CRC_24_Radix_64_poly_0x864CFB__32_big_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_24_Radix_64_poly_0x864CFB__32_big_refl_False_ (No description metadata provided).

rule CRC_24_Radix_64_poly_0x864CFB__32_big_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 00 86 4c fb 01 0c 99 f6 01 8a d5 0d 02 19 33 ec 02 9f 7f 17 03 15 aa 1a 03 93 e6 e1 04 32 67 d8 04 b4 2b 23 05 3e fe 2e 05 b8 b2 d5 06 2b 54 34 06 ad 18 cf 07 27 cd c2 07 a1 81 39 08 64 cf b0 08 e2 83 4b 09 68 56 46 09 ee 1a bd 0a 7d fc 5c 0a fb b0 a7 0b 71 65 aa 0b f7 29 51 0c 56 a8 68 0c d0 e4 93 0d 5a 31 9e 0d dc 7d 65 0e 4f 9b 84 0e c9 d7 7f 0f 43 02 72 0f c5 4e 89 10 c9 9f 60 10 4f d3 9b 11 c5 06 96 11 43 4a 6d 12 d0 ac 8c 12 56 e0 77 13 dc 35 7a 13 5a 79 81 14 fb f8 b8 14 7d b4 43 15 f7 61 4e 15 71 2d b5 16 e2 cb 54 16 64 87 af 17 ee 52 a2 17 68 1e 59 18 ad 50 d0 18 2b 1c 2b 19 a1 c9 26 19 27 85 dd 1a b4 63 3c 1a 32 2f c7 1b b8 fa ca 1b 3e b6 31 1c 9f 37 08 1c 19 7b f3 1d 93 ae fe 1d 15 e2 05 1e 86 04 e4 1e 00 48 1f 1f 8a 9d 12 1f 0c d1 e9 21 93 3e c0 21 15 72 3b 20 9f a7 36 20 19 eb cd 23 8a 0d 2c 23 0c 41 d7 22 86 94 da 22 00 d8 21 25 a1 59 18 25 27 15 e3 24 ad c0 ee 24 2b 8c 15 27 b8 6a f4 27 3e 26 0f 26 b4 f3 02 26 32 bf f9 29 f7 f1 70 29 71 bd 8b 28 fb 68 86 28 7d 24 7d 2b ee c2 9c 2b 68 8e 67 2a e2 5b 6a 2a 64 17 91 2d c5 96 a8 2d 43 da 53 2c c9 0f 5e 2c 4f 43 a5 2f dc a5 44 2f 5a e9 bf 2e d0 3c b2 2e 56 70 49 31 5a a1 a0 31 dc ed 5b 30 56 38 56 30 d0 74 ad 33 43 92 4c 33 c5 de b7 32 4f 0b ba 32 c9 47 41 35 68 c6 78 35 ee 8a 83 34 64 5f 8e 34 e2 13 75 37 71 f5 94 37 f7 b9 6f 36 7d 6c 62 36 fb 20 99 39 3e 6e 10 39 b8 22 eb 38 32 f7 e6 38 b4 bb 1d 3b 27 5d fc 3b a1 11 07 3a 2b c4 0a 3a ad 88 f1 3d 0c 09 c8 3d 8a 45 33 3c 00 90 3e 3c 86 dc c5 3f 15 3a 24 3f 93 76 df 3e 19 a3 d2 3e 9f ef 29 43 26 7d 80 43 a0 31 7b 42 2a e4 76 42 ac a8 8d 41 3f 4e 6c 41 b9 02 97 40 33 d7 9a 40 b5 9b 61 47 14 1a 58 47 92 56 a3 46 18 83 ae 46 9e cf 55 45 0d 29 b4 45 8b 65 4f 44 01 b0 42 44 87 fc b9 4b 42 b2 30 4b c4 fe cb 4a 4e 2b c6 4a c8 67 3d 49 5b 81 dc 49 dd cd 27 48 57 18 2a 48 d1 54 d1 4f 70 d5 e8 4f f6 99 13 4e 7c 4c 1e 4e fa 00 e5 4d 69 e6 04 4d ef aa ff 4c 65 7f f2 4c e3 33 09 53 ef e2 e0 53 69 ae 1b 52 e3 7b 16 52 65 37 ed 51 f6 d1 0c 51 70 9d f7 50 fa 48 fa 50 7c 04 01 57 dd 85 38 57 5b c9 c3 56 d1 1c ce 56 57 50 35 55 c4 b6 d4 55 42 fa 2f 54 c8 2f 22 54 4e 63 d9 5b 8b 2d 50 5b 0d 61 ab 5a 87 b4 a6 5a 01 f8 5d 59 92 1e bc 59 14 52 47 58 9e 87 4a 58 18 cb b1 5f b9 4a 88 5f 3f 06 73 5e b5 d3 7e 5e 33 9f 85 5d a0 79 64 5d 26 35 9f 5c ac e0 92 5c 2a ac 69 62 b5 43 40 62 33 0f bb 63 b9 da b6 63 3f 96 4d 60 ac 70 ac 60 2a 3c 57 61 a0 e9 5a 61 26 a5 a1 66 87 24 98 66 01 68 63 67 8b bd 6e 67 0d f1 95 64 9e 17 74 64 18 5b 8f 65 92 8e 82 65 14 c2 79 6a d1 8c f0 6a 57 c0 0b 6b dd 15 06 6b 5b 59 fd 68 c8 bf 1c 68 4e f3 e7 69 c4 26 ea 69 42 6a 11 6e e3 eb 28 6e 65 a7 d3 6f ef 72 de 6f 69 3e 25 6c fa d8 c4 6c 7c 94 3f 6d f6 41 32 6d 70 0d c9 72 7c dc 20 72 fa 90 db 73 70 45 d6 73 f6 09 2d 70 65 ef cc 70 e3 a3 37 71 69 76 3a 71 ef 3a c1 76 4e bb f8 76 c8 f7 03 77 42 22 0e 77 c4 6e f5 74 57 88 14 74 d1 c4 ef 75 5b 11 e2 75 dd 5d 19 7a 18 13 90 7a 9e 5f 6b 7b 14 8a 66 7b 92 c6 9d 78 01 20 7c 78 87 6c 87 79 0d b9 8a 79 8b f5 71 7e 2a 74 48 7e ac 38 b3 7f 26 ed be 7f a0 a1 45 7c 33 47 a4 7c b5 0b 5f 7d 3f de 52 7d b9 92 a9 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0cf61b6b-5b53-4ed2-ba29-dc8fc83193ca

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion