CRC32_poly_0xcb61b38c__32_lil_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0xcb61b38c__32_lil_refl_True_ (No description metadata provided).

rule CRC32_poly_0xcb61b38c__32_lil_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 af e1 d9 20 f9 ce 28 22 56 2f f1 02 55 90 ca 27 fa 71 13 07 ac 5e e2 05 03 bf 3b 25 0d 2d 0e 2c a2 cc d7 0c f4 e3 26 0e 5b 02 ff 2e 58 bd c4 0b f7 5c 1d 2b a1 73 ec 29 0e 92 35 09 bd 57 87 3b 12 b6 5e 1b 44 99 af 19 eb 78 76 39 e8 c7 4d 1c 47 26 94 3c 11 09 65 3e be e8 bc 1e b0 7a 89 17 1f 9b 50 37 49 b4 a1 35 e6 55 78 15 e5 ea 43 30 4a 0b 9a 10 1c 24 6b 12 b3 c5 b2 32 dd a2 95 14 72 43 4c 34 24 6c bd 36 8b 8d 64 16 88 32 5f 33 27 d3 86 13 71 fc 77 11 de 1d ae 31 d0 8f 9b 38 7f 6e 42 18 29 41 b3 1a 86 a0 6a 3a 85 1f 51 1f 2a fe 88 3f 7c d1 79 3d d3 30 a0 1d 60 f5 12 2f cf 14 cb 0f 99 3b 3a 0d 36 da e3 2d 35 65 d8 08 9a 84 01 28 cc ab f0 2a 63 4a 29 0a 6d d8 1c 03 c2 39 c5 23 94 16 34 21 3b f7 ed 01 38 48 d6 24 97 a9 0f 04 c1 86 fe 06 6e 67 27 26 ba 45 2b 29 15 a4 f2 09 43 8b 03 0b ec 6a da 2b ef d5 e1 0e 40 34 38 2e 16 1b c9 2c b9 fa 10 0c b7 68 25 05 18 89 fc 25 4e a6 0d 27 e1 47 d4 07 e2 f8 ef 22 4d 19 36 02 1b 36 c7 00 b4 d7 1e 20 07 12 ac 12 a8 f3 75 32 fe dc 84 30 51 3d 5d 10 52 82 66 35 fd 63 bf 15 ab 4c 4e 17 04 ad 97 37 0a 3f a2 3e a5 de 7b 1e f3 f1 8a 1c 5c 10 53 3c 5f af 68 19 f0 4e b1 39 a6 61 40 3b 09 80 99 1b 67 e7 be 3d c8 06 67 1d 9e 29 96 1f 31 c8 4f 3f 32 77 74 1a 9d 96 ad 3a cb b9 5c 38 64 58 85 18 6a ca b0 11 c5 2b 69 31 93 04 98 33 3c e5 41 13 3f 5a 7a 36 90 bb a3 16 c6 94 52 14 69 75 8b 34 da b0 39 06 75 51 e0 26 23 7e 11 24 8c 9f c8 04 8f 20 f3 21 20 c1 2a 01 76 ee db 03 d9 0f 02 23 d7 9d 37 2a 78 7c ee 0a 2e 53 1f 08 81 b2 c6 28 82 0d fd 0d 2d ec 24 2d 7b c3 d5 2f d4 22 0c 0f d3 86 cd 31 7c 67 14 11 2a 48 e5 13 85 a9 3c 33 86 16 07 16 29 f7 de 36 7f d8 2f 34 d0 39 f6 14 de ab c3 1d 71 4a 1a 3d 27 65 eb 3f 88 84 32 1f 8b 3b 09 3a 24 da d0 1a 72 f5 21 18 dd 14 f8 38 6e d1 4a 0a c1 30 93 2a 97 1f 62 28 38 fe bb 08 3b 41 80 2d 94 a0 59 0d c2 8f a8 0f 6d 6e 71 2f 63 fc 44 26 cc 1d 9d 06 9a 32 6c 04 35 d3 b5 24 36 6c 8e 01 99 8d 57 21 cf a2 a6 23 60 43 7f 03 0e 24 58 25 a1 c5 81 05 f7 ea 70 07 58 0b a9 27 5b b4 92 02 f4 55 4b 22 a2 7a ba 20 0d 9b 63 00 03 09 56 09 ac e8 8f 29 fa c7 7e 2b 55 26 a7 0b 56 99 9c 2e f9 78 45 0e af 57 b4 0c 00 b6 6d 2c b3 73 df 1e 1c 92 06 3e 4a bd f7 3c e5 5c 2e 1c e6 e3 15 39 49 02 cc 19 1f 2d 3d 1b b0 cc e4 3b be 5e d1 32 11 bf 08 12 47 90 f9 10 e8 71 20 30 eb ce 1b 15 44 2f c2 35 12 00 33 37 bd e1 ea 17 69 c3 e6 18 c6 22 3f 38 90 0d ce 3a 3f ec 17 1a 3c 53 2c 3f 93 b2 f5 1f c5 9d 04 1d 6a 7c dd 3d 64 ee e8 34 cb 0f 31 14 9d 20 c0 16 32 c1 19 36 31 7e 22 13 9e 9f fb 33 c8 b0 0a 31 67 51 d3 11 d4 94 61 23 7b 75 b8 03 2d 5a 49 01 82 bb 90 21 81 04 ab 04 2e e5 72 24 78 ca 83 26 d7 2b 5a 06 d9 b9 6f 0f 76 58 b6 2f 20 77 47 2d 8f 96 9e 0d 8c 29 a5 28 23 c8 7c 08 75 e7 8d 0a da 06 54 2a b4 61 73 0c 1b 80 aa 2c 4d af 5b 2e e2 4e 82 0e e1 f1 b9 2b 4e 10 60 0b 18 3f 91 09 b7 de 48 29 b9 4c 7d 20 16 ad a4 00 40 82 55 02 ef 63 8c 22 ec dc b7 07 43 3d 6e 27 15 12 9f 25 ba f3 46 05 09 36 f4 37 a6 d7 2d 17 f0 f8 dc 15 5f 19 05 35 5c a6 3e 10 f3 47 e7 30 a5 68 16 32 0a 89 cf 12 04 1b fa 1b ab fa 23 3b fd d5 d2 39 52 34 0b 19 51 8b 30 3c fe 6a e9 1c a8 45 18 1e 07 a4 c1 3e }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6ce9debe-580a-4b90-8b55-81cf0f3abab0

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion