CRC32_poly_0xa00ae278__32_big_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0xa00ae278__32_big_refl_False_ (No description metadata provided).

rule CRC32_poly_0xa00ae278__32_big_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 a0 0a e2 78 e0 1f 26 88 40 15 c4 f0 60 34 af 68 c0 3e 4d 10 80 2b 89 e0 20 21 6b 98 c0 69 5e d0 60 63 bc a8 20 76 78 58 80 7c 9a 20 a0 5d f1 b8 00 57 13 c0 40 42 d7 30 e0 48 35 48 20 d8 5f d8 80 d2 bd a0 c0 c7 79 50 60 cd 9b 28 40 ec f0 b0 e0 e6 12 c8 a0 f3 d6 38 00 f9 34 40 e0 b1 01 08 40 bb e3 70 00 ae 27 80 a0 a4 c5 f8 80 85 ae 60 20 8f 4c 18 60 9a 88 e8 c0 90 6a 90 41 b0 bf b0 e1 ba 5d c8 a1 af 99 38 01 a5 7b 40 21 84 10 d8 81 8e f2 a0 c1 9b 36 50 61 91 d4 28 81 d9 e1 60 21 d3 03 18 61 c6 c7 e8 c1 cc 25 90 e1 ed 4e 08 41 e7 ac 70 01 f2 68 80 a1 f8 8a f8 61 68 e0 68 c1 62 02 10 81 77 c6 e0 21 7d 24 98 01 5c 4f 00 a1 56 ad 78 e1 43 69 88 41 49 8b f0 a1 01 be b8 01 0b 5c c0 41 1e 98 30 e1 14 7a 48 c1 35 11 d0 61 3f f3 a8 21 2a 37 58 81 20 d5 20 83 61 7f 60 23 6b 9d 18 63 7e 59 e8 c3 74 bb 90 e3 55 d0 08 43 5f 32 70 03 4a f6 80 a3 40 14 f8 43 08 21 b0 e3 02 c3 c8 a3 17 07 38 03 1d e5 40 23 3c 8e d8 83 36 6c a0 c3 23 a8 50 63 29 4a 28 a3 b9 20 b8 03 b3 c2 c0 43 a6 06 30 e3 ac e4 48 c3 8d 8f d0 63 87 6d a8 23 92 a9 58 83 98 4b 20 63 d0 7e 68 c3 da 9c 10 83 cf 58 e0 23 c5 ba 98 03 e4 d1 00 a3 ee 33 78 e3 fb f7 88 43 f1 15 f0 c2 d1 c0 d0 62 db 22 a8 22 ce e6 58 82 c4 04 20 a2 e5 6f b8 02 ef 8d c0 42 fa 49 30 e2 f0 ab 48 02 b8 9e 00 a2 b2 7c 78 e2 a7 b8 88 42 ad 5a f0 62 8c 31 68 c2 86 d3 10 82 93 17 e0 22 99 f5 98 e2 09 9f 08 42 03 7d 70 02 16 b9 80 a2 1c 5b f8 82 3d 30 60 22 37 d2 18 62 22 16 e8 c2 28 f4 90 22 60 c1 d8 82 6a 23 a0 c2 7f e7 50 62 75 05 28 42 54 6e b0 e2 5e 8c c8 a2 4b 48 38 02 41 aa 40 a6 c8 1c b8 06 c2 fe c0 46 d7 3a 30 e6 dd d8 48 c6 fc b3 d0 66 f6 51 a8 26 e3 95 58 86 e9 77 20 66 a1 42 68 c6 ab a0 10 86 be 64 e0 26 b4 86 98 06 95 ed 00 a6 9f 0f 78 e6 8a cb 88 46 80 29 f0 86 10 43 60 26 1a a1 18 66 0f 65 e8 c6 05 87 90 e6 24 ec 08 46 2e 0e 70 06 3b ca 80 a6 31 28 f8 46 79 1d b0 e6 73 ff c8 a6 66 3b 38 06 6c d9 40 26 4d b2 d8 86 47 50 a0 c6 52 94 50 66 58 76 28 e7 78 a3 08 47 72 41 70 07 67 85 80 a7 6d 67 f8 87 4c 0c 60 27 46 ee 18 67 53 2a e8 c7 59 c8 90 27 11 fd d8 87 1b 1f a0 c7 0e db 50 67 04 39 28 47 25 52 b0 e7 2f b0 c8 a7 3a 74 38 07 30 96 40 c7 a0 fc d0 67 aa 1e a8 27 bf da 58 87 b5 38 20 a7 94 53 b8 07 9e b1 c0 47 8b 75 30 e7 81 97 48 07 c9 a2 00 a7 c3 40 78 e7 d6 84 88 47 dc 66 f0 67 fd 0d 68 c7 f7 ef 10 87 e2 2b e0 27 e8 c9 98 25 a9 63 d8 85 a3 81 a0 c5 b6 45 50 65 bc a7 28 45 9d cc b0 e5 97 2e c8 a5 82 ea 38 05 88 08 40 e5 c0 3d 08 45 ca df 70 05 df 1b 80 a5 d5 f9 f8 85 f4 92 60 25 fe 70 18 65 eb b4 e8 c5 e1 56 90 05 71 3c 00 a5 7b de 78 e5 6e 1a 88 45 64 f8 f0 65 45 93 68 c5 4f 71 10 85 5a b5 e0 25 50 57 98 c5 18 62 d0 65 12 80 a8 25 07 44 58 85 0d a6 20 a5 2c cd b8 05 26 2f c0 45 33 eb 30 e5 39 09 48 64 19 dc 68 c4 13 3e 10 84 06 fa e0 24 0c 18 98 04 2d 73 00 a4 27 91 78 e4 32 55 88 44 38 b7 f0 a4 70 82 b8 04 7a 60 c0 44 6f a4 30 e4 65 46 48 c4 44 2d d0 64 4e cf a8 24 5b 0b 58 84 51 e9 20 44 c1 83 b0 e4 cb 61 c8 a4 de a5 38 04 d4 47 40 24 f5 2c d8 84 ff ce a0 c4 ea 0a 50 64 e0 e8 28 84 a8 dd 60 24 a2 3f 18 64 b7 fb e8 c4 bd 19 90 e4 9c 72 08 44 96 90 70 04 83 54 80 a4 89 b6 f8 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b1e4f57f-4064-4e2a-b634-f0cf3fdd660f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion