CRC32_poly_0xa00ae278__32_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0xa00ae278__32_lil_refl_False_ (No description metadata provided).

rule CRC32_poly_0xa00ae278__32_lil_refl_False_ {
  strings:
    $a0 = { 00 00 00 00 78 e2 0a a0 88 26 1f e0 f0 c4 15 40 68 af 34 60 10 4d 3e c0 e0 89 2b 80 98 6b 21 20 d0 5e 69 c0 a8 bc 63 60 58 78 76 20 20 9a 7c 80 b8 f1 5d a0 c0 13 57 00 30 d7 42 40 48 35 48 e0 d8 5f d8 20 a0 bd d2 80 50 79 c7 c0 28 9b cd 60 b0 f0 ec 40 c8 12 e6 e0 38 d6 f3 a0 40 34 f9 00 08 01 b1 e0 70 e3 bb 40 80 27 ae 00 f8 c5 a4 a0 60 ae 85 80 18 4c 8f 20 e8 88 9a 60 90 6a 90 c0 b0 bf b0 41 c8 5d ba e1 38 99 af a1 40 7b a5 01 d8 10 84 21 a0 f2 8e 81 50 36 9b c1 28 d4 91 61 60 e1 d9 81 18 03 d3 21 e8 c7 c6 61 90 25 cc c1 08 4e ed e1 70 ac e7 41 80 68 f2 01 f8 8a f8 a1 68 e0 68 61 10 02 62 c1 e0 c6 77 81 98 24 7d 21 00 4f 5c 01 78 ad 56 a1 88 69 43 e1 f0 8b 49 41 b8 be 01 a1 c0 5c 0b 01 30 98 1e 41 48 7a 14 e1 d0 11 35 c1 a8 f3 3f 61 58 37 2a 21 20 d5 20 81 60 7f 61 83 18 9d 6b 23 e8 59 7e 63 90 bb 74 c3 08 d0 55 e3 70 32 5f 43 80 f6 4a 03 f8 14 40 a3 b0 21 08 43 c8 c3 02 e3 38 07 17 a3 40 e5 1d 03 d8 8e 3c 23 a0 6c 36 83 50 a8 23 c3 28 4a 29 63 b8 20 b9 a3 c0 c2 b3 03 30 06 a6 43 48 e4 ac e3 d0 8f 8d c3 a8 6d 87 63 58 a9 92 23 20 4b 98 83 68 7e d0 63 10 9c da c3 e0 58 cf 83 98 ba c5 23 00 d1 e4 03 78 33 ee a3 88 f7 fb e3 f0 15 f1 43 d0 c0 d1 c2 a8 22 db 62 58 e6 ce 22 20 04 c4 82 b8 6f e5 a2 c0 8d ef 02 30 49 fa 42 48 ab f0 e2 00 9e b8 02 78 7c b2 a2 88 b8 a7 e2 f0 5a ad 42 68 31 8c 62 10 d3 86 c2 e0 17 93 82 98 f5 99 22 08 9f 09 e2 70 7d 03 42 80 b9 16 02 f8 5b 1c a2 60 30 3d 82 18 d2 37 22 e8 16 22 62 90 f4 28 c2 d8 c1 60 22 a0 23 6a 82 50 e7 7f c2 28 05 75 62 b0 6e 54 42 c8 8c 5e e2 38 48 4b a2 40 aa 41 02 b8 1c c8 a6 c0 fe c2 06 30 3a d7 46 48 d8 dd e6 d0 b3 fc c6 a8 51 f6 66 58 95 e3 26 20 77 e9 86 68 42 a1 66 10 a0 ab c6 e0 64 be 86 98 86 b4 26 00 ed 95 06 78 0f 9f a6 88 cb 8a e6 f0 29 80 46 60 43 10 86 18 a1 1a 26 e8 65 0f 66 90 87 05 c6 08 ec 24 e6 70 0e 2e 46 80 ca 3b 06 f8 28 31 a6 b0 1d 79 46 c8 ff 73 e6 38 3b 66 a6 40 d9 6c 06 d8 b2 4d 26 a0 50 47 86 50 94 52 c6 28 76 58 66 08 a3 78 e7 70 41 72 47 80 85 67 07 f8 67 6d a7 60 0c 4c 87 18 ee 46 27 e8 2a 53 67 90 c8 59 c7 d8 fd 11 27 a0 1f 1b 87 50 db 0e c7 28 39 04 67 b0 52 25 47 c8 b0 2f e7 38 74 3a a7 40 96 30 07 d0 fc a0 c7 a8 1e aa 67 58 da bf 27 20 38 b5 87 b8 53 94 a7 c0 b1 9e 07 30 75 8b 47 48 97 81 e7 00 a2 c9 07 78 40 c3 a7 88 84 d6 e7 f0 66 dc 47 68 0d fd 67 10 ef f7 c7 e0 2b e2 87 98 c9 e8 27 d8 63 a9 25 a0 81 a3 85 50 45 b6 c5 28 a7 bc 65 b0 cc 9d 45 c8 2e 97 e5 38 ea 82 a5 40 08 88 05 08 3d c0 e5 70 df ca 45 80 1b df 05 f8 f9 d5 a5 60 92 f4 85 18 70 fe 25 e8 b4 eb 65 90 56 e1 c5 00 3c 71 05 78 de 7b a5 88 1a 6e e5 f0 f8 64 45 68 93 45 65 10 71 4f c5 e0 b5 5a 85 98 57 50 25 d0 62 18 c5 a8 80 12 65 58 44 07 25 20 a6 0d 85 b8 cd 2c a5 c0 2f 26 05 30 eb 33 45 48 09 39 e5 68 dc 19 64 10 3e 13 c4 e0 fa 06 84 98 18 0c 24 00 73 2d 04 78 91 27 a4 88 55 32 e4 f0 b7 38 44 b8 82 70 a4 c0 60 7a 04 30 a4 6f 44 48 46 65 e4 d0 2d 44 c4 a8 cf 4e 64 58 0b 5b 24 20 e9 51 84 b0 83 c1 44 c8 61 cb e4 38 a5 de a4 40 47 d4 04 d8 2c f5 24 a0 ce ff 84 50 0a ea c4 28 e8 e0 64 60 dd a8 84 18 3f a2 24 e8 fb b7 64 90 19 bd c4 08 72 9c e4 70 90 96 44 80 54 83 04 f8 b6 89 a4 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

938943ba-452f-4ad4-afb4-baf98385db21

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion