Lame_MP3_window_subband____mdct_routine_winflt64_64_big_1152_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule Lame_MP3_window_subband____mdct_routine_win__flt64___64_big_1152_ (No description metadata provided).

rule Lame_MP3_window_subband____mdct_routine_win__flt64___64_big_1152_ {
  strings:
    $a0 = { 3d 50 c3 60 08 a4 42 66 3d 66 99 99 7e 7f 85 b3 3d 70 89 c4 1b b3 9b f1 3d 73 be ff 7a a6 ff 25 3d 74 d3 8a f6 e3 92 2b 3d 73 be ff 7a a6 ff 25 3d 70 89 c4 1b b3 9b f2 3d 66 99 99 7e 7f 85 b8 3d 50 c3 60 08 a4 42 70 3d 97 ff 0a 65 fe 13 fc 3d 95 75 3f bd 43 63 2c 3d 92 a6 52 35 79 8d 9b 3d 8f 50 33 df f9 31 8a 3d 89 23 bd d3 33 eb e0 3d 82 f7 47 c6 6e a6 35 3d 79 f5 ae 76 e9 79 14 3d 6d 73 f0 af 84 45 99 3d 52 4b 36 d3 5d 7e 37 bd 97 ff 0a 65 fe 13 fc bd 95 75 3f bd 43 63 2c bd 92 a6 52 35 79 8d 9b bd 8f 50 33 df f9 31 8a bd 89 23 bd d3 33 eb e2 bd 82 f7 47 c6 6e a6 35 bd 79 f5 ae 76 e9 79 14 bd 6d 73 f0 af 84 45 9a bd 52 4b 36 d3 5d 7e 37 bd 50 c3 60 08 a4 42 7a bd 66 99 99 7e 7f 85 bc bd 70 89 c4 1b b3 9b f5 bd 73 be ff 7a a6 ff 25 bd 74 d3 8a f6 e3 92 2b bd 73 be ff 7a a6 ff 25 bd 70 89 c4 1b b3 9b f4 bd 66 99 99 7e 7f 85 b9 bd 50 c3 60 08 a4 42 70 3d 50 c3 60 08 a4 42 66 3d 66 99 99 7e 7f 85 b3 3d 70 89 c4 1b b3 9b f1 3d 73 be ff 7a a6 ff 25 3d 74 d3 8a f6 e3 92 2b 3d 73 be ff 7a a6 ff 25 3d 70 89 c4 1b b3 9b f1 3d 66 99 99 7e 7f 85 ba 3d 50 c3 60 08 a4 42 70 3d 97 ff 0a 65 fe 13 fd 3d 95 75 3f bd 43 63 2c 3d 92 a6 52 35 79 8d 9b 3d 8f 50 33 df f9 31 8d 3d 89 23 bd d3 33 eb e0 3d 82 f7 47 c6 6e a6 35 3d 79 f5 ae 76 e9 79 0f 3d 6d 73 f0 af 84 45 9a 3d 52 4b 36 d3 5d 7e 37 bd 98 04 e4 9b ce c6 a8 bd 95 a4 a6 67 18 32 bb bd 93 1a 3d 44 82 c2 3d bd 90 6a 9c 68 70 36 2a bd 8b 35 ff 14 87 01 49 bd 85 61 c1 64 60 d2 60 bd 7e 84 4c bb f6 5e 9f bd 71 26 39 20 97 2c 4a bd 53 af 69 3e 3c b4 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd 50 12 08 fb cf 46 2f bd 5c 69 f5 bb 3b 17 6f bd 4e 35 c0 96 16 c8 6c 3f c0 d9 fd 31 c9 8b f7 3f da 82 79 99 fc ef 31 3f e8 8d f1 53 d6 a6 74 3f f1 75 ff e7 1f 07 5f 3f f4 da 02 d9 3a b9 e7 3f f9 1d 6e 9f ab 8f 62 3f fe bc 57 c1 38 aa b6 40 03 50 4f 33 3f 9d e4 40 09 5f 6d 18 82 82 36 40 12 0a f7 2b 84 12 0c 40 1e 62 0d 5d ba 72 b0 40 36 e7 5d 2d d1 c3 67 3f ef 83 8b 8c 81 1c 17 3f e4 91 b7 52 3c 16 1d 3f d5 e3 a8 74 8a 0b f7 3f ee 11 f6 42 52 2d 1c bf c6 3a 1a 7e 0b 73 88 bf e8 83 6f a2 cf 50 38 3f eb b6 7a e8 58 4c ab 3f e0 00 00 00 00 00 00 bf e0 76 bf cd 6f be cc bf de 30 db 48 5d b6 5f bf d4 0e 60 4f 47 01 fd bf c7 48 ee 85 85 1a ed bf b8 36 03 a7 f2 53 59 bf a4 f9 70 dd 82 06 d0 bf 8d 14 23 9d 59 a7 c1 bf 6e 4f 68 c7 08 d3 f3 3f eb 70 95 01 0f 93 55 3f ec 37 3a fe 3f a8 0c 3f ee 63 5b 9e e7 b5 6f 3f ef 77 50 2a 0d d1 5a 3f ef db 48 2d d3 0f 5a 3f ef f9 1f 90 1a 81 04 3f ef ff 2c 98 db e4 4d 3f ef ff f1 a5 28 05 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3d 50 12 08 fb cf 46 2f 3d 5c 69 f5 bb 3b 17 6f 3d 4e 35 c0 96 16 c8 6c 3d 98 04 e4 9b ce c6 a8 3d 95 a4 a6 67 18 32 bb 3d 93 1a 3d 44 82 c2 3d 3d 90 6a 9c 68 70 36 2a 3d 8b 35 ff 14 87 01 49 3d 85 61 c1 64 60 d2 62 3d 7e 84 4c bb f6 5e 9f 3d 71 26 39 20 97 2c 4a 3d 53 af 69 3e 3c b4 c0 bd 97 ff 0a 65 fe 13 fd bd 95 75 3f bd 43 63 2c bd 92 a6 52 35 79 8d 9b bd 8f 50 33 df f9 31 8d bd 89 23 bd d3 33 eb e0 bd 82 f7 47 c6 6e a6 35 bd 79 f5 ae 76 e9 79 0f bd 6d 73 f0 af 84 45 9a bd 52 4b 36 d3 5d 7e 37 bd 50 c3 60 08 a4 42 66 bd 66 99 99 7e 7f 85 b3 bd 70 89 c4 1b b3 9b f1 bd 73 be ff 7a a6 ff 25 bd 74 d3 8a f6 e3 92 2b bd 73 be ff 7a a6 ff 25 bd 70 89 c4 1b b3 9b f1 bd 66 99 99 7e 7f 85 ba bd 50 c3 60 08 a4 42 70 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7ade9ba5-0167-4865-bc1b-85109245c158

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion