Dolby_window_dol_shortflt64_64_lil_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule Dolby_window_dol_short__flt64___64_lil_1024_ (No description metadata provided).

rule Dolby_window_dol_short__flt64___64_lil_1024_ {
  strings:
    $a0 = { e1 ca f0 e4 28 f6 06 3f 04 35 a5 17 11 1c 1f 3f b1 b0 f1 4c 90 3d 2e 3f 42 be a7 0e 45 86 39 3f 65 42 88 ea ec d9 43 3f 3e 25 2a de 9c 3a 4d 3f 2d b0 ba 60 0f ac 54 3f c5 bf 38 82 de 58 5c 3f 91 db 08 27 d3 f4 62 3f 26 a2 86 ed 4d d5 68 3f fc f6 01 f8 18 f7 6f 3f 21 72 b8 24 3e 43 74 3f db 0d 41 01 5a 59 79 3f 79 6c b9 95 e5 56 7f 3f fb 3d 56 df 1a 2b 83 3f 23 96 05 80 68 39 87 3f 33 bc 72 1d a6 e4 8b 3f 02 6f 41 76 c8 9d 90 3f 74 d2 3d e4 a0 a6 93 3f cd 41 35 be 89 14 97 3f c2 85 8e 4c 43 ef 9a 3f 1f 64 63 83 91 3e 9f 3f e5 1d cb e2 15 05 a2 3f 4f 88 a3 e1 d5 ac a4 3f 19 07 9b cc 3d 9a a7 3f 3c 69 60 ad e1 d0 aa 3f 51 ab f1 19 2b 54 ae 3f a4 0a fb d4 a7 13 b1 3f e4 8f 15 b5 a3 26 b3 3f 5e 9e 5a b4 61 64 b5 3f 30 0a f7 3a 12 ce b7 3f 0e b8 de 1a b9 64 ba 3f 46 59 d2 4e 29 29 bd 3f 1e d6 d8 7e 00 0e c0 3f 9a f0 de e7 d2 9e c1 3f 30 7c 78 d1 20 47 c3 3f be ae 70 d5 df 06 c5 3f 5c e1 e6 03 e5 dd c6 3f b0 02 b3 ef e3 cb c8 3f b5 8f 5a 00 6e d0 ca 3f 3c 6c 9c 0d f2 ea cc 3f a7 d6 dc 47 bc 1a cf 3f b5 1a f7 37 7b af d0 3f b5 fb ec 2f 54 db d1 3f 09 61 b4 72 5c 10 d3 3f a0 b7 1e 77 f7 4d d4 3f d4 e8 32 82 79 93 d5 3f 95 ec a8 8c 28 e0 d6 3f 2e 4c 18 4e 3d 33 d8 3f f9 f9 e2 6b e4 8b d9 3f 6c 43 73 c9 3f e9 da 3f 08 45 f6 f6 67 4a dc 3f 07 a5 55 bb 6d ae dd 3f ca d7 d4 b5 5b 14 df 3f c1 90 b0 09 9c 3d e0 3f d2 8f ac 29 03 f1 e0 3f 27 fd a8 8b e4 a3 e1 3f 7f 32 97 fc c1 55 e2 3f 09 8f 5b b1 1e 06 e3 3f ce 26 e7 30 80 b4 e3 3f 8d bd 27 3a 6f 60 e4 3f 25 92 5a a3 78 09 e5 3f 33 bb 59 30 2e af e5 3f ee a2 8e 5d 27 51 e6 3f b6 7a 4e 1d 02 ef e6 3f 5d 1c 87 85 63 88 e7 3f fa 82 cb 6b f8 1c e8 3f 7b 7e fe ed 75 ac e8 3f f9 21 10 e6 99 36 e9 3f 01 38 7e 47 2b bb e9 3f 7d 3b 89 65 fa 39 ea 3f c2 57 55 21 e1 b2 ea 3f 0a 1c 79 ff c2 25 eb 3f 2c 21 c9 24 8d 92 eb 3f 0e 0a 80 3a 36 f9 eb 3f 6c 20 34 3a be 59 ec 3f cc 58 5e 22 2e b4 ec 3f 30 a9 88 94 97 08 ed 3f 65 22 8a 5e 14 57 ed 3f 82 d5 84 f0 c5 9f ed 3f 43 d4 a2 c1 d4 e2 ed 3f d2 0b d3 a5 6f 20 ee 3f 50 c2 02 17 cb 58 ee 3f f1 83 83 74 20 8c ee 3f f1 b0 75 3b ad ba ee 3f fb 17 2c 3b b2 e4 ee 3f 63 b1 8b c8 72 0a ef 3f f6 77 6a f3 33 2c ef 3f 9e a4 e0 c0 3b 4a ef 3f ce c0 5f 6d d0 64 ef 3f 97 1b 33 b9 37 7c ef 3f b2 bc cd 41 b6 90 ef 3f ea 20 fc e9 8e a2 ef 3f 0a a0 b5 52 02 b2 ef 3f dc b0 e4 65 4e bf ef 3f cd 34 11 f4 ad ca ef 3f 17 d6 67 65 58 d4 ef 3f 18 e3 28 7e 81 dc ef 3f 6f 9d 1b 36 59 e3 ef 3f 95 43 3c a2 0b e9 ef 3f e5 82 7e ef c0 ed ef 3f a6 5d 2e 6d 9d f1 ef 3f 36 2a 39 a5 c1 f4 ef 3f 18 b4 78 80 4a f7 ef 3f 7f 7c fc 74 51 f9 ef 3f 6b 98 40 bc ec fa ef 3f a4 f0 45 8f 2f fc ef 3f f3 3e 93 66 2a fd ef 3f 60 0a 47 3c eb fd ef 3f 29 ad 8e ce 7d fe ef 3f b9 6e 0a e1 eb fe ef 3f 53 2c e0 7b 3d ff ef 3f 49 35 7a 27 79 ff ef 3f c3 5b 2c 24 a4 ff ef 3f fc 89 33 9d c2 ff ef 3f 1d 8d ba d6 d7 ff ef 3f d6 c0 bf 56 e6 ff ef 3f 6c cf e1 08 f0 ff ef 3f 64 2f 3d 5d f6 ff ef 3f 31 2f a0 62 fa ff ef 3f 61 52 70 dc fc ff ef 3f 14 e9 a9 54 fe ff ef 3f c6 bf 6a 2a ff ff ef 3f d5 53 7b 9d ff ff ef 3f 53 01 48 d7 ff ff ef 3f 7d 0d b6 f1 ff ff ef 3f c9 30 38 fc ff ff ef 3f 11 31 7c ff ff ff ef 3f }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b08f7a51-d117-4786-a12a-2e788a1419a7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion