CRC_10_poly_0x331__16_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_10_poly_0x331__16_lil_refl_False_ (No description metadata provided).

rule CRC_10_poly_0x331__16_lil_refl_False_ {
  strings:
    $a0 = { 00 00 31 03 62 06 53 05 c4 0c f5 0f a6 0a 97 09 88 19 b9 1a ea 1f db 1c 4c 15 7d 16 2e 13 1f 10 10 33 21 30 72 35 43 36 d4 3f e5 3c b6 39 87 3a 98 2a a9 29 fa 2c cb 2f 5c 26 6d 25 3e 20 0f 23 20 66 11 65 42 60 73 63 e4 6a d5 69 86 6c b7 6f a8 7f 99 7c ca 79 fb 7a 6c 73 5d 70 0e 75 3f 76 30 55 01 56 52 53 63 50 f4 59 c5 5a 96 5f a7 5c b8 4c 89 4f da 4a eb 49 7c 40 4d 43 1e 46 2f 45 40 cc 71 cf 22 ca 13 c9 84 c0 b5 c3 e6 c6 d7 c5 c8 d5 f9 d6 aa d3 9b d0 0c d9 3d da 6e df 5f dc 50 ff 61 fc 32 f9 03 fa 94 f3 a5 f0 f6 f5 c7 f6 d8 e6 e9 e5 ba e0 8b e3 1c ea 2d e9 7e ec 4f ef 60 aa 51 a9 02 ac 33 af a4 a6 95 a5 c6 a0 f7 a3 e8 b3 d9 b0 8a b5 bb b6 2c bf 1d bc 4e b9 7f ba 70 99 41 9a 12 9f 23 9c b4 95 85 96 d6 93 e7 90 f8 80 c9 83 9a 86 ab 85 3c 8c 0d 8f 5e 8a 6f 89 b1 9b 80 98 d3 9d e2 9e 75 97 44 94 17 91 26 92 39 82 08 81 5b 84 6a 87 fd 8e cc 8d 9f 88 ae 8b a1 a8 90 ab c3 ae f2 ad 65 a4 54 a7 07 a2 36 a1 29 b1 18 b2 4b b7 7a b4 ed bd dc be 8f bb be b8 91 fd a0 fe f3 fb c2 f8 55 f1 64 f2 37 f7 06 f4 19 e4 28 e7 7b e2 4a e1 dd e8 ec eb bf ee 8e ed 81 ce b0 cd e3 c8 d2 cb 45 c2 74 c1 27 c4 16 c7 09 d7 38 d4 6b d1 5a d2 cd db fc d8 af dd 9e de f1 57 c0 54 93 51 a2 52 35 5b 04 58 57 5d 66 5e 79 4e 48 4d 1b 48 2a 4b bd 42 8c 41 df 44 ee 47 e1 64 d0 67 83 62 b2 61 25 68 14 6b 47 6e 76 6d 69 7d 58 7e 0b 7b 3a 78 ad 71 9c 72 cf 77 fe 74 d1 31 e0 32 b3 37 82 34 15 3d 24 3e 77 3b 46 38 59 28 68 2b 3b 2e 0a 2d 9d 24 ac 27 ff 22 ce 21 c1 02 f0 01 a3 04 92 07 05 0e 34 0d 67 08 56 0b 49 1b 78 18 2b 1d 1a 1e 8d 17 bc 14 ef 11 de 12 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

296d6610-dae3-4278-b92e-97a20fc40d02

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion