CRC32_poly_0x76dc4190__32_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x76dc4190__32_lil_refl_False_ (No description metadata provided).

rule CRC32_poly_0x76dc4190__32_lil_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 90 41 dc 76 20 83 b8 ed b0 c2 64 9b d0 47 ad ad 40 06 71 db f0 c4 15 40 60 85 c9 36 30 ce 86 2d a0 8f 5a 5b 10 4d 3e c0 80 0c e2 b6 e0 89 2b 80 70 c8 f7 f6 c0 0a 93 6d 50 4b 4f 1b 60 9c 0d 5b f0 dd d1 2d 40 1f b5 b6 d0 5e 69 c0 b0 db a0 f6 20 9a 7c 80 90 58 18 1b 00 19 c4 6d 50 52 8b 76 c0 13 57 00 70 d1 33 9b e0 90 ef ed 80 15 26 db 10 54 fa ad a0 96 9e 36 30 d7 42 40 c0 38 1b b6 50 79 c7 c0 e0 bb a3 5b 70 fa 7f 2d 10 7f b6 1b 80 3e 6a 6d 30 fc 0e f6 a0 bd d2 80 f0 f6 9d 9b 60 b7 41 ed d0 75 25 76 40 34 f9 00 20 b1 30 36 b0 f0 ec 40 00 32 88 db 90 73 54 ad a0 a4 16 ed 30 e5 ca 9b 80 27 ae 00 10 66 72 76 70 e3 bb 40 e0 a2 67 36 50 60 03 ad c0 21 df db 90 6a 90 c0 00 2b 4c b6 b0 e9 28 2d 20 a8 f4 5b 40 2d 3d 6d d0 6c e1 1b 60 ae 85 80 f0 ef 59 f6 10 30 ea 1a 80 71 36 6c 30 b3 52 f7 a0 f2 8e 81 c0 77 47 b7 50 36 9b c1 e0 f4 ff 5a 70 b5 23 2c 20 fe 6c 37 b0 bf b0 41 00 7d d4 da 90 3c 08 ac f0 b9 c1 9a 60 f8 1d ec d0 3a 79 77 40 7b a5 01 70 ac e7 41 e0 ed 3b 37 50 2f 5f ac c0 6e 83 da a0 eb 4a ec 30 aa 96 9a 80 68 f2 01 10 29 2e 77 40 62 61 6c d0 23 bd 1a 60 e1 d9 81 f0 a0 05 f7 90 25 cc c1 00 64 10 b7 b0 a6 74 2c 20 e7 a8 5a d0 08 f1 ac 40 49 2d da f0 8b 49 41 60 ca 95 37 00 4f 5c 01 90 0e 80 77 20 cc e4 ec b0 8d 38 9a e0 c6 77 81 70 87 ab f7 c0 45 cf 6c 50 04 13 1a 30 81 da 2c a0 c0 06 5a 10 02 62 c1 80 43 be b7 b0 94 fc f7 20 d5 20 81 90 17 44 1a 00 56 98 6c 60 d3 51 5a f0 92 8d 2c 40 50 e9 b7 d0 11 35 c1 80 5a 7a da 10 1b a6 ac a0 d9 c2 37 30 98 1e 41 50 1d d7 77 c0 5c 0b 01 70 9e 6f 9a e0 df b3 ec 20 60 d4 35 b0 21 08 43 00 e3 6c d8 90 a2 b0 ae f0 27 79 98 60 66 a5 ee d0 a4 c1 75 40 e5 1d 03 10 ae 52 18 80 ef 8e 6e 30 2d ea f5 a0 6c 36 83 c0 e9 ff b5 50 a8 23 c3 e0 6a 47 58 70 2b 9b 2e 40 fc d9 6e d0 bd 05 18 60 7f 61 83 f0 3e bd f5 90 bb 74 c3 00 fa a8 b5 b0 38 cc 2e 20 79 10 58 70 32 5f 43 e0 73 83 35 50 b1 e7 ae c0 f0 3b d8 a0 75 f2 ee 30 34 2e 98 80 f6 4a 03 10 b7 96 75 e0 58 cf 83 70 19 13 f5 c0 db 77 6e 50 9a ab 18 30 1f 62 2e a0 5e be 58 10 9c da c3 80 dd 06 b5 d0 96 49 ae 40 d7 95 d8 f0 15 f1 43 60 54 2d 35 00 d1 e4 03 90 90 38 75 20 52 5c ee b0 13 80 98 80 c4 c2 d8 10 85 1e ae a0 47 7a 35 30 06 a6 43 50 83 6f 75 c0 c2 b3 03 70 00 d7 98 e0 41 0b ee b0 0a 44 f5 20 4b 98 83 90 89 fc 18 00 c8 20 6e 60 4d e9 58 f0 0c 35 2e 40 ce 51 b5 d0 8f 8d c3 30 50 3e 2f a0 11 e2 59 10 d3 86 c2 80 92 5a b4 e0 17 93 82 70 56 4f f4 c0 94 2b 6f 50 d5 f7 19 00 9e b8 02 90 df 64 74 20 1d 00 ef b0 5c dc 99 d0 d9 15 af 40 98 c9 d9 f0 5a ad 42 60 1b 71 34 50 cc 33 74 c0 8d ef 02 70 4f 8b 99 e0 0e 57 ef 80 8b 9e d9 10 ca 42 af a0 08 26 34 30 49 fa 42 60 02 b5 59 f0 43 69 2f 40 81 0d b4 d0 c0 d1 c2 b0 45 18 f4 20 04 c4 82 90 c6 a0 19 00 87 7c 6f f0 68 25 99 60 29 f9 ef d0 eb 9d 74 40 aa 41 02 20 2f 88 34 b0 6e 54 42 00 ac 30 d9 90 ed ec af c0 a6 a3 b4 50 e7 7f c2 e0 25 1b 59 70 64 c7 2f 10 e1 0e 19 80 a0 d2 6f 30 62 b6 f4 a0 23 6a 82 90 f4 28 c2 00 b5 f4 b4 b0 77 90 2f 20 36 4c 59 40 b3 85 6f d0 f2 59 19 60 30 3d 82 f0 71 e1 f4 a0 3a ae ef 30 7b 72 99 80 b9 16 02 10 f8 ca 74 70 7d 03 42 e0 3c df 34 50 fe bb af c0 bf 67 d9 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

35639858-e925-4730-a5af-6d59312e8b07

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion