libaf_center_rear__180_degree_flt64_64_lil_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libaf_center_rear__180_degree___flt64___64_lil_1024_ (No description metadata provided).

rule libaf_center_rear__180_degree___flt64___64_lil_1024_ {
  strings:
    $a0 = { 91 60 d4 c5 72 66 0f bf 3e a9 54 29 27 df 2d bf 3e ca 99 24 57 6d 31 3f fc 42 6e 89 04 bd 38 bf ab 1d 99 1a 60 c1 3d 3f 98 81 77 45 6d 8a 3b bf df 07 84 cb 4c b9 30 3f d3 51 86 1a 86 89 32 3f a2 75 cc 88 0d a7 50 bf be 9c 79 03 31 75 67 3f 67 60 0c 3d 90 ac 61 3f 42 9f 75 42 04 33 85 3f c5 60 5d c4 70 77 85 bf 43 79 82 ff 21 07 8b bf 66 2a 8a 8b d5 27 6a 3f d0 ce c3 d3 66 ba 9d 3f c5 35 4c 58 25 e5 c4 3f 20 5b f2 39 d1 d0 ba 3f 2d b2 fb d0 22 ca ba bf 5b d6 1d 22 c3 b4 b7 bf 86 5f dd f9 40 c7 7e bf 2f 8b 37 ae 59 d8 8b 3f a1 9c 7e f4 6a 5a 94 bf 4e dd d7 88 6f 12 c0 3f 12 0c 9c 8d 29 59 d7 3f 88 31 a3 4b 14 e8 c8 3f 21 0f a7 50 d3 b3 a6 bf 6a 8a b2 45 aa d9 a7 3f 83 c3 c6 dc b6 47 b8 3f 39 d5 ed 64 c5 10 a0 bf b8 63 38 67 87 5c ba bf ce ec f3 bc 54 f0 b7 bf 2b 0b 19 ef 6d ea bc bf 6f 32 be d6 ba 1a c3 bf 24 f5 90 9a 89 86 bf bf b5 1b a6 9a f0 45 b0 bf c3 97 81 6f 4d dd ab bf 4a a2 d7 5a 0c 60 b3 bf 08 75 07 a8 de df 97 bf e1 67 f5 cf e9 d0 a5 3f 5f 02 ef 02 b0 07 97 3f c4 28 aa d8 38 f9 94 3f c2 88 71 bf 53 ef ac 3f f6 d1 bc 61 a3 21 ae 3f 8c d4 8e 0a f0 70 a3 3f 02 ec 8a f1 80 19 88 3f 68 ec 72 73 4b f5 76 3f 47 a1 90 22 7d b0 74 3f 87 ca 80 62 e9 78 8a bf 88 2d 56 2d 31 7e 98 bf b7 a0 5b 9f af 23 8b bf 37 6b 9f 10 24 e7 85 bf fc 77 1a 76 4f 8b 9f bf ec 50 db 1d e9 be a2 bf 72 43 2f ad 9b 6a a3 bf d9 93 9f 1f cc 99 a5 bf 78 56 a9 f4 e4 3b 9b bf 92 2a 9a 4a 8a fc 83 bf 6b 84 f7 45 97 ea 60 bf cb 21 9f 6f 5a d3 63 bf c7 16 76 eb 0c 28 7b bf a0 e9 9e fe 63 ec 72 3f 09 1c ba 8d de ea 93 3f 4a 60 9b 84 c0 c4 91 3f a8 3d 47 05 98 10 92 3f f4 ff 61 13 bf 3e 97 3f e9 28 0e ca 8e 6e 93 3f d4 66 95 20 cd 0b 83 3f 06 97 a8 aa 82 c5 5b bf 6c 13 27 bc 97 a7 7b bf be c7 0b 54 54 36 83 bf f3 85 65 76 6d f4 86 bf 82 a1 15 f1 0a cd 8a bf 7e 92 8c e6 0e f6 90 bf a6 57 4b 25 3e 88 96 bf 11 33 1a 37 12 c7 99 bf 4f 70 fb bb 26 53 91 bf 34 c7 0e 8d e1 b7 81 bf d8 34 c2 27 f5 ab 7c bf b7 b6 01 c8 cd 57 76 bf 94 87 29 87 2e 4f 61 bf 26 14 0d cb 69 88 28 3f 1c 67 19 b8 92 c5 32 bf b9 6b 4f 6c 5c dc 5c 3f 18 f3 e5 47 41 9d 7c 3f 54 86 2f 4a 8e a9 85 3f 34 29 a4 c9 33 7c 7a 3f dd ad bf 8c bb 8e 58 bf 28 fd 28 e2 ac 3f 70 bf 26 3f a8 20 34 b0 7a bf a5 ee 6e 01 88 22 83 bf 3d 68 fe 7e 55 4e 7f bf 25 91 55 89 b7 00 72 bf e1 26 6a ce 0c 02 69 bf d5 8d 46 20 10 c0 7c bf 21 89 cc 53 23 f3 83 bf 63 d6 d6 df 88 51 80 bf 37 9f 36 ed 7a f4 7f bf bd 93 79 31 ce dd 7e bf 47 08 c7 3b ed 06 6d bf d5 ff 3c 46 52 b6 58 3f 1d 1d 97 5b 01 20 63 3f b7 da bf d0 99 74 50 bf 70 51 55 0c e8 b8 64 bf 36 30 c0 e4 a2 6a 63 bf 07 89 3a 4a 25 5c 43 bf 62 72 0f ba 04 6f 68 3f 99 73 f2 d8 9f c7 73 3f 71 36 2d f8 62 62 72 3f ed 90 d3 dc c1 b8 fb 3e 12 4a c4 2f 96 3e 71 bf 9d 20 80 f9 57 46 79 bf 6a 93 f5 7f 28 c4 7d bf 3e b3 60 5a 14 f5 7b bf 0e e2 a8 2f 00 43 7c bf ad 17 d6 49 65 1a 7e bf 51 3a bf 51 3b 91 83 bf 7f 78 1b ef 82 25 88 bf 39 f4 05 a2 76 cd 85 bf b8 aa 99 f2 41 7c 7a bf 62 cb fe 9c 63 9a 60 bf 51 15 9e 2b 56 6c 3c bf b8 c8 1b d7 25 4e 52 bf a8 5c 6d 19 dc 67 5d bf e0 9f 6f dc a2 f0 64 bf ca cb 46 53 f6 08 5d bf 7e 78 65 69 ad 30 2f bf c4 62 07 a3 2d 5d 47 3f }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0c7e5980-2c93-41d3-b230-727308c615c6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion