CRC32_poly_0x9b64c2b0__32_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x9b64c2b0__32_lil_refl_False_ (No description metadata provided).

rule CRC32_poly_0x9b64c2b0__32_lil_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 b0 c2 64 9b d0 47 ad ad 60 85 c9 36 10 4d 3e c0 a0 8f 5a 5b c0 0a 93 6d 70 c8 f7 f6 90 58 18 1b 20 9a 7c 80 40 1f b5 b6 f0 dd d1 2d 80 15 26 db 30 d7 42 40 50 52 8b 76 e0 90 ef ed 20 b1 30 36 90 73 54 ad f0 f6 9d 9b 40 34 f9 00 30 fc 0e f6 80 3e 6a 6d e0 bb a3 5b 50 79 c7 c0 b0 e9 28 2d 00 2b 4c b6 60 ae 85 80 d0 6c e1 1b a0 a4 16 ed 10 66 72 76 70 e3 bb 40 c0 21 df db 40 62 61 6c f0 a0 05 f7 90 25 cc c1 20 e7 a8 5a 50 2f 5f ac e0 ed 3b 37 80 68 f2 01 30 aa 96 9a d0 3a 79 77 60 f8 1d ec 00 7d d4 da b0 bf b0 41 c0 77 47 b7 70 b5 23 2c 10 30 ea 1a a0 f2 8e 81 60 d3 51 5a d0 11 35 c1 b0 94 fc f7 00 56 98 6c 70 9e 6f 9a c0 5c 0b 01 a0 d9 c2 37 10 1b a6 ac f0 8b 49 41 40 49 2d da 20 cc e4 ec 90 0e 80 77 e0 c6 77 81 50 04 13 1a 30 81 da 2c 80 43 be b7 80 c4 c2 d8 30 06 a6 43 50 83 6f 75 e0 41 0b ee 90 89 fc 18 20 4b 98 83 40 ce 51 b5 f0 0c 35 2e 10 9c da c3 a0 5e be 58 c0 db 77 6e 70 19 13 f5 00 d1 e4 03 b0 13 80 98 d0 96 49 ae 60 54 2d 35 a0 75 f2 ee 10 b7 96 75 70 32 5f 43 c0 f0 3b d8 b0 38 cc 2e 00 fa a8 b5 60 7f 61 83 d0 bd 05 18 30 2d ea f5 80 ef 8e 6e e0 6a 47 58 50 a8 23 c3 20 60 d4 35 90 a2 b0 ae f0 27 79 98 40 e5 1d 03 c0 a6 a3 b4 70 64 c7 2f 10 e1 0e 19 a0 23 6a 82 d0 eb 9d 74 60 29 f9 ef 00 ac 30 d9 b0 6e 54 42 50 fe bb af e0 3c df 34 80 b9 16 02 30 7b 72 99 40 b3 85 6f f0 71 e1 f4 90 f4 28 c2 20 36 4c 59 e0 17 93 82 50 d5 f7 19 30 50 3e 2f 80 92 5a b4 f0 5a ad 42 40 98 c9 d9 20 1d 00 ef 90 df 64 74 70 4f 8b 99 c0 8d ef 02 a0 08 26 34 10 ca 42 af 60 02 b5 59 d0 c0 d1 c2 b0 45 18 f4 00 87 7c 6f b0 4b e1 2a 00 89 85 b1 60 0c 4c 87 d0 ce 28 1c a0 06 df ea 10 c4 bb 71 70 41 72 47 c0 83 16 dc 20 13 f9 31 90 d1 9d aa f0 54 54 9c 40 96 30 07 30 5e c7 f1 80 9c a3 6a e0 19 6a 5c 50 db 0e c7 90 fa d1 1c 20 38 b5 87 40 bd 7c b1 f0 7f 18 2a 80 b7 ef dc 30 75 8b 47 50 f0 42 71 e0 32 26 ea 00 a2 c9 07 b0 60 ad 9c d0 e5 64 aa 60 27 00 31 10 ef f7 c7 a0 2d 93 5c c0 a8 5a 6a 70 6a 3e f1 f0 29 80 46 40 eb e4 dd 20 6e 2d eb 90 ac 49 70 e0 64 be 86 50 a6 da 1d 30 23 13 2b 80 e1 77 b0 60 71 98 5d d0 b3 fc c6 b0 36 35 f0 00 f4 51 6b 70 3c a6 9d c0 fe c2 06 a0 7b 0b 30 10 b9 6f ab d0 98 b0 70 60 5a d4 eb 00 df 1d dd b0 1d 79 46 c0 d5 8e b0 70 17 ea 2b 10 92 23 1d a0 50 47 86 40 c0 a8 6b f0 02 cc f0 90 87 05 c6 20 45 61 5d 50 8d 96 ab e0 4f f2 30 80 ca 3b 06 30 08 5f 9d 30 8f 23 f2 80 4d 47 69 e0 c8 8e 5f 50 0a ea c4 20 c2 1d 32 90 00 79 a9 f0 85 b0 9f 40 47 d4 04 a0 d7 3b e9 10 15 5f 72 70 90 96 44 c0 52 f2 df b0 9a 05 29 00 58 61 b2 60 dd a8 84 d0 1f cc 1f 10 3e 13 c4 a0 fc 77 5f c0 79 be 69 70 bb da f2 00 73 2d 04 b0 b1 49 9f d0 34 80 a9 60 f6 e4 32 80 66 0b df 30 a4 6f 44 50 21 a6 72 e0 e3 c2 e9 90 2b 35 1f 20 e9 51 84 40 6c 98 b2 f0 ae fc 29 70 ed 42 9e c0 2f 26 05 a0 aa ef 33 10 68 8b a8 60 a0 7c 5e d0 62 18 c5 b0 e7 d1 f3 00 25 b5 68 e0 b5 5a 85 50 77 3e 1e 30 f2 f7 28 80 30 93 b3 f0 f8 64 45 40 3a 00 de 20 bf c9 e8 90 7d ad 73 50 5c 72 a8 e0 9e 16 33 80 1b df 05 30 d9 bb 9e 40 11 4c 68 f0 d3 28 f3 90 56 e1 c5 20 94 85 5e c0 04 6a b3 70 c6 0e 28 10 43 c7 1e a0 81 a3 85 d0 49 54 73 60 8b 30 e8 00 0e f9 de b0 cc 9d 45 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b8f056f2-507c-4190-b956-0d2e0202dcbe

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion