e 41 d6 5f ec f1 6c 22 3b db 7c de 37 59 cb ee 74 60 40 85 f2 a7 ce 77 32 6e a6 07 80 84 19 f8 50 9e e8 ef d8 55 61 d9 97 35 a9 69 a7 aa c5 0c 06 c2 5a 04 ab fc 80 0b ca dc 9e 44 7a 2e c3 45 34 84 fd d5 67 05 0e 1e 9e c9 db 73 db d3 10 55 88 cd 67 5f da 79 e3 67 43 40 c5 c4 34 65 71 3e 38 d8 3d 28 f8 9e f1 6d ff 20 15 3e 21 e7 8f b0 3d 4a e6 e3 9f 2b db 83 ad f7 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d95cb44b-4d98-4491-aad9-85fdee445ddb

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion