CRC32_poly_0x6b6b51f4__32_big_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x6b6b51f4__32_big_refl_False_ (No description metadata provided).

rule CRC32_poly_0x6b6b51f4__32_big_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 6b 6b 51 f4 d6 d6 a3 e8 bd bd f2 1c c6 c6 16 24 ad ad 47 d0 10 10 b5 cc 7b 7b e4 38 e6 e7 7d bc 8d 8c 2c 48 30 31 de 54 5b 5a 8f a0 20 21 6b 98 4b 4a 3a 6c f6 f7 c8 70 9d 9c 99 84 a6 a5 aa 8c cd ce fb 78 70 73 09 64 1b 18 58 90 60 63 bc a8 0b 08 ed 5c b6 b5 1f 40 dd de 4e b4 40 42 d7 30 2b 29 86 c4 96 94 74 d8 fd ff 25 2c 86 84 c1 14 ed ef 90 e0 50 52 62 fc 3b 39 33 08 26 20 04 ec 4d 4b 55 18 f0 f6 a7 04 9b 9d f6 f0 e0 e6 12 c8 8b 8d 43 3c 36 30 b1 20 5d 5b e0 d4 c0 c7 79 50 ab ac 28 a4 16 11 da b8 7d 7a 8b 4c 06 01 6f 74 6d 6a 3e 80 d0 d7 cc 9c bb bc 9d 68 80 85 ae 60 eb ee ff 94 56 53 0d 88 3d 38 5c 7c 46 43 b8 44 2d 28 e9 b0 90 95 1b ac fb fe 4a 58 66 62 d3 dc 0d 09 82 28 b0 b4 70 34 db df 21 c0 a0 a4 c5 f8 cb cf 94 0c 76 72 66 10 1d 19 37 e4 4c 40 09 d8 27 2b 58 2c 9a 96 aa 30 f1 fd fb c4 8a 86 1f fc e1 ed 4e 08 5c 50 bc 14 37 3b ed e0 aa a7 74 64 c1 cc 25 90 7c 71 d7 8c 17 1a 86 78 6c 61 62 40 07 0a 33 b4 ba b7 c1 a8 d1 dc 90 5c ea e5 a3 54 81 8e f2 a0 3c 33 00 bc 57 58 51 48 2c 23 b5 70 47 48 e4 84 fa f5 16 98 91 9e 47 6c 0c 02 de e8 67 69 8f 1c da d4 7d 00 b1 bf 2c f4 ca c4 c8 cc a1 af 99 38 1c 12 6b 24 77 79 3a d0 6a 60 0d 34 01 0b 5c c0 bc b6 ae dc d7 dd ff 28 ac a6 1b 10 c7 cd 4a e4 7a 70 b8 f8 11 1b e9 0c 8c 87 70 88 e7 ec 21 7c 5a 51 d3 60 31 3a 82 94 4a 41 66 ac 21 2a 37 58 9c 97 c5 44 f7 fc 94 b0 cc c5 a7 b8 a7 ae f6 4c 1a 13 04 50 71 78 55 a4 0a 03 b1 9c 61 68 e0 68 dc d5 12 74 b7 be 43 80 2a 22 da 04 41 49 8b f0 fc f4 79 ec 97 9f 28 18 ec e4 cc 20 87 8f 9d d4 3a 32 6f c8 51 59 3e 3c 98 80 13 b0 f3 eb 42 44 4e 56 b0 58 25 3d e1 ac 5e 46 05 94 35 2d 54 60 88 90 a6 7c e3 fb f7 88 7e 67 6e 0c 15 0c 3f f8 a8 b1 cd e4 c3 da 9c 10 b8 a1 78 28 d3 ca 29 dc 6e 77 db c0 05 1c 8a 34 3e 25 b9 3c 55 4e e8 c8 e8 f3 1a d4 83 98 4b 20 f8 e3 af 18 93 88 fe ec 2e 35 0c f0 45 5e 5d 04 d8 c2 c4 80 b3 a9 95 74 0e 14 67 68 65 7f 36 9c 1e 04 d2 a4 75 6f 83 50 c8 d2 71 4c a3 b9 20 b8 be a0 17 5c d5 cb 46 a8 68 76 b4 b4 03 1d e5 40 78 66 01 78 13 0d 50 8c ae b0 a2 90 c5 db f3 64 58 47 6a e0 33 2c 3b 14 8e 91 c9 08 e5 fa 98 fc 9e 81 7c c4 f5 ea 2d 30 48 57 df 2c 23 3c 8e d8 18 05 bd d0 73 6e ec 24 ce d3 1e 38 a5 b8 4f cc de c3 ab f4 b5 a8 fa 00 08 15 08 1c 63 7e 59 e8 fe e2 c0 6c 95 89 91 98 28 34 63 84 43 5f 32 70 38 24 d6 48 53 4f 87 bc ee f2 75 a0 85 99 24 54 d4 c0 1a 68 bf ab 4b 9c 02 16 b9 80 69 7d e8 74 12 06 0c 4c 79 6d 5d b8 c4 d0 af a4 af bb fe 50 32 27 67 d4 59 4c 36 20 e4 f1 c4 3c 8f 9a 95 c8 f4 e1 71 f0 9f 8a 20 04 22 37 d2 18 49 5c 83 ec 72 65 b0 e4 19 0e e1 10 a4 b3 13 0c cf d8 42 f8 b4 a3 a6 c0 df c8 f7 34 62 75 05 28 09 1e 54 dc 94 82 cd 58 ff e9 9c ac 42 54 6e b0 29 3f 3f 44 52 44 db 7c 39 2f 8a 88 84 92 78 94 ef f9 29 60 f2 e0 1e 84 99 8b 4f 70 24 36 bd 6c 4f 5d ec 98 34 26 08 a0 5f 4d 59 54 e2 f0 ab 48 89 9b fa bc 14 07 63 38 7f 6c 32 cc c2 d1 c0 d0 a9 ba 91 24 d2 c1 75 1c b9 aa 24 e8 04 17 d6 f4 6f 7c 87 00 54 45 b4 08 3f 2e e5 fc 82 93 17 e0 e9 f8 46 14 92 83 a2 2c f9 e8 f3 d8 44 55 01 c4 2f 3e 50 30 b2 a2 c9 b4 d9 c9 98 40 64 74 6a 5c 0f 1f 3b a8 74 64 df 90 1f 0f 8e 64 a2 b2 7c 78 c9 d9 2d 8c }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

74754614-2622-4e9d-9b4c-7b15c19c2543

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion