CRC32_poly_0x4db26158__32_big_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x4db26158__32_big_refl_False_ (No description metadata provided).

rule CRC32_poly_0x4db26158__32_big_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 4d b2 61 58 9b 64 c2 b0 d6 d6 a3 e8 7b 7b e4 38 36 c9 85 60 e0 1f 26 88 ad ad 47 d0 f6 f7 c8 70 bb 45 a9 28 6d 93 0a c0 20 21 6b 98 8d 8c 2c 48 c0 3e 4d 10 16 e8 ee f8 5b 5a 8f a0 a0 5d f1 b8 ed ef 90 e0 3b 39 33 08 76 8b 52 50 db 26 15 80 96 94 74 d8 40 42 d7 30 0d f0 b6 68 56 aa 39 c8 1b 18 58 90 cd ce fb 78 80 7c 9a 20 2d d1 dd f0 60 63 bc a8 b6 b5 1f 40 fb 07 7e 18 0d 09 82 28 40 bb e3 70 96 6d 40 98 db df 21 c0 76 72 66 10 3b c0 07 48 ed 16 a4 a0 a0 a4 c5 f8 fb fe 4a 58 b6 4c 2b 00 60 9a 88 e8 2d 28 e9 b0 80 85 ae 60 cd 37 cf 38 1b e1 6c d0 56 53 0d 88 ad 54 73 90 e0 e6 12 c8 36 30 b1 20 7b 82 d0 78 d6 2f 97 a8 9b 9d f6 f0 4d 4b 55 18 00 f9 34 40 5b a3 bb e0 16 11 da b8 c0 c7 79 50 8d 75 18 08 20 d8 5f d8 6d 6a 3e 80 bb bc 9d 68 f6 0e fc 30 1a 13 04 50 57 a1 65 08 81 77 c6 e0 cc c5 a7 b8 61 68 e0 68 2c da 81 30 fa 0c 22 d8 b7 be 43 80 ec e4 cc 20 a1 56 ad 78 77 80 0e 90 3a 32 6f c8 97 9f 28 18 da 2d 49 40 0c fb ea a8 41 49 8b f0 ba 4e f5 e8 f7 fc 94 b0 21 2a 37 58 6c 98 56 00 c1 35 11 d0 8c 87 70 88 5a 51 d3 60 17 e3 b2 38 4c b9 3d 98 01 0b 5c c0 d7 dd ff 28 9a 6f 9e 70 37 c2 d9 a0 7a 70 b8 f8 ac a6 1b 10 e1 14 7a 48 17 1a 86 78 5a a8 e7 20 8c 7e 44 c8 c1 cc 25 90 6c 61 62 40 21 d3 03 18 f7 05 a0 f0 ba b7 c1 a8 e1 ed 4e 08 ac 5f 2f 50 7a 89 8c b8 37 3b ed e0 9a 96 aa 30 d7 24 cb 68 01 f2 68 80 4c 40 09 d8 b7 47 77 c0 fa f5 16 98 2c 23 b5 70 61 91 d4 28 cc 3c 93 f8 81 8e f2 a0 57 58 51 48 1a ea 30 10 41 b0 bf b0 0c 02 de e8 da d4 7d 00 97 66 1c 58 3a cb 5b 88 77 79 3a d0 a1 af 99 38 ec 1d f8 60 34 26 08 a0 79 94 69 f8 af 42 ca 10 e2 f0 ab 48 4f 5d ec 98 02 ef 8d c0 d4 39 2e 28 99 8b 4f 70 c2 d1 c0 d0 8f 63 a1 88 59 b5 02 60 14 07 63 38 b9 aa 24 e8 f4 18 45 b0 22 ce e6 58 6f 7c 87 00 94 7b f9 18 d9 c9 98 40 0f 1f 3b a8 42 ad 5a f0 ef 00 1d 20 a2 b2 7c 78 74 64 df 90 39 d6 be c8 62 8c 31 68 2f 3e 50 30 f9 e8 f3 d8 b4 5a 92 80 19 f7 d5 50 54 45 b4 08 82 93 17 e0 cf 21 76 b8 39 2f 8a 88 74 9d eb d0 a2 4b 48 38 ef f9 29 60 42 54 6e b0 0f e6 0f e8 d9 30 ac 00 94 82 cd 58 cf d8 42 f8 82 6a 23 a0 54 bc 80 48 19 0e e1 10 b4 a3 a6 c0 f9 11 c7 98 2f c7 64 70 62 75 05 28 99 72 7b 30 d4 c0 1a 68 02 16 b9 80 4f a4 d8 d8 e2 09 9f 08 af bb fe 50 79 6d 5d b8 34 df 3c e0 6f 85 b3 40 22 37 d2 18 f4 e1 71 f0 b9 53 10 a8 14 fe 57 78 59 4c 36 20 8f 9a 95 c8 c2 28 f4 90 2e 35 0c f0 63 87 6d a8 b5 51 ce 40 f8 e3 af 18 55 4e e8 c8 18 fc 89 90 ce 2a 2a 78 83 98 4b 20 d8 c2 c4 80 95 70 a5 d8 43 a6 06 30 0e 14 67 68 a3 b9 20 b8 ee 0b 41 e0 38 dd e2 08 75 6f 83 50 8e 68 fd 48 c3 da 9c 10 15 0c 3f f8 58 be 5e a0 f5 13 19 70 b8 a1 78 28 6e 77 db c0 23 c5 ba 98 78 9f 35 38 35 2d 54 60 e3 fb f7 88 ae 49 96 d0 03 e4 d1 00 4e 56 b0 58 98 80 13 b0 d5 32 72 e8 23 3c 8e d8 6e 8e ef 80 b8 58 4c 68 f5 ea 2d 30 58 47 6a e0 15 f5 0b b8 c3 23 a8 50 8e 91 c9 08 d5 cb 46 a8 98 79 27 f0 4e af 84 18 03 1d e5 40 ae b0 a2 90 e3 02 c3 c8 35 d4 60 20 78 66 01 78 83 61 7f 60 ce d3 1e 38 18 05 bd d0 55 b7 dc 88 f8 1a 9b 58 b5 a8 fa 00 63 7e 59 e8 2e cc 38 b0 75 96 b7 10 38 24 d6 48 ee f2 75 a0 a3 40 14 f8 0e ed 53 28 43 5f 32 70 95 89 91 98 d8 3b f0 c0 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6670a94e-d96c-4d73-b4a3-29209b186fc7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion