CRC32_poly_0x76dc4190__32_big_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x76dc4190__32_big_refl_False_ (No description metadata provided).

rule CRC32_poly_0x76dc4190__32_big_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 76 dc 41 90 ed b8 83 20 9b 64 c2 b0 ad ad 47 d0 db 71 06 40 40 15 c4 f0 36 c9 85 60 2d 86 ce 30 5b 5a 8f a0 c0 3e 4d 10 b6 e2 0c 80 80 2b 89 e0 f6 f7 c8 70 6d 93 0a c0 1b 4f 4b 50 5b 0d 9c 60 2d d1 dd f0 b6 b5 1f 40 c0 69 5e d0 f6 a0 db b0 80 7c 9a 20 1b 18 58 90 6d c4 19 00 76 8b 52 50 00 57 13 c0 9b 33 d1 70 ed ef 90 e0 db 26 15 80 ad fa 54 10 36 9e 96 a0 40 42 d7 30 b6 1b 38 c0 c0 c7 79 50 5b a3 bb e0 2d 7f fa 70 1b b6 7f 10 6d 6a 3e 80 f6 0e fc 30 80 d2 bd a0 9b 9d f6 f0 ed 41 b7 60 76 25 75 d0 00 f9 34 40 36 30 b1 20 40 ec f0 b0 db 88 32 00 ad 54 73 90 ed 16 a4 a0 9b ca e5 30 00 ae 27 80 76 72 66 10 40 bb e3 70 36 67 a2 e0 ad 03 60 50 db df 21 c0 c0 90 6a 90 b6 4c 2b 00 2d 28 e9 b0 5b f4 a8 20 6d 3d 2d 40 1b e1 6c d0 80 85 ae 60 f6 59 ef f0 1a ea 30 10 6c 36 71 80 f7 52 b3 30 81 8e f2 a0 b7 47 77 c0 c1 9b 36 50 5a ff f4 e0 2c 23 b5 70 37 6c fe 20 41 b0 bf b0 da d4 7d 00 ac 08 3c 90 9a c1 b9 f0 ec 1d f8 60 77 79 3a d0 01 a5 7b 40 41 e7 ac 70 37 3b ed e0 ac 5f 2f 50 da 83 6e c0 ec 4a eb a0 9a 96 aa 30 01 f2 68 80 77 2e 29 10 6c 61 62 40 1a bd 23 d0 81 d9 e1 60 f7 05 a0 f0 c1 cc 25 90 b7 10 64 00 2c 74 a6 b0 5a a8 e7 20 ac f1 08 d0 da 2d 49 40 41 49 8b f0 37 95 ca 60 01 5c 4f 00 77 80 0e 90 ec e4 cc 20 9a 38 8d b0 81 77 c6 e0 f7 ab 87 70 6c cf 45 c0 1a 13 04 50 2c da 81 30 5a 06 c0 a0 c1 62 02 10 b7 be 43 80 f7 fc 94 b0 81 20 d5 20 1a 44 17 90 6c 98 56 00 5a 51 d3 60 2c 8d 92 f0 b7 e9 50 40 c1 35 11 d0 da 7a 5a 80 ac a6 1b 10 37 c2 d9 a0 41 1e 98 30 77 d7 1d 50 01 0b 5c c0 9a 6f 9e 70 ec b3 df e0 35 d4 60 20 43 08 21 b0 d8 6c e3 00 ae b0 a2 90 98 79 27 f0 ee a5 66 60 75 c1 a4 d0 03 1d e5 40 18 52 ae 10 6e 8e ef 80 f5 ea 2d 30 83 36 6c a0 b5 ff e9 c0 c3 23 a8 50 58 47 6a e0 2e 9b 2b 70 6e d9 fc 40 18 05 bd d0 83 61 7f 60 f5 bd 3e f0 c3 74 bb 90 b5 a8 fa 00 2e cc 38 b0 58 10 79 20 43 5f 32 70 35 83 73 e0 ae e7 b1 50 d8 3b f0 c0 ee f2 75 a0 98 2e 34 30 03 4a f6 80 75 96 b7 10 83 cf 58 e0 f5 13 19 70 6e 77 db c0 18 ab 9a 50 2e 62 1f 30 58 be 5e a0 c3 da 9c 10 b5 06 dd 80 ae 49 96 d0 d8 95 d7 40 43 f1 15 f0 35 2d 54 60 03 e4 d1 00 75 38 90 90 ee 5c 52 20 98 80 13 b0 d8 c2 c4 80 ae 1e 85 10 35 7a 47 a0 43 a6 06 30 75 6f 83 50 03 b3 c2 c0 98 d7 00 70 ee 0b 41 e0 f5 44 0a b0 83 98 4b 20 18 fc 89 90 6e 20 c8 00 58 e9 4d 60 2e 35 0c f0 b5 51 ce 40 c3 8d 8f d0 2f 3e 50 30 59 e2 11 a0 c2 86 d3 10 b4 5a 92 80 82 93 17 e0 f4 4f 56 70 6f 2b 94 c0 19 f7 d5 50 02 b8 9e 00 74 64 df 90 ef 00 1d 20 99 dc 5c b0 af 15 d9 d0 d9 c9 98 40 42 ad 5a f0 34 71 1b 60 74 33 cc 50 02 ef 8d c0 99 8b 4f 70 ef 57 0e e0 d9 9e 8b 80 af 42 ca 10 34 26 08 a0 42 fa 49 30 59 b5 02 60 2f 69 43 f0 b4 0d 81 40 c2 d1 c0 d0 f4 18 45 b0 82 c4 04 20 19 a0 c6 90 6f 7c 87 00 99 25 68 f0 ef f9 29 60 74 9d eb d0 02 41 aa 40 34 88 2f 20 42 54 6e b0 d9 30 ac 00 af ec ed 90 b4 a3 a6 c0 c2 7f e7 50 59 1b 25 e0 2f c7 64 70 19 0e e1 10 6f d2 a0 80 f4 b6 62 30 82 6a 23 a0 c2 28 f4 90 b4 f4 b5 00 2f 90 77 b0 59 4c 36 20 6f 85 b3 40 19 59 f2 d0 82 3d 30 60 f4 e1 71 f0 ef ae 3a a0 99 72 7b 30 02 16 b9 80 74 ca f8 10 42 03 7d 70 34 df 3c e0 af bb fe 50 d9 67 bf c0 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1c818f28-0949-4199-8557-8d20b3b006df

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion