libaf_center_rear__180_degree_flt64_64_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule libaf_center_rear__180_degree___flt64___64_big_1024_ (No description metadata provided).

rule libaf_center_rear__180_degree___flt64___64_big_1024_ {
  strings:
    $a0 = { bf 0f 66 72 c5 d4 60 91 bf 2d df 27 29 54 a9 3e 3f 31 6d 57 24 99 ca 3e bf 38 bd 04 89 6e 42 fc 3f 3d c1 60 1a 99 1d ab bf 3b 8a 6d 45 77 81 98 3f 30 b9 4c cb 84 07 df 3f 32 89 86 1a 86 51 d3 bf 50 a7 0d 88 cc 75 a2 3f 67 75 31 03 79 9c be 3f 61 ac 90 3d 0c 60 67 3f 85 33 04 42 75 9f 42 bf 85 77 70 c4 5d 60 c5 bf 8b 07 21 ff 82 79 43 3f 6a 27 d5 8b 8a 2a 66 3f 9d ba 66 d3 c3 ce d0 3f c4 e5 25 58 4c 35 c5 3f ba d0 d1 39 f2 5b 20 bf ba ca 22 d0 fb b2 2d bf b7 b4 c3 22 1d d6 5b bf 7e c7 40 f9 dd 5f 86 3f 8b d8 59 ae 37 8b 2f bf 94 5a 6a f4 7e 9c a1 3f c0 12 6f 88 d7 dd 4e 3f d7 59 29 8d 9c 0c 12 3f c8 e8 14 4b a3 31 88 bf a6 b3 d3 50 a7 0f 21 3f a7 d9 aa 45 b2 8a 6a 3f b8 47 b6 dc c6 c3 83 bf a0 10 c5 64 ed d5 39 bf ba 5c 87 67 38 63 b8 bf b7 f0 54 bc f3 ec ce bf bc ea 6d ef 19 0b 2b bf c3 1a ba d6 be 32 6f bf bf 86 89 9a 90 f5 24 bf b0 45 f0 9a a6 1b b5 bf ab dd 4d 6f 81 97 c3 bf b3 60 0c 5a d7 a2 4a bf 97 df de a8 07 75 08 3f a5 d0 e9 cf f5 67 e1 3f 97 07 b0 02 ef 02 5f 3f 94 f9 38 d8 aa 28 c4 3f ac ef 53 bf 71 88 c2 3f ae 21 a3 61 bc d1 f6 3f a3 70 f0 0a 8e d4 8c 3f 88 19 80 f1 8a ec 02 3f 76 f5 4b 73 72 ec 68 3f 74 b0 7d 22 90 a1 47 bf 8a 78 e9 62 80 ca 87 bf 98 7e 31 2d 56 2d 88 bf 8b 23 af 9f 5b a0 b7 bf 85 e7 24 10 9f 6b 37 bf 9f 8b 4f 76 1a 77 fc bf a2 be e9 1d db 50 ec bf a3 6a 9b ad 2f 43 72 bf a5 99 cc 1f 9f 93 d9 bf 9b 3b e4 f4 a9 56 78 bf 83 fc 8a 4a 9a 2a 92 bf 60 ea 97 45 f7 84 6b bf 63 d3 5a 6f 9f 21 cb bf 7b 28 0c eb 76 16 c7 3f 72 ec 63 fe 9e e9 a0 3f 93 ea de 8d ba 1c 09 3f 91 c4 c0 84 9b 60 4a 3f 92 10 98 05 47 3d a8 3f 97 3e bf 13 61 ff f4 3f 93 6e 8e ca 0e 28 e9 3f 83 0b cd 20 95 66 d4 bf 5b c5 82 aa a8 97 06 bf 7b a7 97 bc 27 13 6c bf 83 36 54 54 0b c7 be bf 86 f4 6d 76 65 85 f3 bf 8a cd 0a f1 15 a1 82 bf 90 f6 0e e6 8c 92 7e bf 96 88 3e 25 4b 57 a6 bf 99 c7 12 37 1a 33 11 bf 91 53 26 bb fb 70 4f bf 81 b7 e1 8d 0e c7 34 bf 7c ab f5 27 c2 34 d8 bf 76 57 cd c8 01 b6 b7 bf 61 4f 2e 87 29 87 94 3f 28 88 69 cb 0d 14 26 bf 32 c5 92 b8 19 67 1c 3f 5c dc 5c 6c 4f 6b b9 3f 7c 9d 41 47 e5 f3 18 3f 85 a9 8e 4a 2f 86 54 3f 7a 7c 33 c9 a4 29 34 bf 58 8e bb 8c bf ad dd bf 70 3f ac e2 28 fd 28 bf 7a b0 34 20 a8 3f 26 bf 83 22 88 01 6e ee a5 bf 7f 4e 55 7e fe 68 3d bf 72 00 b7 89 55 91 25 bf 69 02 0c ce 6a 26 e1 bf 7c c0 10 20 46 8d d5 bf 83 f3 23 53 cc 89 21 bf 80 51 88 df d6 d6 63 bf 7f f4 7a ed 36 9f 37 bf 7e dd ce 31 79 93 bd bf 6d 06 ed 3b c7 08 47 3f 58 b6 52 46 3c ff d5 3f 63 20 01 5b 97 1d 1d bf 50 74 99 d0 bf da b7 bf 64 b8 e8 0c 55 51 70 bf 63 6a a2 e4 c0 30 36 bf 43 5c 25 4a 3a 89 07 3f 68 6f 04 ba 0f 72 62 3f 73 c7 9f d8 f2 73 99 3f 72 62 62 f8 2d 36 71 3e fb b8 c1 dc d3 90 ed bf 71 3e 96 2f c4 4a 12 bf 79 46 57 f9 80 20 9d bf 7d c4 28 7f f5 93 6a bf 7b f5 14 5a 60 b3 3e bf 7c 43 00 2f a8 e2 0e bf 7e 1a 65 49 d6 17 ad bf 83 91 3b 51 bf 3a 51 bf 88 25 82 ef 1b 78 7f bf 85 cd 76 a2 05 f4 39 bf 7a 7c 41 f2 99 aa b8 bf 60 9a 63 9c fe cb 62 bf 3c 6c 56 2b 9e 15 51 bf 52 4e 25 d7 1b c8 b8 bf 5d 67 dc 19 6d 5c a8 bf 64 f0 a2 dc 6f 9f e0 bf 5d 08 f6 53 46 cb ca bf 2f 30 ad 69 65 78 7e 3f 47 5d 2d a3 07 62 c4 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8a6e51e4-334d-4720-b1ea-d658ed3e8de8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion