CRC_12_poly_0x80f__16_lil_refl_False_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC_12_poly_0x80f__16_lil_refl_False_ (No description metadata provided).

rule CRC_12_poly_0x80f__16_lil_refl_False_ {
  strings:
    $a0 = { 00 00 0f 08 1e 10 11 18 3c 20 33 28 22 30 2d 38 78 40 77 48 66 50 69 58 44 60 4b 68 5a 70 55 78 f0 80 ff 88 ee 90 e1 98 cc a0 c3 a8 d2 b0 dd b8 88 c0 87 c8 96 d0 99 d8 b4 e0 bb e8 aa f0 a5 f8 ef 09 e0 01 f1 19 fe 11 d3 29 dc 21 cd 39 c2 31 97 49 98 41 89 59 86 51 ab 69 a4 61 b5 79 ba 71 1f 89 10 81 01 99 0e 91 23 a9 2c a1 3d b9 32 b1 67 c9 68 c1 79 d9 76 d1 5b e9 54 e1 45 f9 4a f1 de 13 d1 1b c0 03 cf 0b e2 33 ed 3b fc 23 f3 2b a6 53 a9 5b b8 43 b7 4b 9a 73 95 7b 84 63 8b 6b 2e 93 21 9b 30 83 3f 8b 12 b3 1d bb 0c a3 03 ab 56 d3 59 db 48 c3 47 cb 6a f3 65 fb 74 e3 7b eb 31 1a 3e 12 2f 0a 20 02 0d 3a 02 32 13 2a 1c 22 49 5a 46 52 57 4a 58 42 75 7a 7a 72 6b 6a 64 62 c1 9a ce 92 df 8a d0 82 fd ba f2 b2 e3 aa ec a2 b9 da b6 d2 a7 ca a8 c2 85 fa 8a f2 9b ea 94 e2 bc 27 b3 2f a2 37 ad 3f 80 07 8f 0f 9e 17 91 1f c4 67 cb 6f da 77 d5 7f f8 47 f7 4f e6 57 e9 5f 4c a7 43 af 52 b7 5d bf 70 87 7f 8f 6e 97 61 9f 34 e7 3b ef 2a f7 25 ff 08 c7 07 cf 16 d7 19 df 53 2e 5c 26 4d 3e 42 36 6f 0e 60 06 71 1e 7e 16 2b 6e 24 66 35 7e 3a 76 17 4e 18 46 09 5e 06 56 a3 ae ac a6 bd be b2 b6 9f 8e 90 86 81 9e 8e 96 db ee d4 e6 c5 fe ca f6 e7 ce e8 c6 f9 de f6 d6 62 34 6d 3c 7c 24 73 2c 5e 14 51 1c 40 04 4f 0c 1a 74 15 7c 04 64 0b 6c 26 54 29 5c 38 44 37 4c 92 b4 9d bc 8c a4 83 ac ae 94 a1 9c b0 84 bf 8c ea f4 e5 fc f4 e4 fb ec d6 d4 d9 dc c8 c4 c7 cc 8d 3d 82 35 93 2d 9c 25 b1 1d be 15 af 0d a0 05 f5 7d fa 75 eb 6d e4 65 c9 5d c6 55 d7 4d d8 45 7d bd 72 b5 63 ad 6c a5 41 9d 4e 95 5f 8d 50 85 05 fd 0a f5 1b ed 14 e5 39 dd 36 d5 27 cd 28 c5 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b676409f-fd36-4816-a7c0-8dfa00856b9f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion