CRC_32CCastagnolipoly_0x82F63B78__32_big_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_32C__Castagnoli__poly_0x82F63B78__32_big_refl_False_ (No description metadata provided).

rule CRC_32C__Castagnoli__poly_0x82F63B78__32_big_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 82 f6 3b 78 87 1a 4d 88 05 ec 76 f0 8c c2 a0 68 0e 34 9b 10 0b d8 ed e0 89 2e d6 98 9b 73 7b a8 19 85 40 d0 1c 69 36 20 9e 9f 0d 58 17 b1 db c0 95 47 e0 b8 90 ab 96 48 12 5d ad 30 b4 10 cc 28 36 e6 f7 50 33 0a 81 a0 b1 fc ba d8 38 d2 6c 40 ba 24 57 38 bf c8 21 c8 3d 3e 1a b0 2f 63 b7 80 ad 95 8c f8 a8 79 fa 08 2a 8f c1 70 a3 a1 17 e8 21 57 2c 90 24 bb 5a 60 a6 4d 61 18 ea d7 a3 28 68 21 98 50 6d cd ee a0 ef 3b d5 d8 66 15 03 40 e4 e3 38 38 e1 0f 4e c8 63 f9 75 b0 71 a4 d8 80 f3 52 e3 f8 f6 be 95 08 74 48 ae 70 fd 66 78 e8 7f 90 43 90 7a 7c 35 60 f8 8a 0e 18 5e c7 6f 00 dc 31 54 78 d9 dd 22 88 5b 2b 19 f0 d2 05 cf 68 50 f3 f4 10 55 1f 82 e0 d7 e9 b9 98 c5 b4 14 a8 47 42 2f d0 42 ae 59 20 c0 58 62 58 49 76 b4 c0 cb 80 8f b8 ce 6c f9 48 4c 9a c2 30 57 59 7d 28 d5 af 46 50 d0 43 30 a0 52 b5 0b d8 db 9b dd 40 59 6d e6 38 5c 81 90 c8 de 77 ab b0 cc 2a 06 80 4e dc 3d f8 4b 30 4b 08 c9 c6 70 70 40 e8 a6 e8 c2 1e 9d 90 c7 f2 eb 60 45 04 d0 18 e3 49 b1 00 61 bf 8a 78 64 53 fc 88 e6 a5 c7 f0 6f 8b 11 68 ed 7d 2a 10 e8 91 5c e0 6a 67 67 98 78 3a ca a8 fa cc f1 d0 ff 20 87 20 7d d6 bc 58 f4 f8 6a c0 76 0e 51 b8 73 e2 27 48 f1 14 1c 30 bd 8e de 00 3f 78 e5 78 3a 94 93 88 b8 62 a8 f0 31 4c 7e 68 b3 ba 45 10 b6 56 33 e0 34 a0 08 98 26 fd a5 a8 a4 0b 9e d0 a1 e7 e8 20 23 11 d3 58 aa 3f 05 c0 28 c9 3e b8 2d 25 48 48 af d3 73 30 09 9e 12 28 8b 68 29 50 8e 84 5f a0 0c 72 64 d8 85 5c b2 40 07 aa 89 38 02 46 ff c8 80 b0 c4 b0 92 ed 69 80 10 1b 52 f8 15 f7 24 08 97 01 1f 70 1e 2f c9 e8 9c d9 f2 90 99 35 84 60 1b c3 bf 18 ae b2 fa 50 2c 44 c1 28 29 a8 b7 d8 ab 5e 8c a0 22 70 5a 38 a0 86 61 40 a5 6a 17 b0 27 9c 2c c8 35 c1 81 f8 b7 37 ba 80 b2 db cc 70 30 2d f7 08 b9 03 21 90 3b f5 1a e8 3e 19 6c 18 bc ef 57 60 1a a2 36 78 98 54 0d 00 9d b8 7b f0 1f 4e 40 88 96 60 96 10 14 96 ad 68 11 7a db 98 93 8c e0 e0 81 d1 4d d0 03 27 76 a8 06 cb 00 58 84 3d 3b 20 0d 13 ed b8 8f e5 d6 c0 8a 09 a0 30 08 ff 9b 48 44 65 59 78 c6 93 62 00 c3 7f 14 f0 41 89 2f 88 c8 a7 f9 10 4a 51 c2 68 4f bd b4 98 cd 4b 8f e0 df 16 22 d0 5d e0 19 a8 58 0c 6f 58 da fa 54 20 53 d4 82 b8 d1 22 b9 c0 d4 ce cf 30 56 38 f4 48 f0 75 95 50 72 83 ae 28 77 6f d8 d8 f5 99 e3 a0 7c b7 35 38 fe 41 0e 40 fb ad 78 b0 79 5b 43 c8 6b 06 ee f8 e9 f0 d5 80 ec 1c a3 70 6e ea 98 08 e7 c4 4e 90 65 32 75 e8 60 de 03 18 e2 28 38 60 f9 eb 87 78 7b 1d bc 00 7e f1 ca f0 fc 07 f1 88 75 29 27 10 f7 df 1c 68 f2 33 6a 98 70 c5 51 e0 62 98 fc d0 e0 6e c7 a8 e5 82 b1 58 67 74 8a 20 ee 5a 5c b8 6c ac 67 c0 69 40 11 30 eb b6 2a 48 4d fb 4b 50 cf 0d 70 28 ca e1 06 d8 48 17 3d a0 c1 39 eb 38 43 cf d0 40 46 23 a6 b0 c4 d5 9d c8 d6 88 30 f8 54 7e 0b 80 51 92 7d 70 d3 64 46 08 5a 4a 90 90 d8 bc ab e8 dd 50 dd 18 5f a6 e6 60 13 3c 24 50 91 ca 1f 28 94 26 69 d8 16 d0 52 a0 9f fe 84 38 1d 08 bf 40 18 e4 c9 b0 9a 12 f2 c8 88 4f 5f f8 0a b9 64 80 0f 55 12 70 8d a3 29 08 04 8d ff 90 86 7b c4 e8 83 97 b2 18 01 61 89 60 a7 2c e8 78 25 da d3 00 20 36 a5 f0 a2 c0 9e 88 2b ee 48 10 a9 18 73 68 ac f4 05 98 2e 02 3e e0 3c 5f 93 d0 be a9 a8 a8 bb 45 de 58 39 b3 e5 20 b0 9d 33 b8 32 6b 08 c0 37 87 7e 30 b5 71 45 48 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8f857ddd-acd1-4835-b438-52e8c213cf49

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion