libaf_rear_opposite_side___135_degree_flt64_64_lil_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libaf_rear_opposite_side___135_degree___flt64___64_lil_1024_ (No description metadata provided).

rule libaf_rear_opposite_side___135_degree___flt64___64_lil_1024_ {
  strings:
    $a0 = { 3b fe 2e ef ce 00 20 3f cb 9e d2 09 f8 d7 f6 be 24 85 ee fd 75 6c d8 3e 5e 76 61 d6 d7 89 e9 be bc 1f 8d 39 7b 0d 10 bf 94 d1 a9 af 29 61 d7 3e ae 75 24 22 17 e0 09 bf 90 ef 80 ae da bf b3 3e a8 cd b3 bb 8c 0e 0f bf 82 73 7c 11 2c ee e3 3e d9 37 fd 13 87 96 23 bf 0f 3d 35 ea 08 0e 20 3f 09 a0 ee fd 20 45 19 bf 22 06 57 2f ad 3d d9 3e 2d ad 4d df d9 94 01 3f 41 f0 1c 54 13 51 29 bf 9b 22 5b 9b 8b c1 40 3f 3e cf 17 de eb 99 42 bf f2 3d ba ab 23 c1 53 3f 5e 96 5c e3 89 b4 4e 3f b0 f1 85 22 c0 d3 72 3f 46 b6 30 45 9e da 5e bf a4 a2 bc f2 a2 cf 80 bf 7a 32 a1 78 a4 46 6f 3f d3 1f 61 62 35 df 81 3f 2b 6a ec b9 8e 0f b1 3f 22 69 24 37 08 61 b1 3f 0c d2 26 d6 2a 00 a7 bf d7 e7 cb ba f8 94 a4 bf 67 54 7a 91 f9 d4 9a 3f 77 f8 bf 69 47 03 8c 3f b1 15 88 0f a6 5b 8d bf a0 1b 54 38 2d c5 84 3f 89 71 ee 78 64 97 bd 3f 7d 64 46 81 52 4e c4 3f a2 55 46 4a 16 b5 ae 3f 63 4e af e3 a8 22 73 3f 92 f9 2e 42 98 20 a0 3f 84 0a 24 ce 91 5d 8d 3f 73 3b 40 d5 19 35 8e bf 73 3c 58 3a 64 0c 95 bf 1d 94 4e b6 f7 af ab bf 8a 05 b1 4a 8c e2 b3 bf 82 f6 01 2f bb bf a9 bf 6f 38 37 69 38 8c 9f bf 52 86 ae ba 03 6b a1 bf e9 70 14 41 bb 40 9f bf 86 cf 6b 51 45 04 8d bf 89 17 14 df 05 63 88 3f 22 c1 e9 55 05 42 8d 3f 70 72 96 7f 42 1f 7a 3f 32 86 ae 42 f0 fd 92 3f 8e e1 b6 61 e4 f9 9c 3f 02 b9 8c 8b e2 d3 99 3f bd c6 0b 86 3d 75 96 3f 8d cf 69 82 91 2e 94 3f f8 80 22 bb 25 b5 91 3f 15 34 83 56 2f e3 91 3f 0a f6 6e 01 d9 ec 83 3f 6c 82 85 6b 34 63 68 bf 83 63 f3 16 5d 99 83 bf 0f 3c db a8 43 83 90 bf 69 44 6a 50 8d 0b 9e bf 54 f5 4e 54 36 2a a5 bf bd 4c 5f ac 7a 4a a6 bf ab 22 47 05 f0 c2 a3 bf d6 30 db 2d 47 83 9c bf 91 fc b5 f3 75 73 93 bf b0 2b b5 45 db 50 8a bf 66 1c fb ef 0b 2d 72 bf 39 45 1d 25 48 9a 32 3f 00 f9 d0 51 ae f0 6e 3f 2e d7 b9 d5 b4 86 80 3f 69 11 9d 64 41 f3 81 3f 60 bb f7 29 44 6d 80 3f 08 02 59 82 24 fa 7b 3f c4 34 30 53 2d 2c 62 3f 50 69 3f 35 b3 c6 60 bf 0d f3 cb 70 9b 5f 70 bf e4 30 c6 12 8a f1 7c bf fc 77 64 05 c0 44 83 bf dd e5 9e 84 2f 67 86 bf 50 7f 97 93 be 1d 88 bf 04 6c 65 16 38 54 87 bf b7 70 03 15 25 ae 85 bf e4 9a 00 53 75 28 84 bf ea 51 2a 51 d2 c1 7f bf 87 e8 61 7a a3 50 77 bf e0 04 07 5b db a6 7a bf 4d ae 69 fe d3 e5 75 bf 1f 36 80 0c 2c 07 70 bf d1 e7 44 a3 ec 90 6d bf 01 c0 50 7c 35 a7 60 bf 24 57 b2 de 45 81 27 3f 83 d8 9e 65 6b da 6a 3f ec 34 17 1b 87 42 70 3f 39 a1 98 b3 77 a9 60 3f 77 eb 06 c4 21 be 1d bf 84 47 b9 1a 13 0e 5e bf 59 da 57 82 13 23 6d bf ee 3c 8d e9 a0 76 71 bf 88 98 86 bc d1 16 68 bf 1a ad b7 81 de 21 6c bf 42 ed ac 1a fe ab 78 bf 9f 57 c6 e9 f1 b9 7f bf 3f c9 7b 19 48 34 80 bf 44 09 62 e8 b9 9b 79 bf 9d 8f c5 5d af bd 75 bf 17 16 bc 0a 47 d0 76 bf c5 8c 9c 59 07 1b 73 bf 41 cd 43 2e 48 ec 6e bf 0d fe 75 6b 7c 1a 71 bf 48 09 59 42 f2 15 73 bf 4c 7f 20 9f e6 83 74 bf 74 07 20 80 6b 60 73 bf 09 14 be a8 9c e2 6b bf 79 37 39 1c 98 08 5c bf ec ad bf e3 49 f6 43 bf 3b ea 09 ea 8f 4c 5a bf fa 5f 6a ac 94 23 6b bf 58 f4 44 5c 5f 74 72 bf 9f cc 2d a8 eb 01 71 bf 1f c3 91 cb e2 5d 6a bf a4 89 d9 11 92 58 66 bf 76 76 ee 12 41 19 5c bf 18 f7 49 ab 9c a0 54 bf 26 39 a2 a6 a9 5b 5e bf f6 ce a5 69 7a cf 64 bf }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

63f9f5ee-3160-46bf-88ae-39be33f87192

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion