CRC32_poly_0x86d3d2d4__32_lil_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x86d3d2d4__32_lil_refl_True_ (No description metadata provided).

rule CRC32_poly_0x86d3d2d4__32_lil_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 e2 d1 ae 0c c4 a3 5d 19 26 72 f3 15 88 47 bb 32 6a 96 15 3e 4c e4 e6 2b ae 35 48 27 d3 19 e1 33 31 c8 4f 3f 17 ba bc 2a f5 6b 12 26 5b 5e 5a 01 b9 8f f4 0d 9f fd 07 18 7d 2c a9 14 65 a5 55 31 87 74 fb 3d a1 06 08 28 43 d7 a6 24 ed e2 ee 03 0f 33 40 0f 29 41 b3 1a cb 90 1d 16 b6 bc b4 02 54 6d 1a 0e 72 1f e9 1b 90 ce 47 17 3e fb 0f 30 dc 2a a1 3c fa 58 52 29 18 89 fc 25 09 dc 3c 34 eb 0d 92 38 cd 7f 61 2d 2f ae cf 21 81 9b 87 06 63 4a 29 0a 45 38 da 1f a7 e9 74 13 da c5 dd 07 38 14 73 0b 1e 66 80 1e fc b7 2e 12 52 82 66 35 b0 53 c8 39 96 21 3b 2c 74 f0 95 20 6c 79 69 05 8e a8 c7 09 a8 da 34 1c 4a 0b 9a 10 e4 3e d2 37 06 ef 7c 3b 20 9d 8f 2e c2 4c 21 22 bf 60 88 36 5d b1 26 3a 7b c3 d5 2f 99 12 7b 23 37 27 33 04 d5 f6 9d 08 f3 84 6e 1d 11 55 c0 11 d1 2e ee 3e 33 ff 40 32 15 8d b3 27 f7 5c 1d 2b 59 69 55 0c bb b8 fb 00 9d ca 08 15 7f 1b a6 19 02 37 0f 0d e0 e6 a1 01 c6 94 52 14 24 45 fc 18 8a 70 b4 3f 68 a1 1a 33 4e d3 e9 26 ac 02 47 2a b4 8b bb 0f 56 5a 15 03 70 28 e6 16 92 f9 48 1a 3c cc 00 3d de 1d ae 31 f8 6f 5d 24 1a be f3 28 67 92 5a 3c 85 43 f4 30 a3 31 07 25 41 e0 a9 29 ef d5 e1 0e 0d 04 4f 02 2b 76 bc 17 c9 a7 12 1b d8 f2 d2 0a 3a 23 7c 06 1c 51 8f 13 fe 80 21 1f 50 b5 69 38 b2 64 c7 34 94 16 34 21 76 c7 9a 2d 0b eb 33 39 e9 3a 9d 35 cf 48 6e 20 2d 99 c0 2c 83 ac 88 0b 61 7d 26 07 47 0f d5 12 a5 de 7b 1e bd 57 87 3b 5f 86 29 37 79 f4 da 22 9b 25 74 2e 35 10 3c 09 d7 c1 92 05 f1 b3 61 10 13 62 cf 1c 6e 4e 66 08 8c 9f c8 04 aa ed 3b 11 48 3c 95 1d e6 09 dd 3a 04 d8 73 36 22 aa 80 23 c0 7b 2e 2f 61 cb 4b 2b 83 1a e5 27 a5 68 16 32 47 b9 b8 3e e9 8c f0 19 0b 5d 5e 15 2d 2f ad 00 cf fe 03 0c b2 d2 aa 18 50 03 04 14 76 71 f7 01 94 a0 59 0d 3a 95 11 2a d8 44 bf 26 fe 36 4c 33 1c e7 e2 3f 04 6e 1e 1a e6 bf b0 16 c0 cd 43 03 22 1c ed 0f 8c 29 a5 28 6e f8 0b 24 48 8a f8 31 aa 5b 56 3d d7 77 ff 29 35 a6 51 25 13 d4 a2 30 f1 05 0c 3c 5f 30 44 1b bd e1 ea 17 9b 93 19 02 79 42 b7 0e 68 17 77 1f 8a c6 d9 13 ac b4 2a 06 4e 65 84 0a e0 50 cc 2d 02 81 62 21 24 f3 91 34 c6 22 3f 38 bb 0e 96 2c 59 df 38 20 7f ad cb 35 9d 7c 65 39 33 49 2d 1e d1 98 83 12 f7 ea 70 07 15 3b de 0b 0d b2 22 2e ef 63 8c 22 c9 11 7f 37 2b c0 d1 3b 85 f5 99 1c 67 24 37 10 41 56 c4 05 a3 87 6a 09 de ab c3 1d 3c 7a 6d 11 1a 08 9e 04 f8 d9 30 08 56 ec 78 2f b4 3d d6 23 92 4f 25 36 70 9e 8b 3a b0 e5 a5 15 52 34 0b 19 74 46 f8 0c 96 97 56 00 38 a2 1e 27 da 73 b0 2b fc 01 43 3e 1e d0 ed 32 63 fc 44 26 81 2d ea 2a a7 5f 19 3f 45 8e b7 33 eb bb ff 14 09 6a 51 18 2f 18 a2 0d cd c9 0c 01 d5 40 f0 24 37 91 5e 28 11 e3 ad 3d f3 32 03 31 5d 07 4b 16 bf d6 e5 1a 99 a4 16 0f 7b 75 b8 03 06 59 11 17 e4 88 bf 1b c2 fa 4c 0e 20 2b e2 02 8e 1e aa 25 6c cf 04 29 4a bd f7 3c a8 6c 59 30 b9 39 99 21 5b e8 37 2d 7d 9a c4 38 9f 4b 6a 34 31 7e 22 13 d3 af 8c 1f f5 dd 7f 0a 17 0c d1 06 6a 20 78 12 88 f1 d6 1e ae 83 25 0b 4c 52 8b 07 e2 67 c3 20 00 b6 6d 2c 26 c4 9e 39 c4 15 30 35 dc 9c cc 10 3e 4d 62 1c 18 3f 91 09 fa ee 3f 05 54 db 77 22 b6 0a d9 2e 90 78 2a 3b 72 a9 84 37 0f 85 2d 23 ed 54 83 2f cb 26 70 3a 29 f7 de 36 87 c2 96 11 65 13 38 1d 43 61 cb 08 a1 b0 65 04 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7916b34d-83f9-45ab-87af-181de53f323f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion