CRC32_poly_0xd6d6a3e8__32_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0xd6d6a3e8__32_lil_refl_False_ (No description metadata provided).

rule CRC32_poly_0xd6d6a3e8__32_lil_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 e8 a3 d6 d6 38 e4 7b 7b d0 47 ad ad 70 c8 f7 f6 98 6b 21 20 48 2c 8c 8d a0 8f 5a 5b 08 33 39 3b e0 90 ef ed 30 d7 42 40 d8 74 94 96 78 fb ce cd 90 58 18 1b 40 1f b5 b6 a8 bc 63 60 10 66 72 76 f8 c5 a4 a0 28 82 09 0d c0 21 df db 60 ae 85 80 88 0d 53 56 58 4a fe fb b0 e9 28 2d 18 55 4b 4d f0 f6 9d 9b 20 b1 30 36 c8 12 e6 e0 68 9d bc bb 80 3e 6a 6d 50 79 c7 c0 b8 da 11 16 20 cc e4 ec c8 6f 32 3a 18 28 9f 97 f0 8b 49 41 50 04 13 1a b8 a7 c5 cc 68 e0 68 61 80 43 be b7 28 ff dd d7 c0 5c 0b 01 10 1b a6 ac f8 b8 70 7a 58 37 2a 21 b0 94 fc f7 60 d3 51 5a 88 70 87 8c 30 aa 96 9a d8 09 40 4c 08 4e ed e1 e0 ed 3b 37 40 62 61 6c a8 c1 b7 ba 78 86 1a 17 90 25 cc c1 38 99 af a1 d0 3a 79 77 00 7d d4 da e8 de 02 0c 48 51 58 57 a0 f2 8e 81 70 b5 23 2c 98 16 f5 fa a8 3b 1f 0f 40 98 c9 d9 90 df 64 74 78 7c b2 a2 d8 f3 e8 f9 30 50 3e 2f e0 17 93 82 08 b4 45 54 a0 08 26 34 48 ab f0 e2 98 ec 5d 4f 70 4f 8b 99 d0 c0 d1 c2 38 63 07 14 e8 24 aa b9 00 87 7c 6f b8 5d 6d 79 50 fe bb af 80 b9 16 02 68 1a c0 d4 c8 95 9a 8f 20 36 4c 59 f0 71 e1 f4 18 d2 37 22 b0 6e 54 42 58 cd 82 94 88 8a 2f 39 60 29 f9 ef c0 a6 a3 b4 28 05 75 62 f8 42 d8 cf 10 e1 0e 19 88 f7 fb e3 60 54 2d 35 b0 13 80 98 58 b0 56 4e f8 3f 0c 15 10 9c da c3 c0 db 77 6e 28 78 a1 b8 80 c4 c2 d8 68 67 14 0e b8 20 b9 a3 50 83 6f 75 f0 0c 35 2e 18 af e3 f8 c8 e8 4e 55 20 4b 98 83 98 91 89 95 70 32 5f 43 a0 75 f2 ee 48 d6 24 38 e8 59 7e 63 00 fa a8 b5 d0 bd 05 18 38 1e d3 ce 90 a2 b0 ae 78 01 66 78 a8 46 cb d5 40 e5 1d 03 e0 6a 47 58 08 c9 91 8e d8 8e 3c 23 30 2d ea f5 50 77 3e 1e b8 d4 e8 c8 68 93 45 65 80 30 93 b3 20 bf c9 e8 c8 1c 1f 3e 18 5b b2 93 f0 f8 64 45 58 44 07 25 b0 e7 d1 f3 60 a0 7c 5e 88 03 aa 88 28 8c f0 d3 c0 2f 26 05 10 68 8b a8 f8 cb 5d 7e 40 11 4c 68 a8 b2 9a be 78 f5 37 13 90 56 e1 c5 30 d9 bb 9e d8 7a 6d 48 08 3d c0 e5 e0 9e 16 33 48 22 75 53 a0 81 a3 85 70 c6 0e 28 98 65 d8 fe 38 ea 82 a5 d0 49 54 73 00 0e f9 de e8 ad 2f 08 70 bb da f2 98 18 0c 24 48 5f a1 89 a0 fc 77 5f 00 73 2d 04 e8 d0 fb d2 38 97 56 7f d0 34 80 a9 78 88 e3 c9 90 2b 35 1f 40 6c 98 b2 a8 cf 4e 64 08 40 14 3f e0 e3 c2 e9 30 a4 6f 44 d8 07 b9 92 60 dd a8 84 88 7e 7e 52 58 39 d3 ff b0 9a 05 29 10 15 5f 72 f8 b6 89 a4 28 f1 24 09 c0 52 f2 df 68 ee 91 bf 80 4d 47 69 50 0a ea c4 b8 a9 3c 12 18 26 66 49 f0 85 b0 9f 20 c2 1d 32 c8 61 cb e4 f8 4c 21 11 10 ef f7 c7 c0 a8 5a 6a 28 0b 8c bc 88 84 d6 e7 60 27 00 31 b0 60 ad 9c 58 c3 7b 4a f0 7f 18 2a 18 dc ce fc c8 9b 63 51 20 38 b5 87 80 b7 ef dc 68 14 39 0a b8 53 94 a7 50 f0 42 71 e8 2a 53 67 00 89 85 b1 d0 ce 28 1c 38 6d fe ca 98 e2 a4 91 70 41 72 47 a0 06 df ea 48 a5 09 3c e0 19 6a 5c 08 ba bc 8a d8 fd 11 27 30 5e c7 f1 90 d1 9d aa 78 72 4b 7c a8 35 e6 d1 40 96 30 07 d8 80 c5 fd 30 23 13 2b e0 64 be 86 08 c7 68 50 a8 48 32 0b 40 eb e4 dd 90 ac 49 70 78 0f 9f a6 d0 b3 fc c6 38 10 2a 10 e8 57 87 bd 00 f4 51 6b a0 7b 0b 30 48 d8 dd e6 98 9f 70 4b 70 3c a6 9d c8 e6 b7 8b 20 45 61 5d f0 02 cc f0 18 a1 1a 26 b8 2e 40 7d 50 8d 96 ab 80 ca 3b 06 68 69 ed d0 c0 d5 8e b0 28 76 58 66 f8 31 f5 cb 10 92 23 1d b0 1d 79 46 58 be af 90 88 f9 02 3d 60 5a d4 eb }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c2bff379-579b-4a38-9720-cb2cdd14669c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion