CRC_15_CAN_poly_0x4cd1__16_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_15_CAN_poly_0x4cd1__16_lil_refl_False_ (No description metadata provided).

rule CRC_15_CAN_poly_0x4cd1__16_lil_refl_False_ {
  strings:
    $a0 = { 00 00 d1 4c a2 99 73 d5 95 7f 44 33 37 e6 e6 aa 2a ff fb b3 88 66 59 2a bf 80 6e cc 1d 19 cc 55 85 b2 54 fe 27 2b f6 67 10 cd c1 81 b2 54 63 18 af 4d 7e 01 0d d4 dc 98 3a 32 eb 7e 98 ab 49 e7 db 29 0a 65 79 b0 a8 fc 4e 56 9f 1a ec cf 3d 83 f1 d6 20 9a 53 4f 82 03 64 a9 b5 e5 c6 30 17 7c 5e 9b 8f d7 fc 02 2d 4e cb e4 1a a8 69 7d b8 31 74 64 a5 28 d6 fd 07 b1 e1 1b 30 57 43 82 92 ce b6 53 67 1f 14 ca c5 86 23 2c f2 60 81 b5 50 f9 9c ac 4d e0 3e 35 ef 79 09 d3 d8 9f ab 4a 7a 06 33 e1 e2 ad 91 78 40 34 a6 9e 77 d2 04 07 d5 4b 19 1e c8 52 bb 87 6a cb 8c 61 5d 2d 2e f8 ff b4 6d 7a bc 36 cf e3 1e af f8 05 29 49 5a 9c 8b d0 47 85 96 c9 e5 1c 34 50 d2 fa 03 b6 70 63 a1 2f e8 c8 39 84 4a 51 9b 1d 7d b7 ac fb df 2e 0e 62 c2 37 13 7b 60 ae b1 e2 57 48 86 04 f5 d1 24 9d 6c a7 bd eb ce 3e 1f 72 f9 d8 28 94 5b 41 8a 0d 46 58 97 14 e4 c1 35 8d d3 27 02 6b 71 be a0 f2 e9 15 38 59 4b 8c 9a c0 7c 6a ad 26 de f3 0f bf c3 ea 12 a6 61 73 b0 3f 56 95 87 d9 f4 0c 25 40 b7 8e 66 c2 15 17 c4 5b 22 f1 f3 bd 80 68 51 24 9d 71 4c 3d 3f e8 ee a4 08 0e d9 42 aa 97 7b db 32 3c e3 70 90 a5 41 e9 a7 43 76 0f 05 da d4 96 18 c3 c9 8f ba 5a 6b 16 8d bc 5c f0 2f 25 fe 69 da f4 0b b8 78 6d a9 21 4f 8b 9e c7 ed 12 3c 5e f0 0b 21 47 52 92 83 de 65 74 b4 38 c7 ed 16 a1 5f 46 8e 0a fd df 2c 93 ca 39 1b 75 68 a0 b9 ec 75 b9 a4 f5 d7 20 06 6c e0 c6 31 8a 42 5f 93 13 01 dd d0 91 a3 44 72 08 94 a2 45 ee 36 3b e7 77 2b 22 fa 6e 89 bb 58 f7 be 5d 6f 11 1c c4 cd 88 84 6f 55 23 26 f6 f7 ba 11 10 c0 5c b3 89 62 c5 ae 90 7f dc 0c 09 dd 45 3b ef ea a3 99 76 48 3a }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7956201e-4bf8-4aba-902d-d607b56b8db3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion