CRC32_poly_0x26d930ac__32_lil_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x26d930ac__32_lil_refl_True_ (No description metadata provided).

rule CRC32_poly_0x26d930ac__32_lil_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 e4 4b 36 36 01 a1 75 06 e5 ea 43 30 02 42 eb 0c e6 09 dd 3a 03 e3 9e 0a e7 a8 a8 3c 04 84 d6 19 e0 cf e0 2f 05 25 a3 1f e1 6e 95 29 06 c6 3d 15 e2 8d 0b 23 07 67 48 13 e3 2c 7e 25 08 08 ad 33 ec 43 9b 05 09 a9 d8 35 ed e2 ee 03 0a 4a 46 3f ee 01 70 09 0b eb 33 39 ef a0 05 0f 0c 8c 7b 2a e8 c7 4d 1c 0d 2d 0e 2c e9 66 38 1a 0e ce 90 26 ea 85 a6 10 0f 6f e5 20 eb 24 d3 16 d9 26 43 0d 3d 6d 75 3b d8 87 36 0b 3c cc 00 3d db 64 a8 01 3f 2f 9e 37 da c5 dd 07 3e 8e eb 31 dd a2 95 14 39 e9 a3 22 dc 03 e0 12 38 48 d6 24 df e0 7e 18 3b ab 48 2e de 41 0b 1e 3a 0a 3d 28 d1 2e ee 3e 35 65 d8 08 d0 8f 9b 38 34 c4 ad 0e d3 6c 05 32 37 27 33 04 d2 cd 70 34 36 86 46 02 d5 aa 38 27 31 e1 0e 11 d4 0b 4d 21 30 40 7b 17 d7 e8 d3 2b 33 a3 e5 1d d6 49 a6 2d 32 02 90 1b b2 4d 86 1a 56 06 b0 2c b3 ec f3 1c 57 a7 c5 2a b0 0f 6d 16 54 44 5b 20 b1 ae 18 10 55 e5 2e 26 b6 c9 50 03 52 82 66 35 b7 68 25 05 53 23 13 33 b4 8b bb 0f 50 c0 8d 39 b5 2a ce 09 51 61 f8 3f ba 45 2b 29 5e 0e 1d 1f bb e4 5e 2f 5f af 68 19 b8 07 c0 25 5c 4c f6 13 b9 a6 b5 23 5d ed 83 15 be c1 fd 30 5a 8a cb 06 bf 60 88 36 5b 2b be 00 bc 83 16 3c 58 c8 20 0a bd 22 63 3a 59 69 55 0c 6b 6b c5 17 8f 20 f3 21 6a ca b0 11 8e 81 86 27 69 29 2e 1b 8d 62 18 2d 68 88 5b 1d 8c c3 6d 2b 6f ef 13 0e 8b a4 25 38 6e 4e 66 08 8a 05 50 3e 6d ad f8 02 89 e6 ce 34 6c 0c 8d 04 88 47 bb 32 63 63 68 24 87 28 5e 12 62 c2 1d 22 86 89 2b 14 61 21 83 28 85 6a b5 1e 60 80 f6 2e 84 cb c0 18 67 e7 be 3d 83 ac 88 0b 66 46 cb 3b 82 0d fd 0d 65 a5 55 31 81 ee 63 07 64 04 20 37 80 4f 16 01 64 9b 0c 35 80 d0 3a 03 65 3a 79 33 81 71 4f 05 66 d9 e7 39 82 92 d1 0f 67 78 92 3f 83 33 a4 09 60 1f da 2c 84 54 ec 1a 61 be af 2a 85 f5 99 1c 62 5d 31 20 86 16 07 16 63 fc 44 26 87 b7 72 10 6c 93 a1 06 88 d8 97 30 6d 32 d4 00 89 79 e2 36 6e d1 4a 0a 8a 9a 7c 3c 6f 70 3f 0c 8b 3b 09 3a 68 17 77 1f 8c 5c 41 29 69 b6 02 19 8d fd 34 2f 6a 55 9c 13 8e 1e aa 25 6b f4 e9 15 8f bf df 23 bd bd 4f 38 59 f6 79 0e bc 1c 3a 3e 58 57 0c 08 bf ff a4 34 5b b4 92 02 be 5e d1 32 5a 15 e7 04 b9 39 99 21 5d 72 af 17 b8 98 ec 27 5c d3 da 11 bb 7b 72 2d 5f 30 44 1b ba da 07 2b 5e 91 31 1d b5 b5 e2 0b 51 fe d4 3d b4 14 97 0d 50 5f a1 3b b7 f7 09 07 53 bc 3f 31 b6 56 7c 01 52 1d 4a 37 b1 31 34 12 55 7a 02 24 b0 90 41 14 54 db 77 22 b3 73 df 1e 57 38 e9 28 b2 d2 aa 18 56 99 9c 2e d6 d6 8a 2f 32 9d bc 19 d7 77 ff 29 33 3c c9 1f d4 94 61 23 30 df 57 15 d5 35 14 25 31 7e 22 13 d2 52 5c 36 36 19 6a 00 d3 f3 29 30 37 b8 1f 06 d0 10 b7 3a 34 5b 81 0c d1 b1 c2 3c 35 fa f4 0a de de 27 1c 3a 95 11 2a df 7f 52 1a 3b 34 64 2c dc 9c cc 10 38 d7 fa 26 dd 3d b9 16 39 76 8f 20 da 5a f1 05 3e 11 c7 33 db fb 84 03 3f b0 b2 35 d8 18 1a 09 3c 53 2c 3f d9 b9 6f 0f 3d f2 59 39 0f f0 c9 22 eb bb ff 14 0e 51 bc 24 ea 1a 8a 12 0d b2 22 2e e9 f9 14 18 0c 13 57 28 e8 58 61 1e 0b 74 1f 3b ef 3f 29 0d 0a d5 6a 3d ee 9e 5c 0b 09 36 f4 37 ed 7d c2 01 08 97 81 31 ec dc b7 07 07 f8 64 11 e3 b3 52 27 06 59 11 17 e2 12 27 21 05 ba 8f 1d e1 f1 b9 2b 04 1b fa 1b e0 50 cc 2d 03 7c b2 08 e7 37 84 3e 02 dd c7 0e e6 96 f1 38 01 3e 59 04 e5 75 6f 32 00 9f 2c 02 e4 d4 1a 34 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c9de2db6-85a6-4b94-b1a8-61eb3f43fc8a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion