CRC_32CCastagnolipoly_0x1EDC6F41__32_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_32C__Castagnoli__poly_0x1EDC6F41__32_lil_refl_False_ (No description metadata provided).

rule CRC_32C__Castagnoli__poly_0x1EDC6F41__32_lil_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 41 6f dc 1e 82 de b8 3d c3 b1 64 23 04 bd 71 7b 45 d2 ad 65 86 63 c9 46 c7 0c 15 58 08 7a e3 f6 49 15 3f e8 8a a4 5b cb cb cb 87 d5 0c c7 92 8d 4d a8 4e 93 8e 19 2a b0 cf 76 f6 ae 51 9b 1a f3 10 f4 c6 ed d3 45 a2 ce 92 2a 7e d0 55 26 6b 88 14 49 b7 96 d7 f8 d3 b5 96 97 0f ab 59 e1 f9 05 18 8e 25 1b db 3f 41 38 9a 50 9d 26 5d 5c 88 7e 1c 33 54 60 df 82 30 43 9e ed ec 5d e3 59 e9 f8 a2 36 35 e6 61 87 51 c5 20 e8 8d db e7 e4 98 83 a6 8b 44 9d 65 3a 20 be 24 55 fc a0 eb 23 0a 0e aa 4c d6 10 69 fd b2 33 28 92 6e 2d ef 9e 7b 75 ae f1 a7 6b 6d 40 c3 48 2c 2f 1f 56 b2 c2 f3 0b f3 ad 2f 15 30 1c 4b 36 71 73 97 28 b6 7f 82 70 f7 10 5e 6e 34 a1 3a 4d 75 ce e6 53 ba b8 10 fd fb d7 cc e3 38 66 a8 c0 79 09 74 de be 05 61 86 ff 6a bd 98 3c db d9 bb 7d b4 05 a5 87 dc 0e ef c6 b3 d2 f1 05 02 b6 d2 44 6d 6a cc 83 61 7f 94 c2 0e a3 8a 01 bf c7 a9 40 d0 1b b7 8f a6 ed 19 ce c9 31 07 0d 78 55 24 4c 17 89 3a 8b 1b 9c 62 ca 74 40 7c 09 c5 24 5f 48 aa f8 41 d6 47 14 1c 97 28 c8 02 54 99 ac 21 15 f6 70 3f d2 fa 65 67 93 95 b9 79 50 24 dd 5a 11 4b 01 44 de 3d f7 ea 9f 52 2b f4 5c e3 4f d7 1d 8c 93 c9 da 80 86 91 9b ef 5a 8f 58 5e 3e ac 19 31 e2 b2 64 85 e7 17 25 ea 3b 09 e6 5b 5f 2a a7 34 83 34 60 38 96 6c 21 57 4a 72 e2 e6 2e 51 a3 89 f2 4f 6c ff 04 e1 2d 90 d8 ff ee 21 bc dc af 4e 60 c2 68 42 75 9a 29 2d a9 84 ea 9c cd a7 ab f3 11 b9 35 1e fd e4 74 71 21 fa b7 c0 45 d9 f6 af 99 c7 31 a3 8c 9f 70 cc 50 81 b3 7d 34 a2 f2 12 e8 bc 3d 64 1e 12 7c 0b c2 0c bf ba a6 2f fe d5 7a 31 39 d9 6f 69 78 b6 b3 77 bb 07 d7 54 fa 68 0b 4a 4f d6 c1 c0 0e b9 1d de cd 08 79 fd 8c 67 a5 e3 4b 6b b0 bb 0a 04 6c a5 c9 b5 08 86 88 da d4 98 47 ac 22 36 06 c3 fe 28 c5 72 9a 0b 84 1d 46 15 43 11 53 4d 02 7e 8f 53 c1 cf eb 70 80 a0 37 6e 1e 4d db 33 5f 22 07 2d 9c 93 63 0e dd fc bf 10 1a f0 aa 48 5b 9f 76 56 98 2e 12 75 d9 41 ce 6b 16 37 38 c5 57 58 e4 db 94 e9 80 f8 d5 86 5c e6 12 8a 49 be 53 e5 95 a0 90 54 f1 83 d1 3b 2d 9d ac 8f 28 38 ed e0 f4 26 2e 51 90 05 6f 3e 4c 1b a8 32 59 43 e9 5d 85 5d 2a ec e1 7e 6b 83 3d 60 a4 f5 cb ce e5 9a 17 d0 26 2b 73 f3 67 44 af ed a0 48 ba b5 e1 27 66 ab 22 96 02 88 63 f9 de 96 fd 14 32 cb bc 7b ee d5 7f ca 8a f6 3e a5 56 e8 f9 a9 43 b0 b8 c6 9f ae 7b 77 fb 8d 3a 18 27 93 f5 6e d1 3d b4 01 0d 23 77 b0 69 00 36 df b5 1e f1 d3 a0 46 b0 bc 7c 58 73 0d 18 7b 32 62 c4 65 c8 0a cf 2f 89 65 13 31 4a d4 77 12 0b bb ab 0c cc b7 be 54 8d d8 62 4a 4e 69 06 69 0f 06 da 77 c0 70 2c d9 81 1f f0 c7 42 ae 94 e4 03 c1 48 fa c4 cd 5d a2 85 a2 81 bc 46 13 e5 9f 07 7c 39 81 99 91 d5 dc d8 fe 09 c2 1b 4f 6d e1 5a 20 b1 ff 9d 2c a4 a7 dc 43 78 b9 1f f2 1c 9a 5e 9d c0 84 91 eb 36 2a d0 84 ea 34 13 35 8e 17 52 5a 52 09 95 56 47 51 d4 39 9b 4f 17 88 ff 6c 56 e7 23 72 2b 53 26 d7 6a 3c fa c9 a9 8d 9e ea e8 e2 42 f4 2f ee 57 ac 6e 81 8b b2 ad 30 ef 91 ec 5f 33 8f 23 29 c5 21 62 46 19 3f a1 f7 7d 1c e0 98 a1 02 27 94 b4 5a 66 fb 68 44 a5 4a 0c 67 e4 25 d0 79 7a c8 3c 24 3b a7 e0 3a f8 16 84 19 b9 79 58 07 7e 75 4d 5f 3f 1a 91 41 fc ab f5 62 bd c4 29 7c 72 b2 df d2 33 dd 03 cc f0 6c 67 ef b1 03 bb f1 76 0f ae a9 37 60 72 b7 f4 d1 16 94 b5 be ca 8a }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

80824111-5768-4d68-a4d8-d636839067bf

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion