MPEG4_fir48_4_120flt64_64_lil_968_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule MPEG4_fir48_4_120__flt64___64_lil_968_ (No description metadata provided).

rule MPEG4_fir48_4_120__flt64___64_lil_968_ {
  strings:
    $a0 = { 00 00 00 00 00 00 00 80 3e e9 94 a4 83 9e 3a bf ed 7e 9d ac f4 79 45 bf b8 2e d3 f3 89 5c 42 bf 00 00 00 00 00 00 00 00 0e 52 93 c8 95 ed 50 3f 57 fa f3 a6 47 b7 63 3f 9d 18 8b 47 66 8c 6f 3f 16 1d 34 ef 04 78 74 3f 43 fc 21 08 20 4d 76 3f 4a 68 59 1b 0d de 73 3f 73 35 a9 95 bf c3 68 3f 00 00 00 00 00 00 00 80 ae 9b bc 8b ea 02 70 bf e9 53 f6 f5 76 a6 80 bf fe b7 95 8c 8a 59 88 bf 3b 02 77 62 0f 5b 8d bf f3 b7 33 86 cf 13 8e bf 30 6e 4a 49 74 6e 89 bf 63 1f 50 75 49 4e 7e bf 00 00 00 00 00 00 00 00 82 b4 aa dd 22 34 82 3f e7 8d 71 8f ae 5c 92 3f 6e 14 98 18 8b 22 9a 3f 89 98 55 8a eb c0 9e 3f 03 a6 b1 d0 1e d5 9e 3f 96 3d 54 d5 ee 90 99 3f 91 80 65 6e c4 ef 8d 3f 00 00 00 00 00 00 00 80 2a 25 8b 09 df 73 91 bf 45 86 5a 75 4b 62 a1 bf fb bd b8 88 bb 77 a8 bf a7 9a b5 29 99 82 ac bf 80 76 66 4f 39 57 ac bf c8 9c 9f 4d 8b 54 a7 bf ef 12 e9 f6 ca 27 9b bf 00 00 00 00 00 00 00 00 be 0e 1d fd d6 67 9f 3f 66 01 57 d5 72 37 af 3f 06 7c db 64 fd f3 b5 3f 9a 99 99 99 99 99 b9 3f 4f 1a b7 10 1c 82 b9 3f e0 db bb 98 bb 15 b5 3f a5 54 d8 41 ab b0 a8 3f 00 00 00 00 00 00 00 80 ff 85 c0 76 59 18 ad bf 78 ea 58 80 52 4f bd bf e6 9a 44 6c 50 f5 c4 bf f2 5d d1 04 46 f2 c8 bf 9e 70 96 9d 7c 7d c9 bf 95 21 e8 52 de ba c5 bf 77 68 a4 1a 00 6e ba bf 00 00 00 00 00 00 00 00 f0 d2 6a 25 84 50 c1 3f 6b a7 07 38 4d ce d2 3f 9c cf bb dc 20 ad dd 3f 3a af ac 92 9a 2e e4 3f 33 4c e6 4a 8f f6 e8 3f d2 2f 65 6e 2b be ec 3f 4b bf 86 21 67 2a ef 3f 00 00 00 00 00 00 f0 3f 4b bf 86 21 67 2a ef 3f d2 2f 65 6e 2b be ec 3f 33 4c e6 4a 8f f6 e8 3f 3a af ac 92 9a 2e e4 3f 9c cf bb dc 20 ad dd 3f 6b a7 07 38 4d ce d2 3f f0 d2 6a 25 84 50 c1 3f 00 00 00 00 00 00 00 00 77 68 a4 1a 00 6e ba bf 95 21 e8 52 de ba c5 bf 9e 70 96 9d 7c 7d c9 bf f2 5d d1 04 46 f2 c8 bf e6 9a 44 6c 50 f5 c4 bf 78 ea 58 80 52 4f bd bf ff 85 c0 76 59 18 ad bf 00 00 00 00 00 00 00 80 a5 54 d8 41 ab b0 a8 3f e0 db bb 98 bb 15 b5 3f 4f 1a b7 10 1c 82 b9 3f 9a 99 99 99 99 99 b9 3f 06 7c db 64 fd f3 b5 3f 66 01 57 d5 72 37 af 3f be 0e 1d fd d6 67 9f 3f 00 00 00 00 00 00 00 00 ef 12 e9 f6 ca 27 9b bf c8 9c 9f 4d 8b 54 a7 bf 80 76 66 4f 39 57 ac bf a7 9a b5 29 99 82 ac bf fb bd b8 88 bb 77 a8 bf 45 86 5a 75 4b 62 a1 bf 2a 25 8b 09 df 73 91 bf 00 00 00 00 00 00 00 80 91 80 65 6e c4 ef 8d 3f 96 3d 54 d5 ee 90 99 3f 03 a6 b1 d0 1e d5 9e 3f 89 98 55 8a eb c0 9e 3f 6e 14 98 18 8b 22 9a 3f e7 8d 71 8f ae 5c 92 3f 82 b4 aa dd 22 34 82 3f 00 00 00 00 00 00 00 00 63 1f 50 75 49 4e 7e bf 30 6e 4a 49 74 6e 89 bf f3 b7 33 86 cf 13 8e bf 3b 02 77 62 0f 5b 8d bf fe b7 95 8c 8a 59 88 bf e9 53 f6 f5 76 a6 80 bf ae 9b bc 8b ea 02 70 bf 00 00 00 00 00 00 00 80 73 35 a9 95 bf c3 68 3f 4a 68 59 1b 0d de 73 3f 43 fc 21 08 20 4d 76 3f 16 1d 34 ef 04 78 74 3f 9d 18 8b 47 66 8c 6f 3f 57 fa f3 a6 47 b7 63 3f 0e 52 93 c8 95 ed 50 3f 00 00 00 00 00 00 00 00 b8 2e d3 f3 89 5c 42 bf ed 7e 9d ac f4 79 45 bf 3e e9 94 a4 83 9e 3a bf 00 00 00 00 00 00 00 80 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

19f59a25-53a3-494b-bf5f-a7dbe5483a80

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion