CRC32_poly_0x4db26158__32_big_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x4db26158__32_big_refl_True_ (No description metadata provided).

rule CRC32_poly_0x4db26158__32_big_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 05 10 64 2c 0a 20 c8 58 0f 30 ac 74 14 41 90 b0 11 51 f4 9c 1e 61 58 e8 1b 71 3c c4 1d 8f ba 05 18 9f de 29 17 af 72 5d 12 bf 16 71 09 ce 2a b5 0c de 4e 99 03 ee e2 ed 06 fe 86 c1 0e 13 ef 6f 0b 03 8b 43 04 33 27 37 01 23 43 1b 1a 52 7f df 1f 42 1b f3 10 72 b7 87 15 62 d3 ab 13 9c 55 6a 16 8c 31 46 19 bc 9d 32 1c ac f9 1e 07 dd c5 da 02 cd a1 f6 0d fd 0d 82 08 ed 69 ae 1c 27 de de 19 37 ba f2 16 07 16 86 13 17 72 aa 08 66 4e 6e 0d 76 2a 42 02 46 86 36 07 56 e2 1a 01 a8 64 db 04 b8 00 f7 0b 88 ac 83 0e 98 c8 af 15 e9 f4 6b 10 f9 90 47 1f c9 3c 33 1a d9 58 1f 12 34 31 b1 17 24 55 9d 18 14 f9 e9 1d 04 9d c5 06 75 a1 01 03 65 c5 2d 0c 55 69 59 09 45 0d 75 0f bb 8b b4 0a ab ef 98 05 9b 43 ec 00 8b 27 c0 1b fa 1b 04 1e ea 7f 28 11 da d3 5c 14 ca b7 70 0d 43 26 d9 08 53 42 f5 07 63 ee 81 02 73 8a ad 19 02 b6 69 1c 12 d2 45 13 22 7e 31 16 32 1a 1d 10 cc 9c dc 15 dc f8 f0 1a ec 54 84 1f fc 30 a8 04 8d 0c 6c 01 9d 68 40 0e ad c4 34 0b bd a0 18 03 50 c9 b6 06 40 ad 9a 09 70 01 ee 0c 60 65 c2 17 11 59 06 12 01 3d 2a 1d 31 91 5e 18 21 f5 72 1e df 73 b3 1b cf 17 9f 14 ff bb eb 11 ef df c7 0a 9e e3 03 0f 8e 87 2f 00 be 2b 5b 05 ae 4f 77 11 64 f8 07 14 74 9c 2b 1b 44 30 5f 1e 54 54 73 05 25 68 b7 00 35 0c 9b 0f 05 a0 ef 0a 15 c4 c3 0c eb 42 02 09 fb 26 2e 06 cb 8a 5a 03 db ee 76 18 aa d2 b2 1d ba b6 9e 12 8a 1a ea 17 9a 7e c6 1f 77 17 68 1a 67 73 44 15 57 df 30 10 47 bb 1c 0b 36 87 d8 0e 26 e3 f4 01 16 4f 80 04 06 2b ac 02 f8 ad 6d 07 e8 c9 41 08 d8 65 35 0d c8 01 19 16 b9 3d dd 13 a9 59 f1 1c 99 f5 85 19 89 91 a9 1a 86 4d b2 1f 96 29 9e 10 a6 85 ea 15 b6 e1 c6 0e c7 dd 02 0b d7 b9 2e 04 e7 15 5a 01 f7 71 76 07 09 f7 b7 02 19 93 9b 0d 29 3f ef 08 39 5b c3 13 48 67 07 16 58 03 2b 19 68 af 5f 1c 78 cb 73 14 95 a2 dd 11 85 c6 f1 1e b5 6a 85 1b a5 0e a9 00 d4 32 6d 05 c4 56 41 0a f4 fa 35 0f e4 9e 19 09 1a 18 d8 0c 0a 7c f4 03 3a d0 80 06 2a b4 ac 1d 5b 88 68 18 4b ec 44 17 7b 40 30 12 6b 24 1c 06 a1 93 6c 03 b1 f7 40 0c 81 5b 34 09 91 3f 18 12 e0 03 dc 17 f0 67 f0 18 c0 cb 84 1d d0 af a8 1b 2e 29 69 1e 3e 4d 45 11 0e e1 31 14 1e 85 1d 0f 6f b9 d9 0a 7f dd f5 05 4f 71 81 00 5f 15 ad 08 b2 7c 03 0d a2 18 2f 02 92 b4 5b 07 82 d0 77 1c f3 ec b3 19 e3 88 9f 16 d3 24 eb 13 c3 40 c7 15 3d c6 06 10 2d a2 2a 1f 1d 0e 5e 1a 0d 6a 72 01 7c 56 b6 04 6c 32 9a 0b 5c 9e ee 0e 4c fa c2 17 c5 6b 6b 12 d5 0f 47 1d e5 a3 33 18 f5 c7 1f 03 84 fb db 06 94 9f f7 09 a4 33 83 0c b4 57 af 0a 4a d1 6e 0f 5a b5 42 00 6a 19 36 05 7a 7d 1a 1e 0b 41 de 1b 1b 25 f2 14 2b 89 86 11 3b ed aa 19 d6 84 04 1c c6 e0 28 13 f6 4c 5c 16 e6 28 70 0d 97 14 b4 08 87 70 98 07 b7 dc ec 02 a7 b8 c0 04 59 3e 01 01 49 5a 2d 0e 79 f6 59 0b 69 92 75 10 18 ae b1 15 08 ca 9d 1a 38 66 e9 1f 28 02 c5 0b e2 b5 b5 0e f2 d1 99 01 c2 7d ed 04 d2 19 c1 1f a3 25 05 1a b3 41 29 15 83 ed 5d 10 93 89 71 16 6d 0f b0 13 7d 6b 9c 1c 4d c7 e8 19 5d a3 c4 02 2c 9f 00 07 3c fb 2c 08 0c 57 58 0d 1c 33 74 05 f1 5a da 00 e1 3e f6 0f d1 92 82 0a c1 f6 ae 11 b0 ca 6a 14 a0 ae 46 1b 90 02 32 1e 80 66 1e 18 7e e0 df 1d 6e 84 f3 12 5e 28 87 17 4e 4c ab 0c 3f 70 6f 09 2f 14 43 06 1f b8 37 03 0f dc 1b }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

253946d2-90dd-4ffe-a5d0-125e7bbbbb5e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion