libavcodec_ff_wma_lsp_codebookflt64_64_big_1088_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libavcodec_ff_wma_lsp_codebook__flt64___64_big_1088_ (No description metadata provided).

rule libavcodec_ff_wma_lsp_codebook__flt64___64_big_1088_ {
  strings:
    $a0 = { 3f ff cc 19 40 98 cc 6a 3f ff ab ce d0 5d 25 1f 3f ff 8c 74 98 02 6a be 3f ff 66 d5 03 a8 00 3a 3f ff 34 c5 94 9f 33 e2 3f fe ef 0c 17 3a 84 35 3f fe 83 dc 18 19 51 60 3f fd ca 66 7d e3 5a ae 3f ff 8f c5 04 81 6f 00 3f ff 5f 90 f4 af 69 e5 3f ff 32 7c 99 d9 85 6d 3f ff 02 4c ec 16 e9 fc 3f fe cd 7a f2 8f 7f 0e 3f fe 8f c7 1a b1 31 3b 3f fe 46 f4 ce 9e 89 18 3f fd f1 a8 03 3e ce c8 3f fd 87 c6 62 d0 59 ca 3f fd 04 6d 2a 24 ec 9e 3f fc 6b 51 6c da 1d ee 3f fb b8 f1 f9 82 0c 8a 3f fa dd 81 78 3a a4 41 3f f9 c0 e2 4b 0e 46 3f 3f f8 21 fb 82 c2 bd 7f 3f f5 4c 9b d4 dd 3c 87 3f fe 6a de 80 53 77 76 3f fd d6 51 f6 97 cc 65 3f fd 58 de a6 3e 17 be 3f fc d3 b3 25 b1 c0 57 3f fc 43 96 b8 68 bc ad 3f fb a6 8e 74 a2 69 4c 3f fa f5 de df 1e 08 29 3f fa 32 b8 0e 23 da 25 3f f9 5c 39 87 0a 4a dd 3f f8 49 87 d6 4d aa 02 3f f6 fd 21 02 d9 fa 07 3f f5 6e 9d af a8 cf 98 3f f3 de 41 ea 30 34 fc 3f f1 f6 33 0f cc d1 aa 3f ee f5 bb 98 f2 d5 a0 3f e7 b2 08 ab a0 2c 5b 3f fc 4f 9e e4 31 42 6d 3f fa da 02 11 d3 11 35 3f f9 97 67 32 3e 40 ad 3f f8 91 d7 68 87 27 fd 3f f7 98 67 5f b5 9d 30 3f f6 97 f7 eb b4 6e 87 3f f5 85 82 b6 53 38 b7 3f f4 5f d3 82 48 9a 23 3f f3 16 af 29 22 e4 06 3f f1 8f fb 37 ef 2f a3 3f ef 9f 3a ce 07 34 7d 3f eb ea a7 c9 5d 2b aa 3f e7 cc 52 93 f6 97 76 3f e3 20 35 aa 86 d1 c1 3f db a0 bf 93 28 66 51 3f c7 02 b5 d2 5f 5d df 3f f6 f2 d3 3e ab e2 47 3f f5 20 4a 7d a7 a0 98 3f f3 5f 31 ce da 18 3a 3f f1 b1 46 3e 52 cc 00 3f f0 17 02 55 6f c9 11 3f ec e8 51 a3 0a dc 7d 3f e9 bd 70 68 c8 c1 4f 3f e6 a0 89 47 91 e4 ef 3f e3 56 36 52 a2 64 43 3f df e1 88 9b 9a 7a c0 3f d8 a5 67 22 78 fb bf 3f d1 59 2d 98 bf 7f 06 3f c2 71 05 a6 b3 07 aa 3f 62 03 d8 d2 94 8c ea bf c5 68 7e 84 14 77 30 bf d7 a3 9b b0 cb 0e 87 3f ef f7 74 65 d8 76 fa 3f ea f0 b1 ce 99 ab 8d 3f e6 a4 25 73 d7 e9 0b 3f e2 87 b5 50 af 44 fd 3f de 1d 95 5c 73 1d 84 3f d7 a8 aa e4 44 b8 97 3f d1 2b 47 2b 8d a2 6a 3f c5 f8 18 aa f1 b0 b2 3f b2 74 17 7e f7 ac ca bf 9f 5d 4d 8d fd 59 32 bf f6 67 ee 71 0c 5c b0 bf d0 15 21 4f 5b 07 0d bf d7 d1 21 a5 ed 0f 0d bf e0 58 1d ee 7d 76 a3 bf e4 c3 95 c1 72 d1 84 bf e9 b2 d5 7a 70 5e 8d 3f d0 f8 43 73 1c 57 4f 3f b0 29 a6 16 aa 91 64 bf b6 b6 68 06 79 96 c5 bf cb 03 35 ea 72 a5 0e bf d3 e2 74 bf 44 a3 f4 bf d9 65 39 5f f3 04 c5 bf de 39 18 0f 15 71 ac bf e1 55 5f 27 ad c3 f3 bf e3 a9 8d 98 03 97 64 bf e6 0f d6 b2 53 cf b6 bf e8 81 73 6d 35 0c a7 bf eb 41 22 13 fc 0b 54 bf ee 7e 14 72 d3 b2 19 bf f1 0a d7 9c b4 81 27 bf f3 48 1e 59 dd 41 0e bf f6 04 d2 a8 03 13 dc bf e1 42 ca 19 ea 0b f8 bf e7 9b 50 83 50 2c 12 bf ec 4b c4 0e 37 50 4e bf f0 2d ca 58 7e 46 57 bf f2 24 6a cb 7a e8 29 bf f4 4a f5 b4 cd 7c a0 bf f6 ba 0a 2f 83 d1 30 bf f9 ec e8 c9 57 a2 53 bf f1 a0 1a d2 94 37 04 bf f2 a4 5a cd d6 e2 fb bf f3 bb e3 85 f6 cf 80 bf f4 dd c6 1c 03 96 b8 bf f6 06 b0 73 4f d8 db bf f7 7f 22 2c 7a b2 4e bf f9 38 5a 49 a2 8b 5b bf fa b3 f6 a2 33 46 29 bf d8 b4 8d 1a b0 2f 88 bf e1 ec 49 34 26 78 3a bf e5 6e e0 98 86 9f 16 bf e8 54 40 99 a3 29 bb bf ea d4 ab 68 79 10 37 bf ed 13 e9 e7 64 d3 94 bf ef 2b bc 4b cb 2f 94 bf f0 97 58 7c 17 fe 79 bf f8 fb b2 e1 3e 48 e6 bf fa 8d 11 4b 01 05 39 bf fb a1 5e 97 65 0b f3 bf fc 75 0d 93 66 79 b2 bf fd 27 09 0b 6c 6f c0 bf fd cb 93 0e 3a 2a 73 bf fe 72 08 2d 76 04 ea bf ff 2b d8 c9 2f 5e 67 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

52afa84d-f7c7-4030-9334-4e0bb8479b66

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion