CRC32_poly_0xbdbdf21c__32_big_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0xbdbdf21c__32_big_refl_True_ (No description metadata provided).

rule CRC32_poly_0xbdbdf21c__32_big_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 0f 40 33 0f 1e 80 66 1e 11 c0 55 11 3d 00 cc 3c 32 40 ff 33 23 80 aa 22 2c c0 99 2d 0a 9e e3 03 05 de d0 0c 14 1e 85 1d 1b 5e b6 12 37 9e 2f 3f 38 de 1c 30 29 1e 49 21 26 5e 7a 2e 15 3d c6 06 1a 7d f5 09 0b bd a0 18 04 fd 93 17 28 3d 0a 3a 27 7d 39 35 36 bd 6c 24 39 fd 5f 2b 1f a3 25 05 10 e3 16 0a 01 23 43 1b 0e 63 70 14 22 a3 e9 39 2d e3 da 36 3c 23 8f 27 33 63 bc 28 2a 7b 8c 0c 25 3b bf 03 34 fb ea 12 3b bb d9 1d 17 7b 40 30 18 3b 73 3f 09 fb 26 2e 06 bb 15 21 20 e5 6f 0f 2f a5 5c 00 3e 65 09 11 31 25 3a 1e 1d e5 a3 33 12 a5 90 3c 03 65 c5 2d 0c 25 f6 22 3f 46 4a 0a 30 06 79 05 21 c6 2c 14 2e 86 1f 1b 02 46 86 36 0d 06 b5 39 1c c6 e0 28 13 86 d3 27 35 d8 a9 09 3a 98 9a 06 2b 58 cf 17 24 18 fc 18 08 d8 65 35 07 98 56 3a 16 58 03 2b 19 18 30 24 24 68 63 63 2b 28 50 6c 3a e8 05 7d 35 a8 36 72 19 68 af 5f 16 28 9c 50 07 e8 c9 41 08 a8 fa 4e 2e f6 80 60 21 b6 b3 6f 30 76 e6 7e 3f 36 d5 71 13 f6 4c 5c 1c b6 7f 53 0d 76 2a 42 02 36 19 4d 31 55 a5 65 3e 15 96 6a 2f d5 c3 7b 20 95 f0 74 0c 55 69 59 03 15 5a 56 12 d5 0f 47 1d 95 3c 48 3b cb 46 66 34 8b 75 69 25 4b 20 78 2a 0b 13 77 06 cb 8a 5a 09 8b b9 55 18 4b ec 44 17 0b df 4b 0e 13 ef 6f 01 53 dc 60 10 93 89 71 1f d3 ba 7e 33 13 23 53 3c 53 10 5c 2d 93 45 4d 22 d3 76 42 04 8d 0c 6c 0b cd 3f 63 1a 0d 6a 72 15 4d 59 7d 39 8d c0 50 36 cd f3 5f 27 0d a6 4e 28 4d 95 41 1b 2e 29 69 14 6e 1a 66 05 ae 4f 77 0a ee 7c 78 26 2e e5 55 29 6e d6 5a 38 ae 83 4b 37 ee b0 44 11 b0 ca 6a 1e f0 f9 65 0f 30 ac 74 00 70 9f 7b 2c b0 06 56 23 f0 35 59 32 30 60 48 3d 70 53 47 38 4f bd bd 37 0f 8e b2 26 cf db a3 29 8f e8 ac 05 4f 71 81 0a 0f 42 8e 1b cf 17 9f 14 8f 24 90 32 d1 5e be 3d 91 6d b1 2c 51 38 a0 23 11 0b af 0f d1 92 82 00 91 a1 8d 11 51 f4 9c 1e 11 c7 93 2d 72 7b bb 22 32 48 b4 33 f2 1d a5 3c b2 2e aa 10 72 b7 87 1f 32 84 88 0e f2 d1 99 01 b2 e2 96 27 ec 98 b8 28 ac ab b7 39 6c fe a6 36 2c cd a9 1a ec 54 84 15 ac 67 8b 04 6c 32 9a 0b 2c 01 95 12 34 31 b1 1d 74 02 be 0c b4 57 af 03 f4 64 a0 2f 34 fd 8d 20 74 ce 82 31 b4 9b 93 3e f4 a8 9c 18 aa d2 b2 17 ea e1 bd 06 2a b4 ac 09 6a 87 a3 25 aa 1e 8e 2a ea 2d 81 3b 2a 78 90 34 6a 4b 9f 07 09 f7 b7 08 49 c4 b8 19 89 91 a9 16 c9 a2 a6 3a 09 3b 8b 35 49 08 84 24 89 5d 95 2b c9 6e 9a 0d 97 14 b4 02 d7 27 bb 13 17 72 aa 1c 57 41 a5 30 97 d8 88 3f d7 eb 87 2e 17 be 96 21 57 8d 99 1c 27 de de 13 67 ed d1 02 a7 b8 c0 0d e7 8b cf 21 27 12 e2 2e 67 21 ed 3f a7 74 fc 30 e7 47 f3 16 b9 3d dd 19 f9 0e d2 08 39 5b c3 07 79 68 cc 2b b9 f1 e1 24 f9 c2 ee 35 39 97 ff 3a 79 a4 f0 09 1a 18 d8 06 5a 2b d7 17 9a 7e c6 18 da 4d c9 34 1a d4 e4 3b 5a e7 eb 2a 9a b2 fa 25 da 81 f5 03 84 fb db 0c c4 c8 d4 1d 04 9d c5 12 44 ae ca 3e 84 37 e7 31 c4 04 e8 20 04 51 f9 2f 44 62 f6 36 5c 52 d2 39 1c 61 dd 28 dc 34 cc 27 9c 07 c3 0b 5c 9e ee 04 1c ad e1 15 dc f8 f0 1a 9c cb ff 3c c2 b1 d1 33 82 82 de 22 42 d7 cf 2d 02 e4 c0 01 c2 7d ed 0e 82 4e e2 1f 42 1b f3 10 02 28 fc 23 61 94 d4 2c 21 a7 db 3d e1 f2 ca 32 a1 c1 c5 1e 61 58 e8 11 21 6b e7 00 e1 3e f6 0f a1 0d f9 29 ff 77 d7 26 bf 44 d8 37 7f 11 c9 38 3f 22 c6 14 ff bb eb 1b bf 88 e4 0a 7f dd f5 05 3f ee fa }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

cafb4bec-da21-41b6-85c8-8496a564c180

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion